Static task
static1
Behavioral task
behavioral1
Sample
4060c3e57490611c918747f0ab008a61a5aa94ffad1d6d7ba89237b1b75ca3a3.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
4060c3e57490611c918747f0ab008a61a5aa94ffad1d6d7ba89237b1b75ca3a3.exe
Resource
win10v2004-20230915-en
General
-
Target
4060c3e57490611c918747f0ab008a61a5aa94ffad1d6d7ba89237b1b75ca3a3
-
Size
5.3MB
-
MD5
f21b1a52912ca851449ecca9a7bf0f23
-
SHA1
47cb9922d3755643539c507ec80623fa18b7a6ff
-
SHA256
4060c3e57490611c918747f0ab008a61a5aa94ffad1d6d7ba89237b1b75ca3a3
-
SHA512
b781c63ab1b538b6305dcdf8d574b010999f1510de27542f49a90c6fd9deb118b841136c4757ee5bc8f257cd5454baea2452b54a627758541bea2ce5b9582707
-
SSDEEP
98304:jfcUpWxCPgtOI5K3IVu56T8dNLaTvXM3oXa1vzMJzOqqUYOdoRW:oUpWxCPgtOI5K3IVuiaNLabvQI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4060c3e57490611c918747f0ab008a61a5aa94ffad1d6d7ba89237b1b75ca3a3
Files
-
4060c3e57490611c918747f0ab008a61a5aa94ffad1d6d7ba89237b1b75ca3a3.exe windows:6 windows x86
4f7b64624298c9e9c359d8244f711345
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SleepConditionVariableCS
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
TryEnterCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
SubmitThreadpoolWork
CloseThreadpoolWork
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
GetNativeSystemInfo
CloseThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
GetFileInformationByHandleEx
CreateSymbolicLinkW
GlobalFree
GetModuleFileNameA
ReleaseMutex
CreateMutexA
DeleteFileA
GetPrivateProfileStringA
lstrlenA
GetCurrentDirectoryA
MoveFileA
FindClose
FindNextFileA
FindFirstFileA
SetFileAttributesA
SetThreadPriority
CreateEventA
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
WaitForSingleObject
SetEvent
Process32Next
SetEndOfFile
HeapQueryInformation
HeapSize
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SleepConditionVariableSRW
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
SetStdHandle
OutputDebugStringW
HeapReAlloc
SetFileAttributesW
SetCurrentDirectoryW
GetTimeZoneInformation
CreateProcessW
GetExitCodeProcess
GetFileAttributesExW
SetConsoleCtrlHandler
FlushFileBuffers
MoveFileExW
DeleteFileW
CreateDirectoryW
EnumSystemLocalesW
Sleep
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
ReadConsoleW
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetFileInformationByHandle
WriteConsoleW
GetFileType
GetStdHandle
ExitProcess
GetFullPathNameW
GetDriveTypeW
GetModuleHandleExW
FreeLibraryAndExitThread
ResumeThread
ExitThread
CreateThread
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
SwitchToThread
SetFileInformationByHandle
GetExitCodeThread
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitOnceExecuteOnce
CreateEventExW
CreateSemaphoreExW
FlushProcessWriteBuffers
GetCurrentProcessorNumber
GetTickCount64
FreeLibraryWhenCallbackReturns
GetCommandLineA
CreateThreadpoolWork
OpenProcess
Process32First
GetSystemInfo
GetLastError
ReadProcessMemory
GetCurrentProcess
Module32Next
Module32First
GetCurrentProcessId
CreateToolhelp32Snapshot
GetTickCount
GetCurrentDirectoryW
MultiByteToWideChar
HeapFree
GetProcessHeap
TlsAlloc
RaiseException
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
GetThreadTimes
QueryPerformanceFrequency
SetLastError
GetModuleFileNameW
WaitNamedPipeW
PeekNamedPipe
GetSystemTimeAsFileTime
