1e391f29094598ce7514e7026001109044be383b9da8fa02c87f387cc4bb5171

Sharing

Copy URL

Twitter E-mail

General

Target

1e391f29094598ce7514e7026001109044be383b9da8fa02c87f387cc4bb5171
Size

7.5MB
MD5

00441d426aeccb38dab91e458719e5be
SHA1

840100a3f56aa903f62658ca21d440095b885f02
SHA256

1e391f29094598ce7514e7026001109044be383b9da8fa02c87f387cc4bb5171
SHA512

5fc7355f5bbd87557270c7fa176e8307e46a306c9c99a57d8c51a87bfb7fba47f789ef5afade871abf01691e1b409fe52c49af62d2301c3379568bcf633539ba
SSDEEP

98304:GERSTXXFPIMzhEVlqdEk5gl6y8MnHF2QXYKfGxpBwHpnbCjFMHiSMM9i4LAgszY:lUFgMzhEVguk5gl6V732Vq3gUZY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1e391f29094598ce7514e7026001109044be383b9da8fa02c87f387cc4bb5171

Files

1e391f29094598ce7514e7026001109044be383b9da8fa02c87f387cc4bb5171
.exe windows x86

fff324694729cb520ca5d732d57babb4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeleteFileA
ReleaseMutex
WriteConsoleW
HeapQueryInformation
PeekConsoleInputA
ReadConsoleInputW
GetNumberOfConsoleInputEvents
CreateMutexA
GetModuleFileNameA
GlobalFree
MoveFileA
GetModuleHandleA
Module32Next
CreateThread
GetCurrentDirectoryA
Process32First
SetConsoleMode
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
HeapReAlloc
MoveFileExW
GetFileSizeEx
ReadConsoleW
GetConsoleMode
GetTickCount
Process32Next
GetCurrentDirectoryW
ReadProcessMemory
GetCurrentProcessId
GetCurrentProcess
GlobalLock
GlobalUnlock
GlobalAlloc
GetLastError
FindNextFileA
SetFileAttributesA
MultiByteToWideChar
FindClose
GetPrivateProfileStringA
FindFirstFileA
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
CreateToolhelp32Snapshot
GetSystemInfo
OpenProcess
SetThreadPriority
Sleep
CreateEventA
WaitForSingleObject
SetEvent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetProcessHeap
HeapFree
Module32First
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
HeapCompact
UnlockFileEx
LockFileEx
GetTimeZoneInformation
CreateProcessW
HeapSize
FlushFileBuffers
SetFilePointerEx
SetStdHandle
VirtualQuery
VirtualProtect
VirtualAlloc
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
ExitProcess
GetDriveTypeW
GetModuleHandleExW
FreeLibraryAndExitThread
ResumeThread
ExitThread
LoadLibraryExW
InitializeCriticalSectionAndSpinCount
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
RaiseException
GetThreadTimes
GetCurrentThread
GetStdHandle
ExpandEnvironmentStringsW
FlushViewOfFile
GetACP
SetConsoleCtrlHandler
ResetEvent
GenerateConsoleCtrlEvent
SystemTimeToFileTime
MoveFileW
GetVersion
GetSystemTime
CreateProcessA
GetExitCodeProcess
GetProcessTimes
CreatePipe
DuplicateHandle
SetFileTime
SetFileAttributesW
RemoveDirectoryW
GetFullPathNameW
GetFileType
GetFileInformationByHandle
GetFileAttributesExW
GetFileAttributesExA
GetFileAttributesW
FindNextFileW
FindFirstFileW
DeleteFileW
CreateDirectoryW
SetCurrentDirectoryW
SetCurrentDirectoryA
SetEnvironmentVariableW
SetEnvironmentVariableA
GetEnvironmentVariableA
LoadLibraryExA
SetErrorMode
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetLastError
GetFullPathNameA
SetEndOfFile
IsDBCSLeadByte
GetConsoleOutputCP
GetConsoleCP
GetFileAttributesA
WaitNamedPipeW
PeekNamedPipe
GetModuleFileNameW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
TerminateProcess
UnhandledExceptionFilter
FindResourceW
FindResourceA
SizeofResource
LoadResource
LockResource
CreateFileW
IsProcessorFeaturePresent
InterlockedDecrement
HeapValidate
InterlockedIncrement
GetCPInfo
CompareStringEx
CreateSymbolicLinkW
GetFileInformationByHandleEx
GetModuleHandleW
CloseThreadpoolWait
SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
FreeLibraryWhenCallbackReturns
HeapAlloc
DeviceIoControl
GetTickCount64
GetSystemTimeAsFileTime
GetCurrentProcessorNumber
FlushProcessWriteBuffers
CreateSemaphoreExW
CreateEventExW
SleepConditionVariableCS
InitOnceExecuteOnce
InitializeSRWLock
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetTempPathW
SetFileInformationByHandle
SleepConditionVariableSRW
WakeAllConditionVariable
WakeConditionVariable
CreateFileA
CloseHandle
lstrlenA
AllocConsole
CreateDirectoryA
RemoveDirectoryA
GetTempPathA
GetTempFileNameA
OutputDebugStringA
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
GetFileSize
SetUnhandledExceptionFilter
GetCurrentThreadId
GetProcAddress
LoadLibraryA
ReadFile
SetFilePointer
WriteFile
OutputDebugStringW
WideCharToMultiByte
GetSystemDirectoryA
GetVersionExA
FreeLibrary
lstrlenW
CompareStringA
GetLocaleInfoA
ReleaseSemaphore
CreateSemaphoreA
CopyFileA
QueryPerformanceCounter
FormatMessageA
WaitForSingleObjectEx
SwitchToThread
GetExitCodeThread
GetNativeSystemInfo
GetStringTypeW
InitializeCriticalSectionEx
LocalFree
GetLocaleInfoEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceFrequency
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
InitializeConditionVariable

