Static task
static1
Behavioral task
behavioral1
Sample
51ea77c9e129a7814bfc45015728d630cd8b9175959007e009da95b99ef0f189.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
51ea77c9e129a7814bfc45015728d630cd8b9175959007e009da95b99ef0f189.exe
Resource
win10v2004-20230915-en
General
-
Target
51ea77c9e129a7814bfc45015728d630cd8b9175959007e009da95b99ef0f189
-
Size
4.4MB
-
MD5
250514603c7f484acfe45274d03211c5
-
SHA1
c2f3a2d99a1f5634911a16a9d921b5d02f84e97e
-
SHA256
51ea77c9e129a7814bfc45015728d630cd8b9175959007e009da95b99ef0f189
-
SHA512
7fb6e60c7228b80160d566b934283f3710732156a76b7a267435a66c426bfdc4be7f3fe60363a21a96499ea222aec0255f805439c84b8c9916392ab56636906b
-
SSDEEP
49152:KuS2eLETjlh8er7a6j0XFEyYgtDd7C/UKZG1JEsE0t5yAvxgSIk/ZRJvu5Ib1CSj:ZRVH6JooqAzDT9wgHLGiwy8TYHIaD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 51ea77c9e129a7814bfc45015728d630cd8b9175959007e009da95b99ef0f189
Files
-
51ea77c9e129a7814bfc45015728d630cd8b9175959007e009da95b99ef0f189.exe windows:6 windows x86
3495e55c4e312ba8b47586ec06daff3a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetFileAttributesA
WriteConsoleW
SetEndOfFile
HeapSize
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
HeapReAlloc
SetStdHandle
CreateProcessW
GetExitCodeProcess
CreateDirectoryW
Module32Next
Module32First
Process32Next
Process32First
GetCurrentProcess
CreateToolhelp32Snapshot
GetSystemInfo
OpenProcess
SetThreadPriority
GetTimeZoneInformation
ReadConsoleW
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetFileAttributesExW
MoveFileExW
DeleteFileW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetStdHandle
GetFileType
ExitProcess
GetCurrentProcessId
MultiByteToWideChar
ResumeThread
ExitThread
CreateThread
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InterlockedPushEntrySList
RtlUnwind
Sleep
GetModuleFileNameW
WaitNamedPipeW
PeekNamedPipe
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
TerminateProcess
UnhandledExceptionFilter
CreateEventW
ResetEvent
InitializeCriticalSectionAndSpinCount
CreateFileW
HeapValidate
GetCPInfo
GetModuleHandleW
GetSystemTimeAsFileTime
QueryPerformanceFrequency
FindClose
FindFirstFileA
FindNextFileA
GetModuleFileNameA
FreeLibraryAndExitThread
GetLastError
ReadProcessMemory
GetCurrentDirectoryW
GetTickCount
GetCurrentDirectoryA
DeleteFileA
ReleaseMutex
CreateMutexA
LoadLibraryA
GlobalFree
lstrlenA
GetPrivateProfileStringA
MoveFileA
LCMapStringEx
DecodePointer
EncodePointer
GetStringTypeW
IsProcessorFeaturePresent
GetModuleHandleExW
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
FreeLibraryWhenCallbackReturns
InitOnceComplete
InitOnceBeginInitialize
SleepConditionVariableSRW
SleepConditionVariableCS
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
TryEnterCriticalSection
InitializeCriticalSectionEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
GetExitCodeThread
GetCurrentThreadId
CreateEventA
WaitForSingleObject
SetEvent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GlobalLock
GlobalUnlock
GlobalAlloc
GetLocalTime
GetFileAttributesA
CreateDirectoryA
GetProcessHeap
HeapFree
WaitForSingleObjectEx
RaiseException
QueryPerformanceCounter
ReleaseSemaphore
GetLocaleInfoA
CompareStringA
WideCharToMultiByte
lstrlenW
