Static task
static1
Behavioral task
behavioral1
Sample
63dfa711c90d5148774755e0906c596f713c12192cdf04d2191e164cb8ead828.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
63dfa711c90d5148774755e0906c596f713c12192cdf04d2191e164cb8ead828.exe
Resource
win10v2004-20221111-en
General
-
Target
63dfa711c90d5148774755e0906c596f713c12192cdf04d2191e164cb8ead828
-
Size
5.2MB
-
MD5
d21e79fec2df02b03f62d8cd283aec4a
-
SHA1
0ae7b230426297de144f18f205ab1ed28581bd33
-
SHA256
63dfa711c90d5148774755e0906c596f713c12192cdf04d2191e164cb8ead828
-
SHA512
288bda460d03cbd3a6d3ae953ddf86f8c2d7f246f1c21b9544932bdfb1b1689e96fa51db706f9ac2876d027a86705e6f88e73f1ba2e8b877039b788618d358bf
-
SSDEEP
98304:bsJDvWKHntoqKbSl4I1SopqzooS8DLDe6uKoTSF1Ear:bsJTWKzKq4I1zpJoRDLDaq
Malware Config
Signatures
Files
-
63dfa711c90d5148774755e0906c596f713c12192cdf04d2191e164cb8ead828.exe windows x86
9a3f9c13504e46cf4f82edcbacbd0a37
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
pathlib
?destroyPathFinder@PathLibRoot@PathLib@@QAEXPAVPathFinder@2@@Z
?destroyPathData@PathLibRoot@PathLib@@QAEXPAVPathData@2@@Z
?getBuildingCollsion@PathLibRoot@PathLib@@QAEPAVBuildingCollision@2@XZ
?getPathFinder@PathLibRoot@PathLib@@QAEPAVPathFinder@2@XZ
?destroyBuildingCollision@PathLibRoot@PathLib@@QAEXPAVBuildingCollision@2@@Z
?getPathData@PathLibRoot@PathLib@@QAEPAVPathData@2@XZ
fmod
_FSOUND_Sample_SetMode@8
_FSOUND_PlaySoundEx@16
_FSOUND_StopSound@4
_FSOUND_SetVolume@8
_FSOUND_SetPaused@8
_FSOUND_SetLoopMode@8
_FSOUND_IsPlaying@4
_FSOUND_SetOutput@4
_FSOUND_SetDriver@4
_FSOUND_SetMixer@4
_FSOUND_Init@12
_FSOUND_Close@0
_FSOUND_GetVersion@0
_FSOUND_SetMute@8
_FSOUND_3D_SetRolloffFactor@4
_FSOUND_Sample_Load@20
_FSOUND_Sample_Free@4
winmm
timeSetEvent
timeKillEvent
timeGetTime
ws2_32
WSAStartup
WSACleanup
select
__WSAFDIsSet
inet_addr
htons
htonl
WSAGetLastError
socket
shutdown
setsockopt
sendto
send
accept
recvfrom
recv
listen
getsockopt
ioctlsocket
connect
closesocket
bind
kernel32
GetLastError
CopyFileA
FreeLibrary
GetFileTime
InitializeSListHead
GetSystemTimeAsFileTime
VirtualQuery
GetProcessHeap
HeapFree
HeapAlloc
GetStartupInfoW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
WideCharToMultiByte
MultiByteToWideChar
IsDebuggerPresent
Sleep
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
QueryPerformanceCounter
CompareStringA
GetCurrentDirectoryA
GetCurrentProcessId
TerminateProcess
CreateProcessA
GetModuleFileNameA
GetModuleHandleA
GetLocalTime
CloseHandle
RaiseException
TerminateThread
GetExitCodeThread
ResumeThread
SetEvent
ResetEvent
CreateEventA
GetPrivateProfileIntA
GetPrivateProfileStringA
WritePrivateProfileStringA
GetPrivateProfileSectionA
GetCurrentProcess
ExitProcess
GetProcAddress
SystemTimeToFileTime
CreateFileMappingA
FileTimeToDosDateTime
UnmapViewOfFile
MapViewOfFile
DuplicateHandle
WriteFile
SetFilePointer
ReadFile