user32

RegisterClassExA
DefWindowProcA
DestroyWindow
MoveWindow
SetFocus
SetRect
OffsetRect
LoadStringA
MessageBoxA
CharPrevExA
UnregisterClassA
CharNextExA
SetWindowLongA
GetWindowLongA
IsWindow
EmptyClipboard
PostQuitMessage
SetWindowPos
GetAsyncKeyState
GetCursorPos
ScreenToClient
FindWindowA
LoadIconA
SystemParametersInfoA
GetKeyState
ShowCursor
SetCursor
DestroyCursor
LoadImageA
SetCursorPos
ClientToScreen
ShowWindow
GetCapture
SetCapture
ReleaseCapture
ChangeDisplaySettingsA
OpenClipboard
CloseClipboard
SetClipboardData
RegisterClassA
GetSystemMetrics
GetMessageA
DispatchMessageA
CreateWindowExA
PeekMessageA
GetDC
ReleaseDC
BeginPaint
EndPaint
InvalidateRect
GetClientRect
FillRect
CharPrevA
CharNextW
GetClipboardData
GetKeyboardLayout
GetKeyboardLayoutNameA
TranslateMessage
LoadCursorA
AdjustWindowRectEx
GetWindowRect
SetWindowTextA
GetMenu
UpdateWindow

gdi32

GetTextExtentPoint32A
StretchBlt
PatBlt
DeleteObject
CreateSolidBrush
EnumFontFamiliesExA
GetStockObject
CreateFontIndirectA
GetCharABCWidthsFloatW
GetTextExtentPoint32W
SelectObject
SetBkColor
SetTextColor
TextOutW
CreateCompatibleDC
DeleteDC
SetBkMode
SetDIBitsToDevice
CreateDIBSection
TextOutA

advapi32

RegOpenKeyExA
CryptReleaseContext
CryptAcquireContextA
RegSetValueExA
RegSetValueA
RegSaveKeyA
RegLoadKeyA
RegFlushKey
RegEnumValueA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegCreateKeyA
RegConnectRegistryA
RegQueryInfoKeyA
RegEnumKeyExA
RegQueryValueA
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
CryptGenRandom
RegQueryValueExA
RegOpenKeyA

shell32

ShellExecuteA
ShellExecuteW
SHGetSpecialFolderPathA

ole32

OleSetContainedObject
OleUninitialize
OleInitialize
CoGetClassObject
CoUninitialize
CoCreateInstance
CoInitialize
CoInitializeEx

winmm

timeBeginPeriod
timeGetDevCaps
timeGetTime
timeEndPeriod

d3d8

Direct3DCreate8

iphlpapi

GetAdaptersInfo
GetPerAdapterInfo

imm32

ImmGetOpenStatus
ImmSetConversionStatus
ImmGetConversionStatus
ImmGetCandidateListW
ImmSetCompositionStringW
ImmGetCompositionStringW
ImmAssociateContext
ImmReleaseContext
ImmGetContext
ImmIsIME
ImmGetIMEFileNameA
ImmNotifyIME

