Static task
static1
Behavioral task
behavioral1
Sample
b6efe98a423ee09a145498d0e36312cbe48e9d6fb0a6be7b77fc4461976b1c8b.exe
Resource
win7-20230831-en
windows7-x64
Behavioral task
behavioral2
Sample
b6efe98a423ee09a145498d0e36312cbe48e9d6fb0a6be7b77fc4461976b1c8b.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
General
-
Target
b6efe98a423ee09a145498d0e36312cbe48e9d6fb0a6be7b77fc4461976b1c8b
-
Size
5.2MB
-
MD5
abdbd6c58fe22ee7a3405f8012766a60
-
SHA1
1da83b2b40773a765a7dbbfc794d696e4e091839
-
SHA256
b6efe98a423ee09a145498d0e36312cbe48e9d6fb0a6be7b77fc4461976b1c8b
-
SHA512
d4d761cabc7ecf9621a3763d66ff4322e0c8baab3c4931238d08cd98be6a0340e7592dd2acbc8cc79f76a266fe2cff86ad8764fff89bb9cb9b46df03ff6dc721
-
SSDEEP
98304:chnpZsjyi4RxmF0Z2uu4nf+vO8SkoMrg1p+rIu:cfZMyi3F0Z2uFaol
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b6efe98a423ee09a145498d0e36312cbe48e9d6fb0a6be7b77fc4461976b1c8b
Files
-
b6efe98a423ee09a145498d0e36312cbe48e9d6fb0a6be7b77fc4461976b1c8b.exe windows:6 windows x86
28730449cd1fe6647f1ce388a700382f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetFileAttributesA
ExitProcess
SetThreadPriority
CreateEventA
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
WriteConsoleW
HeapQueryInformation
HeapSize
SetEndOfFile
OutputDebugStringW
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
HeapReAlloc
SetStdHandle
SetFileAttributesW
SetCurrentDirectoryW
GetTimeZoneInformation
CreateProcessW
GetExitCodeProcess
GetFileAttributesExW
SetConsoleCtrlHandler
FlushFileBuffers
MoveFileExW
DeleteFileW
CreateDirectoryW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetTempPathW
HeapAlloc
ReadConsoleW
HeapFree
GetConsoleOutputCP
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetFileInformationByHandle
GetFullPathNameW
GetDriveTypeW
GetModuleHandleExW
FreeLibraryAndExitThread
ResumeThread
ExitThread
CreateThread
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
DeleteCriticalSection
RaiseException
InterlockedFlushSList
FindFirstFileA
RtlUnwind
GetThreadTimes
GetFileSizeEx
VerifyVersionInfoW
VerSetConditionMask
WaitForMultipleObjects
GetFileType
GetEnvironmentVariableA
MoveFileExA
FormatMessageW
SetLastError
SleepEx
SetFilePointerEx
GetModuleFileNameW
WaitNamedPipeW
CreateFileW
PeekNamedPipe
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
CreateEventW
ResetEvent
InitializeCriticalSectionAndSpinCount
GetCPInfo
CompareStringEx
GetLocaleInfoEx
CreateSymbolicLinkW
GetFileInformationByHandleEx
GetModuleHandleW
CloseThreadpoolWait
SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
FreeLibraryWhenCallbackReturns
GetTickCount64
GetSystemTimeAsFileTime
GetCurrentProcessorNumber
FlushProcessWriteBuffers
CreateSemaphoreExW
CreateEventExW
InitOnceExecuteOnce
FlsFree
FlsSetValue
WaitForSingleObject
SetEvent
Process32Next
Sleep
OpenProcess
Process32First
GetSystemInfo
GetLastError
ReadProcessMemory
GetCurrentProcess
Module32Next
CloseHandle
Module32First
GetCurrentProcessId