GetCurrentThreadId
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
TerminateProcess
UnhandledExceptionFilter
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
InitializeCriticalSectionAndSpinCount
GetLocaleInfoEx
GetCPInfo
CompareStringEx
LCMapStringEx
InitializeCriticalSectionEx
LocalFree
DecodePointer
EncodePointer
GetStringTypeW
FormatMessageA
FindResourceW
FindResourceA
SizeofResource
LoadResource
LockResource
CreateFileW
IsProcessorFeaturePresent
InterlockedDecrement
HeapValidate
InterlockedIncrement
QueryPerformanceCounter
CopyFileA
CreateSemaphoreA
ReleaseSemaphore
GetLocaleInfoA
CompareStringA
WideCharToMultiByte
lstrlenW
GlobalLock
GlobalUnlock
LoadLibraryA
GetProcAddress
FreeLibrary
GetVersionExA
GetSystemDirectoryA
WriteFile
SetFilePointer
ReadFile
OutputDebugStringA
WinExec
GetModuleHandleA
GetCurrentThread
SetUnhandledExceptionFilter
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
GetFileSize
GetTempFileNameA
GetTempPathA
RemoveDirectoryA
CreateDirectoryA
AllocConsole
GlobalAlloc
HeapAlloc
CloseHandle
DeviceIoControl
GetUserDefaultLCID
CreateFileA
user32
LoadIconA
SetWindowPos
SystemParametersInfoA
FlashWindowEx
GetKeyState
LoadImageA
DestroyCursor
GetMonitorInfoA
MonitorFromPoint
CharPrevExA
CharNextExA
CharNextW
DefWindowProcA
UnregisterClassA
RegisterClassExA
CreateWindowExA
IsWindow
DestroyWindow
MoveWindow
SetFocus
UpdateWindow
GetWindowLongA
SetWindowLongA
RegisterClassA
GetMenu
SetWindowTextA
GetWindowRect
FindWindowA
AdjustWindowRectEx
LoadCursorA
ScreenToClient
GetCursorPos
PostQuitMessage
GetAsyncKeyState
SetRect
OffsetRect
GetClientRect
ClientToScreen
PeekMessageA
ReleaseDC
FillRect
GetDC
EndPaint
BeginPaint
ShowCursor
InvalidateRect
SetCursor
SetCursorPos
SetCapture
GetMessageA
TranslateMessage
DispatchMessageA
GetKeyboardLayoutNameA
GetKeyboardLayout
OpenClipboard
CloseClipboard
GetClipboardData
MessageBoxA
LoadStringA
IsIconic
GetSystemMetrics
GetCapture
ShowWindow
ReleaseCapture
ChangeDisplaySettingsA
gdi32
CreateDIBSection
GetCharABCWidthsFloatW
GetTextExtentPoint32W
TextOutW
GetDeviceCaps
GetPixel
SetTextColor
SetDIBitsToDevice
SetBkColor
SelectObject
DeleteDC
CreateCompatibleDC
EnumFontFamiliesExA
GetStockObject
GetTextExtentPoint32A
TextOutA
CreateFontIndirectA
StretchBlt
DeleteObject
CreateSolidBrush
PatBlt
SetBkMode
advapi32
CryptGenRandom
RegOpenKeyExW
RegQueryValueExA
RegOpenKeyA
RegCloseKey
RegQueryValueExW
RegSetValueExW
CryptReleaseContext
CryptAcquireContextA
RegCreateKeyExW
RegOpenKeyExA
ole32
CoInitializeEx
OleUninitialize
OleInitialize
CoGetClassObject
CoCreateInstance
CoInitialize
CoUninitialize
OleSetContainedObject
winmm
timeGetTime
timeGetDevCaps
timeBeginPeriod
timeEndPeriod
d3d8
Direct3DCreate8
python27
PyList_New
PyInt_AsLong
PyTuple_GetItem
PyExc_RuntimeError
PyErr_SetString
Py_InitModule4
Py_BuildValue
PyTuple_SetItem
PyList_Append
PyInt_FromLong
PyDict_Size
PyDict_Next
PyObject_HasAttrString
PyString_AsString
PyString_FromString
PyModule_AddIntConstant
PyTuple_Size
PyDict_GetItemString
PyObject_GetAttrString
PyDict_SetItem
PyLong_AsLongLong
PyLong_AsLong
PyDict_SetItemString
PyDict_New
PyList_SetItem
PyTuple_New
PyString_InternFromString
PyObject_GetAttr
PyCallable_Check
PyLong_FromLongLong
PyFloat_AsDouble
PyErr_Clear
PyErr_BadArgument
PyErr_Print
PyObject_CallObject
