?init_lalacare@@YAXXZ
Static task
static1
Behavioral task
behavioral1
Sample
ac1208f5ca7dcf832c8058ce6410d75e7734b315e0d31087631a7a96f390f32f.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
ac1208f5ca7dcf832c8058ce6410d75e7734b315e0d31087631a7a96f390f32f.exe
Resource
win10v2004-20230703-en
General
-
Target
ac1208f5ca7dcf832c8058ce6410d75e7734b315e0d31087631a7a96f390f32f
-
Size
5.3MB
-
MD5
c6d8d67a88bde1bb50a31a7272637a8c
-
SHA1
2a00a4d82d1c52dc7f2039e3d8ab19ae0e15a83e
-
SHA256
ac1208f5ca7dcf832c8058ce6410d75e7734b315e0d31087631a7a96f390f32f
-
SHA512
1ed3bb554196a95194e1aece3ccf8be7a3ea3d6f77c255c8dab1c11a6e561a6d1e46b09f411513c8c611d891f81c2e8dc229c81388d5abd15996f411e8046804
-
SSDEEP
98304:+KZler6mLvJqm6HKjMvHfezFRGBZzfVYsQ:VYrdDJqmueiC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ac1208f5ca7dcf832c8058ce6410d75e7734b315e0d31087631a7a96f390f32f
Files
-
ac1208f5ca7dcf832c8058ce6410d75e7734b315e0d31087631a7a96f390f32f.exe windows x86
0c75cc5e11c4adaea763feb87d77ed8d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SleepConditionVariableSRW
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
GetNativeSystemInfo
GetExitCodeThread
SwitchToThread
SubmitThreadpoolWork
CloseThreadpoolWork
CreateThreadpoolTimer
SetThreadpoolTimer
SetFileInformationByHandle
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
GetFileInformationByHandleEx
CreateSymbolicLinkW
MoveFileA
GetPrivateProfileStringA
lstrlenA
GlobalFree
LoadLibraryW
GetProcAddress
GetModuleFileNameA
CreateMutexA
ReleaseMutex
RemoveVectoredExceptionHandler
AddVectoredExceptionHandler
DeleteFileA
GetCurrentDirectoryA
GetTickCount
GetCurrentDirectoryW
GetModuleHandleA
VirtualProtect
ReadProcessMemory
GetCurrentProcessId
GetCurrentProcess
GetSystemFirmwareTable
IsProcessorFeaturePresent
ExitProcess
GetLastError
FindNextFileA
FindFirstFileA
WriteConsoleW
SetEndOfFile
HeapQueryInformation
FlsAlloc
OutputDebugStringW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
SetStdHandle
DeleteFileW
SetFileAttributesW
SetCurrentDirectoryW
GetTimeZoneInformation
CreateDirectoryW
GetFileSizeEx
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
HeapReAlloc
GetFileAttributesExW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
FindClose
CompareStringW
GetTimeFormatW
GetDateFormatW
GetTempPathW
HeapAlloc
HeapFree
GetStdHandle
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetFileType
GetFileInformationByHandle
GetFullPathNameW
GetDriveTypeW
SetConsoleCtrlHandler
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InterlockedFlushSList
FlsGetValue
FlsSetValue
FlsFree
InitOnceExecuteOnce
CreateThreadpoolWork
SleepConditionVariableCS
CreateEventExW
CreateSemaphoreExW
FlushProcessWriteBuffers
GetCurrentProcessorNumber
GetTickCount64
FreeLibraryWhenCallbackReturns
HeapSize
InterlockedPushEntrySList
RtlUnwind
RaiseException
GetThreadTimes
MultiByteToWideChar
SetFileAttributesA
Module32Next
Module32First
Process32Next
Process32First
CreateToolhelp32Snapshot
GetSystemInfo
OpenProcess
SetThreadPriority
Sleep
CreateEventA
WaitForSingleObject
SetEvent
DeleteCriticalSection
QueryPerformanceFrequency
SetFilePointerEx
LoadLibraryExW
LoadLibraryExA
VirtualQuery
VirtualFree
VirtualAlloc
FlushInstructionCache
SetThreadContext
GetThreadContext
SuspendThread
GetCurrentThread
WriteProcessMemory
VirtualProtectEx
VirtualAllocEx
CreateProcessW
CreateProcessA
ResumeThread
GetExitCodeProcess
SetLastError
GetEnvironmentVariableW
