Static task
static1
Behavioral task
behavioral1
Sample
421473ca3ab97b53bd391f5efb59e76be263947bffd6d821ecf06c205cd48359.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
421473ca3ab97b53bd391f5efb59e76be263947bffd6d821ecf06c205cd48359.exe
Resource
win10v2004-20230831-en
General
-
Target
421473ca3ab97b53bd391f5efb59e76be263947bffd6d821ecf06c205cd48359
-
Size
3.3MB
-
MD5
4a5a63b10a56b767e9791ffd9955d27d
-
SHA1
01b1fba322d2ccf252f6b12b6237a968d483d604
-
SHA256
421473ca3ab97b53bd391f5efb59e76be263947bffd6d821ecf06c205cd48359
-
SHA512
d9e0ac980d43754faa9d9cf59ca3988d7cc109ca2d641e0113fc2d77e6448a2f918b866137d00d4282c3f6b9b6b2c379f957faf3af51e5e7e2e0e3f9c090df3c
-
SSDEEP
49152:sv2t+B1JAEaj94Pczgo0IBncS3ZxN9t0wPPzGsY49S+ZlAs90OcTGtIUt:suW1Fho9ZcS3Zxx0O
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 421473ca3ab97b53bd391f5efb59e76be263947bffd6d821ecf06c205cd48359
Files
-
421473ca3ab97b53bd391f5efb59e76be263947bffd6d821ecf06c205cd48359.exe windows x86
25ab639dff0f1a6dbea0a777cd4a9e24
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
libcef
cef_string_list_append
cef_string_map_size
cef_string_map_key
cef_string_map_value
cef_string_map_append
cef_string_multimap_size
cef_string_multimap_key
cef_string_multimap_value
cef_string_multimap_append
cef_string_list_size
cef_string_multimap_alloc
cef_string_multimap_free
cef_browser_host_create_browser
cef_command_line_get_global
cef_string_list_value
cef_string_utf8_to_utf16
cef_string_utf16_clear
cef_string_utf8_clear
cef_string_utf16_to_utf8
cef_string_utf16_cmp
cef_string_ascii_to_utf16
cef_string_utf16_set
cef_string_userfree_utf16_free
cef_string_list_alloc
cef_string_list_free
cef_register_extension
cef_execute_process
cef_initialize
cef_shutdown
cef_run_message_loop
cef_api_hash
cef_log
cef_v8context_get_current_context
cef_string_map_alloc
cef_string_map_free
kernel32
GlobalAlloc
CreateFileA
GetFileSize
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
SetUnhandledExceptionFilter
GetCurrentThread
GetModuleHandleA
WinExec
OutputDebugStringA
ReadFile
WriteConsoleW
SetEndOfFile
HeapSize
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
HeapReAlloc
SetStdHandle
GetTimeZoneInformation
CreateProcessW
GetExitCodeProcess
FlushFileBuffers
DeleteFileW
CreateDirectoryW
GetFileAttributesExW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
HeapAlloc
MultiByteToWideChar
GetCurrentDirectoryW
GetTickCount
CreateToolhelp32Snapshot
GetCurrentProcessId
Module32First
CloseHandle
Module32Next
GetCurrentProcess
ReadProcessMemory
GetLastError
GetSystemInfo
Sleep
SetEvent
WaitForSingleObject
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
SetFileAttributesA
FindFirstFileA
FindNextFileA
FindClose
MoveFileA
GetCurrentDirectoryA
lstrlenA
GetPrivateProfileStringA
DeleteFileA
GetModuleFileNameA
GlobalFree
SetLastError
WriteFile
GetSystemDirectoryA
GetVersionExA
ReadConsoleW
CreateDirectoryA
FreeLibrary
GetProcAddress
LoadLibraryA
GlobalUnlock
GlobalLock
lstrlenW
WideCharToMultiByte
CompareStringA
GetLocaleInfoA
ReleaseSemaphore
QueryPerformanceCounter
InitOnceExecuteOnce
GetStringTypeW
InitializeCriticalSectionEx
EncodePointer
MoveFileExW
HeapFree
GetStdHandle
GetModuleFileNameW
DecodePointer
LCMapStringEx
GetCPInfo
HeapValidate
GetFileType
GetModuleHandleExW
ExitProcess
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InterlockedPushEntrySList
RaiseException
RtlUnwind
QueryPerformanceFrequency
GetSystemTimeAsFileTime
GetCurrentThreadId
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
TerminateProcess
UnhandledExceptionFilter
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
InitializeCriticalSectionAndSpinCount
CreateFileW
IsProcessorFeaturePresent
GetProcessHeap
user32
GetMenu
SetWindowTextA
AdjustWindowRectEx
DefWindowProcA
RegisterClassExA
CreateWindowExA
GetClientRect
ShowWindow
UpdateWindow
SetFocus
MoveWindow
IsWindow
