49fc823bfd6029bed12b5d7fc3d7c329452a989bba092ba31c6bae8d4f117efa

Sharing

Copy URL Twitter E-mail

General

Target

49fc823bfd6029bed12b5d7fc3d7c329452a989bba092ba31c6bae8d4f117efa
Size

4.8MB
MD5

b9a154ab5db20d70d18d9989c8a98ad8
SHA1

96dbf8be339b4cc7f1762013dd306724293ccfa1
SHA256

49fc823bfd6029bed12b5d7fc3d7c329452a989bba092ba31c6bae8d4f117efa
SHA512

45f2a315833d57c2ebb2ad096482f0ce8c566c4d256141843293873fbb8bc8068018b7b662a0b80637e5735e21bced35c2f88729dedbd298e85887b3dd26e8c9
SSDEEP

98304:CFKZETtyK62Wq1P66mz/AWjmVhFPhJJdV2e4Cr:qP4KHWq1S6OIhe

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
49fc823bfd6029bed12b5d7fc3d7c329452a989bba092ba31c6bae8d4f117efa

Files

49fc823bfd6029bed12b5d7fc3d7c329452a989bba092ba31c6bae8d4f117efa
.exe windows x86

9b9b24e94dfdc9de797bf0319fe6e19a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetTempPathW
SetFileInformationByHandle
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
CloseThreadpoolWork
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
InitOnceExecuteOnce
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
GetFileInformationByHandleEx
CreateSymbolicLinkW
MoveFileA
GetPrivateProfileStringA
lstrlenA
GlobalFree
GetModuleFileNameA
CreateMutexA
ReleaseMutex
DeleteFileA
GetCurrentDirectoryA
GetTickCount
GetCurrentDirectoryW
ReadProcessMemory
GetCurrentProcessId
GetCurrentProcess
GetLastError
FindNextFileA
FindFirstFileA
WriteConsoleW
SetEndOfFile
HeapQueryInformation
HeapSize
OutputDebugStringW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
InitializeConditionVariable
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
HeapReAlloc
SetStdHandle
DeleteFileW
SetFileAttributesW
SetCurrentDirectoryW
GetTimeZoneInformation
CreateProcessW
GetExitCodeProcess
CreateDirectoryW
GetFileSizeEx
SetConsoleCtrlHandler
SetFilePointerEx
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetFileAttributesExW
EnumSystemLocalesW
GetUserDefaultLCID
FindClose
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
HeapAlloc
HeapFree
GetStdHandle
GetModuleFileNameW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileType
GetFileInformationByHandle
ExitProcess
GetFullPathNameW
GetDriveTypeW
GetModuleHandleExW
FreeLibraryAndExitThread
ResumeThread
ExitThread
WakeConditionVariable
SubmitThreadpoolWork
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
CreateEventExW
CreateSemaphoreExW
FlushProcessWriteBuffers
GetCurrentProcessorNumber
GetTickCount64
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
GetCommandLineW
CreateThread
LoadLibraryExW
TlsFree
TlsSetValue
MultiByteToWideChar
SetFileAttributesA
Module32Next
Module32First
Process32Next
Process32First
CreateToolhelp32Snapshot
GetSystemInfo
OpenProcess
SetThreadPriority
Sleep
CreateEventA
WaitForSingleObject
SetEvent
DeleteCriticalSection
TlsGetValue
TlsAlloc
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
RaiseException
GetThreadTimes
GetCurrentThread
QueryPerformanceFrequency
SetLastError
GetSystemTimeAsFileTime
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
TerminateProcess
UnhandledExceptionFilter
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
InitializeCriticalSectionAndSpinCount
FindResourceW
FindResourceA
SizeofResource
LoadResource
LockResource
CreateFileW
IsProcessorFeaturePresent
InterlockedDecrement
GetProcessHeap
HeapValidate
InterlockedIncrement
GetCPInfo
CompareStringEx
LCMapStringEx
DecodePointer
EncodePointer
GetLocaleInfoEx
LocalFree
InitializeCriticalSectionEx
GetStringTypeW
FormatMessageA
QueryPerformanceCounter
CopyFileA
CreateSemaphoreA
ReleaseSemaphore
GetLocaleInfoA
CompareStringA
WideCharToMultiByte
lstrlenW
GlobalLock
GlobalUnlock
FreeLibrary
GetVersionExA
GetSystemDirectoryA
GetModuleHandleA
WriteFile
SetFilePointer
ReadFile
LoadLibraryA
GetProcAddress
GetCurrentThreadId
SetUnhandledExceptionFilter
GetFileSize
CreateFileA
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
OutputDebugStringA
GetTempFileNameA
GetTempPathA
RemoveDirectoryA
CreateDirectoryA
AllocConsole
GlobalAlloc
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
IsValidLocale
CloseHandle