GetEnvironmentVariableA
K32EnumProcesses
Process32NextW
Process32FirstW
QueryFullProcessImageNameW
VirtualQueryEx
WaitNamedPipeW
PeekNamedPipe
GetModuleFileNameW
GetSystemTimeAsFileTime
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
TerminateProcess
UnhandledExceptionFilter
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
InitializeCriticalSectionAndSpinCount
FindResourceW
FindResourceA
SizeofResource
LoadResource
LockResource
CreateFileW
InterlockedDecrement
GetProcessHeap
HeapValidate
InterlockedIncrement
GetCPInfo
CompareStringEx
LCMapStringEx
DecodePointer
EncodePointer
InitializeCriticalSectionEx
GetStringTypeW
GetLocaleInfoEx
FormatMessageA
LocalFree
QueryPerformanceCounter
CopyFileA
CreateSemaphoreA
ReleaseSemaphore
GetLocaleInfoA
CompareStringA
WideCharToMultiByte
lstrlenW
GlobalLock
GlobalUnlock
FreeLibrary
GetVersionExA
GetSystemDirectoryA
WriteFile
SetFilePointer
ReadFile
LoadLibraryA
GetCurrentThreadId
SetUnhandledExceptionFilter
GetFileSize
CreateFileA
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
OutputDebugStringA
GetTempFileNameA
GetTempPathA
RemoveDirectoryA
CreateDirectoryA
AllocConsole
GlobalAlloc
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
LCMapStringW
CloseHandle
user32
SetCursor
ShowCursor
GetKeyState
DestroyCursor
LoadImageA
ClientToScreen
ShowWindow
UnregisterClassA
RegisterClassExA
CreateWindowExA
IsWindow
DestroyWindow
MoveWindow
SetFocus
UpdateWindow
GetWindowLongA
SetWindowLongA
CharNextExA
CharPrevExA
RegisterClassA
GetMenu
SetWindowTextA
GetWindowRect
AdjustWindowRectEx
LoadCursorA
GetMessageA
GetCapture
SetCapture
TranslateMessage
DispatchMessageA
ReleaseCapture
ChangeDisplaySettingsA
GetSystemMetrics
PeekMessageA
GetDC
ReleaseDC
BeginPaint
EndPaint
InvalidateRect
GetClientRect
FillRect
SetRect
OffsetRect
LoadStringA
MessageBoxA
DefWindowProcA
SystemParametersInfoA
LoadIconA
FindWindowA
ScreenToClient
GetCursorPos
GetAsyncKeyState
SetWindowPos
SendMessageA
PostQuitMessage
SetCursorPos
GetKeyboardLayoutNameA
GetKeyboardLayout
OpenClipboard
CloseClipboard
GetClipboardData
CharNextW
DefWindowProcW
gdi32
GetStockObject
CreateDIBSection
SetDIBitsToDevice
SetBkMode
DeleteDC
CreateCompatibleDC
TextOutA
SetTextColor
EnumFontFamiliesExA
SelectObject
GetTextExtentPoint32W
GetCharABCWidthsFloatW
CreateFontIndirectA
TextOutW
GetTextExtentPoint32A
SetBkColor
StretchBlt
PatBlt
DeleteObject
CreateSolidBrush
advapi32
RegCloseKey
RegDeleteValueW
RegQueryValueExA
RegOpenKeyA
RegOpenKeyExW
RegSetValueExW
RegGetValueW
RegCreateKeyExW
RegQueryValueExW
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
LookupPrivilegeValueW
PrivilegeCheck
AdjustTokenPrivileges
OpenProcessToken
RegOpenKeyExA
ole32
CoInitializeEx
OleSetContainedObject
OleUninitialize
OleInitialize
CoGetClassObject
CoUninitialize
CoInitialize
CoCreateInstance
winmm
timeBeginPeriod
timeGetDevCaps
timeGetTime
timeEndPeriod
d3d8
Direct3DCreate8
python27
PyList_New
PyDict_GetItemString
_Py_EllipsisObject
PyTuple_Size
PyLong_AsLong
Py_InitModule4
PyModule_AddIntConstant
Py_BuildValue
_PyLong_New
PyMarshal_ReadObjectFromString
PyCode_New
PyEval_GetRestricted
PyErr_NoMemory
PyErr_Occurred
PyTuple_New
PyList_SetItem
PyList_Append
PyInt_FromLong
PyList_Size
PyString_FromStringAndSize
PyComplex_FromCComplex
PyList_GetItem
PyInt_AsLong
PyDict_Next
PyExc_StopIteration
PyExc_EOFError
PyFloat_FromDouble
_PyLong_FromByteArray
PyUnicodeUCS2_DecodeUTF8
PyCode_Type
Py_OptimizeFlag