DestroyWindow
UnregisterClassA
InvalidateRect
GetMonitorInfoA
MonitorFromPoint
CharPrevExA
CharNextExA
GetDC
FillRect
ReleaseDC
PeekMessageA
ClientToScreen
OffsetRect
SetRect
GetAsyncKeyState
PostQuitMessage
GetCursorPos
ScreenToClient
FindWindowA
LoadIconA
SetWindowPos
SystemParametersInfoA
FlashWindowEx
GetKeyState
LoadImageA
DestroyCursor
ShowCursor
SetCursor
SetCursorPos
SetCapture
ReleaseCapture
ChangeDisplaySettingsA
CharNextW
GetCapture
GetSystemMetrics
LoadStringA
MessageBoxA
GetClipboardData
CloseClipboard
RegisterClassA
OpenClipboard
GetKeyboardLayout
GetKeyboardLayoutNameA
DispatchMessageA
TranslateMessage
GetMessageA
GetWindowLongA
SetWindowLongA
LoadCursorA
gdi32
SetBkColor
SetTextColor
TextOutW
CreateCompatibleDC
DeleteDC
SetBkMode
GetTextExtentPoint32W
GetCharABCWidthsFloatW
EnumFontFamiliesExA
SelectObject
TextOutA
CreateFontIndirectA
CreateSolidBrush
DeleteObject
StretchBlt
GetStockObject
GetTextExtentPoint32A
GetPixel
GetDeviceCaps
CreateDIBSection
ole32
CoCreateInstance
CoInitialize
CoInitializeEx
CoUninitialize
winmm
timeGetTime
timeEndPeriod
timeBeginPeriod
timeGetDevCaps
d3d8
Direct3DCreate8
python27
PyModule_AddIntConstant
PyErr_SetString
PyExc_RuntimeError
PyTuple_GetItem
PyInt_AsLong
PyList_New
PyString_FromString
PyList_Append
PyTuple_Size
PyDict_GetItemString
PyLong_AsLong
PyArg_ParseTuple
PyDict_Size
PyDict_Next
PyLong_FromLongLong
Py_InitModule4
PyString_InternFromString
PyObject_GetAttrString
PyObject_GetAttr
PyCallable_Check
PyLong_AsLongLong
PyLong_AsUnsignedLongLong
PyFloat_AsDouble
PyString_AsString
PyErr_Clear
PyErr_BadArgument
PyErr_Print
PyObject_CallObject
PyNumber_Check
_Py_NoneStruct
PyDict_SetItemString
PyModule_GetDict
PyImport_ImportModule
PyErr_Fetch
Py_SetProgramName
Py_Initialize
Py_Finalize
PyRun_StringFlags
PyImport_AddModule
Py_BuildValue
imm32
ImmGetIMEFileNameA
ImmGetContext
ImmReleaseContext
ImmAssociateContext
ImmGetCompositionStringW
ImmSetCompositionStringW
ImmGetCandidateListW
ImmGetConversionStatus
ImmSetConversionStatus
ImmGetOpenStatus
ImmNotifyIME
ImmIsIME
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
imagehlp
EnumerateLoadedModules
StackWalk
GetTimestampForLoadedLibrary
devil
ilCopyPixels
ilDeleteImages
ilShutDown
ilConvertImage
ilGetInteger
ilTexImage
ilSetPixels
ilInit
ilLoad
ilOriginFunc
ilBindImage
ilGenImages
ilSave
ilEnable
granny2
GrannyPNT332VertexType
_GrannyDeformVertices@24
_GrannyFreeMeshDeformer@4
_GrannyNewMeshDeformer@16
_GrannyCopyMeshIndices@12
_GrannyGetMeshVertices@4
_GrannyCopyMeshVertices@12
_GrannyGetMeshVertexType@4
_GrannyGetMeshTriangleGroups@4
_GrannyGetMeshTriangleGroupCount@4
_GrannyPlayControlledAnimation@12
_GrannySetControlRawLocalClock@8
_GrannyGetControlRawLocalClock@4
_GrannySetControlEaseOut@8
_GrannySetControlEaseInCurve@28
_GrannySetControlEaseIn@8
_GrannyGetControlLocalDuration@4
_GrannySetControlSpeed@8
_GrannyGetControlSpeed@4
_GrannySetControlLoopCount@8
_GrannyGetControlLoopCount@4
_GrannyFreeControlIfComplete@4
_GrannyControlIsComplete@4
_GrannyCompleteControlAt@8
_GrannyFreeControlOnceUnused@4
_GrannyFreeControl@4
_GrannyGetMeshIndexCount@4
_GrannyMeshIsRigid@4
_GrannyGetMeshVertexCount@4
_GrannyGetTotalTypeSize@4
_GrannyGetWorldPoseComposite4x4@8
_GrannyGetWorldPose4x4@8
_GrannyFreeWorldPose@4
_GrannyNewWorldPose@4
_GrannyFindBoneByName@12
_GrannyGetMeshBindingToBoneIndices@4
_GrannyFreeMeshBinding@4
_GrannyNewMeshBinding@12
_GrannyFreeModelInstance@4
_GrannyInstantiateModel@4
_GrannyGetWorldPoseComposite4x4Array@4
_GrannyFreeLocalPose@4
_GrannyNewLocalPose@4
_GrannyUpdateModelMatrix@20
_GrannySampleModelAnimationsAccelerated@20
_GrannyFreeCompletedModelControls@4
_GrannySetModelClock@8
_GrannyGetSourceSkeleton@4
_GrannyGetFileInfo@4
_GrannyFreeFile@4
_GrannyFreeFileSection@8
_GrannyReadEntireFileFromMemory@8
_GrannyConvertSingleObject@20
_GrannyFindMatchingMember@16