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

devil

ilLoad
ilConvertImage
ilCopyPixels
ilEnable
ilGetInteger
ilShutDown
ilSave
ilSetPixels
ilTexImage
ilInit
ilDeleteImages
ilGenImages
ilBindImage
ilOriginFunc

granny2

_GrannyNewWorldPose@4
_GrannyFindBoneByName@12
_GrannyGetMeshBindingToBoneIndices@4
_GrannyFreeMeshBinding@4
_GrannyNewMeshBinding@12
_GrannyFreeModelInstance@4
_GrannyInstantiateModel@4
_GrannyGetWorldPoseComposite4x4@8
_GrannyFreeLocalPose@4
_GrannyNewLocalPose@4
_GrannyUpdateModelMatrix@20
_GrannySampleModelAnimationsAccelerated@20
_GrannyFreeCompletedModelControls@4
_GrannyFreeWorldPose@4
_GrannyGetSourceSkeleton@4
_GrannyGetFileInfo@4
_GrannyFreeFile@4
_GrannyFreeFileSection@8
_GrannyReadEntireFileFromMemory@8
_GrannyConvertSingleObject@20
_GrannyFindMatchingMember@16
_GrannyGetMaterialTextureByType@8
_GrannySetLogCallback@4
_GrannyGetTotalTypeSize@4
_GrannyGetMeshVertexCount@4
_GrannyMeshIsRigid@4
_GrannyGetMeshIndexCount@4
_GrannySetModelClock@8
_GrannyGetWorldPose4x4@8
_GrannyFreeControl@4
_GrannyFreeControlOnceUnused@4
_GrannyCompleteControlAt@8
_GrannyControlIsComplete@4
_GrannyFreeControlIfComplete@4
_GrannyGetWorldPoseComposite4x4Array@4
GrannyPNT332VertexType
_GrannyDeformVertices@24
_GrannyFreeMeshDeformer@4
_GrannyGetControlLoopCount@4
_GrannySetControlLoopCount@8
_GrannyGetControlSpeed@4
_GrannySetControlSpeed@8
_GrannyGetControlLocalDuration@4
_GrannySetControlEaseIn@8
_GrannySetControlEaseInCurve@28
_GrannySetControlEaseOut@8
_GrannySetControlEaseOutCurve@28
_GrannyGetControlRawLocalClock@4
_GrannySetControlRawLocalClock@8
_GrannyPlayControlledAnimation@12
_GrannyGetMeshTriangleGroupCount@4
_GrannyGetMeshTriangleGroups@4
_GrannyGetMeshVertexType@4
_GrannyCopyMeshVertices@12
_GrannyGetMeshVertices@4
_GrannyCopyMeshIndices@12
_GrannyNewMeshDeformer@16

mss32

_AIL_auto_update_3D_position@8
_AIL_update_3D_position@8
_AIL_3D_sample_volume@4
_AIL_mem_free_lock@4
_AIL_file_read@8
_AIL_set_file_callbacks@16
_AIL_WAV_info@8
_AIL_decompress_ASI@24
_AIL_decompress_ADPCM@12
_AIL_file_type@8
_AIL_open_digital_driver@16
_AIL_open_stream@12
_AIL_close_digital_driver@4
_AIL_enumerate_3D_providers@12
_AIL_open_3D_provider@4
_AIL_close_3D_provider@4
_AIL_open_3D_listener@4
_AIL_close_3D_listener@4
_AIL_set_3D_position@16
_AIL_set_3D_velocity@20
_AIL_set_3D_orientation@28
_AIL_startup@0
_AIL_shutdown@0
_AIL_set_redist_directory@4
_AIL_close_stream@4
_AIL_start_stream@4
_AIL_pause_stream@8
_AIL_set_stream_volume_levels@12
_AIL_stream_volume_levels@12
_AIL_set_stream_loop_count@8
_AIL_stream_status@4
_AIL_last_error@0
_AIL_allocate_sample_handle@4
_AIL_release_sample_handle@4
_AIL_init_sample@4
_AIL_set_sample_file@12
_AIL_start_sample@4
_AIL_stop_sample@4
_AIL_resume_sample@4
_AIL_end_sample@4
_AIL_set_sample_volume_pan@12
_AIL_set_sample_loop_count@8
_AIL_sample_status@4
_AIL_sample_volume_pan@12
_AIL_allocate_3D_sample_handle@4
_AIL_release_3D_sample_handle@4
_AIL_start_3D_sample@4
_AIL_stop_3D_sample@4
_AIL_resume_3D_sample@4
_AIL_end_3D_sample@4
_AIL_3D_sample_status@4
_AIL_set_3D_sample_loop_count@8
_AIL_set_3D_sample_volume@8
_AIL_set_3D_sample_file@8