GetProcAddress
FreeLibrary
GetVersionExA
GetSystemDirectoryA
WriteFile
ReadFile
WinExec
GetModuleHandleA
GetCurrentThread
SetUnhandledExceptionFilter
GetFileSize
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
OutputDebugStringA
HeapAlloc
DeviceIoControl
CloseHandle
SetLastError
CreateFileA
user32
LoadCursorA
TranslateMessage
SetWindowTextA
GetMenu
RegisterClassA
CharPrevExA
CharNextExA
SetWindowLongA
GetWindowLongA
UpdateWindow
SetFocus
MoveWindow
DestroyWindow
IsWindow
CreateWindowExA
DispatchMessageA
GetKeyboardLayoutNameA
GetKeyboardLayout
GetClipboardData
CharNextW
ShowWindow
ClientToScreen
SetCursorPos
LoadImageA
DestroyCursor
SetCursor
ShowCursor
GetKeyState
SystemParametersInfoA
DestroyIcon
LoadIconA
FindWindowA
ScreenToClient
GetCursorPos
GetAsyncKeyState
SetWindowPos
SendMessageA
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
PostQuitMessage
SetCapture
ReleaseCapture
CreatePopupMenu
DestroyMenu
InsertMenuA
TrackPopupMenu
DefWindowProcA
SetForegroundWindow
ChangeDisplaySettingsA
GetSystemMetrics
PeekMessageA
GetDC
ReleaseDC
BeginPaint
EndPaint
InvalidateRect
GetClientRect
FillRect
SetRect
OffsetRect
LoadStringA
MessageBoxA
UnregisterClassA
GetMessageA
AdjustWindowRectEx
GetCapture
RegisterClassExA
gdi32
GetCharABCWidthsFloatW
GetStockObject
SelectObject
SetBkColor
SetTextColor
TextOutW
CreateCompatibleDC
DeleteDC
SetBkMode
CreateDIBSection
TextOutA
EnumFontFamiliesExA
CreateSolidBrush
DeleteObject
StretchBlt
GetTextExtentPoint32A
CreateFontIndirectA
GetTextExtentPoint32W
PatBlt
advapi32
CryptReleaseContext
CryptGenRandom
RegQueryValueExW
RegOpenKeyExW
CryptAcquireContextA
RegCreateKeyExW
RegSetValueExW
RegOpenKeyA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
shell32
Shell_NotifyIconA
ShellExecuteA
SHGetSpecialFolderPathA
ole32
OleInitialize
CoGetClassObject
OleSetContainedObject
OleUninitialize
CoInitializeEx
CoCreateInstance
CoInitialize
CoUninitialize
winmm
timeGetDevCaps
timeBeginPeriod
timeEndPeriod
timeGetTime
d3d8
Direct3DCreate8
python27
Py_BuildValue
Py_InitModule4
PyModule_AddIntConstant
PyLong_AsLong
PyTuple_Size
PyTuple_GetItem
PyDict_GetItemString
PyInt_FromLong
PyLong_FromLongLong
PyList_New
PyList_Append
Py_IncRef
PyInt_AsLong
PyDict_New
PyDict_SetItem
PyDict_Next
PyObject_GetAttrString
PyObject_HasAttrString
PyString_AsString
PyList_SetItem
PyExc_RuntimeError
PyString_FromString
PyArg_ParseTuple
PyTuple_New
PyTuple_SetItem
PyModule_AddStringConstant
PyImport_ImportModule
PyString_InternFromString
PyObject_GetAttr
PyCallable_Check
PyLong_AsLongLong
PyFloat_AsDouble
PyErr_Clear
PyErr_BadArgument
PyErr_Print
PyObject_CallObject
PyNumber_Check
_Py_NoneStruct
PyDict_SetItemString
PyModule_GetDict
PyErr_Fetch
Py_SetProgramName
Py_Initialize
Py_Finalize
PyRun_StringFlags
PyDict_Size
PyErr_SetString
PyImport_AddModule
iphlpapi
IcmpCloseHandle
IcmpCreateFile
GetPerAdapterInfo
GetAdaptersInfo
IcmpSendEcho2
imm32
ImmGetOpenStatus
ImmSetConversionStatus
ImmGetConversionStatus
ImmGetCandidateListW
ImmSetCompositionStringW
ImmGetCompositionStringW
ImmAssociateContext
ImmReleaseContext
ImmGetContext
ImmIsIME
ImmGetIMEFileNameA
ImmNotifyIME
libconfig++
??ASetting@libconfig@@QBEAAV01@H@Z
?lookupValue@Setting@libconfig@@QBE_NPBDAA_J@Z