_GrannyGetMaterialTextureByType@8
_GrannySetLogCallback@4
_GrannySetControlEaseOutCurve@28
mss32
_AIL_file_read@8
_AIL_mem_free_lock@4
_AIL_set_file_callbacks@16
_AIL_WAV_info@8
_AIL_decompress_ASI@24
_AIL_decompress_ADPCM@12
_AIL_file_type@8
_AIL_open_digital_driver@16
_AIL_open_stream@12
_AIL_close_digital_driver@4
_AIL_enumerate_3D_providers@12
_AIL_open_3D_provider@4
_AIL_close_3D_provider@4
_AIL_open_3D_listener@4
_AIL_close_3D_listener@4
_AIL_set_3D_position@16
_AIL_set_3D_velocity@20
_AIL_set_3D_orientation@28
_AIL_startup@0
_AIL_shutdown@0
_AIL_set_redist_directory@4
_AIL_close_stream@4
_AIL_start_stream@4
_AIL_pause_stream@8
_AIL_set_stream_volume_levels@12
_AIL_stream_volume_levels@12
_AIL_set_stream_loop_count@8
_AIL_stream_status@4
_AIL_last_error@0
_AIL_allocate_sample_handle@4
_AIL_release_sample_handle@4
_AIL_init_sample@4
_AIL_set_sample_file@12
_AIL_start_sample@4
_AIL_stop_sample@4
_AIL_resume_sample@4
_AIL_end_sample@4
_AIL_set_sample_volume_pan@12
_AIL_set_sample_loop_count@8
_AIL_sample_status@4
_AIL_sample_volume_pan@12
_AIL_allocate_3D_sample_handle@4
_AIL_release_3D_sample_handle@4
_AIL_start_3D_sample@4
_AIL_stop_3D_sample@4
_AIL_resume_3D_sample@4
_AIL_end_3D_sample@4
_AIL_set_3D_sample_file@8
_AIL_set_3D_sample_volume@8
_AIL_set_3D_sample_loop_count@8
_AIL_3D_sample_status@4
_AIL_3D_sample_volume@4
_AIL_auto_update_3D_position@8
speedtreert
?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z
?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ
?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z
?GetCurrentError@CSpeedTreeRT@@SAPBDXZ
?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z
?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z
?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z
?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ
?SetLodLimits@CSpeedTreeRT@@QAEXMM@Z
?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z
?SetLodLevel@CSpeedTreeRT@@QAEXM@Z
?ComputeLodLevel@CSpeedTreeRT@@QAEXXZ
?SetLocalMatrices@CSpeedTreeRT@@QAEXII@Z
?SetTime@CSpeedTreeRT@@SAXM@Z
?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z
?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z
?SetLightState@CSpeedTreeRT@@SAXI_N@Z
?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z
?SetCamera@CSpeedTreeRT@@SAXPBM0@Z
??0SGeometry@CSpeedTreeRT@@QAE@XZ
??1SGeometry@CSpeedTreeRT@@QAE@XZ
??0STextures@CSpeedTreeRT@@QAE@XZ
??1STextures@CSpeedTreeRT@@QAE@XZ
??0CSpeedTreeRT@@QAE@XZ
??1CSpeedTreeRT@@QAE@XZ
??2CSpeedTreeRT@@SAPAXI@Z
??3CSpeedTreeRT@@SAXPAX@Z
?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z
?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ
?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z
?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z
?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ
?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z
?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ
?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z
?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z
?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
dinput8
DirectInput8Create
ws2_32
__WSAFDIsSet
closesocket
connect
ioctlsocket
recv
select
send
gethostbyname
inet_addr
htons
WSACleanup
WSAStartup
WSAGetLastError
socket
ddraw
DirectDrawCreate
advapi32
RegCloseKey
RegQueryValueExA
RegOpenKeyA
CryptAcquireContextA
CryptReleaseContext
CryptGenRandom
RegOpenKeyExA
shell32
SHGetSpecialFolderPathA
oleaut32
VariantClear
SysFreeString
Sections
.text Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 469KB - Virtual size: 468KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 191KB - Virtual size: 464KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 61KB - Virtual size: 61KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 139KB - Virtual size: 139KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