dinput8

DirectInput8Create

ws2_32

select
send
socket
WSAGetLastError
recv
WSACleanup
htonl
htons
inet_addr
ioctlsocket
connect
closesocket
WSAStartup
__WSAFDIsSet
ntohl
ntohs
gethostbyname
gethostname

ddraw

DirectDrawCreate

oleaut32

SysFreeString
SysAllocString
SafeArrayCreate
SafeArrayDestroy
VariantInit
SafeArrayAccessData
VariantClear

Exports

Exports

PyAST_Compile
PyAST_FromNode
PyArena_AddPyObject
PyArena_Free
PyArena_Malloc
PyArena_New
PyArg_Parse
PyArg_ParseTuple
PyArg_ParseTupleAndKeywords
PyArg_UnpackTuple
PyArg_VaParse
PyArg_VaParseTupleAndKeywords
PyBaseObject_Type
PyBaseString_Type
PyBool_FromLong
PyBool_Type
PyBuffer_FillContiguousStrides
PyBuffer_FillInfo
PyBuffer_FromContiguous
PyBuffer_FromMemory
PyBuffer_FromObject
PyBuffer_FromReadWriteMemory
PyBuffer_FromReadWriteObject
PyBuffer_GetPointer
PyBuffer_IsContiguous
PyBuffer_New
PyBuffer_Release
PyBuffer_ToContiguous
PyBuffer_Type
PyByteArrayIter_Type
PyByteArray_AsString
PyByteArray_Concat
PyByteArray_Fini
PyByteArray_FromObject
PyByteArray_FromStringAndSize
PyByteArray_Init
PyByteArray_Resize
PyByteArray_Size
PyByteArray_Type
PyCFunction_Call
PyCFunction_ClearFreeList
PyCFunction_Fini
PyCFunction_GetFlags
PyCFunction_GetFunction
PyCFunction_GetSelf
PyCFunction_New
PyCFunction_NewEx
PyCFunction_Type
PyCObject_AsVoidPtr
PyCObject_FromVoidPtr
PyCObject_FromVoidPtrAndDesc
PyCObject_GetDesc
PyCObject_Import
PyCObject_SetVoidPtr
PyCObject_Type
PyCallIter_New
PyCallIter_Type
PyCallable_Check
PyCapsule_GetContext
PyCapsule_GetDestructor
PyCapsule_GetName
PyCapsule_GetPointer
PyCapsule_Import
PyCapsule_IsValid
PyCapsule_New
PyCapsule_SetContext
PyCapsule_SetDestructor
PyCapsule_SetName
PyCapsule_SetPointer
PyCapsule_Type
PyCell_Get
PyCell_New
PyCell_Set
PyCell_Type
PyClassMethod_New
PyClassMethod_Type
PyClass_IsSubclass
PyClass_New
PyClass_Type
PyCode_Addr2Line
PyCode_New
PyCode_NewEmpty
PyCode_Optimize
PyCode_Type
PyCodec_BackslashReplaceErrors
PyCodec_Decode
PyCodec_Decoder
PyCodec_Encode
PyCodec_Encoder
PyCodec_IgnoreErrors
PyCodec_IncrementalDecoder
PyCodec_IncrementalEncoder
PyCodec_LookupError
PyCodec_Register
PyCodec_RegisterError
PyCodec_ReplaceErrors
PyCodec_StreamReader
PyCodec_StreamWriter
PyCodec_StrictErrors
PyCodec_XMLCharRefReplaceErrors
PyComplex_AsCComplex
PyComplex_FromCComplex
PyComplex_FromDoubles
PyComplex_ImagAsDouble
PyComplex_RealAsDouble
PyComplex_Type
PyDescr_NewClassMethod
PyDescr_NewGetSet
PyDescr_NewMember
PyDescr_NewMethod
PyDescr_NewWrapper
PyDictItems_Type
PyDictIterItem_Type
PyDictIterKey_Type
PyDictIterValue_Type
PyDictKeys_Type
PyDictProxy_New
PyDictProxy_Type
PyDictValues_Type
PyDict_Clear
PyDict_Contains
PyDict_Copy
PyDict_DelItem
PyDict_DelItemString
PyDict_Fini
PyDict_GetItem
