Static task
static1
Behavioral task
behavioral1
Sample
0cdc59aef2364c3d3d1271305fd77db83f09a820c904c3484775ada25c7a022d.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
0cdc59aef2364c3d3d1271305fd77db83f09a820c904c3484775ada25c7a022d.exe
Resource
win10v2004-20230915-en
General
-
Target
0cdc59aef2364c3d3d1271305fd77db83f09a820c904c3484775ada25c7a022d
-
Size
2.2MB
-
MD5
c0022b1701262a1abd50873d1e5c16d8
-
SHA1
905681c0467d6d7b766c1978ebcd1a08a40c68a4
-
SHA256
0cdc59aef2364c3d3d1271305fd77db83f09a820c904c3484775ada25c7a022d
-
SHA512
5ffea40b06d5453b5535e24b6ba6a14a074468ad10bd9380a3122905e0fd4a3b686899222dcd778aa30c729024e67fbec7c099afe98c9615bfc259023e6a0983
-
SSDEEP
49152:bLkxW7P5Xb0tpro9ywCafIXqbw4/X8jDShJ5YVVuFSHH:bLkOlHKafbbwBuu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0cdc59aef2364c3d3d1271305fd77db83f09a820c904c3484775ada25c7a022d
Files
-
0cdc59aef2364c3d3d1271305fd77db83f09a820c904c3484775ada25c7a022d.exe windows:5 windows x86
4837b1a6442aba1720b8294c51c09cc7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetTickCount
ReadProcessMemory
SetEndOfFile
SetEnvironmentVariableA
CreateFileW
CreateProcessA
GetExitCodeProcess
OutputDebugStringW
WriteConsoleW
HeapReAlloc
SetStdHandle
GetCurrentProcessId
GetCurrentProcess
GetLastError
FindNextFileA
FindFirstFileA
GetTimeZoneInformation
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetModuleFileNameW
GetProcessHeap
SetFilePointerEx
ReadConsoleW
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetStdHandle
GetOEMCP
GetACP
IsValidCodePage
GetFileAttributesExW
HeapSize
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
FindClose
GetModuleHandleW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
InitializeCriticalSectionAndSpinCount
SetLastError
UnhandledExceptionFilter
GetFileType
AreFileApisANSI
GetCurrentDirectoryW
ExitProcess
GetCPInfo
LoadLibraryExW
GetCurrentThreadId
GetCommandLineA
HeapAlloc
HeapFree
IsProcessorFeaturePresent
IsDebuggerPresent
GetSystemTimeAsFileTime
RtlUnwind
RaiseException
DecodePointer
EncodePointer
GetStringTypeW
QueryPerformanceCounter
ReleaseSemaphore
GetLocaleInfoA
CompareStringA
WideCharToMultiByte
GetSystemDirectoryA
lstrlenW
GlobalUnlock
GlobalLock
FreeLibrary
GetVersionExA
LoadLibraryA
GetProcAddress
ReadFile
WriteFile
GetModuleHandleA
WinExec
GetCurrentThread
SetUnhandledExceptionFilter
CreateFileA
GetFileSize
OutputDebugStringA
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
CreateDirectoryA
GlobalAlloc
MultiByteToWideChar
SetFileAttributesA
Module32Next
Module32First
CreateToolhelp32Snapshot
GetSystemInfo
CloseHandle
Sleep
GlobalFree
lstrlenA
GetModuleFileNameA
GetPrivateProfileStringA
GetCurrentDirectoryA
DeleteFileA
MoveFileA
GetModuleHandleExW
CreateDirectoryW
WaitForSingleObject
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
user32
ReleaseDC
PostQuitMessage
FlashWindowEx
LoadStringA
MessageBoxA
OffsetRect
SetRect
FillRect
GetClientRect
InvalidateRect
DefWindowProcA
RegisterClassExA
CreateWindowExA
SetWindowPos
GetAsyncKeyState
GetCursorPos
ScreenToClient
FindWindowA
LoadIconA
SystemParametersInfoA
GetKeyState
ShowCursor
SetCursor
DestroyCursor
LoadImageA
SetCursorPos
ClientToScreen
ShowWindow
GetCapture
SetCapture
ReleaseCapture
ChangeDisplaySettingsA
GetSystemMetrics
PeekMessageA
GetDC
CharNextW
GetClipboardData
CloseClipboard
OpenClipboard
GetKeyboardLayout
GetKeyboardLayoutNameA
DispatchMessageA
TranslateMessage
GetMessageA
LoadCursorA
AdjustWindowRectEx
GetMenu
RegisterClassA
CharPrevExA
CharNextExA
SetWindowLongA
GetWindowLongA
UpdateWindow
SetFocus
MoveWindow
DestroyWindow
IsWindow
UnregisterClassA
gdi32
GetStockObject
CreateFontIndirectA
GetCharABCWidthsFloatW
GetTextExtentPoint32W
SelectObject
SetBkColor
SetTextColor
TextOutW
CreateCompatibleDC
DeleteDC
SetBkMode
