No_Crypt_Client_3d[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

No_Crypt_Client_3d.exe
Size

1.9MB
MD5

3925af368443c4a22e68875aec9f5989
SHA1

958cb0a34a5048e701fdaf7f0f29c3c43027ec98
SHA256

5e5f6aa821fd5f8ed0d5768b0377c8871c5f237844e17323ef379d36e906c204
SHA512

21b69046926e68a6a25ead5aea944396840bce44235b36eaafcbb375c85a8ef63e8aafd5432210ac900ca2874df7915a0639d411e4b1b2b0d01e327cc34c1bad
SSDEEP

49152:1knnVveVVj6r3h4Vfe1lhyGlxu+Bt3Bwv:1knnVveV44Vfe1GGlxu+fRc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
No_Crypt_Client_3d.exe

Files

No_Crypt_Client_3d.exe
.exe windows x86

a0c96ae64fcb045831b68dc3227372b9

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

binkw32

_BinkDDSurfaceType@4
_BinkOpenDirectSound@4
_BinkSetSoundSystem@8
_BinkOpen@8
_BinkWait@4
_BinkClose@4
_BinkCopyToBuffer@28
_BinkNextFrame@4
_BinkDoFrame@4

granny

_GrannyLockSequenceForRendering@16
_GrannyUnlockIntersection@8
_GrannyGetNextIntersection@12
_GrannyGetIntersectionsLeft@12
_GrannyLockSequenceForRayIntersection@20
_GrannyGetBoneTreeState@20
_GrannyAttachSequence@32
_GrannyDetachSequence@8
_GrannyStopWearingSequence@8
_GrannyWearSequence@16
_GrannyGetAnimationParameter@20
_GrannyHasControlExpired@16
_GrannyAddControlledAnimation@20
_GrannySetAnimationParameter@24
_GrannySetSequenceAccumulating@12
_GrannyOpenSequence@12
_GrannySetSequencePosition@12
_GrannyCloseSequence@8
_GrannyReleaseControlledAnimation@12
_GrannyClose@4
_GrannyOpenVersion@20
_GrannyGetPreference@12
_GrannySetPreference@12
_GrannyGetBoneCount@12
_GrannyGetBoneState@20
_GrannyOpenAnimation@12
_GrannyGetToolCoordinateSystemForAnimation@16
_GrannyTransformAnimation@16
_GrannyOpenModel@12
_GrannyGetToolCoordinateSystemForModel@16
_GrannyRecommendTransform@28
_GrannyTransformModel@16
_GrannyCloseAnimation@8
_GrannyCloseModel@8
_GrannyGetExpiredTexturesLeft@8
_GrannyGetNextExpiredTextureCookie@8
_GrannyGetCurrentTime@8
_GrannyAdvanceTime@12
_GrannyGetNewTexturesLeft@8
_GrannyLockNextNewTexture@8
_GrannyUnlockNewTexture@8
_GrannyAllowTextureFormat@8
_GrannyUnlockRendering@8
_GrannyUnlockRenderingState@4
_GrannyLockNextRenderingState@12
_GrannyGetRenderingStatesLeft@12

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

kernel32

SetFilePointer
FlushFileBuffers
GetFileType
GetStartupInfoA
WideCharToMultiByte
CreateDirectoryA
IsBadWritePtr
HeapReAlloc
VirtualAlloc
VirtualFree
GetSystemTimeAsFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
GetLocalTime
GetSystemTime
RaiseException
RtlUnwind
InterlockedDecrement
InterlockedIncrement
GetFullPathNameA
SetHandleCount
GetStdHandle
GetEnvironmentVariableA
HeapDestroy
HeapCreate
SetUnhandledExceptionFilter
HeapSize
LCMapStringA
LCMapStringW
GetCPInfo
GetOEMCP
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
Sleep
InterlockedExchange
CloseHandle
WriteFile
CreateFileA
GetLastError
LeaveCriticalSection
EnterCriticalSection
FindClose
FindNextFileA
FindFirstFileA
QueryPerformanceFrequency
GetEnvironmentStringsW
LocalFree
FormatMessageA
GetDiskFreeSpaceA
GetDriveTypeA
GetProcAddress
LoadLibraryA
GetLogicalDrives
GlobalMemoryStatus
GetTickCount
SetThreadPriority
CreateThread
InitializeCriticalSection
DeleteCriticalSection
WaitForSingleObject
ResumeThread
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetFileSize
FlushViewOfFile
GetCurrentProcessId
FreeLibrary
GetVersion
OpenFileMappingA
ExitProcess
GetVersionExA
GlobalUnlock
GlobalLock
MultiByteToWideChar
GetACP
IsDBCSLeadByte
CreateMutexA
ReleaseMutex
GetTimeZoneInformation
GetSystemInfo
DeviceIoControl
GetLogicalDriveStringsA
GetCurrentDirectoryA
GetModuleFileNameA
SetFileAttributesA
GetFileAttributesA
GetCommandLineA
GetProfileStringA
TerminateProcess
CreateProcessA
OpenProcess
HeapFree
GetProcessHeap
HeapAlloc
MoveFileA
DeleteFileA
GetExitCodeProcess
SetCurrentDirectoryA
ReadFile
GetCurrentProcess
OpenMutexA
GetModuleHandleA
lstrcmpiA
IsBadReadPtr
GetWindowsDirectoryA
SetEndOfFile
SetStdHandle
GetStringTypeA
GetStringTypeW
IsBadCodePtr
CompareStringA
CompareStringW
QueryPerformanceCounter
SetEnvironmentVariableA

