Static task
static1
Behavioral task
behavioral1
Sample
f6a5d84c6a9ac75570ad38494f714662cec89680f8caae8c9e2c388e3c297103.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
f6a5d84c6a9ac75570ad38494f714662cec89680f8caae8c9e2c388e3c297103.exe
Resource
win10v2004-20230915-en
General
-
Target
f6a5d84c6a9ac75570ad38494f714662cec89680f8caae8c9e2c388e3c297103
-
Size
4.0MB
-
MD5
c4a38ef57ea2c5c76098bf77edfee706
-
SHA1
7cb72c109516c1e46051a982b5aa08e83afc6b7f
-
SHA256
f6a5d84c6a9ac75570ad38494f714662cec89680f8caae8c9e2c388e3c297103
-
SHA512
44ae2ba61ae20a212e96e2e355450ff71adfb95bac5fe1151201318e8e61a1a15c6b5b0c31fbb929a17c2333c0ab9a69d3fd147e63b1bd72c0673305607bfbd7
-
SSDEEP
98304:QbZp6TWI4ML5xx3q8Hvfmf3AQG/D+1hrJVkdsLOId:QbZp6TWYyCfmf3AQ0Dj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f6a5d84c6a9ac75570ad38494f714662cec89680f8caae8c9e2c388e3c297103
Files
-
f6a5d84c6a9ac75570ad38494f714662cec89680f8caae8c9e2c388e3c297103.exe windows:6 windows x86
84ff32238ce1c75f2a2282693e1a1077
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
libcef
cef_string_multimap_key
cef_string_multimap_value
cef_string_multimap_append
cef_log
cef_string_map_append
cef_string_multimap_free
cef_string_list_append
cef_string_list_value
cef_string_list_size
cef_string_map_value
cef_string_multimap_size
cef_string_map_key
cef_string_multimap_alloc
cef_string_utf16_clear
cef_string_utf8_to_utf16
cef_string_utf8_clear
cef_string_utf16_cmp
cef_string_utf16_to_utf8
cef_string_utf16_set
cef_string_userfree_utf16_free
cef_string_list_alloc
cef_string_list_free
cef_register_extension
cef_execute_process
cef_initialize
cef_shutdown
cef_run_message_loop
cef_api_hash
cef_v8context_get_current_context
cef_string_map_alloc
cef_string_map_free
cef_command_line_get_global
cef_browser_host_create_browser
cef_string_map_size
kernel32
GetTimeZoneInformation
FlushFileBuffers
MoveFileExW
DeleteFileW
CreateDirectoryW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetFileAttributesExW
CreateProcessW
GetExitCodeProcess
ReadConsoleW
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
HeapAlloc
HeapFree
GetStdHandle
GetFileType
FreeLibraryAndExitThread
ExitThread
CreateThread
GetModuleHandleExW
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
WriteConsoleW
RtlUnwind
RaiseException
GetModuleFileNameW
WaitNamedPipeW
PeekNamedPipe
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
TerminateProcess
UnhandledExceptionFilter
CreateEventW
ResetEvent
VerSetConditionMask
VerifyVersionInfoW
SetEnvironmentVariableW
GetLastError
Sleep
ExitProcess
GetModuleHandleA
LoadLibraryA
GetCurrentDirectoryW
GetTickCount
MultiByteToWideChar
CloseHandle
GetCurrentProcess
ReadProcessMemory
CreateToolhelp32Snapshot
Module32First
Module32Next
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
WaitForSingleObject
GetSystemInfo
SetFileAttributesA
FindClose
FindFirstFileA
FindNextFileA
GetCurrentDirectoryA
DeleteFileA
GetModuleFileNameA
GlobalFree
lstrlenA
GetPrivateProfileStringA
MoveFileA
SetLastError
WinExec
GetCurrentThread
SetUnhandledExceptionFilter
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
