Static task
static1
Behavioral task
behavioral1
Sample
06b5062a0bbaada6ac9e7713ca8d461d21b264bd9128804f5efbf77c39151d53.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
06b5062a0bbaada6ac9e7713ca8d461d21b264bd9128804f5efbf77c39151d53.exe
Resource
win10v2004-20230915-en
General
-
Target
06b5062a0bbaada6ac9e7713ca8d461d21b264bd9128804f5efbf77c39151d53
-
Size
2.9MB
-
MD5
0ac4a3d9fa85911c829346af40415a82
-
SHA1
d95e7581590548562fc4ec334bb48520b0622c38
-
SHA256
06b5062a0bbaada6ac9e7713ca8d461d21b264bd9128804f5efbf77c39151d53
-
SHA512
c9507fba7425ec38ee01af3f16d05a3373504812341dc84d230468912bd41ae05f629b10f388946f245f7552a3f867d2c34f0805993d99efe9a08236d7ccb450
-
SSDEEP
49152:DKBB4ylfEL3WweX0VgkQd7H6QDDTk4MmJ5jQ67LZA7y:DKBAL3WweEVgkQd7H6QP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 06b5062a0bbaada6ac9e7713ca8d461d21b264bd9128804f5efbf77c39151d53
Files
-
06b5062a0bbaada6ac9e7713ca8d461d21b264bd9128804f5efbf77c39151d53.exe windows:6 windows x86
ec4a969511fcf736029e6c16627eba6e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SleepConditionVariableCS
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
TryEnterCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
SleepConditionVariableSRW
GlobalFree
GetModuleFileNameA
DeleteFileA
GetPrivateProfileStringA
lstrlenA
GetCurrentDirectoryA
MoveFileA
FindClose
FindNextFileA
FindFirstFileA
SetFileAttributesA
InitializeCriticalSection
LeaveCriticalSection
WriteConsoleW
SetEndOfFile
HeapSize
SetEnvironmentVariableW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
HeapReAlloc
SetStdHandle
GetTimeZoneInformation
CreateProcessW
GetExitCodeProcess
GetFileAttributesExW
FlushFileBuffers
CreateDirectoryW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
EnterCriticalSection
HeapAlloc
ReadConsoleW
HeapFree
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
GetStdHandle
GetFileType
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
GetExitCodeThread
FreeEnvironmentStringsW
DeleteCriticalSection
WaitForSingleObject
SetEvent
Sleep
GetSystemInfo
GetLastError
ReadProcessMemory
GetCurrentProcess
Module32Next
CloseHandle
Module32First
GetCurrentProcessId
ExitThread
CreateThread
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InterlockedPushEntrySList
RaiseException
RtlUnwind
QueryPerformanceFrequency
SetLastError
GetModuleFileNameW
WaitNamedPipeW
PeekNamedPipe
GetSystemTimeAsFileTime
GetCurrentThreadId
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
TerminateProcess
UnhandledExceptionFilter
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
InitializeCriticalSectionAndSpinCount
CreateFileW
IsProcessorFeaturePresent
GetProcessHeap
HeapValidate
GetCPInfo
LCMapStringEx
DecodePointer
EncodePointer
InitializeCriticalSectionEx
GetStringTypeW
QueryPerformanceCounter
ReleaseSemaphore
GetLocaleInfoA
CompareStringA
WideCharToMultiByte
lstrlenW
GlobalLock
GlobalUnlock
LoadLibraryA
GetProcAddress
FreeLibrary
GetVersionExA
GetSystemDirectoryA
WriteFile
ReadFile
OutputDebugStringA
WinExec
GetModuleHandleA
GetCurrentThread
SetUnhandledExceptionFilter
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
GetFileSize
CreateFileA
CreateDirectoryA
GlobalAlloc
CreateToolhelp32Snapshot
GetTickCount
GetCurrentDirectoryW
CompareStringW
MultiByteToWideChar
user32
ReleaseCapture
SetCapture
SetCursorPos
SetCursor
ShowCursor
DestroyCursor
LoadImageA
GetKeyState
FlashWindowEx
ChangeDisplaySettingsA
SetWindowPos
LoadIconA
FindWindowA
ScreenToClient
GetCursorPos
PostQuitMessage
GetAsyncKeyState
SetRect
OffsetRect
SystemParametersInfoA
GetCapture
GetSystemMetrics
UnregisterClassA
RegisterClassExA
CreateWindowExA
IsWindow
DestroyWindow
MoveWindow
SetFocus
UpdateWindow
GetWindowLongA
SetWindowLongA
