Static task
static1
Behavioral task
behavioral1
Sample
b52153483ac411cb00ba9a573e48bb17aff66b998511982ea478241e582bdbc5.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
b52153483ac411cb00ba9a573e48bb17aff66b998511982ea478241e582bdbc5.exe
Resource
win10v2004-20230915-en
General
-
Target
b52153483ac411cb00ba9a573e48bb17aff66b998511982ea478241e582bdbc5
-
Size
3.1MB
-
MD5
c4b3b3d501be17333ff4cddec6a05a8b
-
SHA1
cd9c7c5b34a963b995f75861b2f7e58eb5225060
-
SHA256
b52153483ac411cb00ba9a573e48bb17aff66b998511982ea478241e582bdbc5
-
SHA512
ea966a66ad411a8d72915fdf63ffb8b3f094c8582fe2f38db6f39f8e11d35868d2b55b6d2ed5ed6c02f68ed85dc5c70404f889baf1f007681b909282caf3bcd5
-
SSDEEP
49152:kODelUPKI6ULmkNQge0KAuRPBp7U+3HAlDjYQPUOP8hLCiCxaCEJ5r+PORmED2V/:ykNQXRPBhUFYQsy8hLCiCxaCZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b52153483ac411cb00ba9a573e48bb17aff66b998511982ea478241e582bdbc5
Files
-
b52153483ac411cb00ba9a573e48bb17aff66b998511982ea478241e582bdbc5.exe windows:5 windows x86
b210d0e529e08020bdd7274b21b60c88
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SwitchToThread
SignalObjectAndWait
WaitForSingleObjectEx
CreateTimerQueue
GetExitCodeThread
DuplicateHandle
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
LoadLibraryW
DeleteFileA
GetCurrentDirectoryA
GetModuleFileNameA
MoveFileA
GetPrivateProfileStringA
GlobalFree
lstrlenA
GetModuleHandleA
GetProcAddress
FindNextFileA
FindClose
FindFirstFileA
SetFileAttributesA
DeleteCriticalSection
GetSystemInfo
EnterCriticalSection
SetThreadPriority
LeaveCriticalSection
Sleep
GetThreadTimes
WaitNamedPipeW
SetEndOfFile
SetEnvironmentVariableA
CreateProcessA
GetExitCodeProcess
WriteConsoleW
OutputDebugStringW
HeapReAlloc
SetStdHandle
GetThreadPriority
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetFileAttributesExW
InitializeCriticalSection
CreateDirectoryW
SetFilePointerEx
ChangeTimerQueueTimer
GetConsoleMode
GetConsoleCP
GetModuleFileNameW
GetStdHandle
GetOEMCP
GetACP
IsValidCodePage
HeapSize
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
CreateSemaphoreW
GetModuleHandleW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
CreateEventW
InitializeCriticalSectionAndSpinCount
SetLastError
UnhandledExceptionFilter
PeekNamedPipe
GetFileType
AreFileApisANSI
GetModuleHandleExW
ExitProcess
GetCPInfo
LoadLibraryExW
GetCurrentThreadId
RtlUnwind
RaiseException
GetCommandLineA
GetSystemTimeAsFileTime
ExitThread
CreateThread
IsDebuggerPresent
GetLogicalProcessorInformation
GetTimeZoneInformation
CreateTimerQueueTimer
SetEvent
WaitForSingleObject
GetCurrentProcessId
Module32Next
CreateToolhelp32Snapshot
GetLastError
Module32First
ReadProcessMemory
GetCurrentProcess
GetCurrentDirectoryW
MultiByteToWideChar
GetTickCount
GetProcessHeap
HeapFree
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
FreeLibraryAndExitThread
GetVersionExW
VirtualAlloc
VirtualFree
ReadConsoleW
VirtualProtect
DecodePointer
EncodePointer
GetStringTypeW
CreateFileW
IsProcessorFeaturePresent
HeapValidate
QueryPerformanceCounter
ReleaseSemaphore
GetLocaleInfoA
CompareStringA
WideCharToMultiByte
GetVersionExA
GetSystemDirectoryA
LoadLibraryA
lstrlenW
GlobalUnlock
GlobalLock
FreeLibrary
ReadFile
WriteFile
WinExec
GetCurrentThread
SetUnhandledExceptionFilter
OutputDebugStringA
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
GetFileSize
CreateDirectoryA
GlobalAlloc
HeapAlloc
CloseHandle
FlushFileBuffers
CreateFileA
user32
GetKeyboardLayoutNameA
DispatchMessageA
DefWindowProcA
CreateWindowExA
GetWindowLongA
UnregisterClassA
SetWindowLongA
TranslateMessage
RegisterClassExA
GetMessageA
DestroyWindow
UpdateWindow
LoadCursorA
GetSystemMetrics
SetCapture
GetCapture
ShowWindow
GetClipboardData
ReleaseCapture
ChangeDisplaySettingsA
SetCursorPos
SetCursor
ShowCursor
