Client_3D[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

Client_3D.exe
Size

1.9MB
MD5

df1b25af92d01662bd0d332d25afd4fe
SHA1

2a8b3b1d1bc3a4cd45a348460dd47eb894fea9ea
SHA256

95a81144f16b9b5e4fe43cadf36f12307125c6eb7864b87cbf6ab1e3f98d1635
SHA512

1ce5548d144d48eee25f2dd8e69a261238cc58c04a3234d0a16c36b4e18b528bb554ca9035ff730bee96842a16d50b1ac3d4774df93c84d9f6ff143edca9f252
SSDEEP

24576:q878sNVveI0KRaZD3fyDVJej0Ydj2UlNuuCns1+PJmzGPvVsEscvwn3E1XsPlLRT:q8bVveLKROfyDVJeIylNuHPJ0GPHC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Client_3D.exe

Files

Client_3D.exe
.exe windows x86

d46a5e570a53f6aca4326449a66f1346

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

binkw32

_BinkDDSurfaceType@4
_BinkOpenDirectSound@4
_BinkSetSoundSystem@8
_BinkOpen@8
_BinkWait@4
_BinkClose@4
_BinkCopyToBuffer@28
_BinkNextFrame@4
_BinkDoFrame@4

granny

_GrannyLockSequenceForRendering@16
_GrannyUnlockIntersection@8
_GrannyGetNextIntersection@12
_GrannyGetIntersectionsLeft@12
_GrannyLockSequenceForRayIntersection@20
_GrannyGetBoneTreeState@20
_GrannyAttachSequence@32
_GrannyDetachSequence@8
_GrannyStopWearingSequence@8
_GrannyWearSequence@16
_GrannyGetAnimationParameter@20
_GrannyHasControlExpired@16
_GrannyAddControlledAnimation@20
_GrannySetAnimationParameter@24
_GrannySetSequenceAccumulating@12
_GrannyOpenSequence@12
_GrannySetSequencePosition@12
_GrannyCloseSequence@8
_GrannyReleaseControlledAnimation@12
_GrannyClose@4
_GrannyOpenVersion@20
_GrannyGetPreference@12
_GrannySetPreference@12
_GrannyGetBoneCount@12
_GrannyGetBoneState@20
_GrannyOpenAnimation@12
_GrannyGetToolCoordinateSystemForAnimation@16
_GrannyTransformAnimation@16
_GrannyOpenModel@12
_GrannyGetToolCoordinateSystemForModel@16
_GrannyRecommendTransform@28
_GrannyTransformModel@16
_GrannyCloseAnimation@8
_GrannyCloseModel@8
_GrannyGetExpiredTexturesLeft@8
_GrannyGetNextExpiredTextureCookie@8
_GrannyGetCurrentTime@8
_GrannyAdvanceTime@12
_GrannyGetNewTexturesLeft@8
_GrannyLockNextNewTexture@8
_GrannyUnlockNewTexture@8
_GrannyAllowTextureFormat@8
_GrannyUnlockRendering@8
_GrannyUnlockRenderingState@4
_GrannyLockNextRenderingState@12
_GrannyGetRenderingStatesLeft@12

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

kernel32

SetFilePointer
FlushFileBuffers
GetFileType
GetStartupInfoA
WideCharToMultiByte
CreateDirectoryA
IsBadWritePtr
HeapReAlloc
VirtualAlloc
VirtualFree
GetSystemTimeAsFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
GetLocalTime
GetSystemTime
RaiseException
RtlUnwind
InterlockedDecrement
InterlockedIncrement
GetFullPathNameA
SetHandleCount
GetStdHandle
GetEnvironmentVariableA
HeapDestroy
HeapCreate
SetUnhandledExceptionFilter
HeapSize
LCMapStringA
LCMapStringW
GetCPInfo
GetOEMCP
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
Sleep
InterlockedExchange
CloseHandle
WriteFile
CreateFileA
GetLastError
LeaveCriticalSection
EnterCriticalSection
FindClose
FindNextFileA
FindFirstFileA
QueryPerformanceFrequency
QueryPerformanceCounter
LocalFree
GetEnvironmentStringsW
GetDiskFreeSpaceA
GetDriveTypeA
GetProcAddress
LoadLibraryA
GetLogicalDrives
GlobalMemoryStatus
GetTickCount
SetThreadPriority
CreateThread
InitializeCriticalSection
DeleteCriticalSection
WaitForSingleObject
ResumeThread
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetFileSize
FlushViewOfFile
GetCurrentProcessId
FreeLibrary
GetVersion
OpenFileMappingA
ExitProcess
GetVersionExA
GlobalUnlock
GlobalLock
MultiByteToWideChar
GetACP
IsDBCSLeadByte
CreateMutexA
ReleaseMutex
GetTimeZoneInformation
GetSystemInfo
DeviceIoControl
GetLogicalDriveStringsA
GetCurrentDirectoryA
GetModuleFileNameA
SetFileAttributesA
GetFileAttributesA
GetCommandLineA
GetProfileStringA
TerminateProcess
CopyFileA
CreateProcessA
OpenProcess
HeapFree
GetProcessHeap
HeapAlloc
MoveFileA
DeleteFileA
GetExitCodeProcess
SetCurrentDirectoryA
ReadFile
GetCurrentProcess
GlobalFree
GlobalAlloc
OpenMutexA
GetModuleHandleA
lstrcmpiA
IsBadReadPtr
GetWindowsDirectoryA
SetEndOfFile
SetStdHandle
GetStringTypeA
GetStringTypeW
IsBadCodePtr
CompareStringA
CompareStringW
FormatMessageA
SetEnvironmentVariableA