user32

CharPrevExA
CharNextExA
SetWindowLongA
GetWindowLongA
UpdateWindow
SetFocus
MoveWindow
DestroyWindow
IsWindow
CreateWindowExA
RegisterClassExA
UnregisterClassA
DefWindowProcA
OpenClipboard
CloseClipboard
GetClipboardData
CharNextW
GetDC
PeekMessageA
GetSystemMetrics
ChangeDisplaySettingsA
GetWindowRect
RegisterClassA
SetCapture
GetCapture
ShowWindow
ClientToScreen
SetCursorPos
LoadImageA
DestroyCursor
BeginPaint
SetCursor
ShowCursor
GetKeyState
SystemParametersInfoA
LoadIconA
FindWindowA
ScreenToClient
GetCursorPos
GetAsyncKeyState
SetWindowPos
PostQuitMessage
ReleaseDC
EndPaint
InvalidateRect
GetMenu
ReleaseCapture
AdjustWindowRectEx
LoadCursorA
GetMessageA
TranslateMessage
DispatchMessageA
GetKeyboardLayoutNameA
SetWindowTextA
GetKeyboardLayout
MessageBoxA
LoadStringA
OffsetRect
SetRect
FillRect
GetClientRect

gdi32

SetTextColor
TextOutW
CreateCompatibleDC
DeleteDC
SetBkMode
SetDIBitsToDevice
CreateDIBSection
TextOutA
GetTextExtentPoint32W
CreateFontIndirectA
GetStockObject
EnumFontFamiliesExA
GetTextExtentPoint32A
SelectObject
SetBkColor
StretchBlt
PatBlt
DeleteObject
CreateSolidBrush
GetCharABCWidthsFloatW

ole32

OleSetContainedObject
OleUninitialize
OleInitialize
CoGetClassObject
CoUninitialize
CoInitialize
CoCreateInstance
CoInitializeEx

winmm

timeGetDevCaps
timeEndPeriod
timeGetTime
timeBeginPeriod

d3d8

Direct3DCreate8

python27

PyTuple_Size
PyLong_AsLong
Py_InitModule4
PyModule_AddIntConstant
Py_BuildValue
PyModule_AddStringConstant
PyImport_ImportModule
PyDict_GetItemString
PyObject_GetAttrString
PyObject_GetAttr
PyCallable_Check
PyLong_AsLongLong
PyTuple_GetItem
PyInt_AsLong
PyDict_Next
PyDict_Size
PyFloat_AsDouble
PyString_AsString
PyErr_Clear
PyErr_SetString
PyList_Append
PyList_New
PyString_FromString
PyString_InternFromString
PyErr_BadArgument
PyErr_Print
PyObject_CallObject
PyNumber_Check
_Py_NoneStruct
PyDict_SetItemString
PyModule_GetDict
PyErr_Fetch
Py_SetProgramName
Py_Initialize
Py_Finalize
PyRun_StringFlags
PyEval_SetTrace
Py_FlushLine
PyImport_GetMagicNumber
PyImport_AddModule
PyObject_AsCharBuffer
PyCode_Addr2Line
PyEval_EvalCode
Py_OptimizeFlag
PyCode_Type
PyUnicodeUCS2_DecodeUTF8
PyInt_FromLong
_PyLong_FromByteArray
PyFloat_FromDouble
PyComplex_FromCComplex
PyString_FromStringAndSize
PyTuple_New
PyList_SetItem
PyDict_New
PyErr_Occurred
PyErr_NoMemory
PyEval_GetRestricted
PyCode_New
PyMarshal_ReadObjectFromString
_PyLong_New
_Py_EllipsisObject
PyExc_StopIteration
PyExc_EOFError
PyExc_ValueError
PyExc_RuntimeError
PyDict_SetItem

imm32

ImmNotifyIME
ImmGetOpenStatus
ImmSetConversionStatus
ImmGetConversionStatus
ImmGetCandidateListW
ImmSetCompositionStringW
ImmGetCompositionStringW
ImmAssociateContext
ImmReleaseContext
ImmGetContext
ImmGetIMEFileNameA
ImmIsIME

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

devil

ilCopyPixels
ilConvertImage
ilLoad
ilGetInteger
ilGenImages
ilDeleteImages
ilBindImage
ilInit
ilTexImage
ilSetPixels
ilSave
ilOriginFunc
ilShutDown
ilEnable