user32

GetAsyncKeyState
GetKeyNameTextA
GetDoubleClickTime
DestroyMenu
ShowCursor
GetMenu
SetWindowTextA
SetWindowTextW
IsWindowUnicode
CheckMenuItem
LoadAcceleratorsA
SetCursor
LoadCursorA
GetWindowDC
GetDesktopWindow
FindWindowA
DispatchMessageA
TranslateMessage
TranslateAcceleratorA
PeekMessageA
UnregisterClassA
UnregisterClassW
SendMessageA
UpdateWindow
ShowWindow
CreateWindowExA
RegisterClassA
CreateWindowExW
RegisterClassW
LoadIconA
LoadMenuA
CloseClipboard
GetClipboardData
OpenClipboard
IsClipboardFormatAvailable
DefWindowProcA
DefWindowProcW
GetActiveWindow
SetFocus
SetCapture
ReleaseCapture
IsZoomed
GetSystemMetrics
EndPaint
BeginPaint
PostQuitMessage
GetWindowRect
GetFocus
ScreenToClient
GetCursorPos
DestroyWindow
GetMessageA
SetWindowPos
SetWindowLongA
GetWindowLongA
SetMenu
MoveWindow
MapVirtualKeyA
KillTimer
SetTimer
LoadImageA
GetParent
GetClassInfoA
DrawTextA
SetWindowPlacement
AdjustWindowRectEx
GetWindowPlacement
wsprintfA
MessageBoxA
CopyRect
IsIconic
GetClientRect
ClientToScreen
GetDC
ReleaseDC
GetKeyState

gdi32

StretchBlt
GetObjectA
GetPaletteEntries
GetDeviceCaps
DeleteDC
SetBkMode
CreateDIBSection
DeleteObject
CreateCompatibleDC
SelectObject
BitBlt
GetStockObject
SetTextColor

advapi32

RegQueryValueExW
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegSetValueExA

ole32

CoUninitialize
CoInitialize

wsock32

socket
recvfrom
sendto
ntohl
gethostbyname
gethostname
WSAStartup
WSACleanup
closesocket
inet_ntoa
setsockopt
send
connect
htons
htonl
__WSAFDIsSet
select
WSAGetLastError
recv
ntohs
bind

ddraw

DirectDrawEnumerateExA
DirectDrawCreateEx

dsound

ord1

winmm

timeKillEvent
timeSetEvent
mciSendCommandA
midiOutSetVolume
midiOutGetDevCapsA
midiOutGetVolume
timeGetTime

igrping

?SendPingMessage@@YA_NPADH00H@Z

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 268KB - Virtual size: 264KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 100KB - Virtual size: 9.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

LBMPEG_D
Size: 4KB - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a0c96ae64fcb045831b68dc3227372b9

Headers

File Characteristics

Imports

binkw32

granny

version

kernel32

user32

gdi32

advapi32

ole32

wsock32

ddraw

dsound

winmm

igrping

Sections

.text Size: 1.5MB - Virtual size: 1.5MB

.rdata Size: 268KB - Virtual size: 264KB

.data Size: 100KB - Virtual size: 9.5MB

LBMPEG_D Size: 4KB - Virtual size: 1024B

.rsrc Size: 8KB - Virtual size: 4KB

.text
Size: 1.5MB - Virtual size: 1.5MB

.rdata
Size: 268KB - Virtual size: 264KB

.data
Size: 100KB - Virtual size: 9.5MB

LBMPEG_D
Size: 4KB - Virtual size: 1024B

.rsrc
Size: 8KB - Virtual size: 4KB