PyNumber_Check
_Py_NoneStruct
PyModule_GetDict
PyErr_Fetch
Py_SetProgramName
Py_Initialize
Py_Finalize
PyRun_StringFlags
PyEval_SetTrace
Py_FlushLine
PyImport_GetMagicNumber
PyImport_AddModule
PyImport_ImportModule
PyObject_AsCharBuffer
PyCode_Addr2Line
PyEval_EvalCode
Py_OptimizeFlag
PyCode_Type
PyUnicodeUCS2_DecodeUTF8
_PyLong_FromByteArray
PyFloat_FromDouble
PyComplex_FromCComplex
PyString_FromStringAndSize
PyErr_Occurred
PyErr_NoMemory
PyEval_GetRestricted
PyCode_New
PyMarshal_ReadObjectFromString
_PyLong_New
_Py_EllipsisObject
PyExc_StopIteration
PyExc_EOFError
PyExc_ValueError
PyLong_AsUnsignedLong
PyArg_ParseTuple
iphlpapi
GetAdaptersInfo
GetPerAdapterInfo
imm32
ImmGetOpenStatus
ImmSetConversionStatus
ImmGetConversionStatus
ImmGetCandidateListW
ImmSetCompositionStringW
ImmGetCompositionStringW
ImmAssociateContext
ImmReleaseContext
ImmGetContext
ImmIsIME
ImmGetIMEFileNameA
ImmNotifyIME
devil
ilEnable
ilBindImage
ilGenImages
ilInit
ilSetPixels
ilTexImage
ilSave
ilShutDown
ilDeleteImages
ilCopyPixels
ilLoad
ilConvertImage
ilGetInteger
ilOriginFunc
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
imagehlp
StackWalk
EnumerateLoadedModules
GetTimestampForLoadedLibrary
granny2
_GrannyFreeWorldPose@4
_GrannyNewWorldPose@4
_GrannyFindBoneByName@12
_GrannyGetMeshBindingToBoneIndices@4
_GrannyFreeMeshBinding@4
_GrannyNewMeshBinding@12
_GrannyFreeModelInstance@4
_GrannyInstantiateModel@4
_GrannyGetWorldPoseComposite4x4Array@4
_GrannyFreeLocalPose@4
_GrannyNewLocalPose@4
_GrannyGetWorldPose4x4@8
_GrannySampleModelAnimationsAccelerated@20
_GrannyFreeCompletedModelControls@4
_GrannySetModelClock@8
_GrannyGetSourceSkeleton@4
_GrannyGetFileInfo@4
_GrannyFreeFile@4
_GrannyFreeFileSection@8
_GrannyDeformVertices@24
_GrannyConvertSingleObject@20
_GrannyFindMatchingMember@16
_GrannyGetMaterialTextureByType@8
GrannyPNT332VertexType
_GrannyGetWorldPoseComposite4x4@8
_GrannyGetTotalTypeSize@4
_GrannyGetMeshVertexCount@4
_GrannyMeshIsRigid@4
_GrannyGetMeshIndexCount@4
_GrannyFreeControl@4
_GrannyFreeControlOnceUnused@4
_GrannyCompleteControlAt@8
_GrannyControlIsComplete@4
_GrannyFreeControlIfComplete@4
_GrannyGetControlLoopCount@4
_GrannySetControlLoopCount@8
_GrannyGetControlSpeed@4
_GrannySetControlSpeed@8
_GrannyGetControlLocalDuration@4
_GrannySetControlEaseIn@8
_GrannySetControlEaseInCurve@28
_GrannySetControlEaseOut@8
_GrannySetControlEaseOutCurve@28
_GrannyGetControlRawLocalClock@4
_GrannySetControlRawLocalClock@8
_GrannyPlayControlledAnimation@12
_GrannyGetMeshTriangleGroupCount@4
_GrannyGetMeshTriangleGroups@4
_GrannyGetMeshVertexType@4
_GrannyCopyMeshVertices@12
_GrannyGetMeshVertices@4
_GrannyCopyMeshIndices@12
_GrannyNewMeshDeformer@16
_GrannyUpdateModelMatrix@20
_GrannyFreeMeshDeformer@4
_GrannyReadEntireFileFromMemory@8
mss32
_AIL_mem_free_lock@4
_AIL_file_read@8
_AIL_set_file_callbacks@16
_AIL_WAV_info@8
_AIL_decompress_ASI@24
_AIL_decompress_ADPCM@12
_AIL_file_type@8
_AIL_open_digital_driver@16
_AIL_open_stream@12
_AIL_close_digital_driver@4
_AIL_enumerate_3D_providers@12
_AIL_open_3D_provider@4
_AIL_close_3D_provider@4
_AIL_open_3D_listener@4
_AIL_close_3D_listener@4
_AIL_auto_update_3D_position@8
_AIL_set_3D_position@16
_AIL_3D_sample_volume@4
_AIL_3D_sample_status@4
_AIL_set_3D_sample_loop_count@8
_AIL_set_3D_sample_volume@8
_AIL_set_3D_sample_file@8
