Static task
static1
Behavioral task
behavioral1
Sample
ff89d3f1bb0188852f9acac90c8de0117944e32518b603d4eede03ec47337218.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
ff89d3f1bb0188852f9acac90c8de0117944e32518b603d4eede03ec47337218.exe
Resource
win10v2004-20220901-en
General
-
Target
ff89d3f1bb0188852f9acac90c8de0117944e32518b603d4eede03ec47337218
-
Size
508KB
-
MD5
655ff57a88213fe7cce7d8f463588c40
-
SHA1
40cdb0fd6405c93ee898f2c4be6214bea1879aa7
-
SHA256
ff89d3f1bb0188852f9acac90c8de0117944e32518b603d4eede03ec47337218
-
SHA512
43aac914a849e0bb94af228c81d37ddb2175ddd279d9525eeec5fa453794159f73f10b163238269332ae7c6670721d05991d1ba25ab033ab76ab446dda6918c7
-
SSDEEP
6144:ifNJD8ALniSETlzauzwvKznppMbyl3SVaTWa+H2LYEFoVQFbyFtMp:7W+lzauzdzQb4+aGbEFoVQNyPy
Malware Config
Signatures
Files
-
ff89d3f1bb0188852f9acac90c8de0117944e32518b603d4eede03ec47337218.exe windows x86
53cc69491ec4b58742b2e0356e1992f5
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetStartupInfoA
Sleep
AllocConsole
FreeConsole
GetVersion
FindFirstFileA
SetFileAttributesA
FindNextFileA
FindClose
RemoveDirectoryA
SystemTimeToTzSpecificLocalTime
LoadLibraryA
GetProcAddress
FreeLibrary
MulDiv
DeleteFileA
GetTickCount
GetTempPathA
GetTempFileNameA
GetModuleHandleA
user32
ShowCursor
SetCaretPos
CloseClipboard
EmptyClipboard
GetClipboardData
OpenClipboard
SetCursor
SetCursorPos
ClientToScreen
SendMessageA
SetWindowTextA
MessageBoxA
LoadCursorA
GetKeyState
LoadCursorFromFileA
shell32
SHGetSpecialFolderPathA
lualibdll
lua_pushstring
lua_pushnumber
lua_type
lua_tonumber
lua_gettop
lua_tostring
engine
?Run@KWin32App@@UAEXXZ
??1KPakList@@QAE@XZ
??1KDirectSound@@QAE@XZ
??1KMemClass@@QAE@XZ
??1KMusic@@UAE@XZ
??1KMp3Music@@UAE@XZ
EDOneTimePad_Decipher
?g_FileName2Id@@YAKPAD@Z
?g_pIme@@3PAVKIme@@A
?Init@KWin32App@@UAEHPAUHINSTANCE__@@PAD@Z
?LoadBuffer@KLuaScript@@QAEHPAEK@Z
?ExecuteCode@KLuaScript@@QAEHXZ
?Load@KLuaScript@@UAEHPAD@Z
?Init@KLuaScript@@UAEHXZ
?RegisterFunctions@KLuaScript@@QAEHQAUTLua_Funcs@@H@Z
?g_GetRootPath@@YAXPAD@Z
??1KLuaScript@@UAE@XZ
??0KLuaScript@@QAE@XZ
?EraseSection@KIniFile@@QAEXPBD@Z
?TurnOn@KIme@@QAEXXZ
??0KPakList@@QAE@XZ
EDOneTimePad_Encipher
?g_DebugLog@@YAXPADZZ
?GetElapse@KTimer@@QAEKXZ
?Exit@KDirectSound@@QAEXXZ
?g_SetRootPath@@YAXPAD@Z
?g_SetFilePath@@YAXPAD@Z
?Open@KPakList@@QAE_NPBD@Z
?Init@KDirectSound@@QAEHXZ
?Start@KTimer@@QAEXXZ
?SetMouseHoverTime@KWin32App@@QAEXI@Z
??0KWin32App@@QAE@XZ
??0KMusic@@QAE@XZ
??0KMemClass@@QAE@XZ
??_7KMp3Music@@6B@
??0KDirectSound@@QAE@XZ
