search

mandiant / capa-rules

Standard collection of rules for capa: the tool for enumerating the capabilities of programs
https://github.com/mandiant/capa/
Apache License 2.0
537 stars 163 forks source link

delay execution: add Beep WinAPI #915

Open fariss opened 3 months ago

fariss commented 3 months ago

Summary

The Beep WinAPI allows programs to generate simple beep sounds through the computer's speaker. It takes two parameters: frequency (in Hertz) and duration (in milliseconds).

BOOL Beep(
  [in] DWORD dwFreq,
  [in] DWORD dwDuration
);

When called, Beep invokes NtDelayExecution, which pauses the execution of the calling thread for a specified duration.

Additional context

https://thehackernews.com/2023/02/experts-warn-of-beep-new-evasive.html https://securityliterate.com/beeeeeeeeep-how-malware-uses-the-beep-winapi-function-for-anti-analysis/