DestroyCursor
LoadImageA
GetKeyState
ScreenToClient
PostQuitMessage
LoadIconA
SetWindowPos
GetCursorPos
SystemParametersInfoA
FindWindowA
ClientToScreen
FillRect
GetClientRect
GetDC
OffsetRect
GetAsyncKeyState
SetRect
InvalidateRect
PeekMessageA
ReleaseDC
CloseClipboard
OpenClipboard
LoadStringA
GetKeyboardLayout
MessageBoxA
AdjustWindowRectEx
SetWindowTextA
GetMenu
RegisterClassA
SetFocus
MoveWindow
IsWindow
CharNextW
CharNextExA
CharPrevExA
gdi32
DeleteDC
CreateCompatibleDC
GetStockObject
StretchBlt
DeleteObject
CreateSolidBrush
TextOutW
SetBkMode
CreateDIBSection
TextOutA
SetTextColor
SetBkColor
GetTextExtentPoint32W
GetCharABCWidthsFloatW
CreateFontIndirectA
EnumFontFamiliesExA
GetTextExtentPoint32A
SelectObject
advapi32
RegCloseKey
CryptReleaseContext
CryptAcquireContextA
RegSetValueExW
RegCreateKeyExW
RegOpenKeyA
RegQueryValueExA
RegOpenKeyExA
RegQueryValueExW
RegOpenKeyExW
CryptGenRandom
ole32
CoInitializeEx
OleUninitialize
OleInitialize
CoGetClassObject
OleSetContainedObject
CoCreateInstance
CoUninitialize
CoInitialize
winmm
timeEndPeriod
timeGetDevCaps
timeBeginPeriod
timeGetTime
d3d8
Direct3DCreate8
python27
PyImport_ImportModule
PyImport_AddModule
Py_BuildValue
PyErr_SetString
PyExc_RuntimeError
PyString_FromString
PyInt_AsLong
PyTuple_GetItem
PyModule_AddIntConstant
PyList_New
Py_InitModule4
PyList_Append
PyArg_ParseTuple
PyTuple_Size
PyDict_GetItemString
PyLong_AsLong
PyString_AsString
PyThreadState_Get
PyTuple_New
PyDict_New
PyTuple_SetItem
PyDict_SetItemString
PyInt_FromLong
PyDict_Next
PyDict_Size
PyString_InternFromString
PyObject_GetAttrString
PyObject_GetAttr
PyCallable_Check
PyLong_AsLongLong
PyFloat_AsDouble
PyErr_Clear
PyErr_BadArgument
PyErr_Print
PyObject_CallObject
PyNumber_Check
_Py_NoneStruct
PyModule_GetDict
PyErr_Fetch
Py_SetProgramName
Py_Initialize
Py_Finalize
PyRun_StringFlags
devil
ilShutDown
ilGenImages
ilConvertImage
ilEnable
ilBindImage
ilLoad
ilInit
ilTexImage
ilSetPixels
ilCopyPixels
ilOriginFunc
ilGetInteger
ilSave
ilDeleteImages
imm32
ImmGetOpenStatus
ImmSetConversionStatus
ImmGetConversionStatus
ImmGetCandidateListW
ImmSetCompositionStringW
ImmGetCompositionStringW
ImmAssociateContext
ImmReleaseContext
ImmGetContext
ImmIsIME
ImmGetIMEFileNameA
ImmNotifyIME
version
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
imagehlp
StackWalk
EnumerateLoadedModules
GetTimestampForLoadedLibrary
granny2
_GrannyFindBoneByName@12
_GrannyGetMeshBindingToBoneIndices@4
_GrannyFreeMeshBinding@4
_GrannyNewMeshBinding@12
_GrannyFreeModelInstance@4
_GrannyInstantiateModel@4
_GrannyGetWorldPoseComposite4x4Array@4
_GrannyFreeLocalPose@4
_GrannyNewLocalPose@4
_GrannyUpdateModelMatrix@20
_GrannySampleModelAnimationsAccelerated@20
_GrannyFreeCompletedModelControls@4
_GrannySetModelClock@8
_GrannyGetSourceSkeleton@4
_GrannyGetFileInfo@4
_GrannyFreeFile@4
_GrannyFreeFileSection@8
_GrannyReadEntireFileFromMemory@8
_GrannyConvertSingleObject@20
_GrannyFindMatchingMember@16
_GrannyGetMaterialTextureByType@8
_GrannyNewWorldPose@4
_GrannyFreeWorldPose@4
_GrannyGetWorldPose4x4@8
_GrannyGetWorldPoseComposite4x4@8
_GrannyGetTotalTypeSize@4
_GrannyGetMeshVertexCount@4
_GrannyMeshIsRigid@4
_GrannyGetMeshIndexCount@4
_GrannyFreeControl@4
_GrannyFreeControlOnceUnused@4
_GrannyCompleteControlAt@8
_GrannyControlIsComplete@4
_GrannyFreeControlIfComplete@4
_GrannyGetControlLoopCount@4
_GrannySetControlLoopCount@8
_GrannyGetControlSpeed@4
_GrannySetControlSpeed@8
_GrannyGetControlLocalDuration@4
_GrannySetControlEaseIn@8
GrannyPNT332VertexType
_GrannyDeformVertices@24
_GrannyFreeMeshDeformer@4
_GrannyNewMeshDeformer@16
_GrannyCopyMeshIndices@12
_GrannyGetMeshVertices@4
_GrannyCopyMeshVertices@12
_GrannyGetMeshVertexType@4
_GrannyGetMeshTriangleGroups@4
_GrannyGetMeshTriangleGroupCount@4
