Static task
static1
Behavioral task
behavioral1
Sample
a140fde4866b5a546e8afc7542948ba8fb0215858e1d818a47adf4dca769cd01.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
a140fde4866b5a546e8afc7542948ba8fb0215858e1d818a47adf4dca769cd01.exe
Resource
win10v2004-20230824-en
General
-
Target
a140fde4866b5a546e8afc7542948ba8fb0215858e1d818a47adf4dca769cd01
-
Size
3.8MB
-
MD5
a5a0e1fbb225f4c5776a8d0d5d8a7eb3
-
SHA1
6e5c4957c522d9f7d3f928d7d8496baa5f46c607
-
SHA256
a140fde4866b5a546e8afc7542948ba8fb0215858e1d818a47adf4dca769cd01
-
SHA512
ff006d24afbc66b6d408498ddff07e8a270ec0be8df609124b2f917471f8c70e88b9b75a2e4149d97696ed2040d19fc186a1955552a3da8537ca7c435681e2f1
-
SSDEEP
49152:K4UQe2UcZ+twWr1ToAAqOcycZ5VMOeV0fGRsy2BeLlyLKNO/J0shKBeay2uUjiIs:x8O2uGl0OE+EeYmnETO1kfxJru
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a140fde4866b5a546e8afc7542948ba8fb0215858e1d818a47adf4dca769cd01
Files
-
a140fde4866b5a546e8afc7542948ba8fb0215858e1d818a47adf4dca769cd01.exe windows x86
541dd0c927829ee84ea0aa1a379f610e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindNextFileA
FindFirstFileA
SetEndOfFile
HeapSize
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
HeapReAlloc
SetStdHandle
GetTimeZoneInformation
CreateProcessW
GetExitCodeProcess
GetFileAttributesExW
FlushFileBuffers
CreateDirectoryW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
SetFileAttributesA
GetModuleFileNameA
DeleteCriticalSection
GetSystemInfo
Process32Next
SetEvent
Sleep
WaitForSingleObject
GetLocalTime
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
ReadConsoleW
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
HeapAlloc
HeapFree
WriteConsoleW
GetStdHandle
GetFileType
GetModuleHandleA
FindClose
GetModuleHandleExW
LoadLibraryExW
TlsFree
TlsSetValue
InitializeCriticalSection
TlsAlloc
InterlockedPushEntrySList
RaiseException
RtlUnwind
SetLastError
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
TerminateProcess
UnhandledExceptionFilter
CreateEventW
WaitForSingleObjectEx
ResetEvent
InitializeCriticalSectionAndSpinCount
GetModuleFileNameW
CreateFileW
IsProcessorFeaturePresent
GetProcessHeap
HeapValidate
GetCPInfo
LCMapStringEx
DecodePointer
EncodePointer
GetModuleHandleW
ExitProcess
SetUnhandledExceptionFilter
GetProcAddress
MoveFileA
lstrlenA
GetCurrentDirectoryA
DeleteFileA
GlobalFree
GetPrivateProfileStringA
LeaveCriticalSection
EnterCriticalSection
GetCurrentProcessId
GetLastError
CreateToolhelp32Snapshot
GetCurrentProcess
GetTickCount
GetCurrentDirectoryW
MultiByteToWideChar
CreateProcessA
GetSystemTimeAsFileTime
QueryPerformanceFrequency
GetStringTypeW
TryEnterCriticalSection
InitializeCriticalSectionEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
QueryPerformanceCounter
ReleaseSemaphore
GetLocaleInfoA
CompareStringA
WideCharToMultiByte
lstrlenW
GlobalLock
GlobalUnlock
FreeLibrary
GetVersionExA
GetSystemDirectoryA
WriteFile
LoadLibraryA
GetCurrentThreadId
OutputDebugStringA
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
GetFileSize
CreateFileA
CreateDirectoryA
GlobalAlloc
CloseHandle
CreatePipe
SetHandleInformation
TlsGetValue
ReadFile
user32
GetWindow
GetKeyState
ShowCursor
MoveWindow
SetFocus
RegisterClassA
GetMenu
SetWindowTextA
GetWindowRect
AdjustWindowRectEx
GetKeyboardLayoutNameA
GetKeyboardLayout
OpenClipboard
CloseClipboard
GetClipboardData
CharNextW
CharNextExA
CharPrevExA
IsWindowVisible
SetWindowPos
ScreenToClient
GetWindowTextA
GetTopWindow
SendMessageA
LoadCursorA
LoadIconA
FlashWindowEx
SystemParametersInfoA
PostQuitMessage
GetWindowTextLengthA
FindWindowA
GetCursorPos
GetDC
FillRect
GetAsyncKeyState
OffsetRect
ClientToScreen
GetClientRect
PeekMessageA
SetRect
InvalidateRect
ReleaseDC
DispatchMessageA
GetMessageA
LoadStringA
DefWindowProcA
CreateWindowExA
TranslateMessage
UnregisterClassA
RegisterClassExA