PyDict_GetItemString
PyDict_Items
PyDict_Keys
PyDict_Merge
PyDict_MergeFromSeq2
PyDict_New
PyDict_Next
PyDict_SetItem
PyDict_SetItemString
PyDict_Size
PyDict_Type
PyDict_Update
PyDict_Values
PyEllipsis_Type
PyEnum_Type
PyErr_BadArgument
PyErr_BadInternalCall
PyErr_CheckSignals
PyErr_Clear
PyErr_Display
PyErr_ExceptionMatches
PyErr_Fetch
PyErr_Format
PyErr_GivenExceptionMatches
PyErr_NewException
PyErr_NewExceptionWithDoc
PyErr_NoMemory
PyErr_NormalizeException
PyErr_Occurred
PyErr_Print
PyErr_PrintEx
PyErr_ProgramText
PyErr_Restore
PyErr_SetExcFromWindowsErr
PyErr_SetExcFromWindowsErrWithFilename
PyErr_SetExcFromWindowsErrWithFilenameObject
PyErr_SetExcFromWindowsErrWithUnicodeFilename
PyErr_SetFromErrno
PyErr_SetFromErrnoWithFilename
PyErr_SetFromErrnoWithFilenameObject
PyErr_SetFromErrnoWithUnicodeFilename
PyErr_SetFromWindowsErr
PyErr_SetFromWindowsErrWithFilename
PyErr_SetFromWindowsErrWithUnicodeFilename
PyErr_SetInterrupt
PyErr_SetNone
PyErr_SetObject
PyErr_SetString
PyErr_SyntaxLocation
PyErr_Warn
PyErr_WarnEx
PyErr_WarnExplicit
PyErr_WriteUnraisable
PyEval_AcquireLock
PyEval_AcquireThread
PyEval_CallFunction
PyEval_CallMethod
PyEval_CallObjectWithKeywords
PyEval_EvalCode
PyEval_EvalCodeEx
PyEval_EvalFrame
PyEval_EvalFrameEx
PyEval_GetBuiltins
PyEval_GetCallStats
PyEval_GetFrame
PyEval_GetFuncDesc
PyEval_GetFuncName
PyEval_GetGlobals
PyEval_GetLocals
PyEval_GetRestricted
PyEval_InitThreads
PyEval_MergeCompilerFlags
PyEval_ReInitThreads
PyEval_ReleaseLock
PyEval_ReleaseThread
PyEval_RestoreThread
PyEval_SaveThread
PyEval_SetProfile
PyEval_SetTrace
PyEval_ThreadsInitialized
PyExc_ArithmeticError
PyExc_AssertionError
PyExc_AttributeError
PyExc_BaseException
PyExc_BlockingIOError
PyExc_BufferError
PyExc_BytesWarning
PyExc_DeprecationWarning
PyExc_EOFError
PyExc_EnvironmentError
PyExc_Exception
PyExc_FloatingPointError
PyExc_FutureWarning
PyExc_GeneratorExit
PyExc_IOError
PyExc_ImportError
PyExc_ImportWarning
PyExc_IndentationError
PyExc_IndexError
PyExc_KeyError
PyExc_KeyboardInterrupt
PyExc_LookupError
PyExc_MemoryError
PyExc_MemoryErrorInst
PyExc_NameError
PyExc_NotImplementedError
PyExc_OSError
PyExc_OverflowError
PyExc_PendingDeprecationWarning
PyExc_RecursionErrorInst
PyExc_ReferenceError
PyExc_RuntimeError
PyExc_RuntimeWarning
PyExc_StandardError
PyExc_StopIteration
PyExc_SyntaxError
PyExc_SyntaxWarning
PyExc_SystemError
PyExc_SystemExit
PyExc_TabError
PyExc_TypeError
PyExc_UnboundLocalError
PyExc_UnicodeDecodeError
PyExc_UnicodeEncodeError
PyExc_UnicodeError
PyExc_UnicodeTranslateError
PyExc_UnicodeWarning
PyExc_UserWarning
PyExc_ValueError
PyExc_Warning
PyExc_WindowsError
PyExc_ZeroDivisionError
PyFile_AsFile
PyFile_DecUseCount
PyFile_FromFile
PyFile_FromString
PyFile_GetLine