CreateToolhelp32Snapshot
FindNextFileA
FindClose
GetUserDefaultUILanguage
MoveFileA
GetCurrentDirectoryA
lstrlenA
GetPrivateProfileStringA
DeleteFileA
CreateMutexA
ReleaseMutex
GetModuleFileNameA
InterlockedPushEntrySList
GlobalFree
FlsGetValue
FlsAlloc
SetFileInformationByHandle
LCMapStringEx
DecodePointer
EncodePointer
GetStringTypeW
LocalFree
SleepConditionVariableSRW
SleepConditionVariableCS
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
TryEnterCriticalSection
InitializeCriticalSectionEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
QueryPerformanceFrequency
FormatMessageA
GetNativeSystemInfo
GetExitCodeThread
SwitchToThread
WaitForSingleObjectEx
QueryPerformanceCounter
CreateSemaphoreA
ReleaseSemaphore
GetLocaleInfoA
CompareStringA
WideCharToMultiByte
lstrlenW
GlobalLock
GlobalUnlock
LoadLibraryA
GetProcAddress
FreeLibrary
GetVersionExA
GetSystemDirectoryA
SetFilePointer
ReadFile
OutputDebugStringA
WinExec
GetModuleHandleA
GetCurrentThread
SetUnhandledExceptionFilter
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
WriteConsoleA
GetConsoleMode
GetDynamicTimeZoneInformation
GetCurrentThreadId
WriteFile
GetFileAttributesA
GetStdHandle
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
GetFileSize
CreateFileA
GetTempFileNameA
GetTempPathA
RemoveDirectoryA
CreateDirectoryA
AllocConsole
GlobalAlloc
GetTickCount
GetCurrentDirectoryW
MultiByteToWideChar
TlsAlloc
GetSystemDefaultLangID
user32
GetMonitorInfoA
MonitorFromPoint
CharPrevExA
CharNextExA
CharNextW
GetClipboardData
CloseClipboard
OpenClipboard
GetKeyboardLayout
GetKeyboardLayoutNameA
GetMessageA
LoadCursorA
AdjustWindowRectEx
GetWindowRect
SetWindowTextA
GetMenu
TranslateMessage
ScreenToClient
GetCursorPos
PostQuitMessage
DefWindowProcW
SetRect
OffsetRect
GetClientRect
ClientToScreen
PeekMessageA
ReleaseDC
FillRect
GetDC
EndPaint
BeginPaint
InvalidateRect
RegisterClassA
SetWindowLongA
GetWindowLongA
UpdateWindow
SetFocus
MoveWindow
DestroyWindow
IsWindow
CreateWindowExA
RegisterClassExA
GetAsyncKeyState
UnregisterClassA
DefWindowProcA
DispatchMessageA
FindWindowA
SetWindowPos
LoadIconA
SystemParametersInfoA
GetKeyState
LoadImageA
DestroyCursor
ShowCursor
SetCursor
SetCursorPos
SetCapture
ReleaseCapture
ChangeDisplaySettingsA
ShowWindow
GetCapture
FlashWindowEx
GetSystemMetrics
LoadStringA
MessageBoxA
gdi32
CreateFontIndirectA
GetCharABCWidthsFloatW
GetStockObject
GetTextExtentPoint32A
GetTextExtentPoint32W
SelectObject
SetBkColor
SetTextColor
TextOutW
CreateCompatibleDC
DeleteDC
SetBkMode
SetDIBitsToDevice
CreateDIBSection
StretchBlt
DeleteObject
CreateSolidBrush
GetDeviceCaps
EnumFontFamiliesExA
TextOutA
PatBlt
GetPixel
ole32
CoInitialize
CoCreateInstance
CoUninitialize
OleSetContainedObject
CoInitializeEx
OleInitialize
OleUninitialize
CoGetClassObject
winmm
timeEndPeriod
timeGetTime
timeBeginPeriod
timeGetDevCaps
d3d9
Direct3DCreate9
d3dx9_43
D3DXVec2Normalize
D3DXQuaternionMultiply
D3DXQuaternionRotationAxis
