Static task
static1
Behavioral task
behavioral1
Sample
81b2b2615361b17d776342ba5a386302431d572751c11ba4cf765f6c7d8a9939.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
81b2b2615361b17d776342ba5a386302431d572751c11ba4cf765f6c7d8a9939.exe
Resource
win10v2004-20230915-en
General
-
Target
81b2b2615361b17d776342ba5a386302431d572751c11ba4cf765f6c7d8a9939
-
Size
5.3MB
-
MD5
2d83177c49a7fa3320ea0685a34e5504
-
SHA1
a2052757cb1d99a8d9d2a41db2af62af07cfa276
-
SHA256
81b2b2615361b17d776342ba5a386302431d572751c11ba4cf765f6c7d8a9939
-
SHA512
27831e0c9755e3ffb8251b63d9e34a6aa1f3907ec381719ea30e49f0da59b88ec5d0d0659a94c53e2828bdc0f6939671c68c309a3d00311b660490a22daa12b7
-
SSDEEP
98304:hv52aWxt5TICZoePEXcrxg33xm1bG4aEo:b2ag5TIgBg346
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 81b2b2615361b17d776342ba5a386302431d572751c11ba4cf765f6c7d8a9939
Files
-
81b2b2615361b17d776342ba5a386302431d572751c11ba4cf765f6c7d8a9939.exe windows:6 windows x86
0346cef7bb9a61af481e2b60913f73fc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FlsGetValue
FlsAlloc
SetFileInformationByHandle
TryEnterCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
GetFileInformationByHandleEx
InitializeConditionVariable
CreateSymbolicLinkW
GlobalFree
GetModuleFileNameA
ReleaseMutex
CreateMutexA
DeleteFileA
GetPrivateProfileStringA
lstrlenA
GetCurrentDirectoryA
MoveFileA
FindClose
FindNextFileA
FindFirstFileA
SetFileAttributesA
SetThreadPriority
CreateEventA
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
WaitForSingleObject
SetEvent
Process32Next
SetEndOfFile
HeapQueryInformation
HeapSize
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FlsSetValue
FindFirstFileExW
SetStdHandle
OutputDebugStringW
HeapReAlloc
SetFileAttributesW
SetCurrentDirectoryW
GetTimeZoneInformation
CreateProcessW
GetExitCodeProcess
GetFileAttributesExW
SetConsoleCtrlHandler
FlushFileBuffers
MoveFileExW
DeleteFileW
CreateDirectoryW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
Sleep
CompareStringW
GetTimeFormatW
GetDateFormatW
GetTempPathW
ReadConsoleW
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileInformationByHandle
WriteConsoleW
GetModuleFileNameW
GetFileType
GetStdHandle
ExitProcess
GetFullPathNameW
GetDriveTypeW
GetModuleHandleExW
FreeLibraryAndExitThread
ResumeThread
ExitThread
CreateThread
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RaiseException
FlsFree
WakeConditionVariable
InitOnceExecuteOnce
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
CreateEventExW
CreateSemaphoreExW
FlushProcessWriteBuffers
GetCurrentProcessorNumber
GetTickCount64
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
FindNextFileW
CloseThreadpoolWork
OpenProcess
Process32First
GetSystemInfo
GetLastError
ReadProcessMemory
GetCurrentProcess
Module32Next
Module32First
GetCurrentProcessId
CreateToolhelp32Snapshot
GetTickCount
GetCurrentDirectoryW
MultiByteToWideChar
HeapFree
GetProcessHeap
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
GetThreadTimes
QueryPerformanceFrequency
SetLastError
GetSystemTimeAsFileTime
GetCurrentThreadId
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
TerminateProcess
UnhandledExceptionFilter
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