_AIL_end_3D_sample@4
_AIL_set_3D_velocity@20
_AIL_stop_3D_sample@4
_AIL_start_3D_sample@4
_AIL_release_3D_sample_handle@4
_AIL_allocate_3D_sample_handle@4
_AIL_sample_volume_pan@12
_AIL_sample_status@4
_AIL_set_sample_loop_count@8
_AIL_set_sample_volume_pan@12
_AIL_end_sample@4
_AIL_resume_sample@4
_AIL_stop_sample@4
_AIL_start_sample@4
_AIL_set_sample_file@12
_AIL_init_sample@4
_AIL_release_sample_handle@4
_AIL_allocate_sample_handle@4
_AIL_last_error@0
_AIL_stream_status@4
_AIL_set_stream_loop_count@8
_AIL_stream_volume_levels@12
_AIL_set_stream_volume_levels@12
_AIL_pause_stream@8
_AIL_start_stream@4
_AIL_close_stream@4
_AIL_set_redist_directory@4
_AIL_shutdown@0
_AIL_startup@0
_AIL_set_3D_orientation@28
_AIL_resume_3D_sample@4
_AIL_update_3D_position@8
speedtreert
?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ
?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z
?GetCurrentError@CSpeedTreeRT@@SAPBDXZ
?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z
?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z
?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z
?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ
?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z
?SetLodLimits@CSpeedTreeRT@@QAEXMM@Z
?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z
?SetLodLevel@CSpeedTreeRT@@QAEXM@Z
?ComputeLodLevel@CSpeedTreeRT@@QAEXXZ
?SetLocalMatrices@CSpeedTreeRT@@QAEXII@Z
?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z
?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z
?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetLeafLightingAdjustment@CSpeedTreeRT@@QBEMXZ
?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z
?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ
?SetTime@CSpeedTreeRT@@SAXM@Z
?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z
?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z
?SetLightState@CSpeedTreeRT@@SAXI_N@Z
?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z
?SetCamera@CSpeedTreeRT@@SAXPBM0@Z
??0SGeometry@CSpeedTreeRT@@QAE@XZ
??1SGeometry@CSpeedTreeRT@@QAE@XZ
??0STextures@CSpeedTreeRT@@QAE@XZ
??1STextures@CSpeedTreeRT@@QAE@XZ
??0CSpeedTreeRT@@QAE@XZ
??1CSpeedTreeRT@@QAE@XZ
??2CSpeedTreeRT@@SAPAXI@Z
??3CSpeedTreeRT@@SAXPAX@Z
?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z
?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ
?DeleteTransientData@CSpeedTreeRT@@QAEXXZ
?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z
?GetTreeSize@CSpeedTreeRT@@QBEXAAM0@Z
?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z
?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ
dinput8
DirectInput8Create
ws2_32
connect
ioctlsocket
recv
closesocket
__WSAFDIsSet
socket
WSAGetLastError
WSAStartup
WSACleanup
htonl
htons
inet_addr
ntohs
send
gethostname
select
ntohl
gethostbyname
ddraw
DirectDrawCreate
shell32
SHGetSpecialFolderPathA
oleaut32
VariantClear
VariantInit
SafeArrayAccessData
SafeArrayDestroy
SafeArrayCreate
SysAllocString
SysFreeString
Sections
.text Size: 4.3MB - Virtual size: 4.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 739KB - Virtual size: 739KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 226KB - Virtual size: 740KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 52KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