CreateDIBSection
TextOutA
EnumFontFamiliesExA
CreateSolidBrush
StretchBlt
GetTextExtentPoint32A
DeleteObject
ole32
CoInitializeEx
OleUninitialize
OleInitialize
CoGetClassObject
OleSetContainedObject
CoCreateInstance
CoUninitialize
CoInitialize
winmm
timeBeginPeriod
timeEndPeriod
timeGetDevCaps
timeGetTime
d3d9
Direct3DCreate9
d3dx9_42
D3DXCreateTexture
D3DXLoadSurfaceFromSurface
D3DXGetFVFVertexSize
D3DXCreateSphere
D3DXCreateCylinder
D3DXCreateMatrixStack
D3DXMatrixOrthoOffCenterRH
D3DXMatrixOrthoRH
D3DXMatrixPerspectiveFovRH
D3DXMatrixLookAtRH
D3DXMatrixDeterminant
D3DXVec2Normalize
D3DXMatrixScaling
D3DXCreateTextureFromFileInMemoryEx
D3DXVec4Transform
D3DXMatrixRotationAxis
D3DXVec3TransformNormal
D3DXMatrixRotationX
D3DXMatrixInverse
D3DXMatrixRotationYawPitchRoll
D3DXQuaternionMultiply
D3DXQuaternionRotationAxis
D3DXMatrixRotationQuaternion
D3DXMatrixTranslation
D3DXMatrixMultiply
D3DXMatrixRotationZ
D3DXVec3TransformCoord
D3DXVec3Normalize
D3DXVec3Project
D3DXPlaneNormalize
D3DXQuaternionRotationYawPitchRoll
D3DXVec3Transform
D3DXMatrixTranspose
python27
PyImport_ImportModule
PyImport_AddModule
PyRun_StringFlags
Py_Finalize
Py_Initialize
Py_SetProgramName
PyErr_Fetch
PyModule_GetDict
PyDict_SetItemString
PyNumber_Check
PyObject_CallObject
PyErr_Print
PyErr_BadArgument
PyErr_Clear
PyString_AsString
PyFloat_AsDouble
PyCallable_Check
PyObject_GetAttr
PyObject_GetAttrString
PyString_InternFromString
PyTuple_SetItem
PyTuple_New
PyInt_FromLong
PyList_Append
PyList_New
PyString_FromString
PyExc_RuntimeError
PyErr_SetString
PyDict_Size
PyDict_Next
PyInt_AsLong
PyDict_GetItemString
PyTuple_GetItem
Py_BuildValue
_Py_NoneStruct
PyModule_AddIntConstant
Py_InitModule4
PyLong_AsLong
PyTuple_Size
imm32
ImmGetOpenStatus
ImmSetConversionStatus
ImmGetConversionStatus
ImmGetCandidateListW
ImmSetCompositionStringW
ImmGetCompositionStringW
ImmAssociateContext
ImmReleaseContext
ImmGetContext
ImmIsIME
ImmGetIMEFileNameA
ImmNotifyIME
version
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
imagehlp
StackWalk
GetTimestampForLoadedLibrary
EnumerateLoadedModules
devil
ilTexImage
ilSave
ilShutDown
ilEnable
ilOriginFunc
ilCopyPixels
ilSetPixels
ilConvertImage
ilLoad
ilGetInteger
ilGenImages
ilBindImage
ilDeleteImages
ilInit
granny2
_GrannyFreeMeshBinding@4
_GrannyGetMeshBindingToBoneIndices@4
_GrannyNewMeshBinding@12
_GrannyFreeModelInstance@4
_GrannyInstantiateModel@4
_GrannyGetWorldPoseComposite4x4Array@4
_GrannyFreeLocalPose@4
_GrannyNewLocalPose@4
_GrannyUpdateModelMatrix@20
_GrannyFindBoneByName@12
_GrannyFreeCompletedModelControls@4
_GrannySetModelClock@8
_GrannyGetSourceSkeleton@4
_GrannyGetFileInfo@4
_GrannyFreeFile@4
_GrannyFreeFileSection@8
_GrannyReadEntireFileFromMemory@8
_GrannyConvertSingleObject@20
_GrannyFindMatchingMember@16
_GrannyGetMaterialTextureByType@8
_GrannyNewWorldPose@4
_GrannyFreeWorldPose@4
_GrannyGetWorldPose4x4@8
_GrannyGetWorldPoseComposite4x4@8
_GrannyGetTotalTypeSize@4
_GrannyGetMeshVertexCount@4
_GrannyMeshIsRigid@4
_GrannyGetMeshIndexCount@4
_GrannyFreeControl@4
_GrannyFreeControlOnceUnused@4
_GrannyCompleteControlAt@8
_GrannyControlIsComplete@4
_GrannyFreeControlIfComplete@4
_GrannyGetControlLoopCount@4
_GrannySetControlLoopCount@8
_GrannyGetControlSpeed@4
_GrannySetControlSpeed@8
_GrannyGetControlLocalDuration@4
_GrannySetControlEaseIn@8
_GrannySetControlEaseInCurve@28
_GrannySetControlEaseOut@8
_GrannySetControlEaseOutCurve@28
_GrannyGetControlRawLocalClock@4
_GrannySetControlRawLocalClock@8
_GrannyPlayControlledAnimation@12
_GrannyGetMeshTriangleGroupCount@4
_GrannyGetMeshTriangleGroups@4
_GrannyGetMeshVertexType@4
_GrannyCopyMeshVertices@12
_GrannyGetMeshVertices@4
_GrannyCopyMeshIndices@12
_GrannyNewMeshDeformer@16
_GrannyFreeMeshDeformer@4
_GrannyDeformVertices@24
