Static task
static1
General
-
Target
mb_warband.exe
-
Size
5.1MB
-
MD5
00c7d31dceb71fbf75950dadc1dfade8
-
SHA1
8ff0d022685b6d7b10856f8c018f0631a95adad1
-
SHA256
a4ef0017a8cf6d85c327cfb16f9cdc4faeccc3d140c57571fe00c1e1894e52c9
-
SHA512
034f13d8aafb05c0d47d3df944bc6de76f0f7f672dbe3095da07444208368646175fb3c685da57d952f481e2a1129801d95adfedbc8581f6ecd59a8864608eca
-
SSDEEP
98304:V4c1m0u2pGIvvscGA3u11SLp8JR5MYb3ebJs5NSe3zwclx1O47iL+SF:Gam12TGA3u11SyD5MYubEO47iL3F
Malware Config
Signatures
Files
-
mb_warband.exe.exe windows x86
7529506b4708146f3278ef767f3833f6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
wininet
InternetConnectA
HttpOpenRequestA
InternetReadFile
InternetQueryOptionA
HttpSendRequestA
InternetOpenA
InternetSetOptionA
InternetCloseHandle
shfolder
SHGetFolderPathA
d3d9
Direct3DCreate9
d3dx9_42
D3DXCreateTextureFromFileExA
D3DXMatrixMultiply
D3DXMatrixOrthoOffCenterRH
D3DXMatrixPerspectiveOffCenterRH
D3DXMatrixOrthoOffCenterLH
D3DXMatrixPerspectiveOffCenterLH
D3DXCreateEffectFromFileA
D3DXPlaneTransform
D3DXMatrixTranspose
D3DXMatrixInverse
D3DXVec3Normalize
D3DXAssembleShaderFromFileA
D3DXCreateTexture
D3DXSaveTextureToFileA
D3DXCreateCubeTextureFromFileExA
D3DXVec3Transform
D3DXSaveSurfaceToFileA
D3DXCreateTextureFromFileInMemoryEx
dinput8
DirectInput8Create
winmm
timeGetTime
timeBeginPeriod
timeEndPeriod
ws2_32
WSAGetLastError
WSACleanup
closesocket
WSAIoctl
WSASocketA
WSAStartup
ioctlsocket
listen
bind
setsockopt
htons
inet_ntoa
recv
__WSAFDIsSet
send
accept
shutdown
inet_addr
gethostbyname
gethostbyaddr
socket
WSASendTo
ntohs
WSARecvFrom
crypt32
CertOpenSystemStoreA
CertFindCertificateInStore
CertFreeCertificateContext
CertCloseStore
fmodex
?getDriverCaps@System@FMOD@@QAG?AW4FMOD_RESULT@@HPAIPAHPAW4FMOD_SPEAKERMODE@@@Z
?getNumDrivers@System@FMOD@@QAG?AW4FMOD_RESULT@@PAH@Z
?getDefaults@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAM00PAH@Z
?setHardwareChannels@System@FMOD@@QAG?AW4FMOD_RESULT@@H@Z
?createSound@System@FMOD@@QAG?AW4FMOD_RESULT@@PBDIPAUFMOD_CREATESOUNDEXINFO@@PAPAVSound@2@@Z
?getLength@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAII@Z
?getUserData@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PAPAX@Z
?setSpeakerMode@System@FMOD@@QAG?AW4FMOD_RESULT@@W4FMOD_SPEAKERMODE@@@Z
?setPosition@Channel@FMOD@@QAG?AW4FMOD_RESULT@@II@Z
?setFrequency@Channel@FMOD@@QAG?AW4FMOD_RESULT@@M@Z
?setUserData@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PAX@Z
?setPaused@Channel@FMOD@@QAG?AW4FMOD_RESULT@@_N@Z
?getOpenState@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAW4FMOD_OPENSTATE@@PAIPA_N2@Z
?playSound@System@FMOD@@QAG?AW4FMOD_RESULT@@W4FMOD_CHANNELINDEX@@PAVSound@2@_NPAPAVChannel@2@@Z
?setPriority@Channel@FMOD@@QAG?AW4FMOD_RESULT@@H@Z
?setCallback@Channel@FMOD@@QAG?AW4FMOD_RESULT@@P6G?AW43@PAUFMOD_CHANNEL@@W4FMOD_CHANNEL_CALLBACKTYPE@@PAX2@Z@Z