InitializeCriticalSectionAndSpinCount
GetLocaleInfoEx
GetCPInfo
CompareStringEx
LCMapStringEx
InitializeCriticalSectionEx
LocalFree
DecodePointer
EncodePointer
GetStringTypeW
FormatMessageA
FindResourceW
FindResourceA
SizeofResource
LoadResource
LockResource
CreateFileW
IsProcessorFeaturePresent
InterlockedDecrement
HeapValidate
InterlockedIncrement
QueryPerformanceCounter
CopyFileA
CreateSemaphoreA
ReleaseSemaphore
GetLocaleInfoA
CompareStringA
WideCharToMultiByte
lstrlenW
GlobalLock
GlobalUnlock
LoadLibraryA
GetProcAddress
FreeLibrary
GetVersionExA
GetSystemDirectoryA
WriteFile
SetFilePointer
ReadFile
OutputDebugStringA
WinExec
GetModuleHandleA
GetCurrentThread
SetUnhandledExceptionFilter
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
GetFileSize
GetTempFileNameA
GetTempPathA
RemoveDirectoryA
CreateDirectoryA
AllocConsole
GlobalAlloc
HeapAlloc
CloseHandle
DeviceIoControl
LCMapStringW
CreateFileA
user32
LoadStringA
MessageBoxA
FindWindowA
LoadIconA
SetWindowPos
SystemParametersInfoA
FlashWindowEx
GetKeyState
LoadImageA
DestroyCursor
GetMonitorInfoA
MonitorFromPoint
CharPrevExA
CharNextExA
CharNextW
GetClipboardData
CloseClipboard
OpenClipboard
GetKeyboardLayout
GetKeyboardLayoutNameA
DefWindowProcA
UnregisterClassA
RegisterClassExA
CreateWindowExA
IsWindow
DestroyWindow
MoveWindow
SetFocus
UpdateWindow
GetWindowLongA
SetWindowLongA
RegisterClassA
IsIconic
GetMenu
SetWindowTextA
ScreenToClient
GetCursorPos
PostQuitMessage
GetAsyncKeyState
SetRect
OffsetRect
GetClientRect
ClientToScreen
PeekMessageA
ShowCursor
ReleaseDC
FillRect
GetDC
EndPaint
BeginPaint
InvalidateRect
SetCursor
SetCursorPos
SetCapture
GetWindowRect
AdjustWindowRectEx
LoadCursorA
GetMessageA
TranslateMessage
DispatchMessageA
GetSystemMetrics
GetCapture
ShowWindow
ReleaseCapture
ChangeDisplaySettingsA
gdi32
CreateDIBSection
TextOutA
SetDIBitsToDevice
GetCharABCWidthsFloatW
GetTextExtentPoint32W
TextOutW
GetDeviceCaps
GetPixel
SetBkMode
SelectObject
DeleteDC
CreateCompatibleDC
EnumFontFamiliesExA
GetStockObject
StretchBlt
DeleteObject
CreateSolidBrush
PatBlt
GetTextExtentPoint32A
SetTextColor
CreateFontIndirectA
SetBkColor
advapi32
CryptGenRandom
CryptReleaseContext
RegQueryValueExA
RegQueryValueExW
CryptAcquireContextA
RegOpenKeyA
RegOpenKeyExW
RegCloseKey
RegOpenKeyExA
ole32
CoInitializeEx
OleUninitialize
OleInitialize
CoGetClassObject
CoCreateInstance
CoInitialize
CoUninitialize
OleSetContainedObject
winmm
timeGetTime
timeGetDevCaps
timeBeginPeriod
timeEndPeriod
d3d8
Direct3DCreate8
python27
PyList_New
PyInt_AsLong
PyTuple_GetItem
PyExc_RuntimeError
PyErr_SetString
Py_InitModule4
Py_BuildValue
PyTuple_SetItem
PyInt_FromLong
PyDict_SetItemString
PyDict_Size
PyDict_Next
PyObject_HasAttrString
PyString_AsString
PyString_FromString
PyDict_New
PyTuple_New
PyLong_FromLongLong
PyObject_GetAttrString
PyDict_SetItem
PyString_InternFromString
PyObject_GetAttr
PyCallable_Check
PyLong_AsUnsignedLong
PyArg_ParseTuple
PyLong_AsLong
PyDict_GetItemString
PyList_SetItem
PyTuple_Size
PyModule_AddIntConstant
PyFloat_AsDouble
PyErr_Clear
PyErr_BadArgument
PyErr_Print
PyObject_CallObject
PyNumber_Check
_Py_NoneStruct
PyModule_GetDict
PyErr_Fetch
Py_SetProgramName
Py_Initialize
Py_Finalize
PyRun_StringFlags