PyFile_IncUseCount
PyFile_Name
PyFile_SetBufSize
PyFile_SetEncoding
PyFile_SetEncodingAndErrors
PyFile_SoftSpace
PyFile_Type
PyFile_WriteObject
PyFile_WriteString
PyFloat_AsDouble
PyFloat_AsReprString
PyFloat_AsString
PyFloat_ClearFreeList
PyFloat_Fini
PyFloat_FromDouble
PyFloat_FromString
PyFloat_GetInfo
PyFloat_GetMax
PyFloat_GetMin
PyFloat_Type
PyFrame_BlockPop
PyFrame_BlockSetup
PyFrame_ClearFreeList
PyFrame_FastToLocals
PyFrame_Fini
PyFrame_GetLineNumber
PyFrame_LocalsToFast
PyFrame_New
PyFrame_Type
PyFrozenSet_New
PyFrozenSet_Type
PyFunction_GetClosure
PyFunction_GetCode
PyFunction_GetDefaults
PyFunction_GetGlobals
PyFunction_GetModule
PyFunction_New
PyFunction_SetClosure
PyFunction_SetDefaults
PyFunction_Type
PyFuture_FromAST
PyGC_Collect
PyGILState_Ensure
PyGILState_GetThisThreadState
PyGILState_Release
PyGen_NeedsFinalizing
PyGen_New
PyGen_Type
PyGetSetDescr_Type
PyImport_AddModule
PyImport_AppendInittab
PyImport_Cleanup
PyImport_ExecCodeModule
PyImport_ExecCodeModuleEx
PyImport_ExtendInittab
PyImport_FrozenModules
PyImport_GetImporter
PyImport_GetMagicNumber
PyImport_GetModuleDict
PyImport_Import
PyImport_ImportFrozenModule
PyImport_ImportModule
PyImport_ImportModuleLevel
PyImport_ImportModuleNoBlock
PyImport_Inittab
PyImport_ReloadModule
PyInstance_New
PyInstance_NewRaw
PyInstance_Type
PyInt_AsLong
PyInt_AsSsize_t
PyInt_AsUnsignedLongLongMask
PyInt_AsUnsignedLongMask
PyInt_ClearFreeList
PyInt_Fini
PyInt_FromLong
PyInt_FromSize_t
PyInt_FromSsize_t
PyInt_FromString
PyInt_FromUnicode
PyInt_GetMax
PyInt_Type
PyInterpreterState_Clear
PyInterpreterState_Delete
PyInterpreterState_Head
PyInterpreterState_New
PyInterpreterState_Next
PyInterpreterState_ThreadHead
PyIter_Next
PyList_Append
PyList_AsTuple
PyList_Fini
PyList_GetItem
PyList_GetSlice
PyList_Insert
PyList_New
PyList_Reverse
PyList_SetItem
PyList_SetSlice
PyList_Size
PyList_Sort
PyList_Type
PyLong_AsDouble
PyLong_AsLong
PyLong_AsLongAndOverflow
PyLong_AsLongLong
PyLong_AsLongLongAndOverflow
PyLong_AsSsize_t
PyLong_AsUnsignedLong
PyLong_AsUnsignedLongLong
PyLong_AsUnsignedLongLongMask
PyLong_AsUnsignedLongMask
PyLong_AsVoidPtr
PyLong_FromDouble
PyLong_FromLong
PyLong_FromLongLong
PyLong_FromSize_t
PyLong_FromSsize_t
PyLong_FromString
PyLong_FromUnicode
PyLong_FromUnsignedLong
PyLong_FromUnsignedLongLong
PyLong_FromVoidPtr
PyLong_GetInfo
PyLong_Type
PyMapping_Check
PyMapping_GetItemString
PyMapping_HasKey
PyMapping_HasKeyString
PyMapping_Length
PyMapping_SetItemString
PyMapping_Size
PyMarshal_ReadLastObjectFromFile
PyMarshal_ReadLongFromFile
PyMarshal_ReadObjectFromFile
PyMarshal_ReadObjectFromString
PyMarshal_ReadShortFromFile
PyMarshal_WriteLongToFile
PyMarshal_WriteObjectToFile
PyMarshal_WriteObjectToString
PyMem_Free