PyEval_EvalCode
PyCode_Addr2Line
PyObject_AsCharBuffer
PyImport_AddModule
PyImport_GetMagicNumber
Py_FlushLine
PyEval_SetTrace
PyRun_StringFlags
PyDict_Size
PyErr_SetString
PyExc_RuntimeError
PyString_FromString
PyArg_ParseTuple
PyDict_New
PyDict_SetItem
PyModule_AddStringConstant
PyImport_ImportModule
PyString_InternFromString
PyObject_GetAttrString
PyObject_GetAttr
PyCallable_Check
PyLong_AsLongLong
PyLong_AsUnsignedLongLong
PyFloat_AsDouble
PyExc_ValueError
PyString_AsString
PyErr_Clear
PyErr_BadArgument
PyErr_Print
PyObject_CallObject
PyNumber_Check
_Py_NoneStruct
PyDict_SetItemString
PyModule_GetDict
PyErr_Fetch
Py_SetProgramName
Py_Initialize
PyTuple_GetItem
Py_Finalize
imm32
ImmNotifyIME
ImmGetOpenStatus
ImmSetConversionStatus
ImmGetConversionStatus
ImmGetCandidateListW
ImmSetCompositionStringW
ImmGetCompositionStringW
ImmReleaseContext
ImmGetContext
ImmIsIME
ImmGetIMEFileNameA
ImmAssociateContext
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
devil
ilInit
ilTexImage
ilSetPixels
ilSave
ilShutDown
ilOriginFunc
ilEnable
ilCopyPixels
ilConvertImage
ilLoad
ilGetInteger
ilGenImages
ilBindImage
ilDeleteImages
granny2
_GrannyGetWorldPoseComposite4x4@8
_GrannyGetWorldPose4x4@8
_GrannyFreeWorldPose@4
_GrannyNewWorldPose@4
_GrannyFindBoneByName@12
_GrannyGetMeshBindingToBoneIndices@4
_GrannyFreeMeshBinding@4
_GrannyNewMeshBinding@12
_GrannyFreeModelInstance@4
_GrannyInstantiateModel@4
_GrannyGetWorldPoseComposite4x4Array@4
_GrannyFreeLocalPose@4
_GrannyGetTotalTypeSize@4
_GrannyUpdateModelMatrix@20
_GrannySampleModelAnimationsAccelerated@20
_GrannyFreeCompletedModelControls@4
_GrannySetModelClock@8
_GrannyGetSourceSkeleton@4
_GrannyGetFileInfo@4
_GrannyFreeFile@4
_GrannyFreeFileSection@8
_GrannyReadEntireFileFromMemory@8
_GrannyConvertSingleObject@20
_GrannyFindMatchingMember@16
_GrannyGetMaterialTextureByType@8
_GrannySetLogCallback@4
_GrannyGetMeshVertexCount@4
_GrannyMeshIsRigid@4
_GrannyGetMeshIndexCount@4
_GrannyFreeControl@4
_GrannyFreeControlOnceUnused@4
_GrannyCompleteControlAt@8
_GrannyControlIsComplete@4
_GrannyFreeControlIfComplete@4
_GrannyGetControlLoopCount@4
_GrannySetControlLoopCount@8
_GrannyGetControlSpeed@4
_GrannySetControlSpeed@8
_GrannyGetControlLocalDuration@4
_GrannySetControlEaseIn@8
_GrannySetControlEaseInCurve@28
_GrannySetControlEaseOut@8
_GrannySetControlEaseOutCurve@28
_GrannyGetControlRawLocalClock@4
_GrannySetControlRawLocalClock@8
_GrannyPlayControlledAnimation@12
_GrannyGetMeshTriangleGroupCount@4
_GrannyGetMeshTriangleGroups@4
_GrannyGetMeshVertexType@4
_GrannyCopyMeshVertices@12
_GrannyGetMeshVertices@4
_GrannyCopyMeshIndices@12
_GrannyNewMeshDeformer@16
_GrannyFreeMeshDeformer@4
_GrannyDeformVertices@24
GrannyPNT332VertexType
_GrannyNewLocalPose@4
mss32
_AIL_release_3D_sample_handle@4
_AIL_start_3D_sample@4
_AIL_stop_3D_sample@4
_AIL_resume_3D_sample@4
_AIL_end_3D_sample@4
_AIL_set_3D_sample_file@8
_AIL_set_3D_sample_volume@8
_AIL_set_3D_sample_loop_count@8
_AIL_3D_sample_status@4
_AIL_3D_sample_volume@4
_AIL_update_3D_position@8
_AIL_auto_update_3D_position@8
_AIL_set_sample_loop_count@8
_AIL_set_sample_volume_pan@12
_AIL_end_sample@4
_AIL_resume_sample@4
_AIL_stop_sample@4
_AIL_start_sample@4
_AIL_set_sample_file@12
_AIL_init_sample@4
_AIL_release_sample_handle@4
_AIL_allocate_sample_handle@4
_AIL_last_error@0
_AIL_stream_status@4
_AIL_set_stream_loop_count@8
_AIL_stream_volume_levels@12
_AIL_set_stream_volume_levels@12