PyEval_SetTrace
Py_FlushLine
PyImport_GetMagicNumber
PyImport_AddModule
PyImport_ImportModule
PyObject_AsCharBuffer
PyCode_Addr2Line
PyEval_EvalCode
Py_OptimizeFlag
PyCode_Type
PyUnicodeUCS2_DecodeUTF8
_PyLong_FromByteArray
PyFloat_FromDouble
PyComplex_FromCComplex
PyString_FromStringAndSize
PyErr_Occurred
PyErr_NoMemory
PyEval_GetRestricted
PyCode_New
PyMarshal_ReadObjectFromString
_PyLong_New
_Py_EllipsisObject
PyExc_StopIteration
PyExc_EOFError
PyExc_ValueError
PyLong_AsLongLong
PyList_Append
iphlpapi
GetAdaptersInfo
GetPerAdapterInfo
imm32
ImmGetOpenStatus
ImmSetConversionStatus
ImmGetConversionStatus
ImmGetCandidateListW
ImmSetCompositionStringW
ImmGetCompositionStringW
ImmAssociateContext
ImmReleaseContext
ImmGetContext
ImmIsIME
ImmGetIMEFileNameA
ImmNotifyIME
devil
ilLoad
ilOriginFunc
ilEnable
ilBindImage
ilGenImages
ilInit
ilSetPixels
ilTexImage
ilSave
ilShutDown
ilDeleteImages
ilConvertImage
ilCopyPixels
ilGetInteger
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
imagehlp
StackWalk
EnumerateLoadedModules
GetTimestampForLoadedLibrary
granny2
_GrannyFreeWorldPose@4
_GrannyNewWorldPose@4
_GrannyFindBoneByName@12
_GrannyGetMeshBindingToBoneIndices@4
_GrannyFreeMeshBinding@4
_GrannyNewMeshBinding@12
_GrannyFreeModelInstance@4
_GrannyInstantiateModel@4
_GrannyGetWorldPoseComposite4x4Array@4
_GrannyFreeLocalPose@4
_GrannyNewLocalPose@4
_GrannyGetWorldPose4x4@8
_GrannySampleModelAnimationsAccelerated@20
_GrannyFreeCompletedModelControls@4
_GrannySetModelClock@8
_GrannyGetSourceSkeleton@4
_GrannyGetFileInfo@4
_GrannyFreeFile@4
_GrannyFreeFileSection@8
_GrannyDeformVertices@24
_GrannyConvertSingleObject@20
_GrannyFindMatchingMember@16
_GrannyGetMaterialTextureByType@8
GrannyPNT332VertexType
_GrannyGetWorldPoseComposite4x4@8
_GrannyGetTotalTypeSize@4
_GrannyGetMeshVertexCount@4
_GrannyMeshIsRigid@4
_GrannyGetMeshIndexCount@4
_GrannyFreeControl@4
_GrannyFreeControlOnceUnused@4
_GrannyCompleteControlAt@8
_GrannyControlIsComplete@4
_GrannyFreeControlIfComplete@4
_GrannyGetControlLoopCount@4
_GrannySetControlLoopCount@8
_GrannyGetControlSpeed@4
_GrannySetControlSpeed@8
_GrannyGetControlLocalDuration@4
_GrannySetControlEaseIn@8
_GrannySetControlEaseInCurve@28
_GrannySetControlEaseOut@8
_GrannySetControlEaseOutCurve@28
_GrannyGetControlRawLocalClock@4
_GrannySetControlRawLocalClock@8
_GrannyPlayControlledAnimation@12
_GrannyGetMeshTriangleGroupCount@4
_GrannyGetMeshTriangleGroups@4
_GrannyGetMeshVertexType@4
_GrannyCopyMeshVertices@12
_GrannyGetMeshVertices@4
_GrannyCopyMeshIndices@12
_GrannyNewMeshDeformer@16
_GrannyUpdateModelMatrix@20
_GrannyFreeMeshDeformer@4
_GrannyReadEntireFileFromMemory@8
mss32
_AIL_mem_free_lock@4
_AIL_file_read@8
_AIL_set_file_callbacks@16
_AIL_WAV_info@8
_AIL_decompress_ASI@24
_AIL_decompress_ADPCM@12
_AIL_file_type@8
_AIL_open_digital_driver@16
_AIL_open_stream@12
_AIL_close_digital_driver@4
_AIL_auto_update_3D_position@8
_AIL_update_3D_position@8
_AIL_3D_sample_volume@4
_AIL_3D_sample_status@4
_AIL_enumerate_3D_providers@12
_AIL_set_3D_sample_volume@8
_AIL_set_3D_sample_file@8
_AIL_end_3D_sample@4
_AIL_resume_3D_sample@4
_AIL_stop_3D_sample@4
_AIL_start_3D_sample@4
_AIL_release_3D_sample_handle@4
_AIL_allocate_3D_sample_handle@4