PyMem_Malloc
PyMem_Realloc
PyMemberDescr_Type
PyMember_Get
PyMember_GetOne
PyMember_Set
PyMember_SetOne
PyMemoryView_FromBuffer
PyMemoryView_FromObject
PyMemoryView_GetContiguous
PyMemoryView_Type
PyMethod_Class
PyMethod_ClearFreeList
PyMethod_Fini
PyMethod_Function
PyMethod_New
PyMethod_Self
PyMethod_Type
PyModule_AddIntConstant
PyModule_AddObject
PyModule_AddStringConstant
PyModule_GetDict
PyModule_GetFilename
PyModule_GetName
PyModule_New
PyModule_Type
PyNode_AddChild
PyNode_Compile
PyNode_Free
PyNode_New
PyNullImporter_Type
PyNumber_Absolute
PyNumber_Add
PyNumber_And
PyNumber_AsSsize_t
PyNumber_Check
PyNumber_Coerce
PyNumber_CoerceEx
PyNumber_Divide
PyNumber_Divmod
PyNumber_Float
PyNumber_FloorDivide
PyNumber_InPlaceAdd
PyNumber_InPlaceAnd
PyNumber_InPlaceDivide
PyNumber_InPlaceFloorDivide
PyNumber_InPlaceLshift
PyNumber_InPlaceMultiply
PyNumber_InPlaceOr
PyNumber_InPlacePower
PyNumber_InPlaceRemainder
PyNumber_InPlaceRshift
PyNumber_InPlaceSubtract
PyNumber_InPlaceTrueDivide
PyNumber_InPlaceXor
PyNumber_Index
PyNumber_Int
PyNumber_Invert
PyNumber_Long
PyNumber_Lshift
PyNumber_Multiply
PyNumber_Negative
PyNumber_Or
PyNumber_Positive
PyNumber_Power
PyNumber_Remainder
PyNumber_Rshift
PyNumber_Subtract
PyNumber_ToBase
PyNumber_TrueDivide
PyNumber_Xor
PyOS_AfterFork
PyOS_CheckStack
PyOS_FiniInterrupts
PyOS_InitInterrupts
PyOS_InputHook
PyOS_InterruptOccurred
PyOS_Readline
PyOS_ReadlineFunctionPointer
PyOS_ascii_atof
PyOS_ascii_formatd
PyOS_ascii_strtod
PyOS_double_to_string
PyOS_getsig
PyOS_setsig
PyOS_snprintf
PyOS_string_to_double
PyOS_strtol
PyOS_strtoul
PyOS_vsnprintf
PyObject_AsCharBuffer
PyObject_AsFileDescriptor
PyObject_AsReadBuffer
PyObject_AsWriteBuffer
PyObject_Call
PyObject_CallFunction

Sections

.text
Size: 5.2MB - Virtual size: 5.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 515KB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data1
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 263KB - Virtual size: 263KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fff324694729cb520ca5d732d57babb4

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

winmm

d3d8

iphlpapi

imm32

version

devil

granny2

mss32

dinput8

ws2_32

ddraw

oleaut32

Exports

Exports

Sections

.text Size: 5.2MB - Virtual size: 5.2MB

.rdata Size: 1.5MB - Virtual size: 1.5MB

.data Size: 515KB - Virtual size: 1.0MB

.data1 Size: 2KB - Virtual size: 2KB

.rsrc Size: 45KB - Virtual size: 44KB

.reloc Size: 263KB - Virtual size: 263KB

.text
Size: 5.2MB - Virtual size: 5.2MB

.rdata
Size: 1.5MB - Virtual size: 1.5MB

.data
Size: 515KB - Virtual size: 1.0MB

.data1
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 45KB - Virtual size: 44KB

.reloc
Size: 263KB - Virtual size: 263KB