_GrannyPlayControlledAnimation@12
_GrannySetControlRawLocalClock@8
_GrannyGetControlRawLocalClock@4
_GrannySetControlEaseOutCurve@28
_GrannySetControlEaseOut@8
_GrannySetControlEaseInCurve@28
mss32
_AIL_decompress_ASI@24
_AIL_decompress_ADPCM@12
_AIL_file_type@8
_AIL_open_digital_driver@16
_AIL_open_stream@12
_AIL_close_digital_driver@4
_AIL_enumerate_3D_providers@12
_AIL_open_3D_provider@4
_AIL_close_3D_provider@4
_AIL_open_3D_listener@4
_AIL_close_3D_listener@4
_AIL_set_3D_position@16
_AIL_set_3D_velocity@20
_AIL_set_3D_orientation@28
_AIL_startup@0
_AIL_shutdown@0
_AIL_set_redist_directory@4
_AIL_close_stream@4
_AIL_start_stream@4
_AIL_pause_stream@8
_AIL_set_stream_volume_levels@12
_AIL_stream_volume_levels@12
_AIL_set_stream_loop_count@8
_AIL_last_error@0
_AIL_WAV_info@8
_AIL_release_sample_handle@4
_AIL_init_sample@4
_AIL_set_sample_file@12
_AIL_start_sample@4
_AIL_stop_sample@4
_AIL_resume_sample@4
_AIL_end_sample@4
_AIL_set_sample_volume_pan@12
_AIL_set_sample_loop_count@8
_AIL_sample_status@4
_AIL_sample_volume_pan@12
_AIL_allocate_3D_sample_handle@4
_AIL_release_3D_sample_handle@4
_AIL_start_3D_sample@4
_AIL_stop_3D_sample@4
_AIL_resume_3D_sample@4
_AIL_end_3D_sample@4
_AIL_set_3D_sample_file@8
_AIL_set_3D_sample_volume@8
_AIL_set_3D_sample_loop_count@8
_AIL_3D_sample_status@4
_AIL_3D_sample_volume@4
_AIL_auto_update_3D_position@8
_AIL_set_file_callbacks@16
_AIL_file_read@8
_AIL_allocate_sample_handle@4
_AIL_stream_status@4
_AIL_mem_free_lock@4
speedtreert
?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ
?SetLodLimits@CSpeedTreeRT@@QAEXMM@Z
?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z
?SetLodLevel@CSpeedTreeRT@@QAEXM@Z
?SetLocalMatrices@CSpeedTreeRT@@QAEXII@Z
?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z
?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z
?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ
?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z
?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ
?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ
?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z
?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ
?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z
??3CSpeedTreeRT@@SAXPAX@Z
??2CSpeedTreeRT@@SAPAXI@Z
??1CSpeedTreeRT@@QAE@XZ
??0CSpeedTreeRT@@QAE@XZ
??1STextures@CSpeedTreeRT@@QAE@XZ
??0STextures@CSpeedTreeRT@@QAE@XZ
??1SGeometry@CSpeedTreeRT@@QAE@XZ
??0SGeometry@CSpeedTreeRT@@QAE@XZ
?SetCamera@CSpeedTreeRT@@SAXPBM0@Z
?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z
?SetLightState@CSpeedTreeRT@@SAXI_N@Z
?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z
?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z
?SetTime@CSpeedTreeRT@@SAXM@Z
?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z
?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z
?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z
?GetCurrentError@CSpeedTreeRT@@SAPBDXZ
?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z
?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ
?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z
?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z
?ComputeLodLevel@CSpeedTreeRT@@QAEXXZ
dinput8
DirectInput8Create
ws2_32
inet_addr
gethostbyname
htons
ioctlsocket
connect
closesocket
__WSAFDIsSet
WSACleanup
WSAStartup
WSAGetLastError
socket
send
select
recv
ddraw
DirectDrawCreate
shell32
SHGetSpecialFolderPathA
oleaut32
VariantInit
VariantClear
SysFreeString
SysAllocString
Sections
.text Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 514KB - Virtual size: 514KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 189KB - Virtual size: 697KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 45KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