_AIL_open_3D_provider@4
_AIL_sample_status@4
_AIL_set_sample_loop_count@8
_AIL_set_sample_volume_pan@12
_AIL_end_sample@4
_AIL_resume_sample@4
_AIL_stop_sample@4
_AIL_start_sample@4
_AIL_set_sample_file@12
_AIL_init_sample@4
_AIL_release_sample_handle@4
_AIL_allocate_sample_handle@4
_AIL_last_error@0
_AIL_stream_status@4
_AIL_set_stream_loop_count@8
_AIL_stream_volume_levels@12
_AIL_set_stream_volume_levels@12
_AIL_pause_stream@8
_AIL_start_stream@4
_AIL_close_stream@4
_AIL_set_redist_directory@4
_AIL_shutdown@0
_AIL_startup@0
_AIL_set_3D_orientation@28
_AIL_set_3D_velocity@20
_AIL_set_3D_position@16
_AIL_close_3D_listener@4
_AIL_open_3D_listener@4
_AIL_close_3D_provider@4
_AIL_sample_volume_pan@12
_AIL_set_3D_sample_loop_count@8
speedtreert
?GetCurrentError@CSpeedTreeRT@@SAPBDXZ
?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z
?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z
?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z
?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ
?SetLodLimits@CSpeedTreeRT@@QAEXMM@Z
?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z
?SetLodLevel@CSpeedTreeRT@@QAEXM@Z
?ComputeLodLevel@CSpeedTreeRT@@QAEXXZ
?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z
?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z
?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z
?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z
?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetLeafLightingAdjustment@CSpeedTreeRT@@QBEMXZ
?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z
?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ
?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z
?GetTreeSize@CSpeedTreeRT@@QBEXAAM0@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z
?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ
?SetLocalMatrices@CSpeedTreeRT@@QAEXII@Z
?SetTime@CSpeedTreeRT@@SAXM@Z
?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z
?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z
?SetLightState@CSpeedTreeRT@@SAXI_N@Z
?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z
?SetCamera@CSpeedTreeRT@@SAXPBM0@Z
??0SGeometry@CSpeedTreeRT@@QAE@XZ
??1SGeometry@CSpeedTreeRT@@QAE@XZ
??0STextures@CSpeedTreeRT@@QAE@XZ
??1STextures@CSpeedTreeRT@@QAE@XZ
??0CSpeedTreeRT@@QAE@XZ
??1CSpeedTreeRT@@QAE@XZ
??2CSpeedTreeRT@@SAPAXI@Z
??3CSpeedTreeRT@@SAXPAX@Z
?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z
?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ
?DeleteTransientData@CSpeedTreeRT@@QAEXXZ
dinput8
DirectInput8Create
ws2_32
connect
ioctlsocket
recv
closesocket
__WSAFDIsSet
socket
WSAGetLastError
WSACleanup
htonl
htons
inet_addr
ntohl
ntohs
send
gethostname
select
WSAStartup
gethostbyname
ddraw
DirectDrawCreate
shell32
SHGetSpecialFolderPathA
oleaut32
VariantClear
VariantInit
SafeArrayAccessData
SafeArrayDestroy
SafeArrayCreate
SysAllocString
SysFreeString
Sections
.text Size: 4.3MB - Virtual size: 4.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 729KB - Virtual size: 729KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 222KB - Virtual size: 522KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 60KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