?lookupValue@Setting@libconfig@@QBE_NPBDAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?add@Setting@libconfig@@QAEAAV12@PBDW4Type@12@@Z
??ASetting@libconfig@@QBEAAV01@PBD@Z
?getLength@Setting@libconfig@@QBEHXZ
??0Config@libconfig@@QAE@XZ
??1Config@libconfig@@UAE@XZ
?readFile@Config@libconfig@@QAEXPBD@Z
?writeFile@Config@libconfig@@QAEXPBD@Z
?getRoot@Config@libconfig@@QBEAAVSetting@2@XZ
??4Setting@libconfig@@QAEAAV01@PBD@Z
??4Setting@libconfig@@QAEAAV01@AB_J@Z
?add@Setting@libconfig@@QAEAAV12@W4Type@12@@Z
??4Setting@libconfig@@QAEAAV01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?getPath@SettingException@libconfig@@QBEPBDXZ
shlwapi
PathFindFileNameA
version
VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
imagehlp
GetTimestampForLoadedLibrary
StackWalk
EnumerateLoadedModules
devil
ilGenImages
ilDeleteImages
ilBindImage
ilInit
ilLoad
ilConvertImage
ilCopyPixels
ilEnable
ilTexImage
ilOriginFunc
ilSetPixels
ilSave
ilShutDown
ilGetInteger
granny2
_GrannyGetMeshBindingToBoneIndices@4
_GrannyFreeMeshBinding@4
_GrannyNewMeshBinding@12
_GrannyFreeModelInstance@4
_GrannyInstantiateModel@4
_GrannyGetWorldPoseComposite4x4Array@4
_GrannyFreeLocalPose@4
_GrannyNewLocalPose@4
_GrannyUpdateModelMatrix@20
_GrannySampleModelAnimationsAccelerated@20
_GrannyFreeCompletedModelControls@4
_GrannySetModelClock@8
_GrannyGetSourceSkeleton@4
_GrannyConvertSingleObject@20
_GrannyFindMatchingMember@16
_GrannyGetMaterialTextureByType@8
_GrannyGetFileInfo@4
_GrannyFindBoneByName@12
_GrannyFreeFileSection@8
_GrannyReadEntireFileFromMemory@8
_GrannySetLogCallback@4
_GrannyNewWorldPose@4
_GrannyFreeWorldPose@4
_GrannyGetWorldPose4x4@8
_GrannyGetWorldPoseComposite4x4@8
_GrannyGetTotalTypeSize@4
_GrannyGetControlLoopCount@4
_GrannyGetMeshVertexCount@4
_GrannyCompleteControlAt@8
_GrannyControlIsComplete@4
_GrannyFreeControlIfComplete@4
GrannyPNT332VertexType
_GrannyDeformVertices@24
_GrannyFreeMeshDeformer@4
_GrannyNewMeshDeformer@16
_GrannyCopyMeshIndices@12
_GrannyGetMeshVertices@4
_GrannyCopyMeshVertices@12
_GrannyGetMeshVertexType@4
_GrannyGetMeshTriangleGroups@4
_GrannyGetMeshTriangleGroupCount@4
_GrannySetTrackGroupLOD@16
_GrannySetTrackGroupTarget@12
_GrannyEndControlledAnimation@4
_GrannyBeginControlledAnimation@8
_GrannyPlayControlledAnimation@12
_GrannySetControlRawLocalClock@8
_GrannyGetControlRawLocalClock@4
_GrannySetControlEaseOutCurve@28
_GrannySetControlEaseOut@8
_GrannySetControlEaseInCurve@28
_GrannySetControlEaseIn@8
_GrannyGetControlLocalDuration@4
_GrannySetControlSpeed@8
_GrannyGetControlSpeed@4
_GrannySetControlLoopCount@8
_GrannyMeshIsRigid@4
_GrannyGetMeshIndexCount@4
_GrannyGetSourceModel@4
_GrannyFindTrackGroupForModel@12
_GrannyFreeControl@4
_GrannyFreeControlOnceUnused@4
_GrannyFreeFile@4
mss32
_AIL_set_redist_directory@4
_AIL_close_stream@4
_AIL_start_stream@4
_AIL_set_stream_volume_levels@12
_AIL_stream_volume_levels@12
_AIL_set_stream_loop_count@8
_AIL_stream_status@4
_AIL_last_error@0
_AIL_allocate_sample_handle@4
_AIL_release_sample_handle@4
_AIL_init_sample@4
_AIL_set_sample_file@12
_AIL_start_sample@4
_AIL_stop_sample@4
_AIL_resume_sample@4
_AIL_end_sample@4
_AIL_startup@0
_AIL_set_sample_loop_count@8
_AIL_sample_status@4