?setDSPBufferSize@System@FMOD@@QAG?AW4FMOD_RESULT@@IH@Z
?getDriverInfo@System@FMOD@@QAG?AW4FMOD_RESULT@@HPADHPAUFMOD_GUID@@@Z
?setSoftwareFormat@System@FMOD@@QAG?AW4FMOD_RESULT@@HW4FMOD_SOUND_FORMAT@@HHW4FMOD_DSP_RESAMPLER@@@Z
?setOutput@System@FMOD@@QAG?AW4FMOD_RESULT@@W4FMOD_OUTPUTTYPE@@@Z
?init@System@FMOD@@QAG?AW4FMOD_RESULT@@HIPAX@Z
FMOD_System_Create
?setDefaults@Sound@FMOD@@QAG?AW4FMOD_RESULT@@MMMH@Z
?getPosition@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PAII@Z
?getIndex@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PAH@Z
?isPlaying@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PA_N@Z
?getMode@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PAI@Z
?stop@Channel@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?getChannelsPlaying@System@FMOD@@QAG?AW4FMOD_RESULT@@PAH@Z
?set3DListenerAttributes@System@FMOD@@QAG?AW4FMOD_RESULT@@HPBUFMOD_VECTOR@@000@Z
?getChannel@System@FMOD@@QAG?AW4FMOD_RESULT@@HPAPAVChannel@2@@Z
?set3DAttributes@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PBUFMOD_VECTOR@@0@Z
?release@Sound@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?setVolume@Channel@FMOD@@QAG?AW4FMOD_RESULT@@M@Z
?setMode@Channel@FMOD@@QAG?AW4FMOD_RESULT@@I@Z
?createStream@System@FMOD@@QAG?AW4FMOD_RESULT@@PBDIPAUFMOD_CREATESOUNDEXINFO@@PAPAVSound@2@@Z
?set3DSettings@System@FMOD@@QAG?AW4FMOD_RESULT@@MMM@Z
?update@System@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?getVolume@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PAM@Z
?set3DMinMaxDistance@Sound@FMOD@@QAG?AW4FMOD_RESULT@@MM@Z
?close@System@FMOD@@QAG?AW4FMOD_RESULT@@XZ
kernel32
FlushFileBuffers
SetFilePointer
SetCurrentDirectoryA
GetCurrentDirectoryA
PeekNamedPipe
GetFileInformationByHandle
LCMapStringW
LCMapStringA
LoadLibraryW
GetConsoleMode
GetConsoleCP
WriteFile
SetHandleCount
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoA
GetCommandLineA
HeapReAlloc
HeapSize
VirtualQuery
FreeEnvironmentStringsA
GetEnvironmentStrings
SetStdHandle
MoveFileA
CreateThread
ResumeThread
ExitThread
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsAlloc
ExitProcess
GetModuleHandleW
HeapAlloc
HeapFree
GetDriveTypeA
FileTimeToLocalFileTime
FileTimeToSystemTime
GetModuleFileNameW
GetFileType
WriteConsoleW
RtlUnwind
FreeEnvironmentStringsW
HeapCreate
VirtualFree
InitializeCriticalSectionAndSpinCount
GetEnvironmentStringsW
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
SetEndOfFile
SetEvent
ResetEvent
WaitForSingleObject
Sleep
lstrlenA
lstrcatA
lstrcpyA
QueryPerformanceCounter
QueryPerformanceFrequency
MulDiv
lstrcmpA
MultiByteToWideChar
WideCharToMultiByte
CloseHandle
CreateFileA
GetFullPathNameA
FreeLibrary
GetProcAddress
LoadLibraryA
GetModuleFileNameA
GetFileAttributesA
TlsGetValue
FindClose
FindFirstFileA
InitializeCriticalSection
DeleteCriticalSection
FindNextFileA
EnterCriticalSection
LeaveCriticalSection
GetExitCodeThread
