Overview
overview
3Static
static
1a-bellyful...1).zip
windows7-x64
1a-bellyful...1).zip
windows10-2004-x64
1Ayme New Mansion.exe
windows7-x64
1Ayme New Mansion.exe
windows10-2004-x64
1audiogroup1.dat
windows7-x64
3audiogroup1.dat
windows10-2004-x64
3data.win
windows7-x64
3data.win
windows10-2004-x64
3options.ini
windows7-x64
1options.ini
windows10-2004-x64
1sprAlley.png
windows7-x64
3sprAlley.png
windows10-2004-x64
3sprBar.png
windows7-x64
3sprBar.png
windows10-2004-x64
3sprBathroom.png
windows7-x64
3sprBathroom.png
windows10-2004-x64
3sprBedroom.png
windows7-x64
3sprBedroom.png
windows10-2004-x64
3sprBikeStore.png
windows7-x64
3sprBikeStore.png
windows10-2004-x64
3sprCityMap.png
windows7-x64
3sprCityMap.png
windows10-2004-x64
3sprCityMapNight.png
windows7-x64
3sprCityMapNight.png
windows10-2004-x64
3sprClinic.png
windows7-x64
3sprClinic.png
windows10-2004-x64
3sprCountryside.png
windows7-x64
3sprCountryside.png
windows10-2004-x64
3sprCountry...ht.png
windows7-x64
3sprCountry...ht.png
windows10-2004-x64
3sprFataurant.png
windows7-x64
3sprFataurant.png
windows10-2004-x64
3Static task
static1
Behavioral task
behavioral1
Sample
a-bellyful-slice-of-life-win (1).zip
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
a-bellyful-slice-of-life-win (1).zip
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
Ayme New Mansion.exe
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
Ayme New Mansion.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
audiogroup1.dat
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
audiogroup1.dat
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
data.win
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
data.win
Resource
win10v2004-20230221-en
Behavioral task
behavioral9
Sample
options.ini
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
options.ini
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
sprAlley.png
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
sprAlley.png
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
sprBar.png
Resource
win7-20230220-en
Behavioral task
behavioral14
Sample
sprBar.png
Resource
win10v2004-20230221-en
Behavioral task
behavioral15
Sample
sprBathroom.png
Resource
win7-20230220-en
Behavioral task
behavioral16
Sample
sprBathroom.png
Resource
win10v2004-20230220-en
Behavioral task
behavioral17
Sample
sprBedroom.png
Resource
win7-20230220-en
Behavioral task
behavioral18
Sample
sprBedroom.png
Resource
win10v2004-20230220-en
Behavioral task
behavioral19
Sample
sprBikeStore.png
Resource
win7-20230220-en
Behavioral task
behavioral20
Sample
sprBikeStore.png
Resource
win10v2004-20230221-en
Behavioral task
behavioral21
Sample
sprCityMap.png
Resource
win7-20230220-en
Behavioral task
behavioral22
Sample
sprCityMap.png
Resource
win10v2004-20230220-en
Behavioral task
behavioral23
Sample
sprCityMapNight.png
Resource
win7-20230220-en
Behavioral task
behavioral24
Sample
sprCityMapNight.png
Resource
win10v2004-20230220-en
Behavioral task
behavioral25
Sample
sprClinic.png
Resource
win7-20230220-en
Behavioral task
behavioral26
Sample
sprClinic.png
Resource
win10v2004-20230220-en
Behavioral task
behavioral27
Sample
sprCountryside.png
Resource
win7-20230220-en
Behavioral task