granny2

_GrannyGetMeshVertexCount@4
_GrannyGetTotalTypeSize@4
_GrannyGetWorldPoseComposite4x4@8
_GrannyGetWorldPose4x4@8
_GrannyFreeWorldPose@4
_GrannyNewWorldPose@4
_GrannyFindBoneByName@12
_GrannyGetMeshBindingToBoneIndices@4
_GrannyFreeMeshBinding@4
_GrannyNewMeshBinding@12
_GrannyFreeModelInstance@4
_GrannyInstantiateModel@4
_GrannyMeshIsRigid@4
_GrannyFreeLocalPose@4
_GrannyNewLocalPose@4
_GrannyUpdateModelMatrix@20
_GrannySampleModelAnimationsAccelerated@20
_GrannyFreeCompletedModelControls@4
_GrannySetModelClock@8
_GrannyGetSourceSkeleton@4
_GrannyGetFileInfo@4
_GrannyFreeFile@4
_GrannyFreeFileSection@8
_GrannyReadEntireFileFromMemory@8
_GrannyConvertSingleObject@20
_GrannyFindMatchingMember@16
_GrannyGetMaterialTextureByType@8
_GrannySetLogCallback@4
_GrannyGetMeshIndexCount@4
_GrannyFreeControl@4
_GrannyFreeControlOnceUnused@4
_GrannyCompleteControlAt@8
_GrannyControlIsComplete@4
_GrannyFreeControlIfComplete@4
_GrannyGetControlLoopCount@4
_GrannySetControlLoopCount@8
_GrannyGetControlSpeed@4
_GrannySetControlSpeed@8
_GrannyGetControlLocalDuration@4
_GrannySetControlEaseIn@8
_GrannySetControlEaseInCurve@28
_GrannySetControlEaseOut@8
_GrannySetControlEaseOutCurve@28
_GrannyGetControlRawLocalClock@4
_GrannySetControlRawLocalClock@8
_GrannyPlayControlledAnimation@12
_GrannyGetMeshTriangleGroupCount@4
_GrannyGetMeshTriangleGroups@4
_GrannyGetMeshVertexType@4
_GrannyGetMeshVertices@4
_GrannyCopyMeshIndices@12
_GrannyNewMeshDeformer@16
_GrannyFreeMeshDeformer@4
_GrannyDeformVertices@24
GrannyPNT332VertexType
_GrannyGetWorldPoseComposite4x4Array@4
_GrannyCopyMeshVertices@12

mss32

_AIL_stop_sample@4
_AIL_mem_free_lock@4
_AIL_file_read@8
_AIL_set_file_callbacks@16
_AIL_WAV_info@8
_AIL_decompress_ASI@24
_AIL_decompress_ADPCM@12
_AIL_file_type@8
_AIL_open_digital_driver@16
_AIL_open_stream@12
_AIL_close_digital_driver@4
_AIL_enumerate_3D_providers@12
_AIL_open_3D_provider@4
_AIL_close_3D_provider@4
_AIL_open_3D_listener@4
_AIL_close_3D_listener@4
_AIL_set_3D_position@16
_AIL_set_3D_velocity@20
_AIL_set_3D_orientation@28
_AIL_startup@0
_AIL_shutdown@0
_AIL_set_redist_directory@4
_AIL_auto_update_3D_position@8
_AIL_update_3D_position@8
_AIL_3D_sample_volume@4
_AIL_3D_sample_status@4
_AIL_set_3D_sample_loop_count@8
_AIL_set_3D_sample_volume@8
_AIL_set_3D_sample_file@8
_AIL_end_3D_sample@4
_AIL_resume_3D_sample@4
_AIL_stop_3D_sample@4
_AIL_start_3D_sample@4
_AIL_release_3D_sample_handle@4
_AIL_allocate_3D_sample_handle@4
_AIL_sample_volume_pan@12
_AIL_sample_status@4
_AIL_set_sample_loop_count@8
_AIL_set_sample_volume_pan@12
_AIL_end_sample@4
_AIL_resume_sample@4
_AIL_close_stream@4
_AIL_start_sample@4
_AIL_set_sample_file@12
_AIL_init_sample@4
_AIL_release_sample_handle@4
_AIL_allocate_sample_handle@4
_AIL_last_error@0
_AIL_stream_status@4
_AIL_set_stream_loop_count@8
_AIL_stream_volume_levels@12
_AIL_set_stream_volume_levels@12
_AIL_pause_stream@8
_AIL_start_stream@4

dinput8

DirectInput8Create

ws2_32

connect
ioctlsocket
recv
select
send
closesocket
__WSAFDIsSet
WSAStartup
WSACleanup
htonl
htons
inet_addr
ntohl
ntohs
gethostbyname
gethostname
WSAGetLastError
socket

ddraw

DirectDrawCreate

advapi32

CryptAcquireContextA
CryptGenRandom
RegOpenKeyExA
RegQueryValueExA
CryptReleaseContext
RegCloseKey
RegOpenKeyA

shell32

SHGetSpecialFolderPathA

oleaut32

VariantClear
VariantInit
SafeArrayAccessData
SafeArrayDestroy
SafeArrayCreate
SysAllocString
SysFreeString

Sections

.text
Size: 3.7MB - Virtual size: 3.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 646KB - Virtual size: 645KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 183KB - Virtual size: 463KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data1
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 180KB - Virtual size: 180KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9b9b24e94dfdc9de797bf0319fe6e19a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

ole32

winmm

d3d8

python27

imm32

version

devil

granny2

mss32

dinput8

ws2_32

ddraw

advapi32

shell32

oleaut32

Sections

.text Size: 3.7MB - Virtual size: 3.7MB

.rdata Size: 646KB - Virtual size: 645KB

.data Size: 183KB - Virtual size: 463KB

.data1 Size: 2KB - Virtual size: 2KB

.rsrc Size: 45KB - Virtual size: 44KB

.reloc Size: 180KB - Virtual size: 180KB

.text
Size: 3.7MB - Virtual size: 3.7MB

.rdata
Size: 646KB - Virtual size: 645KB

.data
Size: 183KB - Virtual size: 463KB

.data1
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 45KB - Virtual size: 44KB

.reloc
Size: 180KB - Virtual size: 180KB