Static task
static1
Behavioral task
behavioral1
Sample
mb_warband.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
mb_warband.exe
Resource
win10v2004-20230220-en
General
-
Target
mb_warband.exe
-
Size
5.3MB
-
MD5
dad0efd0bc93c5a70656fe10278fed45
-
SHA1
5ff40b7dd4912cb6cacbff3673fe8650a28334fc
-
SHA256
43e0120e9c2be155576c351713bcdb9e6835b25db7c29179963756db4ae275fd
-
SHA512
820c34c49f37ba4c289064044f67669cbb4520bc1808d788c4f481e7014ede139eff223b0167e0a33c9673d558f67650f47afd6692c095e5b03a054ca57a48c1
-
SSDEEP
98304:PmGvs4LpMMkRX+wjZDGx92yq7ZvxNQrrDTJo1aPLI2xFI75NSe3zwclx1O47SwKx:uGvs4La1uqZDGT2F5NQT9o1abLIlO47K
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource mb_warband.exe
Files
-
mb_warband.exe.exe windows x86
0dacf83ca0c5249d8b8f36ced8d60b3a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
wininet
InternetQueryOptionA
HttpSendRequestA
InternetCloseHandle
InternetReadFile
HttpOpenRequestA
InternetConnectA
InternetOpenA
InternetSetOptionA
shfolder
SHGetFolderPathA
d3d9
Direct3DCreate9
d3dx9_42
D3DXCreateTextureFromFileExA
D3DXMatrixMultiply
D3DXMatrixOrthoOffCenterRH
D3DXMatrixPerspectiveOffCenterRH
D3DXMatrixOrthoOffCenterLH
D3DXMatrixPerspectiveOffCenterLH
D3DXCreateEffectFromFileA
D3DXPlaneTransform
D3DXMatrixTranspose
D3DXMatrixInverse
D3DXVec3Normalize
D3DXAssembleShaderFromFileA
D3DXCreateTexture
D3DXSaveTextureToFileA
D3DXCreateCubeTextureFromFileExA
D3DXVec3Transform
D3DXSaveSurfaceToFileA
D3DXCreateTextureFromFileInMemoryEx
dinput8
DirectInput8Create
winmm
timeGetTime
timeBeginPeriod
timeEndPeriod
netapi32
Netbios
ws2_32
WSAGetLastError
WSACleanup
closesocket
WSAIoctl
WSASocketA
WSAStartup
ioctlsocket
listen
bind
setsockopt
htons
inet_ntoa
recv
__WSAFDIsSet
send
accept
shutdown
inet_addr
gethostbyname
gethostbyaddr
socket
WSASendTo
ntohs
WSARecvFrom
crypt32
CertFindCertificateInStore
CertFreeCertificateContext
CertCloseStore
CertOpenSystemStoreA
fmodex
?setPosition@Channel@FMOD@@QAG?AW4FMOD_RESULT@@II@Z
?setFrequency@Channel@FMOD@@QAG?AW4FMOD_RESULT@@M@Z
?setUserData@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PAX@Z
?setSpeakerMode@System@FMOD@@QAG?AW4FMOD_RESULT@@W4FMOD_SPEAKERMODE@@@Z
?getOpenState@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAW4FMOD_OPENSTATE@@PAIPA_N2@Z
?playSound@System@FMOD@@QAG?AW4FMOD_RESULT@@W4FMOD_CHANNELINDEX@@PAVSound@2@_NPAPAVChannel@2@@Z
?setPriority@Channel@FMOD@@QAG?AW4FMOD_RESULT@@H@Z
?setVolume@Channel@FMOD@@QAG?AW4FMOD_RESULT@@M@Z
?getPosition@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PAII@Z
?isPlaying@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PA_N@Z
?getIndex@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PAH@Z
?setDefaults@Sound@FMOD@@QAG?AW4FMOD_RESULT@@MMMH@Z
?getDefaults@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAM00PAH@Z
?createStream@System@FMOD@@QAG?AW4FMOD_RESULT@@PBDIPAUFMOD_CREATESOUNDEXINFO@@PAPAVSound@2@@Z