user32

GetAsyncKeyState
GetKeyNameTextA
GetDoubleClickTime
DestroyMenu
ShowCursor
GetMenu
SetWindowTextA
SetWindowTextW
IsWindowUnicode
CheckMenuItem
LoadAcceleratorsA
SetCursor
LoadCursorA
GetWindowDC
GetDesktopWindow
FindWindowA
DispatchMessageA
TranslateMessage
TranslateAcceleratorA
PeekMessageA
UnregisterClassA
UnregisterClassW
SendMessageA
UpdateWindow
ShowWindow
CreateWindowExA
RegisterClassA
CreateWindowExW
RegisterClassW
LoadIconA
LoadMenuA
CloseClipboard
GetClipboardData
OpenClipboard
IsClipboardFormatAvailable
DefWindowProcA
DefWindowProcW
GetActiveWindow
SetFocus
SetCapture
ReleaseCapture
IsZoomed
GetSystemMetrics
EndPaint
BeginPaint
PostQuitMessage
GetWindowRect
GetFocus
ScreenToClient
GetCursorPos
DestroyWindow
GetMessageA
SetWindowPos
SetWindowLongA
GetWindowLongA
SetMenu
MoveWindow
MapVirtualKeyA
KillTimer
SetTimer
LoadImageA
GetParent
GetClassInfoA
DrawTextA
SetWindowPlacement
AdjustWindowRectEx
GetWindowPlacement
wsprintfA
MessageBoxA
CopyRect
IsIconic
GetClientRect
ClientToScreen
GetDC
ReleaseDC
GetKeyState

gdi32

StretchBlt
GetObjectA
GetPaletteEntries
GetDeviceCaps
DeleteDC
SetBkMode
CreateDIBSection
DeleteObject
CreateCompatibleDC
SelectObject
BitBlt
GetStockObject
SetTextColor

advapi32

RegQueryValueExW
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegSetValueExA

ole32

CoUninitialize
CoInitialize

wsock32

socket
recvfrom
sendto
ntohl
gethostbyname
gethostname
WSAStartup
WSACleanup
closesocket
inet_ntoa
setsockopt
send
connect
htons
htonl
__WSAFDIsSet
select
WSAGetLastError
recv
ntohs
bind

ddraw

DirectDrawEnumerateExA
DirectDrawCreateEx

dsound

ord1

winmm

timeKillEvent
timeSetEvent
mciSendCommandA
midiOutSetVolume
midiOutGetDevCapsA
midiOutGetVolume
timeGetTime

igrping

?SendPingMessage@@YA_NPADH00H@Z

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 268KB - Virtual size: 264KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 100KB - Virtual size: 9.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

LBMPEG_D
Size: 4KB - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d46a5e570a53f6aca4326449a66f1346

Headers

File Characteristics

Imports

binkw32

granny

version

kernel32

user32

gdi32

advapi32

ole32

wsock32

ddraw

dsound

winmm

igrping

Sections

.text Size: 1.5MB - Virtual size: 1.5MB

.rdata Size: 268KB - Virtual size: 264KB

.data Size: 100KB - Virtual size: 9.5MB

LBMPEG_D Size: 4KB - Virtual size: 1024B

.rsrc Size: 8KB - Virtual size: 4KB

.text
Size: 1.5MB - Virtual size: 1.5MB

.rdata
Size: 268KB - Virtual size: 264KB

.data
Size: 100KB - Virtual size: 9.5MB

LBMPEG_D
Size: 4KB - Virtual size: 1024B

.rsrc
Size: 8KB - Virtual size: 4KB