RegisterClassA
GetMenu
AdjustWindowRectEx
LoadCursorA
GetMessageA
TranslateMessage
DispatchMessageA
LoadStringA
MessageBoxA
DefWindowProcA
GetClientRect
ClientToScreen
PeekMessageA
ReleaseDC
FillRect
GetDC
InvalidateRect
ShowWindow
GetKeyboardLayoutNameA
GetKeyboardLayout
OpenClipboard
CloseClipboard
GetClipboardData
CharNextW
CharNextExA
CharPrevExA
gdi32
SetBkMode
CreateDIBSection
TextOutA
TextOutW
SetTextColor
SetBkColor
SelectObject
GetTextExtentPoint32W
CreateFontIndirectA
EnumFontFamiliesExA
GetStockObject
GetTextExtentPoint32A
CreateCompatibleDC
DeleteDC
GetCharABCWidthsFloatW
StretchBlt
DeleteObject
CreateSolidBrush
ole32
CoInitializeEx
OleSetContainedObject
OleUninitialize
OleInitialize
CoGetClassObject
CoCreateInstance
CoInitialize
CoUninitialize
winmm
timeGetDevCaps
timeEndPeriod
timeGetTime
timeBeginPeriod
d3d8
Direct3DCreate8
python27
PyInt_AsLong
PyTuple_GetItem
PyExc_RuntimeError
PyErr_SetString
Py_InitModule4
Py_BuildValue
PyString_FromString
PyList_Append
PyModule_AddIntConstant
PyTuple_Size
PyDict_GetItemString
PyLong_AsLong
PyLong_FromLongLong
PyArg_ParseTuple
PyTuple_SetItem
PyDict_Size
PyDict_Next
PyTuple_New
PyString_InternFromString
PyObject_GetAttrString
PyObject_GetAttr
PyCallable_Check
PyLong_AsLongLong
PyFloat_AsDouble
PyString_AsString
PyErr_Clear
PyErr_BadArgument
PyErr_Print
PyObject_CallObject
PyNumber_Check
_Py_NoneStruct
PyDict_SetItemString
PyModule_GetDict
PyErr_Fetch
Py_SetProgramName
Py_Initialize
Py_Finalize
PyRun_StringFlags
PyImport_AddModule
PyImport_ImportModule
PyList_New
imm32
ImmNotifyIME
ImmGetOpenStatus
ImmSetConversionStatus
ImmGetConversionStatus
ImmGetCandidateListW
ImmSetCompositionStringW
ImmGetCompositionStringW
ImmReleaseContext
ImmGetContext
ImmIsIME
ImmGetIMEFileNameA
ImmAssociateContext
devil
ilEnable
ilBindImage
ilGenImages
ilInit
ilSetPixels
ilTexImage
ilSave
ilLoad
ilShutDown
ilDeleteImages
ilCopyPixels
ilConvertImage
ilGetInteger
ilOriginFunc
version
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
imagehlp
GetTimestampForLoadedLibrary
StackWalk
EnumerateLoadedModules
granny2
_GrannyGetTotalTypeSize@4
_GrannyGetWorldPoseComposite4x4@8
_GrannyGetWorldPose4x4@8
_GrannyFreeWorldPose@4
_GrannyNewWorldPose@4
_GrannyFindBoneByName@12
_GrannyGetMeshBindingToBoneIndices@4
_GrannyFreeMeshBinding@4
_GrannyNewMeshBinding@12
_GrannyFreeModelInstance@4
_GrannyInstantiateModel@4
_GrannyGetWorldPoseComposite4x4Array@4
_GrannyGetMeshVertexCount@4
_GrannyNewLocalPose@4
_GrannyUpdateModelMatrix@20
_GrannySampleModelAnimationsAccelerated@20
_GrannyFreeCompletedModelControls@4
_GrannySetModelClock@8
_GrannyGetSourceSkeleton@4
_GrannyGetFileInfo@4
_GrannyFreeFile@4
_GrannyFreeFileSection@8
_GrannyReadEntireFileFromMemory@8
_GrannyConvertSingleObject@20
_GrannyFindMatchingMember@16
_GrannyGetMaterialTextureByType@8
_GrannyMeshIsRigid@4
_GrannyGetMeshIndexCount@4
_GrannyFreeControl@4
_GrannyFreeControlOnceUnused@4
_GrannyCompleteControlAt@8
_GrannyControlIsComplete@4
_GrannyFreeControlIfComplete@4
_GrannyGetControlLoopCount@4
_GrannySetControlLoopCount@8
_GrannyGetControlSpeed@4
_GrannySetControlSpeed@8
_GrannyGetControlLocalDuration@4
_GrannySetControlEaseIn@8
_GrannySetControlEaseInCurve@28
_GrannySetControlEaseOut@8
_GrannySetControlEaseOutCurve@28
_GrannyGetControlRawLocalClock@4
_GrannySetControlRawLocalClock@8
_GrannyPlayControlledAnimation@12
_GrannyGetMeshTriangleGroupCount@4
_GrannyGetMeshTriangleGroups@4
_GrannyGetMeshVertexType@4
_GrannyCopyMeshVertices@12
_GrannyGetMeshVertices@4
_GrannyCopyMeshIndices@12
_GrannyNewMeshDeformer@16
_GrannyFreeMeshDeformer@4
_GrannyDeformVertices@24
GrannyPNT332VertexType
_GrannyFreeLocalPose@4
mss32
_AIL_init_sample@4
_AIL_set_sample_file@12
