Static task
static1
Behavioral task
behavioral1
Sample
d2eedc8da405623c884e67542f702639ecc8a2de94a0cb7f9e3161994ab8474d.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
d2eedc8da405623c884e67542f702639ecc8a2de94a0cb7f9e3161994ab8474d.exe
Resource
win10v2004-20230703-en
General
-
Target
d2eedc8da405623c884e67542f702639ecc8a2de94a0cb7f9e3161994ab8474d
-
Size
3.0MB
-
MD5
dadcda34eca2298f4b891c8bcc2121cd
-
SHA1
bf5933e02cdbe411f9a2f83566aec2c0462a7bd4
-
SHA256
d2eedc8da405623c884e67542f702639ecc8a2de94a0cb7f9e3161994ab8474d
-
SHA512
76745c96e6405223b12abd822b1a75dc59466a2ee6aa32c6aca3a8d0b940408c637dfe34c2e2b7f4b7edebf09df62ad6065230a75d4969ee20b984723e531319
-
SSDEEP
49152:aMJsuJlEnP1by4NNpSCNWgx0pTL87owJ5ga/FmbZq6iviCW:aMJDEdbyQvSCNWgx0pTLWT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d2eedc8da405623c884e67542f702639ecc8a2de94a0cb7f9e3161994ab8474d
Files
-
d2eedc8da405623c884e67542f702639ecc8a2de94a0cb7f9e3161994ab8474d.exe windows x86
62a973cc7fba9702ae044ba73040b3bc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
runikanticheat
ult_041x7130C
ult_C16x29BF2
ult_0x0459y7x
ult_0xAL0X2FB
ult_95341273
ult_094x2429C
ult_U93H29RY1
kernel32
GetExitCodeThread
SleepConditionVariableSRW
SleepConditionVariableCS
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
TryEnterCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
GlobalAlloc
CreateDirectoryA
CreateFileA
GetFileSize
MapViewOfFile
GlobalFree
GetModuleFileNameA
DeleteFileA
GetPrivateProfileStringA
lstrlenA
GetCurrentDirectoryA
MoveFileA
LoadLibraryA
GetModuleHandleA
GetProcAddress
TerminateProcess
FindClose
FindNextFileA
FindFirstFileA
SetFileAttributesA
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
WaitForSingleObject
SetEvent
Sleep
WriteConsoleW
SetEndOfFile
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
HeapReAlloc
CreateProcessW
GetExitCodeProcess
SetStdHandle
GetTimeZoneInformation
GetFileAttributesExW
FlushFileBuffers
CreateDirectoryW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
ReadConsoleW
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
HeapFree
HeapAlloc
GetStdHandle
GetFullPathNameW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetFileType
GetFileInformationByHandle
GetDriveTypeW
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InterlockedPushEntrySList
RaiseException
RtlUnwind
QueryPerformanceFrequency
HeapSize
GetSystemInfo
GetLastError
ReadProcessMemory
GetCurrentProcess
Module32Next
CloseHandle
Module32First
GetCurrentProcessId
CreateToolhelp32Snapshot
GetTickCount
GetCurrentDirectoryW
MultiByteToWideChar
UnmapViewOfFile
SetLastError
GetModuleFileNameW
WaitNamedPipeW
PeekNamedPipe
GetSystemTimeAsFileTime
GetCurrentThreadId
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
UnhandledExceptionFilter
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
InitializeCriticalSectionAndSpinCount
GetCPInfo
LCMapStringEx
InitializeCriticalSectionEx
DecodePointer
EncodePointer
GetStringTypeW
CreateFileW
IsProcessorFeaturePresent
GetProcessHeap
HeapValidate
QueryPerformanceCounter
ReleaseSemaphore
GetLocaleInfoA
CompareStringA
WideCharToMultiByte
lstrlenW
GlobalLock
GlobalUnlock
FreeLibrary
GetVersionExA
GetSystemDirectoryA
WriteFile
ReadFile
OutputDebugStringA
WinExec
GetCurrentThread
SetUnhandledExceptionFilter
CreateFileMappingA
user32
ShowWindow
GetCapture
MessageBoxA
GetSystemMetrics
wvsprintfA
DefWindowProcA
LoadCursorA
RegisterClassExA
CreateWindowExA
UpdateWindow
GetMessageA
TranslateMessage
DispatchMessageA
DestroyWindow
UnregisterClassA
SetWindowLongA
GetWindowLongA
LoadStringA
PeekMessageA
ClientToScreen
GetClientRect
OffsetRect
SetRect
GetAsyncKeyState
PostQuitMessage
GetCursorPos
CharPrevExA
CharNextExA
CharNextW