?createSound@System@FMOD@@QAG?AW4FMOD_RESULT@@PBDIPAUFMOD_CREATESOUNDEXINFO@@PAPAVSound@2@@Z
?getLength@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAII@Z
?getMode@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PAI@Z
?stop@Channel@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?set3DSettings@System@FMOD@@QAG?AW4FMOD_RESULT@@MMM@Z
?setHardwareChannels@System@FMOD@@QAG?AW4FMOD_RESULT@@H@Z
?getNumDrivers@System@FMOD@@QAG?AW4FMOD_RESULT@@PAH@Z
?setDSPBufferSize@System@FMOD@@QAG?AW4FMOD_RESULT@@IH@Z
?getDriverInfo@System@FMOD@@QAG?AW4FMOD_RESULT@@HPADHPAUFMOD_GUID@@@Z
?getUserData@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PAPAX@Z
?setSoftwareFormat@System@FMOD@@QAG?AW4FMOD_RESULT@@HW4FMOD_SOUND_FORMAT@@HHW4FMOD_DSP_RESAMPLER@@@Z
?setOutput@System@FMOD@@QAG?AW4FMOD_RESULT@@W4FMOD_OUTPUTTYPE@@@Z
?init@System@FMOD@@QAG?AW4FMOD_RESULT@@HIPAX@Z
FMOD_System_Create
?getChannelsPlaying@System@FMOD@@QAG?AW4FMOD_RESULT@@PAH@Z
?set3DListenerAttributes@System@FMOD@@QAG?AW4FMOD_RESULT@@HPBUFMOD_VECTOR@@000@Z
?getChannel@System@FMOD@@QAG?AW4FMOD_RESULT@@HPAPAVChannel@2@@Z
?set3DAttributes@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PBUFMOD_VECTOR@@0@Z
?release@Sound@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?setCallback@Channel@FMOD@@QAG?AW4FMOD_RESULT@@P6G?AW43@PAUFMOD_CHANNEL@@W4FMOD_CHANNEL_CALLBACKTYPE@@PAX2@Z@Z
?setMode@Channel@FMOD@@QAG?AW4FMOD_RESULT@@I@Z
?getDriverCaps@System@FMOD@@QAG?AW4FMOD_RESULT@@HPAIPAHPAW4FMOD_SPEAKERMODE@@@Z
?setPaused@Channel@FMOD@@QAG?AW4FMOD_RESULT@@_N@Z
?update@System@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?getVolume@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PAM@Z
?set3DMinMaxDistance@Sound@FMOD@@QAG?AW4FMOD_RESULT@@MM@Z
?close@System@FMOD@@QAG?AW4FMOD_RESULT@@XZ
kernel32
GetCurrentDirectoryA
PeekNamedPipe
GetFileInformationByHandle
LCMapStringW
LCMapStringA
LoadLibraryW
GetConsoleMode
GetConsoleCP
SetHandleCount
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoA
GetCommandLineA
SetCurrentDirectoryA
MoveFileA
ExitThread
VirtualFree
VirtualAlloc
HeapReAlloc
InitializeCriticalSectionAndSpinCount
VirtualQuery
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsAlloc
ExitProcess
GetModuleHandleW
FileTimeToLocalFileTime
FileTimeToSystemTime
GetModuleFileNameW
GetFileType
WriteConsoleW
RtlUnwind
FlushFileBuffers
HeapCreate
SetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
SetEndOfFile
GetTimeZoneInformation
CompareStringA
CompareStringW
SetEnvironmentVariableA
InterlockedExchangeAdd
SetEvent
ResetEvent
WaitForSingleObject
Sleep
lstrlenA
lstrcatA
lstrcpyA
QueryPerformanceCounter
QueryPerformanceFrequency
MulDiv
lstrcmpA
MultiByteToWideChar
WideCharToMultiByte
CloseHandle
CreateFileA
GetFullPathNameA
FreeLibrary
GetProcAddress
LoadLibraryA
GetModuleFileNameA
GetFileAttributesA
TlsGetValue
FindClose
FindFirstFileA
InitializeCriticalSection
DeleteCriticalSection
FindNextFileA
EnterCriticalSection
LeaveCriticalSection