behavioral28
Sample
sprCountryside.png
Resource
win10v2004-20230221-en
Behavioral task
behavioral29
Sample
sprCountrysideNight.png
Resource
win7-20230220-en
Behavioral task
behavioral30
Sample
sprCountrysideNight.png
Resource
win10v2004-20230220-en
Behavioral task
behavioral31
Sample
sprFataurant.png
Resource
win7-20230220-en
Behavioral task
behavioral32
Sample
sprFataurant.png
Resource
win10v2004-20230220-en
General
-
Target
a-bellyful-slice-of-life-win (1).zip
-
Size
166.9MB
-
MD5
7bb4ce6a319ad4f720a95b9b5d39e5ad
-
SHA1
93f35be62ad260abaa326520a43ad7a9bb7136fe
-
SHA256
b3d79eab43df090ddfa0be61e3e622370101923501b5cce43f5eef4d29698868
-
SHA512
a3a4973c686b35ef4c14e7a8bced4d4bb9229e2d21837b32e64b1621911efb2546eea9aa2577df3f5dcbb88fb4b81fbafb46dfb7f6cdaa3f8ecd6481aa2a8de8
-
SSDEEP
3145728:WgN1LoUJjYAdSszZdcYX3eMyb5pvd5JO7EaeXo3eT/O75lvyBiykg8:NLBX/TcjMyvdbVaeXOdlNL
Malware Config
Signatures
Files
-
a-bellyful-slice-of-life-win (1).zip.zip
-
Ayme New Mansion.exe.exe windows x86
0d43a4e1d32b5b42f5f6fb67ca0239b4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
wininet
InternetReadFile
InternetWriteFile
HttpOpenRequestA
InternetCloseHandle
InternetCrackUrlA
HttpEndRequestW
HttpQueryInfoA
InternetConnectA
InternetOpenA
InternetCanonicalizeUrlA
HttpSendRequestA
InternetGetConnectedState
d3d11
D3D11CreateDevice
dbghelp
MiniDumpWriteDump
SymFromAddr
SymInitialize
winmm
mciSendStringA
mciGetErrorStringA
joyGetPos
timeGetDevCaps
timeBeginPeriod
timeEndPeriod
joyGetPosEx
ws2_32
gethostname
WSACleanup
setsockopt
sendto
send
recvfrom
recv
listen
inet_ntoa
inet_addr
getsockopt
ioctlsocket
connect
closesocket
bind
accept
getpeername
select
__WSAFDIsSet
ntohs
ntohl
htons
htonl
WSAStartup
WSAGetLastError
WSAAddressToStringA
getaddrinfo
freeaddrinfo
socket
gdiplus
GdiplusStartup
GdiplusShutdown
comctl32
InitCommonControlsEx
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
rpcrt4
UuidToStringW
UuidCreate
dxgi
CreateDXGIFactory1
kernel32
IsValidCodePage
SetCurrentDirectoryW
HeapReAlloc
GetTimeZoneInformation
SetStdHandle
ReadConsoleW
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
EnumSystemLocalesW
IsValidLocale
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
DecodePointer
WriteFile
GetStdHandle
PeekNamedPipe
GetFileType
GetFileInformationByHandle
GetDriveTypeW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
FindFirstFileExW
ReadFile
MoveFileExW
SetFileAttributesW
GetFileAttributesExW
GetModuleHandleExW
HeapWalk
HeapValidate
EncodePointer
LoadLibraryExW
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
VirtualQuery
GetProcessHeap
HeapFree
HeapAlloc
InitializeSListHead
GetSystemTimeAsFileTime
GetOEMCP
GetCPInfo
RaiseException
GetStartupInfoW
IsDebuggerPresent
TerminateProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetProcAddress
LoadLibraryW
WideCharToMultiByte
GetCommandLineA
WaitForSingleObjectEx
CreateEventExW
OutputDebugStringA
MultiByteToWideChar
GetConsoleWindow
GetLastError
GetCurrentDirectoryW
DeleteFileW
GetFullPathNameW
SetLastError
CreateThread
GetExitCodeThread
GetModuleHandleW
LocalFree
FormatMessageW
SetCurrentDirectoryA
GetCurrentDirectoryA
FreeLibrary
GetEnvironmentVariableW
CreateDirectoryW
FindClose
FindFirstFileW