_AIL_sample_volume_pan@12
_AIL_allocate_3D_sample_handle@4
_AIL_release_3D_sample_handle@4
_AIL_start_3D_sample@4
_AIL_stop_3D_sample@4
_AIL_resume_3D_sample@4
_AIL_end_3D_sample@4
_AIL_set_3D_sample_file@8
_AIL_set_3D_sample_volume@8
_AIL_set_3D_sample_loop_count@8
_AIL_3D_sample_status@4
_AIL_3D_sample_volume@4
_AIL_auto_update_3D_position@8
_AIL_set_3D_orientation@28
_AIL_set_3D_velocity@20
_AIL_set_3D_position@16
_AIL_close_3D_listener@4
_AIL_shutdown@0
_AIL_open_3D_listener@4
_AIL_close_3D_provider@4
_AIL_open_3D_provider@4
_AIL_enumerate_3D_providers@12
_AIL_close_digital_driver@4
_AIL_open_stream@12
_AIL_open_digital_driver@16
_AIL_file_type@8
_AIL_decompress_ADPCM@12
_AIL_decompress_ASI@24
_AIL_WAV_info@8
_AIL_set_file_callbacks@16
_AIL_pause_stream@8
_AIL_file_read@8
_AIL_mem_free_lock@4
_AIL_set_sample_volume_pan@12
speedtreert
?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z
?SetLodLevel@CSpeedTreeRT@@QAEXM@Z
?ComputeLodLevel@CSpeedTreeRT@@QAEXXZ
?SetLocalMatrices@CSpeedTreeRT@@QAEXII@Z
?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z
?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z
?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ
?SetLodLimits@CSpeedTreeRT@@QAEXMM@Z
?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ
?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z
?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z
?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z
?GetCurrentError@CSpeedTreeRT@@SAPBDXZ
?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z
?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ
?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z
?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z
?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ
?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z
?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ
?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z
??3CSpeedTreeRT@@SAXPAX@Z
?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ
??2CSpeedTreeRT@@SAPAXI@Z
??1CSpeedTreeRT@@QAE@XZ
??0CSpeedTreeRT@@QAE@XZ
??1STextures@CSpeedTreeRT@@QAE@XZ
??0STextures@CSpeedTreeRT@@QAE@XZ
??1SGeometry@CSpeedTreeRT@@QAE@XZ
??0SGeometry@CSpeedTreeRT@@QAE@XZ
?SetCamera@CSpeedTreeRT@@SAXPBM0@Z
?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z
?SetLightState@CSpeedTreeRT@@SAXI_N@Z
?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z
?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z
?SetTime@CSpeedTreeRT@@SAXM@Z
?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
dinput8
DirectInput8Create
ws2_32
WSAGetLastError
WSAStartup
WSACleanup
send
__WSAFDIsSet
gethostbyname
socket
select
recv
ioctlsocket
htons
inet_addr
connect
inet_ntoa
closesocket
ddraw
DirectDrawCreate
oleaut32
SysFreeString
VariantClear
VariantInit
SysAllocString
Sections
.text Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 670KB - Virtual size: 670KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 199KB - Virtual size: 698KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 278KB - Virtual size: 278KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 152KB - Virtual size: 152KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