SetThreadAffinityMask
GetCurrentThread
GetProcessAffinityMask
GetCurrentProcess
GetLastError
GetFileSize
ReadFile
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
CreateDirectoryA
GetSystemInfo
GlobalMemoryStatus
GetModuleHandleA
GetVersionExA
CreateEventA
GetStdHandle
RaiseException
GlobalUnlock
GlobalLock
ReleaseMutex
InterlockedIncrement
InterlockedDecrement
GlobalAlloc
RemoveDirectoryA
DeleteFileA
SetFileAttributesA
CreateProcessA
GetUserDefaultLCID
CreateMutexA
GetProcessHeap
GetTimeZoneInformation
CompareStringA
CompareStringW
SetEnvironmentVariableA
InterlockedExchangeAdd
CreateSemaphoreA
VirtualAlloc
ReleaseSemaphore
user32
DefWindowProcA
DefWindowProcW
IsWindowUnicode
PostQuitMessage
DestroyWindow
DestroyMenu
DestroyAcceleratorTable
DispatchMessageW
TranslateMessage
TranslateAcceleratorA
GetMessageW
PeekMessageW
PeekMessageA
LoadAcceleratorsA
GetDlgItem
PostMessageA
EnableWindow
IsDlgButtonChecked
wsprintfA
CheckRadioButton
SendDlgItemMessageA
EndDialog
DialogBoxParamA
SetFocus
EnumDisplayDevicesA
EndPaint
BeginPaint
SetDlgItemTextA
SetDlgItemInt
DispatchMessageA
SetWindowTextA
SendMessageA
GetDlgItemInt
CloseClipboard
SetWindowPos
IsClipboardFormatAvailable
OpenClipboard
GetDlgItemTextA
SetClipboardData
EmptyClipboard
LoadImageA
SetCursorPos
ClientToScreen
ScreenToClient
GetCursorPos
RedrawWindow
DestroyIcon
SetCursor
SetForegroundWindow
SetActiveWindow
CreateDialogParamA
DrawMenuBar
SetMenuItemInfoA
LoadCursorA
RegisterClassExW
LoadMenuA
CreateWindowExW
UpdateWindow
GetWindowLongA
GetWindowRect
GetClientRect
SetWindowLongA
SetMenu
GetMenu
GetSystemMetrics
SetRect
GetClassLongA
ClipCursor
ShowWindow
GetClipboardData
MessageBoxA
AdjustWindowRect
GetWindowTextA
LoadIconA
gdi32
SetTextColor
SetBkColor
DeleteObject
SelectObject
SetMapMode
CreateCompatibleDC
CreateFontIndirectA
GetObjectA
BitBlt
GetStockObject
SetTextAlign
DeleteDC
GetTextExtentPoint32A
ExtTextOutA
GetDeviceCaps
CreateFontA
CreateDIBSection
advapi32
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExA
RegCloseKey
RegQueryValueExA
RegSetValueExA
shell32
ShellExecuteA
ole32
CoCreateInstance
CoUninitialize
CoInitialize
oleaut32
VariantInit
VariantClear
skinmagic
ord3
ord2
ord9
ord1
winhttp
WinHttpCloseHandle
WinHttpReadData
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpSetOption
WinHttpOpen
WinHttpOpenRequest
WinHttpConnect
WinHttpQueryDataAvailable
imm32
ImmGetContext
ImmReleaseContext
ImmGetCompositionStringW
ImmAssociateContext
xinput1_3
ord3
ord2
ord5
wsock32
select
WSAAsyncSelect
connect
gethostname
Sections
.text Size: 3.7MB - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 636KB - Virtual size: 636KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 54KB - Virtual size: 37.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 714KB - Virtual size: 713KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