??0KTimer@@QAE@XZ
?InitClass@KWin32App@@MAEHPAUHINSTANCE__@@@Z
?InitWindow@KWin32App@@MAEHPAUHINSTANCE__@@@Z
?ShowMouse@KWin32App@@UAEXH@Z
?SetMultiGame@KWin32App@@UAEXH@Z
TEncodeText
TGetEncodedTextLineCount
??1KIniFile@@QAE@XZ
?GetString@KIniFile@@QAEHPBD00PADK@Z
?GetInteger@KIniFile@@QAEHPBD0HPAH@Z
?Load@KIniFile@@QAEHPBD@Z
??0KIniFile@@QAE@XZ
TFindSpecialCtrlInEncodedText
?g_CreatePath@@YAXPAD@Z
AdviseEngine
UnAdviseEngine
??1KPakFile@@QAE@XZ
??1KFile@@QAE@XZ
?Close@KFile@@QAEXXZ
?Close@KPakFile@@QAEXXZ
?Read@KPakFile@@QAEKPAXI@Z
?Write@KFile@@QAEKPAXK@Z
?Size@KPakFile@@QAEKXZ
?Open@KPakFile@@QAEHPBD@Z
?Create@KFile@@QAEHPAD@Z
??0KFile@@QAE@XZ
??0KPakFile@@QAE@XZ
??0KIme@@QAE@XZ
??1KIme@@QAE@XZ
?CloseIME@KIme@@QAEXXZ
?DisableLanguageChange@KIme@@QAEXXZ
?IsIme@KIme@@QAEHXZ
?SetCaretPos@KIme@@QAEXHH@Z
?OpenIME@KIme@@QAEXXZ
?EnableLanguageChange@KIme@@QAEXXZ
TSplitString
TGetLimitLenString
TRemoveCtrlInEncodedText
?GetInteger2@KIniFile@@QAEXPBD0PAH1@Z
?g_GetMainHWnd@@YAPAUHWND__@@XZ
?KSG_StringToMD5String@@YAHQADQBD@Z
?WriteInteger@KIniFile@@QAEXPBD0H@Z
?g_GetFullPath@@YAXPAD0@Z
?GetStruct@KIniFile@@QAEXPBD0PAXK@Z
?EraseKey@KIniFile@@QAEXPBD0@Z
?WriteStruct@KIniFile@@QAEXPBD0PAXK@Z
?WriteString@KIniFile@@QAEXPBD00@Z
TClearSpecialCtrlInEncodedText
?Read@KFile@@QAEKPAXK@Z
?Open@KFile@@QAEHPAD@Z
?Clear@KIniFile@@QAEXXZ
TGetEncodedTextEffectCtrls
TSplitEncodedString
TGetEncodedTextOutputLenPos
?IsSectionExist@KIniFile@@QAEHPBD@Z
?Save@KIniFile@@QAEHPBD@Z
?MsgProc@KWin32App@@UAEJPAUHWND__@@IIJ@Z
coreclient
CoreGetShell
msvcrt
strncpy
memmove
atoi
malloc
realloc
rand
_mbsicmp
strstr
srand
mktime
fclose
fopen
remove
??2@YAPAXI@Z
isgraph
strchr
sscanf
__dllonexit
_onexit
_except_handler3
?terminate@@YAXXZ
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
??3@YAXPAX@Z
time
localtime
strftime
free
__CxxFrameHandler
sprintf
_itoa
_strcmpi
_strlwr
_ismbcalpha
_purecall
_mbschr
_mbsstr
_mbsnbcmp
isalnum
_mbscspn
_mbsspn
tolower
isalpha
toupper
_mbsnbcpy
_ftol
isdigit
msvcp60
?_Xran@std@@YAXXZ
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?max_size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??Mstd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?_Xlen@std@@YAXXZ
?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
??0_Lockit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
Sections
.text Size: 380KB - Virtual size: 377KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 20KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE