9be9a43ac496ec6e1c0d3e872c55159686cb6d433017519fc93ba81a3560cc9b

Sharing

Copy URL

Twitter E-mail

General

Target

9be9a43ac496ec6e1c0d3e872c55159686cb6d433017519fc93ba81a3560cc9b
Size

7.2MB
MD5

32e804ae666ff126106e815934b186fc
SHA1

b703130e551dbee7fd8c79808e58b7518bbd2a30
SHA256

9be9a43ac496ec6e1c0d3e872c55159686cb6d433017519fc93ba81a3560cc9b
SHA512

8cce1677939b7c4d283d6e139ed8b2cc8b035d3b652504f443edf87912ba2c106ed9c3cd2430c96e59096502044885e1d57f6fbba7cd11488c460d978deed959
SSDEEP

98304:z4Jgagv4Z/8KZEI0/XQ4vGURKXdkc1wYJgJwk4Psem6zcutHWvMXQUVXkGh:EvgQZPmXQ4vpstkSk40DUL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9be9a43ac496ec6e1c0d3e872c55159686cb6d433017519fc93ba81a3560cc9b

Files

9be9a43ac496ec6e1c0d3e872c55159686cb6d433017519fc93ba81a3560cc9b
.exe windows x86

963c901636eb1c4a06c11c4bdd0ac431

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Module32Next
Module32First
Process32Next
Process32First
CreateToolhelp32Snapshot
GetSystemInfo
OpenProcess
SetThreadPriority
LoadLibraryW
CreateTimerQueue
SignalObjectAndWait
GetThreadPriority
FindFirstFileA
Sleep
CreateEventA
WaitForSingleObject
SetEvent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetProcessHeap
HeapFree
HeapAlloc
DeviceIoControl
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetVersionExW
VirtualFree
ReleaseSemaphore
SetFileAttributesA
QueryDepthSList
HeapSize
PeekConsoleInputA
ReadConsoleInputW
GetNumberOfConsoleInputEvents
SetConsoleMode
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
HeapReAlloc
GetFileSizeEx
EnumSystemLocalesW
GetUserDefaultLCID
TerminateProcess
GetTimeFormatW
GetDateFormatW
CloseHandle
UnlockFileEx
LockFileEx
ReadConsoleW
GetConsoleMode
GetTimeZoneInformation
CreateProcessW
GetTempPathW
FlushFileBuffers
SetFilePointerEx
VirtualQuery
VirtualProtect
VirtualAlloc
SetStdHandle
WriteConsoleW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
MultiByteToWideChar
FindNextFileA
FindClose
GetFileAttributesExA
GetLastError
GetCurrentProcess
GetCurrentProcessId
ReadProcessMemory
TryEnterCriticalSection
GetDiskFreeSpaceA
GetDiskFreeSpaceW
LockFile
UnlockFile
InterlockedPopEntrySList
AreFileApisANSI
FreeLibraryAndExitThread
ResumeThread
ExitThread
GetModuleHandleExW
UnregisterWaitEx
GetPrivateProfileStringA
lstrlenA
GlobalFree
GetModuleFileNameA
GetFileAttributesA
DeleteFileA
CreateDirectoryA
GetCurrentDirectoryA
GetTickCount
GetCurrentDirectoryW
LoadLibraryA
GetProcAddress
GetModuleHandleA
LoadLibraryExW
InterlockedFlushSList
InterlockedPushEntrySList
RaiseException
RtlUnwind
GetThreadTimes
GetCurrentThread
GetExitCodeThread
CreateThread
ExpandEnvironmentStringsW
GetStdHandle
FileTimeToDosDateTime
FileTimeToLocalFileTime
SetConsoleCtrlHandler
FlushViewOfFile
GetACP
QueryPerformanceFrequency
GenerateConsoleCtrlEvent
SystemTimeToFileTime
MoveFileW
GetVersion
GetSystemTime
CreateProcessA
GetExitCodeProcess
GetProcessTimes
CreatePipe
DuplicateHandle
SetFileTime
SetFileAttributesW
RemoveDirectoryW
GetFullPathNameW
GetFileType
GetFileAttributesExW
GetFileAttributesW
FindNextFileW
FindFirstFileW
DeleteFileW
CreateDirectoryW
SetCurrentDirectoryW
SetCurrentDirectoryA
SetEnvironmentVariableW
SetEnvironmentVariableA
GetEnvironmentVariableA
LoadLibraryExA
SetErrorMode
GetFullPathNameA
SetEndOfFile
IsDBCSLeadByte
GetConsoleOutputCP
GetConsoleCP
OutputDebugStringW
GetFileInformationByHandle
LocalFree
WaitNamedPipeW
IsValidLocale
ExitProcess
PeekNamedPipe
CreateFileW
GetModuleFileNameW
FormatMessageA
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
ResetEvent
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
GetModuleHandleW
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SwitchToThread
CreateEventW
InitializeCriticalSectionAndSpinCount
SetLastError
DecodePointer
EncodePointer
FormatMessageW
QueryPerformanceCounter
WriteFile
SetFilePointer
ReadFile
GetLocaleInfoA
CompareStringA
HeapCompact
CreateFileA
lstrlenW
GlobalLock
GlobalUnlock
FreeLibrary
GetVersionExA
GetSystemDirectoryA
WideCharToMultiByte
GetCurrentThreadId
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
GetFileSize
GlobalAlloc
GetTempPathA
RemoveDirectoryA
MoveFileA

user32

CharPrevExA
RegisterClassA
GetMenu
AdjustWindowRectEx
GetWindowLongA
SetWindowLongA
LoadCursorA
GetMessageA
TranslateMessage
DispatchMessageA
GetKeyboardLayoutNameA
GetKeyboardLayout
OpenClipboard
CloseClipboard
GetClipboardData
CharNextW
CharPrevA
CharNextA
MessageBoxA
LoadStringA
OffsetRect
SetCapture
DefWindowProcA
UnregisterClassA
RegisterClassExA
CreateWindowExA
IsWindow
DestroyWindow
ShowWindow
MoveWindow
SetFocus
UpdateWindow
GetClientRect
PostQuitMessage
FlashWindowEx
SetWindowPos
GetCursorPos
ScreenToClient
FindWindowA
LoadIconA
SystemParametersInfoA
GetKeyState
ShowCursor
SetCursor
DestroyCursor
LoadImageA
SetCursorPos
ClientToScreen
GetAsyncKeyState
GetCapture
SetRect
FillRect
InvalidateRect
CharNextExA
ReleaseCapture
ChangeDisplaySettingsA
GetSystemMetrics
IsIconic
EndPaint
BeginPaint
ReleaseDC
GetDC
PeekMessageA
wvsprintfA

gdi32

GetTextExtentPoint32A
EnumFontFamiliesExA
GetStockObject
CreateFontIndirectA
GetCharABCWidthsFloatW
GetTextExtentPoint32W
SelectObject
SetBkColor
SetTextColor
TextOutW
CreateCompatibleDC
DeleteDC
SetBkMode
CreateDIBSection
TextOutA
StretchBlt
PatBlt
DeleteObject
CreateSolidBrush

advapi32

RegDeleteValueA
RegCreateKeyExW
RegSetValueExW
CryptReleaseContext
RegConnectRegistryA
RegCreateKeyA
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegSetValueA
RegEnumKeyExA
RegEnumValueA
RegFlushKey
RegLoadKeyA
RegQueryInfoKeyA
RegQueryValueA
RegSaveKeyA

shell32

ShellExecuteW
SHGetSpecialFolderPathA
ShellExecuteA

ole32

CoUninitialize
CoInitialize
CoCreateInstance
CoInitializeEx

winmm

timeGetDevCaps
timeBeginPeriod
timeEndPeriod
timeGetTime

d3d9

D3DPERF_EndEvent
Direct3DCreate9

d3dx9_43

D3DXMatrixInverse
D3DXMatrixRotationYawPitchRoll
D3DXQuaternionMultiply
D3DXQuaternionRotationAxis
D3DXMatrixRotationQuaternion
D3DXVec4Transform
D3DXVec3Project
D3DXMatrixScaling
D3DXMatrixDeterminant
D3DXMatrixLookAtRH
D3DXMatrixPerspectiveFovRH
D3DXMatrixOrthoRH
D3DXMatrixOrthoOffCenterRH
D3DXCreateMatrixStack
D3DXMatrixTransformation
D3DXCreateSphere
D3DXGetFVFVertexSize
D3DXGetImageInfoFromFileInMemory
D3DXLoadSurfaceFromSurface
D3DXCreateTexture
D3DXCreateTextureFromFileInMemoryEx
D3DXPlaneNormalize
D3DXQuaternionRotationYawPitchRoll
D3DXVec3Transform
D3DXVec2Normalize
D3DXMatrixTranslation
D3DXMatrixMultiply
D3DXMatrixRotationZ
D3DXVec3TransformCoord
D3DXVec3Normalize
D3DXMatrixRotationX
D3DXVec3TransformNormal
D3DXCreateCylinder
D3DXMatrixTranspose
D3DXMatrixRotationAxis

libcef

cef_string_utf8_clear
cef_string_utf8_to_utf16
cef_string_utf16_clear
cef_string_utf16_cmp
cef_string_utf16_to_utf8
cef_string_multimap_free
cef_string_multimap_alloc
cef_string_utf16_set
cef_string_list_alloc
cef_string_list_free
cef_register_extension
cef_execute_process
cef_initialize
cef_shutdown
cef_run_message_loop
cef_api_hash
cef_log
cef_v8context_get_current_context
cef_string_map_alloc
cef_string_map_free
cef_command_line_get_global
cef_browser_host_create_browser
cef_string_list_size
cef_string_list_value
cef_string_list_append
cef_string_map_size
cef_string_map_key
cef_string_map_value
cef_string_map_append
cef_string_multimap_size
cef_string_multimap_key
cef_string_multimap_value
cef_string_multimap_append
cef_string_userfree_utf16_free

iphlpapi

GetAdaptersInfo
GetPerAdapterInfo

imm32

ImmGetOpenStatus
ImmSetConversionStatus
ImmGetConversionStatus
ImmGetCandidateListW
ImmSetCompositionStringW
ImmGetCompositionStringW
ImmAssociateContext
ImmReleaseContext
ImmGetContext
ImmIsIME
ImmGetIMEFileNameA
ImmNotifyIME

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

devil

ilCopyPixels
ilInit
ilTexImage
ilSetPixels
ilSave
ilShutDown
ilOriginFunc
ilEnable
ilBindImage
ilConvertImage
ilLoad
ilGetInteger
ilGenImages
ilDeleteImages

mss32

_AIL_auto_update_3D_position@8
_AIL_mem_free_lock@4
_AIL_file_read@8
_AIL_set_file_callbacks@16
_AIL_WAV_info@8
_AIL_decompress_ASI@24
_AIL_decompress_ADPCM@12
_AIL_file_type@8
_AIL_open_digital_driver@16
_AIL_open_stream@12
_AIL_close_digital_driver@4
_AIL_enumerate_3D_providers@12
_AIL_open_3D_provider@4
_AIL_close_3D_provider@4
_AIL_open_3D_listener@4
_AIL_3D_sample_volume@4
_AIL_close_3D_listener@4
_AIL_set_3D_position@16
_AIL_set_3D_velocity@20
_AIL_set_3D_orientation@28
_AIL_startup@0
_AIL_shutdown@0
_AIL_set_redist_directory@4
_AIL_close_stream@4
_AIL_start_stream@4
_AIL_pause_stream@8
_AIL_set_stream_volume_levels@12
_AIL_stream_volume_levels@12
_AIL_set_3D_sample_loop_count@8
_AIL_set_stream_loop_count@8
_AIL_stream_status@4
_AIL_last_error@0
_AIL_allocate_sample_handle@4
_AIL_release_sample_handle@4
_AIL_init_sample@4
_AIL_set_sample_file@12
_AIL_start_sample@4
_AIL_stop_sample@4
_AIL_resume_sample@4
_AIL_end_sample@4
_AIL_set_sample_volume_pan@12
_AIL_set_sample_loop_count@8
_AIL_sample_status@4
_AIL_sample_volume_pan@12
_AIL_allocate_3D_sample_handle@4
_AIL_release_3D_sample_handle@4
_AIL_start_3D_sample@4
_AIL_stop_3D_sample@4
_AIL_resume_3D_sample@4
_AIL_end_3D_sample@4
_AIL_set_3D_sample_file@8
_AIL_set_3D_sample_volume@8
_AIL_3D_sample_status@4

dinput8

DirectInput8Create

ws2_32

closesocket
connect
WSAIoctl
WSASetLastError
getprotobyname
inet_ntoa
getservbyname
sendto
recvfrom
getservbyport
gethostbyaddr
listen
shutdown
__WSAFDIsSet
ioctlsocket
recv
select
send
socket
WSAGetLastError
WSAStartup
WSACleanup
htonl
htons
inet_addr
ntohl
ntohs
gethostbyname
gethostname
accept
bind
getpeername
getsockname
getsockopt
setsockopt

ddraw

DirectDrawCreate

speedtreert

?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z
?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ
?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z
?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z
?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z
?GetCurrentError@CSpeedTreeRT@@SAPBDXZ
?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z
?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ
?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z
?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z
?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z
?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ
?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z
??3CSpeedTreeRT@@SAXPAX@Z
??2CSpeedTreeRT@@SAPAXI@Z
??1CSpeedTreeRT@@QAE@XZ
??0CSpeedTreeRT@@QAE@XZ
??1STextures@CSpeedTreeRT@@QAE@XZ
??0STextures@CSpeedTreeRT@@QAE@XZ
??1SGeometry@CSpeedTreeRT@@QAE@XZ
??0SGeometry@CSpeedTreeRT@@QAE@XZ
?SetCamera@CSpeedTreeRT@@SAXPBM0@Z
?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z
?SetLightState@CSpeedTreeRT@@SAXI_N@Z
?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z
?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z
?SetTime@CSpeedTreeRT@@SAXM@Z
?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ
?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z
?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ
?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z

oleaut32

VariantClear
SysFreeString

msi

ord170
ord167
ord122
ord115
ord117
ord116
ord124
ord121
ord48
ord20
ord91
ord151
ord148
ord152
ord149
ord77
ord158
ord17
ord166
ord163
ord160
ord8
ord31
ord159

cabinet

ord14
ord10
ord11
ord13

rpcrt4

UuidToStringA
UuidCreate
RpcStringFreeA

Exports

Exports

AmdPowerXpressRequestHighPerformance
LZ4_compress
LZ4_compressBound
LZ4_compress_continue
LZ4_compress_default
LZ4_compress_destSize
LZ4_compress_fast
LZ4_compress_fast_continue
LZ4_compress_fast_extState
LZ4_compress_limitedOutput
LZ4_compress_limitedOutput_continue
LZ4_compress_limitedOutput_withState
LZ4_compress_withState
LZ4_create
LZ4_createStream
LZ4_createStreamDecode
LZ4_decoderRingBufferSize
LZ4_decompress_fast
LZ4_decompress_fast_continue
LZ4_decompress_fast_usingDict
LZ4_decompress_fast_withPrefix64k
LZ4_decompress_safe
LZ4_decompress_safe_continue
LZ4_decompress_safe_partial
LZ4_decompress_safe_usingDict
LZ4_decompress_safe_withPrefix64k
LZ4_freeStream
LZ4_freeStreamDecode
LZ4_initStream
LZ4_loadDict
LZ4_resetStream
LZ4_resetStreamState
LZ4_resetStream_fast
LZ4_saveDict
LZ4_setStreamDecode
LZ4_sizeofState
LZ4_sizeofStreamState
LZ4_slideInputBuffer
LZ4_uncompress
LZ4_uncompress_unknownOutputSize
LZ4_versionNumber
LZ4_versionString
NvOptimusEnablement

Sections

.text
Size: 5.1MB - Virtual size: 5.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 449KB - Virtual size: 1016KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 238KB - Virtual size: 237KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

963c901636eb1c4a06c11c4bdd0ac431

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

winmm

d3d9

d3dx9_43

libcef

iphlpapi

imm32

version

devil

mss32

dinput8

ws2_32

ddraw

speedtreert

oleaut32

msi

cabinet

rpcrt4

Exports

Exports

Sections

.text Size: 5.1MB - Virtual size: 5.1MB

.rdata Size: 1.3MB - Virtual size: 1.3MB

.data Size: 449KB - Virtual size: 1016KB

.rsrc Size: 43KB - Virtual size: 42KB

.reloc Size: 238KB - Virtual size: 237KB

.text
Size: 5.1MB - Virtual size: 5.1MB

.rdata
Size: 1.3MB - Virtual size: 1.3MB

.data
Size: 449KB - Virtual size: 1016KB

.rsrc
Size: 43KB - Virtual size: 42KB

.reloc
Size: 238KB - Virtual size: 237KB