GetClipboardData
CloseClipboard
OpenClipboard
GetKeyboardLayout
GetKeyboardLayoutNameA
IsWindow
MoveWindow
SetFocus
RegisterClassA
GetMenu
SetWindowTextA
AdjustWindowRectEx
ChangeDisplaySettingsA
ReleaseCapture
ReleaseDC
FillRect
GetDC
ScreenToClient
InvalidateRect
FindWindowA
LoadIconA
SetWindowPos
SystemParametersInfoA
FlashWindowEx
GetKeyState
LoadImageA
DestroyCursor
ShowCursor
SetCursor
SetCursorPos
SetCapture
gdi32
CreateDIBSection
SetBkMode
SetTextColor
SetBkColor
GetTextExtentPoint32W
GetCharABCWidthsFloatW
GetStockObject
DeleteDC
SelectObject
CreateCompatibleDC
StretchBlt
DeleteObject
CreateSolidBrush
CreateFontIndirectA
EnumFontFamiliesExA
TextOutA
GetTextExtentPoint32A
TextOutW
shell32
ShellExecuteA
SHGetSpecialFolderPathA
ole32
CoUninitialize
CoInitialize
CoInitializeEx
OleSetContainedObject
OleUninitialize
OleInitialize
CoGetClassObject
CoCreateInstance
winmm
timeGetTime
timeEndPeriod
timeGetDevCaps
timeBeginPeriod
d3d8
Direct3DCreate8
python27
PyTuple_Size
PyDict_GetItemString
PyLong_AsLong
PyArg_ParseTuple
PyDict_Size
PyDict_Next
PyString_InternFromString
Py_BuildValue
Py_InitModule4
_PyThreadState_Current
PyString_AsString
PyObject_GetAttrString
PyObject_GetAttr
PyCallable_Check
PyFloat_AsDouble
PyErr_Clear
PyErr_BadArgument
PyErr_Print
PyFrame_GetLineNumber
PyModule_AddIntConstant
PyList_Append
PyString_FromString
PyList_New
PyObject_CallObject
PyNumber_Check
_Py_NoneStruct
PyInt_AsLong
PyModule_GetDict
PyErr_Fetch
Py_SetProgramName
Py_Initialize
Py_Finalize
PyRun_StringFlags
PyImport_AddModule
PyImport_ImportModule
PyTuple_GetItem
PyExc_RuntimeError
PyDict_SetItemString
PyErr_SetString
iphlpapi
GetAdaptersInfo
imm32
ImmGetOpenStatus
ImmSetConversionStatus
ImmGetConversionStatus
ImmGetCandidateListW
ImmSetCompositionStringW
ImmGetCompositionStringW
ImmAssociateContext
ImmReleaseContext
ImmGetContext
ImmIsIME
ImmGetIMEFileNameA
ImmNotifyIME
devil
ilBindImage
ilGenImages
ilEnable
ilOriginFunc
ilInit
ilSetPixels
ilTexImage
ilSave
ilShutDown
ilDeleteImages
ilLoad
ilCopyPixels
ilConvertImage
ilGetInteger
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
imagehlp
StackWalk
EnumerateLoadedModules
GetTimestampForLoadedLibrary
granny2
_GrannyCompleteControlAt@8
_GrannyFreeControlOnceUnused@4
_GrannyFreeControl@4
_GrannyGetMeshIndexCount@4
_GrannyMeshIsRigid@4
_GrannyGetMeshVertexCount@4
_GrannyGetTotalTypeSize@4
_GrannyGetWorldPoseComposite4x4@8
_GrannyGetWorldPose4x4@8
_GrannyFreeWorldPose@4
_GrannyNewWorldPose@4
_GrannyGetControlLoopCount@4
_GrannyGetMeshBindingToBoneIndices@4
_GrannyFreeMeshBinding@4
_GrannyNewMeshBinding@12
_GrannyFreeModelInstance@4
_GrannyInstantiateModel@4
_GrannyGetWorldPoseComposite4x4Array@4
_GrannyFreeLocalPose@4
_GrannyNewLocalPose@4
_GrannyUpdateModelMatrix@20
_GrannySampleModelAnimationsAccelerated@20
_GrannyFreeCompletedModelControls@4
_GrannySetControlLoopCount@8
_GrannyGetSourceSkeleton@4
_GrannyControlIsComplete@4
_GrannyFreeFile@4
_GrannyFreeFileSection@8
_GrannyReadEntireFileFromMemory@8
_GrannyConvertSingleObject@20
_GrannyFindMatchingMember@16
_GrannyGetMaterialTextureByType@8
_GrannyGetControlSpeed@4
_GrannySetControlSpeed@8
_GrannyGetControlLocalDuration@4
_GrannySetControlEaseIn@8
_GrannySetControlEaseInCurve@28
_GrannySetControlEaseOut@8
_GrannySetControlEaseOutCurve@28
_GrannyGetControlRawLocalClock@4
_GrannySetControlRawLocalClock@8
_GrannyPlayControlledAnimation@12
_GrannyGetMeshTriangleGroupCount@4
_GrannyGetMeshTriangleGroups@4
_GrannyGetMeshVertexType@4
_GrannyCopyMeshVertices@12
_GrannyGetMeshVertices@4
_GrannyCopyMeshIndices@12
_GrannyNewMeshDeformer@16
_GrannyFreeMeshDeformer@4
_GrannyDeformVertices@24
GrannyPNT332VertexType
_GrannyGetFileInfo@4
_GrannyFreeControlIfComplete@4