D3DXMatrixRotationQuaternion
D3DXVec3TransformNormal
D3DXMatrixRotationYawPitchRoll
D3DXMatrixInverse
D3DXMatrixRotationX
D3DXMatrixTranspose
D3DXVec3Transform
D3DXQuaternionRotationYawPitchRoll
D3DXPlaneNormalize
D3DXSaveSurfaceToFileA
D3DXMatrixRotationY
D3DXSaveTextureToFileA
D3DXMatrixMultiply
D3DXCreateTextureFromFileInMemoryEx
D3DXCreateSphere
D3DXCreateCylinder
D3DXCreateMatrixStack
D3DXMatrixOrthoOffCenterRH
D3DXMatrixOrthoRH
D3DXMatrixPerspectiveFovRH
D3DXVec3Unproject
D3DXVec3Project
D3DXMatrixRotationZ
D3DXMatrixScaling
D3DXMatrixLookAtRH
D3DXMatrixTranslation
D3DXMatrixDeterminant
D3DXVec4Transform
D3DXMatrixRotationAxis
D3DXGetFVFVertexSize
D3DXVec3TransformCoord
D3DXVec3Normalize
python27
PyString_FromStringAndSize
PyList_SetItem
PyErr_Occurred
PyEval_EvalCode
PyEval_GetRestricted
PyCode_New
PyComplex_FromCComplex
PyFloat_FromDouble
_PyLong_FromByteArray
PyInt_FromLong
PyUnicodeUCS2_DecodeUTF8
PyMarshal_ReadObjectFromString
_PyLong_New
_Py_EllipsisObject
PyExc_StopIteration
PyExc_EOFError
PyExc_ValueError
PyCode_Addr2Line
PyObject_AsCharBuffer
PyImport_AddModule
PyImport_GetMagicNumber
Py_FlushLine
PyCode_Type
PyRun_StringFlags
Py_IgnoreEnvironmentFlag
Py_FrozenFlag
Py_NoSiteFlag
Py_OptimizeFlag
Py_Finalize
Py_Initialize
Py_SetPythonHome
Py_SetProgramName
PyErr_Fetch
PyModule_GetDict
_Py_NoneStruct
PyNumber_Check
PyObject_CallObject
PyErr_Print
PyErr_BadArgument
PyErr_Clear
PyFloat_AsDouble
PyLong_AsLongLong
PyLong_AsUnsignedLong
PyCallable_Check
PyObject_GetAttr
PyString_InternFromString
PyDict_Next
PyDict_Size
PyImport_ExecCodeModule
Py_CompileStringFlags
PyObject_GetAttrString
PyImport_ImportModule
PyTuple_SetItem
PyTuple_New
PyLong_FromUnsignedLong
PyDict_SetItem
PyDict_New
PyLong_FromLongLong
PyLong_AsLong
PyDict_GetItemString
PyTuple_Size
PyList_Append
PyList_New
PyDict_SetItemString
PyString_FromString
PyDict_Type
PyArg_ParseTuple
PyInt_AsLong
PyTuple_GetItem
PyExc_RuntimeError
PyErr_SetString
PyString_AsString
_PyThreadState_Current
PyModule_AddIntConstant
Py_InitModule4
PyErr_NoMemory
Py_BuildValue
PyEval_SetTrace
devil
ilInit
ilSetPixels
ilTexImage
ilSave
ilShutDown
ilDeleteImages
ilCopyPixels
ilConvertImage
ilGetInteger
ilLoad
ilOriginFunc
ilEnable
ilBindImage
ilGenImages
imm32
ImmGetOpenStatus
ImmSetConversionStatus
ImmGetConversionStatus
ImmGetCandidateListW
ImmSetCompositionStringW
ImmNotifyIME
ImmGetCompositionStringW
ImmAssociateContext
ImmReleaseContext
ImmGetContext
ImmIsIME
ImmGetIMEFileNameA
version
VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
imagehlp
GetTimestampForLoadedLibrary
EnumerateLoadedModules
StackWalk
granny2
_GrannySetLogCallback@4
_GrannyGetMaterialTextureByType@8
_GrannyFindMatchingMember@16
_GrannyConvertSingleObject@20
_GrannyReadEntireFileFromMemory@8
_GrannyFreeFileSection@8
_GrannyFreeFile@4
_GrannyGetFileInfo@4
_GrannyGetSourceSkeleton@4
_GrannySetModelClock@8
_GrannyFreeCompletedModelControls@4
_GrannySampleModelAnimationsAccelerated@20