GetFileType
GetFileSize
GetFileInformationByHandle
Module32Next
Module32First
CreateToolhelp32Snapshot
FileTimeToSystemTime
IsBadCodePtr
IsBadReadPtr
lstrcpynA
GetShortPathNameA
GetVersionExA
GetCurrentThreadId
GetTempFileNameA
GetTempPathA
LoadLibraryA
FileTimeToLocalFileTime
CreateFileA
user32
DialogBoxParamA
ReleaseCapture
SetCapture
SetWindowLongA
SetWindowTextA
LoadIconA
EndDialog
CopyRect
InvalidateRect
EndPaint
BeginPaint
UpdateWindow
MsgWaitForMultipleObjects
GetDlgItem
SetDlgItemTextA
GetDlgItemTextA
CheckDlgButton
SendDlgItemMessageA
IsDlgButtonChecked
EnableWindow
GetWindowRect
OffsetRect
CreateDialogParamA
MessageBoxA
PostMessageA
ShowCursor
SetCursor
LoadCursorA
SendMessageA
FindWindowA
GetDoubleClickTime
GetActiveWindow
GetAsyncKeyState
GetCapture
GetClientRect
SetCursorPos
GetCursorPos
ClientToScreen
ScreenToClient
PtInRect
ShowWindow
MoveWindow
GetSystemMetrics
AdjustWindowRect
SetRect
GetWindowLongA
SystemParametersInfoA
TranslateMessage
DispatchMessageA
PeekMessageA
DefWindowProcA
PostQuitMessage
UnregisterClassA
RegisterClassExA
CreateWindowExA
DestroyWindow
luaplus
?SetObject@LuaObject@LuaPlus@@QAEAAV12@PBDAAV12@@Z
?DoString@LuaState@LuaPlus@@QAEHPBD@Z
?CollectGarbage@LuaState@LuaPlus@@QAEXXZ
?IsBoolean@LuaStackObject@LuaPlus@@QBE_NXZ
?GetBoolean@LuaStackObject@LuaPlus@@QBE_NXZ
?PushNil@LuaState@LuaPlus@@QAE?AVLuaStackObject@2@XZ
?Destroy@LuaState@LuaPlus@@SAXPAV12@@Z
?Create@LuaState@LuaPlus@@SAPAV12@_N0@Z
?Register@LuaObject@LuaPlus@@QAEXPBDP6AHPAVLuaState@2@@ZH@Z
?GetCState@LuaState@LuaPlus@@QAEPAUlua_State@@XZ
?PushBoolean@LuaState@LuaPlus@@QAE?AVLuaStackObject@2@_N@Z
?PushStack@LuaObject@LuaPlus@@QAE?AVLuaStackObject@2@XZ
?GetNumber@LuaStackObject@LuaPlus@@QBENXZ
?GetInteger@LuaStackObject@LuaPlus@@QBEHXZ
?GetFloat@LuaStackObject@LuaPlus@@QBEMXZ
?IsNumber@LuaStackObject@LuaPlus@@QBE_NXZ
?IsInteger@LuaStackObject@LuaPlus@@QBE_NXZ
lua_settable
lua_pushnumber
lua_tonumber
lua_insert
?BoxPointer@LuaState@LuaPlus@@QAE?AVLuaStackObject@2@PAX@Z
?GetGlobals@LuaState@LuaPlus@@QAE?AVLuaObject@2@XZ
?Register@LuaObject@LuaPlus@@QAEXPBDP6AHPAUlua_State@@@ZH@Z
?GetCState@LuaObject@LuaPlus@@QBEPAUlua_State@@XZ
?CreateTable@LuaObject@LuaPlus@@QAE?AV12@PBDHH@Z
?SetMetaTable@LuaObject@LuaPlus@@QAEXABV12@@Z
?PushInteger@LuaState@LuaPlus@@QAE?AVLuaStackObject@2@H@Z
?PushNumber@LuaState@LuaPlus@@QAE?AVLuaStackObject@2@N@Z
?PushString@LuaState@LuaPlus@@QAE?AVLuaStackObject@2@PBD@Z
lua_settop
lua_pushvalue
lua_isuserdata
lua_type
lua_touserdata
lua_pushstring
lua_gettable
lua_newuserdata
lua_getstateuserdata
luaL_argerror
luaL_error
??0LuaStackObject@LuaPlus@@QAE@PAVLuaState@1@H@Z
?IsString@LuaStackObject@LuaPlus@@QBE_NXZ
?GetString@LuaStackObject@LuaPlus@@QBEPBDXZ
??0LuaObject@LuaPlus@@QAE@XZ
??0LuaObject@LuaPlus@@QAE@ABVLuaStackObject@1@@Z
??4LuaObject@LuaPlus@@QAEAAV01@ABV01@@Z