FindNextFileW
GetFileAttributesW
RemoveDirectoryW
Sleep
GetExitCodeProcess
CreateProcessW
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
SetWaitableTimer
CreateWaitableTimerW
GetTickCount64
GetCurrentProcess
GetCurrentThread
SetThreadPriority
SetPriorityClass
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalMemoryStatusEx
GetSystemInfo
GetVersionExW
GetLocaleInfoW
GetUserDefaultLCID
ExitProcess
lstrlenA
GetCommandLineW
ExpandEnvironmentStringsW
CreateFileW
GetFinalPathNameByHandleW
SetUnhandledExceptionFilter
SetErrorMode
GetCurrentProcessId
GetCurrentThreadId
GetModuleFileNameW
MoveFileA
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetConsoleCtrlHandler
OutputDebugStringW
GetStringTypeW
SetEndOfFile
GetACP
HeapSize
CloseHandle
WriteConsoleW
TlsFree
RtlCaptureStackBackTrace
user32
LoadCursorW
LoadImageW
CreateDialogParamW
DialogBoxParamW
EndDialog
GetDlgItem
SetDlgItemTextW
GetDlgItemTextW
DrawTextW
GetDC
ReleaseDC
SetWindowTextW
ScreenToClient
MoveWindow
SetCursorPos
ClientToScreen
MapWindowPoints
GetActiveWindow
GetCursorPos
wsprintfW
GetAsyncKeyState
keybd_event
OpenClipboard
CloseClipboard
SetClipboardData
GetClipboardData
CallNextHookEx
IsClipboardFormatAvailable
GetClientRect
MessageBoxA
SetDlgItemTextA
TranslateMessage
DispatchMessageW
PeekMessageW
IsDialogMessageW
SetProcessDPIAware
GetForegroundWindow
UpdateWindow
SetWindowLongW
EnumDisplaySettingsW
MonitorFromWindow
GetMonitorInfoW
SetCapture
GetKeyState
SetFocus
BringWindowToTop
SetWindowPos
ShowWindow
DestroyWindow
CreateWindowExW
RegisterClassExW
DefWindowProcW
PostMessageW
SendMessageW
SetCursor
AdjustWindowRectEx
EmptyClipboard
MessageBoxW
GetRawInputDeviceList
GetRawInputDeviceInfoA
SetForegroundWindow
GetWindowRect
GetSystemMetrics
GetFocus
ReleaseCapture
gdi32
SelectObject
GetStockObject
GetDeviceCaps
comdlg32
GetOpenFileNameW
GetSaveFileNameW
advapi32
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
shell32
ShellExecuteW
SHGetFolderPathW
ole32
CoCreateInstance
CoCreateFreeThreadedMarshaler
CoTaskMemFree
CoInitialize
dwmapi
DwmGetCompositionTimingInfo
Sections
.text Size: 3.2MB - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 995KB - Virtual size: 994KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 538KB - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
minATL Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.mydata Size: 512B - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 44KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
GMJS-Docs.pdf.pdf
-
Info.html
-
audiogroup1.dat
-
data.win
-
options.ini
-
sprAlley.png.png
-
sprBar.png.png
-
sprBathroom.png.png
-
sprBedroom.png.png
-
sprBikeStore.png.png
-
sprCityMap.png.png
-
sprCityMapNight.png.png
-
sprClinic.png.png
-
sprCountryside.png.png
-
sprCountrysideNight.png.png
-
sprFataurant.png.png
-
sprFatbucks.png.png
-
sprFatdonalds.png.png
-
sprFatdonaldsNight.png.png
-
sprGeneralStore.png.png
-
sprGreenhouse.png.png
-
sprKitchen.png.png
-
sprKitchenFridge.png.png
-
sprLivingroom.png.png
-
sprLockerroom.png.png
-
sprPark.png.png
-
sprPharmacy.png.png
-
sprPool.png.png
-
sprShoppingDistrict.png.png
-
sprShoppingDistrictNight.png.png
-
sprStatusScreen.png.png
-
waterflow.ogg