GetFileSize
CreateFileA
GlobalAlloc
OutputDebugStringA
ReadFile
WriteFile
SetStdHandle
HeapReAlloc
FindNextFileW
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapSize
GetCurrentProcessId
SetEndOfFile
GetSystemDirectoryA
GetVersionExA
FreeLibrary
GetProcAddress
GlobalUnlock
GlobalLock
lstrlenW
WideCharToMultiByte
CompareStringA
GetLocaleInfoA
ReleaseSemaphore
QueryPerformanceCounter
WaitForSingleObjectEx
CreateDirectoryA
InterlockedPushEntrySList
GetCurrentThreadId
GetExitCodeThread
InitializeCriticalSectionAndSpinCount
InitOnceExecuteOnce
GetStringTypeW
QueryPerformanceFrequency
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
CreateFileW
IsProcessorFeaturePresent
GetProcessHeap
HeapValidate
GetCPInfo
GetModuleHandleW
GetSystemTimeAsFileTime
LCMapStringEx
DecodePointer
EncodePointer
SleepConditionVariableSRW
SleepConditionVariableCS
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
TryEnterCriticalSection
InitializeCriticalSectionEx
user32
CharNextExA
CharNextW
GetClipboardData
CloseClipboard
OpenClipboard
GetClientRect
PeekMessageA
UpdateWindow
SetFocus
MoveWindow
ShowWindow
DestroyWindow
IsWindow
CreateWindowExA
RegisterClassExA
UnregisterClassA
DefWindowProcA
LoadImageA
DestroyIcon
FlashWindowEx
GetAsyncKeyState
RegisterClassA
GetMenu
AdjustWindowRectEx
GetDC
ReleaseDC
CharPrevExA
ClientToScreen
FillRect
SetRect
OffsetRect
PostQuitMessage
SetWindowPos
GetCursorPos
ScreenToClient
FindWindowA
LoadIconA
SystemParametersInfoA
GetKeyState
ShowCursor
SetCursor
DestroyCursor
SetCursorPos
GetCapture
SetCapture
ReleaseCapture
ChangeDisplaySettingsA
GetSystemMetrics
IsIconic
LoadStringA
MessageBoxA
GetKeyboardLayout
GetKeyboardLayoutNameA
DispatchMessageA
TranslateMessage
GetWindowLongA
SetWindowLongA
LoadCursorA
InvalidateRect
GetMessageA
gdi32
GetStockObject
StretchBlt
DeleteObject
CreateSolidBrush
CreateCompatibleDC
DeleteDC
SelectObject
SetBkColor
SetTextColor
CreateDIBSection
TextOutA
CreateFontIndirectA
GetCharABCWidthsFloatW
EnumFontFamiliesExA
GetTextExtentPoint32W
TextOutW
SetBkMode
GetTextExtentPoint32A
shell32
SetCurrentProcessExplicitAppUserModelID
SHGetSpecialFolderPathA
ole32
CoCreateInstance
CoUninitialize
CoInitialize
CoInitializeEx
winmm
timeGetTime
timeGetDevCaps
timeBeginPeriod
timeEndPeriod
d3d8
Direct3DCreate8
python27
PyTuple_Size
PyModule_AddIntConstant
PyString_AsString
PyErr_SetString
PyExc_RuntimeError
_PyThreadState_Current
PyInt_AsLong
PyString_FromString
PyTuple_GetItem
PyList_New
PyList_Append
PyLong_AsLong
PyDict_GetItemString
PyLong_FromLongLong
PyTuple_New
PyTuple_SetItem
PyDict_Next
PyDict_Size
PyArg_ParseTuple
PyInt_FromLong
PyList_SetItem
PyDict_New
PyDict_SetItem
PyModule_AddStringConstant
PyImport_ImportModule
PyString_InternFromString
PyObject_GetAttrString
PyObject_GetAttr
PyCallable_Check
PyLong_AsLongLong
PyLong_AsUnsignedLongLong
Py_InitModule4
PyErr_Clear
PyErr_BadArgument
PyErr_Print
PyObject_CallObject
PyNumber_Check
_Py_NoneStruct
PyDict_SetItemString
PyModule_GetDict
PyErr_Fetch
Py_SetProgramName
Py_Initialize
Py_Finalize
PyRun_StringFlags
PyImport_AddModule
PyFloat_AsDouble
Py_BuildValue
imm32