_GrannyFindBoneByName@12
_GrannySetModelClock@8
mss32
_AIL_mem_free_lock@4
_AIL_file_read@8
_AIL_set_file_callbacks@16
_AIL_WAV_info@8
_AIL_decompress_ASI@24
_AIL_decompress_ADPCM@12
_AIL_file_type@8
_AIL_open_digital_driver@16
_AIL_auto_update_3D_position@8
_AIL_3D_sample_volume@4
_AIL_3D_sample_status@4
_AIL_set_3D_sample_loop_count@8
_AIL_set_3D_sample_volume@8
_AIL_set_3D_sample_file@8
_AIL_end_3D_sample@4
_AIL_resume_3D_sample@4
_AIL_stop_3D_sample@4
_AIL_start_3D_sample@4
_AIL_release_3D_sample_handle@4
_AIL_allocate_3D_sample_handle@4
_AIL_sample_volume_pan@12
_AIL_sample_status@4
_AIL_close_digital_driver@4
_AIL_set_sample_volume_pan@12
_AIL_end_sample@4
_AIL_resume_sample@4
_AIL_open_stream@12
_AIL_start_sample@4
_AIL_set_sample_file@12
_AIL_init_sample@4
_AIL_release_sample_handle@4
_AIL_allocate_sample_handle@4
_AIL_last_error@0
_AIL_stream_status@4
_AIL_set_stream_loop_count@8
_AIL_stream_volume_levels@12
_AIL_set_stream_volume_levels@12
_AIL_pause_stream@8
_AIL_start_stream@4
_AIL_close_stream@4
_AIL_set_redist_directory@4
_AIL_shutdown@0
_AIL_startup@0
_AIL_set_3D_orientation@28
_AIL_set_3D_velocity@20
_AIL_set_3D_position@16
_AIL_close_3D_listener@4
_AIL_open_3D_listener@4
_AIL_close_3D_provider@4
_AIL_open_3D_provider@4
_AIL_enumerate_3D_providers@12
_AIL_set_sample_loop_count@8
_AIL_stop_sample@4
speedtreert
?GetCurrentError@CSpeedTreeRT@@SAPBDXZ
?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z
?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z
?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z
?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ
?SetLodLimits@CSpeedTreeRT@@QAEXMM@Z
?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z
?SetLodLevel@CSpeedTreeRT@@QAEXM@Z
?ComputeLodLevel@CSpeedTreeRT@@QAEXXZ
?SetLocalMatrices@CSpeedTreeRT@@QAEXII@Z
?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z
?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z
?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z
?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ
?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ
?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z
?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z
?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ
?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z
?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ
?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z
??3CSpeedTreeRT@@SAXPAX@Z
??2CSpeedTreeRT@@SAPAXI@Z
??1CSpeedTreeRT@@QAE@XZ
??0CSpeedTreeRT@@QAE@XZ
??1STextures@CSpeedTreeRT@@QAE@XZ
?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z
?SetTime@CSpeedTreeRT@@SAXM@Z
?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z
??1SGeometry@CSpeedTreeRT@@QAE@XZ
?SetLightState@CSpeedTreeRT@@SAXI_N@Z
?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z
?SetCamera@CSpeedTreeRT@@SAXPBM0@Z
??0SGeometry@CSpeedTreeRT@@QAE@XZ
??0STextures@CSpeedTreeRT@@QAE@XZ
dinput8
DirectInput8Create
ws2_32
htons
inet_addr
__WSAFDIsSet
closesocket
connect
recv
select
send
gethostbyname
sendto
ioctlsocket
socket
WSAGetLastError
WSAStartup
WSACleanup
ddraw
DirectDrawCreate
advapi32
RegSetValueExW
CryptGenRandom
RegOpenKeyExA
RegQueryValueExA
CryptReleaseContext
CryptAcquireContextA
RegCreateKeyExW
RegCloseKey
RegOpenKeyA
oleaut32
SysAllocString
VariantInit
VariantClear
SysFreeString
Sections
.text Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 439KB - Virtual size: 439KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 185KB - Virtual size: 674KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 45KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 123KB - Virtual size: 122KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