_AIL_pause_stream@8
_AIL_start_stream@4
_AIL_close_stream@4
_AIL_set_redist_directory@4
_AIL_shutdown@0
_AIL_startup@0
_AIL_set_3D_orientation@28
_AIL_set_3D_velocity@20
_AIL_set_3D_position@16
_AIL_close_3D_listener@4
_AIL_open_3D_listener@4
_AIL_close_3D_provider@4
_AIL_open_3D_provider@4
_AIL_enumerate_3D_providers@12
_AIL_close_digital_driver@4
_AIL_open_stream@12
_AIL_open_digital_driver@16
_AIL_file_type@8
_AIL_decompress_ADPCM@12
_AIL_decompress_ASI@24
_AIL_WAV_info@8
_AIL_set_file_callbacks@16
_AIL_file_read@8
_AIL_allocate_3D_sample_handle@4
_AIL_mem_free_lock@4
_AIL_sample_status@4
_AIL_sample_volume_pan@12
speedtreert
?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z
?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ
?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z
?GetCurrentError@CSpeedTreeRT@@SAPBDXZ
?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z
?SetTime@CSpeedTreeRT@@SAXM@Z
?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z
?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z
?SetLightState@CSpeedTreeRT@@SAXI_N@Z
?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z
?SetCamera@CSpeedTreeRT@@SAXPBM0@Z
??0SGeometry@CSpeedTreeRT@@QAE@XZ
?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z
??0STextures@CSpeedTreeRT@@QAE@XZ
??1STextures@CSpeedTreeRT@@QAE@XZ
??0CSpeedTreeRT@@QAE@XZ
??1CSpeedTreeRT@@QAE@XZ
??2CSpeedTreeRT@@SAPAXI@Z
??3CSpeedTreeRT@@SAXPAX@Z
?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z
?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ
?DeleteTransientData@CSpeedTreeRT@@QAEXXZ
?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z
?GetTreeSize@CSpeedTreeRT@@QBEXAAM0@Z
?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z
?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ
?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z
?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?GetLeafLightingAdjustment@CSpeedTreeRT@@QBEMXZ
?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ
?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z
?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z
?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetLocalMatrices@CSpeedTreeRT@@QAEXII@Z
?ComputeLodLevel@CSpeedTreeRT@@QAEXXZ
?SetLodLevel@CSpeedTreeRT@@QAEXM@Z
?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z
?SetLodLimits@CSpeedTreeRT@@QAEXMM@Z
?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ
?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z
??1SGeometry@CSpeedTreeRT@@QAE@XZ
dinput8
DirectInput8Create
ws2_32
WSACleanup
htonl
htons
inet_addr
WSAStartup
ntohs
gethostbyname
gethostname
__WSAFDIsSet
socket
WSAGetLastError
send
select
recv
connect
ioctlsocket
closesocket
ntohl
ddraw
DirectDrawCreate
wintrust
WinVerifyTrust
shell32
SHGetSpecialFolderPathA
oleaut32
SafeArrayDestroy
SysFreeString
SysAllocString
SafeArrayCreate
VariantInit
SafeArrayAccessData
VariantClear
Exports
Exports
Sections
.text Size: 4.0MB - Virtual size: 4.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 680KB - Virtual size: 680KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 191KB - Virtual size: 683KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.detourc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourd Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 223KB - Virtual size: 223KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 192KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