SetCursor
IsWindow
DestroyWindow
SetWindowLongA
DestroyCursor
LoadImageA
SetCursorPos
ReleaseCapture
SetCapture
ChangeDisplaySettingsA
GetCapture
ShowWindow
MessageBoxA
GetSystemMetrics
UpdateWindow
GetWindowLongA
gdi32
SetBkColor
SetBkMode
CreateSolidBrush
SetTextColor
CreateDIBSection
TextOutA
CreateFontIndirectA
GetCharABCWidthsFloatW
GetTextExtentPoint32W
TextOutW
DeleteObject
StretchBlt
DeleteDC
GetStockObject
CreateCompatibleDC
SelectObject
GetTextExtentPoint32A
EnumFontFamiliesExA
ole32
OleUninitialize
OleInitialize
CoGetClassObject
OleSetContainedObject
CoUninitialize
CoInitialize
CoCreateInstance
CoInitializeEx
winmm
timeEndPeriod
timeGetTime
timeBeginPeriod
timeGetDevCaps
d3d8
Direct3DCreate8
python27
PyImport_AddModule
PyRun_StringFlags
Py_Finalize
Py_Initialize
Py_SetProgramName
PyModule_GetDict
Py_BuildValue
Py_InitModule4
PyExc_RuntimeError
PyErr_SetString
PyInt_AsLong
PyModule_AddIntConstant
PyString_FromString
PyTuple_GetItem
PyList_New
PyList_Append
PyLong_AsLong
PyTuple_Size
PyDict_GetItemString
PyArg_ParseTuple
PyTuple_New
PyDict_SetItemString
PyDict_New
PyTuple_SetItem
PyLong_FromLongLong
PyInt_FromLong
Py_IncRef
PyDict_Size
PyDict_Next
PyImport_ImportModule
PyModule_AddStringConstant
PyString_InternFromString
PyObject_GetAttrString
PyObject_GetAttr
PyCallable_Check
PyErr_Fetch
PyLong_AsLongLong
PyLong_AsUnsignedLongLong
PyFloat_AsDouble
PyString_AsString
PyErr_Clear
PyErr_BadArgument
PyErr_Print
PyObject_CallObject
PyNumber_Check
_Py_NoneStruct
iphlpapi
GetAdaptersInfo
imm32
ImmGetOpenStatus
ImmSetConversionStatus
ImmGetConversionStatus
ImmGetCandidateListW
ImmSetCompositionStringW
ImmGetCompositionStringW
ImmAssociateContext
ImmReleaseContext
ImmGetContext
ImmIsIME
ImmGetIMEFileNameA
ImmNotifyIME
devil
ilConvertImage
ilDeleteImages
ilEnable
ilInit
ilSave
ilSetPixels
ilTexImage
ilGenImages
ilLoad
ilCopyPixels
ilShutDown
ilGetInteger
ilBindImage
ilOriginFunc
shlwapi
PathFindFileNameA
version
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
granny2
_GrannyFreeWorldPose@4
_GrannyNewWorldPose@4
_GrannyFindBoneByName@12
_GrannyGetMeshBindingToBoneIndices@4
_GrannyFreeMeshBinding@4
_GrannyNewMeshBinding@12
_GrannyFreeModelInstance@4
_GrannyInstantiateModel@4
_GrannyGetWorldPoseComposite4x4Array@4
_GrannyFreeLocalPose@4
_GrannyNewLocalPose@4
_GrannyUpdateModelMatrix@20
_GrannySampleModelAnimationsAccelerated@20
_GrannyFreeCompletedModelControls@4
_GrannySetModelClock@8
_GrannyGetSourceSkeleton@4
_GrannyGetFileInfo@4
_GrannyFreeFile@4
_GrannyFreeFileSection@8
_GrannyReadEntireFileFromMemory@8
_GrannyConvertSingleObject@20
_GrannyFindMatchingMember@16
_GrannyGetMaterialTextureByType@8
_GrannySetLogCallback@4
_GrannyGetWorldPose4x4@8
_GrannyGetWorldPoseComposite4x4@8
_GrannyGetTotalTypeSize@4
_GrannyGetMeshVertexCount@4
_GrannyMeshIsRigid@4
_GrannyGetMeshIndexCount@4
_GrannyGetSourceModel@4
_GrannyFindTrackGroupForModel@12
_GrannyFreeControl@4
_GrannyFreeControlOnceUnused@4
_GrannyCompleteControlAt@8
_GrannyControlIsComplete@4
_GrannyFreeControlIfComplete@4
_GrannyGetControlLoopCount@4
_GrannySetControlLoopCount@8
_GrannyGetControlSpeed@4
_GrannySetControlSpeed@8
_GrannyGetControlLocalDuration@4
_GrannySetControlEaseIn@8
_GrannySetControlEaseInCurve@28
_GrannySetControlEaseOut@8
_GrannySetControlEaseOutCurve@28
_GrannyGetControlRawLocalClock@4
_GrannySetControlRawLocalClock@8
_GrannyPlayControlledAnimation@12
_GrannyBeginControlledAnimation@8
_GrannyEndControlledAnimation@4
_GrannySetTrackGroupTarget@12
GrannyPNT332VertexType
_GrannyDeformVertices@24
_GrannyFreeMeshDeformer@4
_GrannyNewMeshDeformer@16
_GrannyCopyMeshIndices@12
_GrannyGetMeshVertices@4
_GrannyCopyMeshVertices@12
_GrannyGetMeshVertexType@4
_GrannyGetMeshTriangleGroups@4
_GrannyGetMeshTriangleGroupCount@4
_GrannySetTrackGroupLOD@16
mss32