GrannyPNT332VertexType
_GrannySampleModelAnimationsAccelerated@20
mss32
_AIL_mem_free_lock@4
_AIL_file_read@8
_AIL_set_file_callbacks@16
_AIL_WAV_info@8
_AIL_decompress_ASI@24
_AIL_decompress_ADPCM@12
_AIL_file_type@8
_AIL_open_digital_driver@16
_AIL_open_stream@12
_AIL_close_digital_driver@4
_AIL_enumerate_3D_providers@12
_AIL_open_3D_provider@4
_AIL_open_3D_listener@4
_AIL_close_3D_listener@4
_AIL_set_3D_position@16
_AIL_set_3D_velocity@20
_AIL_set_3D_orientation@28
_AIL_startup@0
_AIL_shutdown@0
_AIL_set_redist_directory@4
_AIL_close_stream@4
_AIL_start_stream@4
_AIL_pause_stream@8
_AIL_set_stream_volume_levels@12
_AIL_stream_volume_levels@12
_AIL_set_stream_loop_count@8
_AIL_stream_status@4
_AIL_last_error@0
_AIL_allocate_sample_handle@4
_AIL_release_sample_handle@4
_AIL_init_sample@4
_AIL_set_sample_file@12
_AIL_start_sample@4
_AIL_stop_sample@4
_AIL_resume_sample@4
_AIL_end_sample@4
_AIL_set_sample_volume_pan@12
_AIL_set_sample_loop_count@8
_AIL_sample_status@4
_AIL_sample_volume_pan@12
_AIL_allocate_3D_sample_handle@4
_AIL_release_3D_sample_handle@4
_AIL_start_3D_sample@4
_AIL_stop_3D_sample@4
_AIL_resume_3D_sample@4
_AIL_end_3D_sample@4
_AIL_set_3D_sample_file@8
_AIL_set_3D_sample_volume@8
_AIL_set_3D_sample_loop_count@8
_AIL_3D_sample_status@4
_AIL_3D_sample_volume@4
_AIL_close_3D_provider@4
_AIL_auto_update_3D_position@8
speedtreert
?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ
?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z
?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z
??3CSpeedTreeRT@@SAXPAX@Z
?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z
??1CSpeedTreeRT@@QAE@XZ
??0CSpeedTreeRT@@QAE@XZ
??1STextures@CSpeedTreeRT@@QAE@XZ
??0STextures@CSpeedTreeRT@@QAE@XZ
??1SGeometry@CSpeedTreeRT@@QAE@XZ
??0SGeometry@CSpeedTreeRT@@QAE@XZ
?SetCamera@CSpeedTreeRT@@SAXPBM0@Z
?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z
?SetLightState@CSpeedTreeRT@@SAXI_N@Z
?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z
?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z
?SetTime@CSpeedTreeRT@@SAXM@Z
?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ
?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z
?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
??2CSpeedTreeRT@@SAPAXI@Z
?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ
?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z
?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z
?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetLocalMatrices@CSpeedTreeRT@@QAEXII@Z
?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z
?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ
?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z
?GetCurrentError@CSpeedTreeRT@@SAPBDXZ
?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z
?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z
?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z
?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ
?SetLodLimits@CSpeedTreeRT@@QAEXMM@Z
?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z
?SetLodLevel@CSpeedTreeRT@@QAEXM@Z
?ComputeLodLevel@CSpeedTreeRT@@QAEXXZ
dinput8
DirectInput8Create
ws2_32
WSAGetLastError
socket
send
select
WSAStartup
ioctlsocket
connect
WSACleanup
closesocket
__WSAFDIsSet
gethostbyname
htons
inet_addr
recv
ddraw
DirectDrawCreate
advapi32
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
shell32
SHGetSpecialFolderPathA
oleaut32
SysAllocString
SysFreeString
VariantClear
VariantInit
Sections
.text Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 382KB - Virtual size: 381KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 99KB - Virtual size: 378KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 118KB - Virtual size: 118KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