_GrannyUpdateModelMatrix@20
_GrannyNewLocalPose@4
_GrannyFreeLocalPose@4
_GrannyGetWorldPoseComposite4x4Array@4
_GrannyInstantiateModel@4
_GrannyFreeModelInstance@4
_GrannyNewMeshBinding@12
_GrannyFreeMeshBinding@4
_GrannyGetMeshBindingToBoneIndices@4
_GrannyFindBoneByName@12
_GrannyNewWorldPose@4
_GrannyFreeWorldPose@4
_GrannyGetWorldPose4x4@8
_GrannyGetWorldPoseComposite4x4@8
_GrannyGetTotalTypeSize@4
_GrannyGetMeshVertexCount@4
_GrannyMeshIsRigid@4
_GrannyGetMeshIndexCount@4
_GrannyGetSourceModel@4
_GrannyFindTrackGroupForModel@12
_GrannyFreeControl@4
_GrannyFreeControlOnceUnused@4
_GrannyCompleteControlAt@8
_GrannyControlIsComplete@4
_GrannyGetControlLoopCount@4
_GrannySetControlLoopCount@8
_GrannyGetControlSpeed@4
GrannyPNT332VertexType
_GrannySetControlSpeed@8
_GrannyGetControlLocalDuration@4
_GrannySetControlEaseIn@8
_GrannySetControlEaseInCurve@28
_GrannySetControlEaseOut@8
_GrannySetControlEaseOutCurve@28
_GrannyGetControlRawLocalClock@4
_GrannySetControlRawLocalClock@8
_GrannyPlayControlledAnimation@12
_GrannyBeginControlledAnimation@8
_GrannyEndControlledAnimation@4
_GrannySetTrackGroupTarget@12
_GrannySetTrackGroupLOD@16
_GrannyGetMeshTriangleGroupCount@4
_GrannyGetMeshTriangleGroups@4
_GrannyGetMeshVertexType@4
_GrannyCopyMeshVertices@12
_GrannyGetMeshVertices@4
_GrannyCopyMeshIndices@12
_GrannyNewMeshDeformer@16
_GrannyFreeMeshDeformer@4
_GrannyDeformVertices@24
_GrannyFreeControlIfComplete@4
mss32
_AIL_file_type@8
_AIL_open_digital_driver@16
_AIL_open_stream@12
_AIL_close_digital_driver@4
_AIL_enumerate_3D_providers@12
_AIL_open_3D_provider@4
_AIL_close_3D_provider@4
_AIL_open_3D_listener@4
_AIL_close_3D_listener@4
_AIL_set_3D_position@16
_AIL_set_3D_velocity@20
_AIL_set_3D_orientation@28
_AIL_startup@0
_AIL_shutdown@0
_AIL_set_redist_directory@4
_AIL_close_stream@4
_AIL_start_stream@4
_AIL_pause_stream@8
_AIL_set_stream_volume_levels@12
_AIL_stream_volume_levels@12
_AIL_set_stream_loop_count@8
_AIL_stream_status@4
_AIL_last_error@0
_AIL_decompress_ASI@24
_AIL_release_sample_handle@4
_AIL_init_sample@4
_AIL_set_sample_file@12
_AIL_start_sample@4
_AIL_stop_sample@4
_AIL_resume_sample@4
_AIL_end_sample@4
_AIL_set_sample_volume_pan@12
_AIL_set_sample_loop_count@8
_AIL_sample_status@4
_AIL_sample_volume_pan@12
_AIL_allocate_3D_sample_handle@4
_AIL_release_3D_sample_handle@4
_AIL_start_3D_sample@4
_AIL_stop_3D_sample@4
_AIL_resume_3D_sample@4
_AIL_end_3D_sample@4
_AIL_set_3D_sample_file@8
_AIL_set_3D_sample_volume@8
_AIL_set_3D_sample_loop_count@8
_AIL_3D_sample_status@4
_AIL_3D_sample_volume@4
_AIL_update_3D_position@8
_AIL_auto_update_3D_position@8
_AIL_decompress_ADPCM@12
_AIL_WAV_info@8
_AIL_set_file_callbacks@16
_AIL_allocate_sample_handle@4
_AIL_mem_free_lock@4
_AIL_file_read@8
speedtreert
?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ
?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z
?GetCurrentError@CSpeedTreeRT@@SAPBDXZ
?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z