ImmGetIMEFileNameA
ImmGetContext
ImmReleaseContext
ImmAssociateContext
ImmGetCompositionStringW
ImmSetCompositionStringW
ImmGetCandidateListW
ImmGetConversionStatus
ImmSetConversionStatus
ImmGetOpenStatus
ImmNotifyIME
ImmIsIME
iphlpapi
IcmpCreateFile
IcmpSendEcho
GetAdaptersInfo
ws2_32
WSACleanup
WSAStartup
socket
send
select
recv
ioctlsocket
connect
closesocket
__WSAFDIsSet
inet_addr
gethostbyname
htons
WSAGetLastError
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
imagehlp
EnumerateLoadedModules
StackWalk
GetTimestampForLoadedLibrary
devil
ilSave
ilTexImage
ilInit
ilShutDown
ilOriginFunc
ilLoad
ilGetInteger
ilGenImages
ilEnable
ilSetPixels
ilDeleteImages
ilCopyPixels
ilConvertImage
ilBindImage
granny2
GrannyPNT332VertexType
_GrannyDeformVertices@24
_GrannyFreeMeshDeformer@4
_GrannyNewMeshDeformer@16
_GrannyCopyMeshIndices@12
_GrannyGetMeshVertices@4
_GrannyCopyMeshVertices@12
_GrannyGetMeshVertexType@4
_GrannyGetMeshTriangleGroups@4
_GrannyGetMeshTriangleGroupCount@4
_GrannySetTrackGroupLOD@16
_GrannySetTrackGroupTarget@12
_GrannyEndControlledAnimation@4
_GrannyBeginControlledAnimation@8
_GrannyPlayControlledAnimation@12
_GrannySetControlRawLocalClock@8
_GrannyGetControlRawLocalClock@4
_GrannySetControlEaseOutCurve@28
_GrannySetControlEaseOut@8
_GrannySetControlEaseInCurve@28
_GrannySetControlEaseIn@8
_GrannyGetControlLocalDuration@4
_GrannySetControlSpeed@8
_GrannyGetControlSpeed@4
_GrannySetControlLoopCount@8
_GrannyGetControlLoopCount@4
_GrannyFreeControlIfComplete@4
_GrannyControlIsComplete@4
_GrannyCompleteControlAt@8
_GrannyFreeControlOnceUnused@4
_GrannyFreeControl@4
_GrannyFindTrackGroupForModel@12
_GrannyGetSourceModel@4
_GrannyGetMeshIndexCount@4
_GrannyMeshIsRigid@4
_GrannyGetMeshVertexCount@4
_GrannyGetTotalTypeSize@4
_GrannyGetWorldPoseComposite4x4@8
_GrannyGetWorldPose4x4@8
_GrannyNewWorldPose@4
_GrannyFindBoneByName@12
_GrannyGetMeshBindingToBoneIndices@4
_GrannyFreeMeshBinding@4
_GrannyNewMeshBinding@12
_GrannyFreeModelInstance@4
_GrannyInstantiateModel@4
_GrannyGetWorldPoseComposite4x4Array@4
_GrannyFreeLocalPose@4
_GrannyNewLocalPose@4
_GrannyUpdateModelMatrix@20
_GrannySampleModelAnimationsAccelerated@20
_GrannyFreeCompletedModelControls@4
_GrannySetModelClock@8
_GrannyGetSourceSkeleton@4
_GrannyGetFileInfo@4
_GrannyFreeFile@4
_GrannyFreeFileSection@8
_GrannyReadEntireFileFromMemory@8
_GrannyConvertSingleObject@20
_GrannyFindMatchingMember@16
_GrannyGetMaterialTextureByType@8
_GrannyGetLogMessageOriginString@4
_GrannyGetLogMessageTypeString@4
_GrannySetLogCallback@4
_GrannyFreeWorldPose@4
mss32
_AIL_set_file_callbacks@16
_AIL_WAV_info@8
_AIL_decompress_ASI@24
_AIL_decompress_ADPCM@12
_AIL_auto_update_3D_position@8
_AIL_file_read@8
_AIL_file_type@8
_AIL_open_digital_driver@16
_AIL_open_stream@12
_AIL_close_digital_driver@4
_AIL_enumerate_3D_providers@12
_AIL_open_3D_provider@4
_AIL_close_3D_provider@4
_AIL_open_3D_listener@4
_AIL_close_3D_listener@4
_AIL_set_3D_position@16
_AIL_set_3D_velocity@20
_AIL_set_3D_orientation@28
_AIL_startup@0
_AIL_shutdown@0
_AIL_set_redist_directory@4
_AIL_close_stream@4
_AIL_start_stream@4