GetExitCodeThread
SetThreadAffinityMask
GetCurrentThread
GetProcessAffinityMask
GetCurrentProcess
GetLastError
GetFileSize
ReadFile
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
CreateDirectoryA
GetSystemInfo
GlobalMemoryStatus
GetModuleHandleA
GetVersionExA
CreateEventA
GetStdHandle
RaiseException
ReleaseMutex
InterlockedIncrement
InterlockedDecrement
GlobalUnlock
GlobalLock
GlobalAlloc
RemoveDirectoryA
DeleteFileA
SetFileAttributesA
CreateProcessA
GetUserDefaultLCID
CreateMutexA
HeapAlloc
GetProcessHeap
HeapFree
TerminateThread
CreateThread
WriteFile
SetFilePointer
GetWindowsDirectoryA
GetSystemTime
GetVolumeInformationA
GetDriveTypeA
GetSystemDirectoryA
ResumeThread
CreateSemaphoreA
HeapSize
ReleaseSemaphore
user32
ShowWindow
ClipCursor
GetClassLongA
SetWindowPos
DefWindowProcA
DefWindowProcW
IsWindowUnicode
PostQuitMessage
DestroyWindow
DestroyMenu
DestroyAcceleratorTable
DispatchMessageW
TranslateMessage
TranslateAcceleratorA
GetMessageW
PeekMessageW
PeekMessageA
LoadAcceleratorsA
GetDlgItem
PostMessageA
EnableWindow
IsDlgButtonChecked
wsprintfA
CheckRadioButton
SendDlgItemMessageA
EndDialog
DialogBoxParamA
SetFocus
EnumDisplayDevicesA
EndPaint
BeginPaint
SetDlgItemTextA
SetDlgItemInt
DispatchMessageA
GetSystemMetrics
GetWindowTextA
GetDlgItemInt
MessageBoxA
LoadBitmapA
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
GetClipboardData
IsClipboardFormatAvailable
GetFocus
LoadImageA
SetCursorPos
ClientToScreen
ScreenToClient
GetCursorPos
RedrawWindow
DestroyIcon
SetCursor
SetForegroundWindow
SetActiveWindow
CreateDialogParamA
DrawMenuBar
SetMenuItemInfoA
GetDesktopWindow
GetWindowRect
GetClientRect
SetRect
AdjustWindowRect
LoadIconA
LoadCursorA
RegisterClassExW
SendMessageA
SetWindowLongA
SetMenu
GetDlgItemTextA
GetMenu
LoadMenuA
CreateWindowExW
UpdateWindow
SetWindowTextA
GetWindowLongA
gdi32
ExtTextOutA
GetTextExtentPoint32A
DeleteDC
SetTextAlign
SetBkColor
SetTextColor
CreateDIBSection
DeleteObject
SelectObject
CreateFontIndirectA
GetObjectA
CreateFontA
GetDeviceCaps
BitBlt
SetMapMode
CreateCompatibleDC
GetStockObject
advapi32
RegOpenKeyExW
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegQueryValueExW
RegEnumKeyA
shell32
ShellExecuteA
ole32
CoCreateInstance
CoUninitialize
CoInitialize
oleaut32
VariantClear
VariantInit
skinmagic
ord3
ord2
ord9
ord1
winhttp
WinHttpConnect
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpOpen
WinHttpCloseHandle
WinHttpOpenRequest
WinHttpSetOption
imm32
ImmGetContext
ImmReleaseContext
ImmGetCompositionStringW
ImmAssociateContext
xinput1_3
ord3
ord5
ord2
wsock32
gethostname
select
connect
WSAAsyncSelect
Sections
.text Size: 3.8MB - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 638KB - Virtual size: 637KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 231KB - Virtual size: 37.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 714KB - Virtual size: 713KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