?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z
?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z
?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ
?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z
?SetLodLimits@CSpeedTreeRT@@QAEXMM@Z
?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z
?SetLodLevel@CSpeedTreeRT@@QAEXM@Z
?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z
?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z
?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetLeafLightingAdjustment@CSpeedTreeRT@@QBEMXZ
?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z
?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ
?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z
?DeleteTransientData@CSpeedTreeRT@@QAEXXZ
?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ
?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z
??3CSpeedTreeRT@@SAXPAX@Z
??2CSpeedTreeRT@@SAPAXI@Z
??0CSpeedTreeRT@@QAE@XZ
??1STextures@CSpeedTreeRT@@QAE@XZ
??0STextures@CSpeedTreeRT@@QAE@XZ
??1SGeometry@CSpeedTreeRT@@QAE@XZ
??0SGeometry@CSpeedTreeRT@@QAE@XZ
?SetCamera@CSpeedTreeRT@@SAXPBM0@Z
?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z
?SetLightState@CSpeedTreeRT@@SAXI_N@Z
?SetTime@CSpeedTreeRT@@SAXM@Z
?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z
?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z
??1CSpeedTreeRT@@QAE@XZ
dinput8
DirectInput8Create
ws2_32
closesocket
connect
ioctlsocket
recv
select
send
socket
WSAGetLastError
WSAStartup
WSACleanup
htonl
sendto
recvfrom
freeaddrinfo
getaddrinfo
listen
accept
WSAIoctl
WSASetLastError
setsockopt
htons
getsockopt
getsockname
getpeername
bind
WSAWaitForMultipleEvents
WSASetEvent
WSAResetEvent
inet_addr
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
__WSAFDIsSet
ntohl
ntohs
gethostbyname
gethostname
WSAEventSelect
ddraw
DirectDrawCreate
advapi32
RegCloseKey
RegOpenKeyExA
CryptEncrypt
CryptImportKey
RegQueryValueExA
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptGenRandom
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
shell32
SHGetSpecialFolderPathA
oleaut32
SysFreeString
VariantClear
VariantInit
SafeArrayAccessData
SafeArrayDestroy
SafeArrayCreate
SysAllocString
crypt32
CertFreeCertificateChain
CryptDecodeObjectEx
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CryptStringToBinaryA
PFXImportCertStore
CertFreeCertificateChainEngine
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertGetCertificateChain
wldap32
ord217
ord143
ord211
ord60
ord45
ord50
ord41
ord22
ord26
ord301
ord46
ord27
ord32
ord33
ord35
ord79
ord30
ord200
normaliz
IdnToUnicode
IdnToAscii
Sections
.text Size: 4.4MB - Virtual size: 4.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 707KB - Virtual size: 706KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128KB - Virtual size: 716KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 51KB - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