_AIL_file_read@8
_AIL_set_file_callbacks@16
_AIL_WAV_info@8
_AIL_decompress_ASI@24
_AIL_decompress_ADPCM@12
_AIL_file_type@8
_AIL_open_digital_driver@16
_AIL_open_stream@12
_AIL_close_digital_driver@4
_AIL_enumerate_3D_providers@12
_AIL_open_3D_provider@4
_AIL_close_3D_provider@4
_AIL_open_3D_listener@4
_AIL_close_3D_listener@4
_AIL_set_3D_position@16
_AIL_set_3D_velocity@20
_AIL_set_3D_orientation@28
_AIL_startup@0
_AIL_shutdown@0
_AIL_set_redist_directory@4
_AIL_close_stream@4
_AIL_start_stream@4
_AIL_pause_stream@8
_AIL_set_stream_volume_levels@12
_AIL_stream_volume_levels@12
_AIL_set_stream_loop_count@8
_AIL_stream_status@4
_AIL_last_error@0
_AIL_release_sample_handle@4
_AIL_init_sample@4
_AIL_set_sample_file@12
_AIL_start_sample@4
_AIL_stop_sample@4
_AIL_resume_sample@4
_AIL_end_sample@4
_AIL_set_sample_volume_pan@12
_AIL_set_sample_loop_count@8
_AIL_sample_status@4
_AIL_sample_volume_pan@12
_AIL_allocate_3D_sample_handle@4
_AIL_release_3D_sample_handle@4
_AIL_start_3D_sample@4
_AIL_stop_3D_sample@4
_AIL_resume_3D_sample@4
_AIL_end_3D_sample@4
_AIL_set_3D_sample_file@8
_AIL_set_3D_sample_volume@8
_AIL_set_3D_sample_loop_count@8
_AIL_3D_sample_status@4
_AIL_3D_sample_volume@4
_AIL_auto_update_3D_position@8
_AIL_allocate_sample_handle@4
_AIL_mem_free_lock@4
speedtreert
?SetLodLimits@CSpeedTreeRT@@QAEXMM@Z
?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z
?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z
?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ
?GetCurrentError@CSpeedTreeRT@@SAPBDXZ
?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ
?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z
?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ
?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z
?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ
?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z
?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z
?SetLodLevel@CSpeedTreeRT@@QAEXM@Z
?ComputeLodLevel@CSpeedTreeRT@@QAEXXZ
?SetLocalMatrices@CSpeedTreeRT@@QAEXII@Z
?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z
?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z
?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ
?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z
?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ
?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z
?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ
?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z
??3CSpeedTreeRT@@SAXPAX@Z
??2CSpeedTreeRT@@SAPAXI@Z
??1CSpeedTreeRT@@QAE@XZ
??0CSpeedTreeRT@@QAE@XZ
??1STextures@CSpeedTreeRT@@QAE@XZ
??0STextures@CSpeedTreeRT@@QAE@XZ
??1SGeometry@CSpeedTreeRT@@QAE@XZ
??0SGeometry@CSpeedTreeRT@@QAE@XZ
?SetCamera@CSpeedTreeRT@@SAXPBM0@Z
?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z
?SetLightState@CSpeedTreeRT@@SAXI_N@Z
?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z
?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z
?SetTime@CSpeedTreeRT@@SAXM@Z
dinput8
DirectInput8Create
ws2_32
inet_addr
htons
WSACleanup
WSAStartup
gethostbyname
socket
send
select
recv
ioctlsocket
connect
closesocket
__WSAFDIsSet
WSAGetLastError
sendto
ddraw
DirectDrawCreate
advapi32
CryptAcquireContextA
RegOpenKeyExA
RegQueryValueExA
CryptReleaseContext
CryptGenRandom
RegOpenKeyA
RegCloseKey
shell32
SHGetSpecialFolderPathA
oleaut32
SysAllocString
VariantInit
VariantClear
SysFreeString
Sections
.text Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 466KB - Virtual size: 465KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 189KB - Virtual size: 619KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 331KB - Virtual size: 330KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 133KB - Virtual size: 132KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