_AIL_pause_stream@8
_AIL_set_stream_volume_levels@12
_AIL_stream_volume_levels@12
_AIL_set_stream_loop_count@8
_AIL_stream_status@4
_AIL_last_error@0
_AIL_allocate_sample_handle@4
_AIL_release_sample_handle@4
_AIL_init_sample@4
_AIL_set_sample_file@12
_AIL_start_sample@4
_AIL_stop_sample@4
_AIL_resume_sample@4
_AIL_end_sample@4
_AIL_set_sample_volume_pan@12
_AIL_set_sample_loop_count@8
_AIL_sample_status@4
_AIL_sample_volume_pan@12
_AIL_allocate_3D_sample_handle@4
_AIL_release_3D_sample_handle@4
_AIL_start_3D_sample@4
_AIL_stop_3D_sample@4
_AIL_resume_3D_sample@4
_AIL_end_3D_sample@4
_AIL_set_3D_sample_file@8
_AIL_set_3D_sample_volume@8
_AIL_set_3D_sample_loop_count@8
_AIL_3D_sample_status@4
_AIL_3D_sample_volume@4
_AIL_mem_free_lock@4
speedtreert
?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z
?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z
?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ
?SetLodLevel@CSpeedTreeRT@@QAEXM@Z
?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z
?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ
?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z
?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ
?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
??3CSpeedTreeRT@@SAXPAX@Z
?SetTime@CSpeedTreeRT@@SAXM@Z
?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z
?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z
?SetLightState@CSpeedTreeRT@@SAXI_N@Z
?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z
?SetCamera@CSpeedTreeRT@@SAXPBM0@Z
??0SGeometry@CSpeedTreeRT@@QAE@XZ
??1SGeometry@CSpeedTreeRT@@QAE@XZ
??0STextures@CSpeedTreeRT@@QAE@XZ
??1STextures@CSpeedTreeRT@@QAE@XZ
??0CSpeedTreeRT@@QAE@XZ
??1CSpeedTreeRT@@QAE@XZ
?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z
?SetLodLimits@CSpeedTreeRT@@QAEXMM@Z
?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ
?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z
?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z
?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z
?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetLocalMatrices@CSpeedTreeRT@@QAEXII@Z
?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z
??2CSpeedTreeRT@@SAPAXI@Z
?GetCurrentError@CSpeedTreeRT@@SAPBDXZ
?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z
?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ
?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z
?ComputeLodLevel@CSpeedTreeRT@@QAEXXZ
dinput8
DirectInput8Create
ddraw
DirectDrawCreate
advapi32
CryptAcquireContextA
RegOpenKeyExA
RegQueryValueExA
RegOpenKeyA
RegQueryValueExW
RegOpenKeyExW
CryptGenRandom
CryptReleaseContext
RegCloseKey
RegCreateKeyExW
RegSetValueExW
oleaut32
SysFreeString
VariantClear
Sections
.text Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 538KB - Virtual size: 538KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 210KB - Virtual size: 699KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 331KB - Virtual size: 330KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 165KB - Virtual size: 165KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