??1LuaObject@LuaPlus@@QAE@XZ
msvcp140d
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
??7ios_base@std@@QBE_NXZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ
_Query_perf_counter
_Query_perf_frequency
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ
?_Xbad_alloc@std@@YAXXZ
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
??Bid@locale@std@@QAEIXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?always_noconv@codecvt_base@std@@QBE_NXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??Bios_base@std@@QBE_NXZ
?good@ios_base@std@@QBE_NXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
dinput8
DirectInput8Create
shlwapi
SHGetValueA
PathFindExtensionA
PathRemoveFileSpecA
PathAppendA
SHSetValueA
vcruntime140d
_purecall
memmove
memset
__std_exception_copy
__std_exception_destroy
_CxxThrowException
__CxxFrameHandler3
memcmp
strchr
strrchr
memchr
strstr
__current_exception
__current_exception_context
_except_handler4_common
__vcrt_GetModuleFileNameW
__vcrt_GetModuleHandleW
__vcrt_LoadLibraryExW
__std_type_info_destroy_list
memcpy
ucrtbased
_initterm
_initterm_e
exit
_exit
_set_fmode
_c_exit
_register_thread_local_exe_atexit_callback
_configthreadlocale
_set_new_mode
__p__commode
_wmakepath_s
_wsplitpath_s
wcscpy_s
_controlfp_s
_itoa
fputc
__stdio_common_vsscanf
_callnewh
_malloc_dbg
_free_dbg
_wassert
asin
ftell
fseek
__acrt_iob_func
_tzset
_mktime64
_strtime
_strdate
acos
__stdio_common_vfprintf
fopen
atan
floor
pow
__stdio_common_vsprintf_s
strncmp
__setusermatherr
strncat
strcpy
isdigit
strftime
_localtime64
fabs
strncpy
strlen
__stdio_common_vsprintf
_CrtDbgReport
atoi
_stricmp
_invalid_parameter
log10
fgetpos
fgetc
fflush
fclose
_get_stream_buffer_pointers
srand
sin
cos
atof
sqrt
abs
rand
ceil
_beginthreadex
strcoll
_set_app_type
_unlock_file
_lock_file
ungetc
setvbuf
fwrite
_fseeki64
fsetpos
_get_narrow_winmain_command_line
_seh_filter_exe
_except1
strcat_s
strcpy_s
terminate
_CrtDbgReportW
_cexit
_crt_at_quick_exit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
labs
_time64
strtok
_seh_filter_dll
strcmp
malloc
strcat
fread
_configure_narrow_argv
gdi32
CreateSolidBrush
SetBkMode
SetBkColor
shell32
SHBrowseForFolderA
SHGetPathFromIDListA
Sections
.textbss Size: - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 4.4MB - Virtual size: 4.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 452KB - Virtual size: 452KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 60KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 1024B - Virtual size: 777B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.00cfg Size: 512B - Virtual size: 270B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 128KB - Virtual size: 127KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 177KB - Virtual size: 177KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