_AIL_start_sample@4
_AIL_stop_sample@4
_AIL_resume_sample@4
_AIL_end_sample@4
_AIL_set_sample_volume_pan@12
_AIL_set_sample_loop_count@8
_AIL_sample_status@4
_AIL_sample_volume_pan@12
_AIL_allocate_3D_sample_handle@4
_AIL_release_3D_sample_handle@4
_AIL_start_3D_sample@4
_AIL_stop_3D_sample@4
_AIL_resume_3D_sample@4
_AIL_end_3D_sample@4
_AIL_set_3D_sample_file@8
_AIL_set_3D_sample_volume@8
_AIL_set_3D_sample_loop_count@8
_AIL_3D_sample_status@4
_AIL_3D_sample_volume@4
_AIL_auto_update_3D_position@8
_AIL_release_sample_handle@4
_AIL_start_stream@4
_AIL_close_stream@4
_AIL_set_redist_directory@4
_AIL_shutdown@0
_AIL_startup@0
_AIL_set_3D_orientation@28
_AIL_set_3D_velocity@20
_AIL_set_3D_position@16
_AIL_close_3D_listener@4
_AIL_open_3D_listener@4
_AIL_close_3D_provider@4
_AIL_open_3D_provider@4
_AIL_enumerate_3D_providers@12
_AIL_close_digital_driver@4
_AIL_open_stream@12
_AIL_open_digital_driver@16
_AIL_file_type@8
_AIL_decompress_ADPCM@12
_AIL_decompress_ASI@24
_AIL_WAV_info@8
_AIL_set_file_callbacks@16
_AIL_file_read@8
_AIL_set_stream_loop_count@8
_AIL_stream_volume_levels@12
_AIL_allocate_sample_handle@4
_AIL_last_error@0
_AIL_stream_status@4
_AIL_pause_stream@8
_AIL_set_stream_volume_levels@12
_AIL_mem_free_lock@4
speedtreert
?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z
?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ
?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z
?GetCurrentError@CSpeedTreeRT@@SAPBDXZ
?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z
?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z
?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z
?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ
?SetLodLimits@CSpeedTreeRT@@QAEXMM@Z
?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z
?SetLodLevel@CSpeedTreeRT@@QAEXM@Z
?ComputeLodLevel@CSpeedTreeRT@@QAEXXZ
?SetLocalMatrices@CSpeedTreeRT@@QAEXII@Z
?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z
?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z
?SetTime@CSpeedTreeRT@@SAXM@Z
?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z
?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z
?SetLightState@CSpeedTreeRT@@SAXI_N@Z
?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z
?SetCamera@CSpeedTreeRT@@SAXPBM0@Z
?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ
??1SGeometry@CSpeedTreeRT@@QAE@XZ
??0STextures@CSpeedTreeRT@@QAE@XZ
??1STextures@CSpeedTreeRT@@QAE@XZ
??0CSpeedTreeRT@@QAE@XZ
??1CSpeedTreeRT@@QAE@XZ
??2CSpeedTreeRT@@SAPAXI@Z
??3CSpeedTreeRT@@SAXPAX@Z
?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z
?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ
?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z
?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z
?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ
?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z
?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ
??0SGeometry@CSpeedTreeRT@@QAE@XZ
dinput8
DirectInput8Create
ws2_32
WSAStartup
WSACleanup
htons
socket
gethostbyname
WSAGetLastError
send
select
recv
ioctlsocket
connect
closesocket
__WSAFDIsSet
inet_addr
ddraw
DirectDrawCreate
advapi32
RegSetValueExW
CryptGenRandom
RegOpenKeyExA
RegQueryValueExA
CryptReleaseContext
CryptAcquireContextA
RegCreateKeyExW
RegCloseKey
RegOpenKeyA
shell32
SHGetSpecialFolderPathA
oleaut32
SysFreeString
SysAllocString
VariantInit
VariantClear
Sections
.text Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 429KB - Virtual size: 428KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 151KB - Virtual size: 658KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 142KB - Virtual size: 141KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