Static task
static1
Behavioral task
behavioral1
Sample
c1b170eedf40a8f2ed4cc105120073267e03da88313c531e3b94a5ebbd9b61b6.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
c1b170eedf40a8f2ed4cc105120073267e03da88313c531e3b94a5ebbd9b61b6.exe
Resource
win10v2004-20230915-en
General
-
Target
c1b170eedf40a8f2ed4cc105120073267e03da88313c531e3b94a5ebbd9b61b6
-
Size
7.5MB
-
MD5
09a93af21e02096ee38eac85c6688fc7
-
SHA1
d5476df3b6108faa10960441b5b182f4d290c2f3
-
SHA256
c1b170eedf40a8f2ed4cc105120073267e03da88313c531e3b94a5ebbd9b61b6
-
SHA512
b85efebd1fcfd66f688686625c32563c656eacaa3e1a2f7d8df925791b2cd55c68004cc13b79152a1320ce1b351fad277785967f4decf0feec4940e7cbbe2082
-
SSDEEP
98304:u8e5AXQD6rAOmVRH99qnkSj3lz71HEapFv4hTpaWO6GneyHmJMWzYEwLw+:6O4YnBjlIfLqy+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c1b170eedf40a8f2ed4cc105120073267e03da88313c531e3b94a5ebbd9b61b6
Files
-
c1b170eedf40a8f2ed4cc105120073267e03da88313c531e3b94a5ebbd9b61b6.exe windows:6 windows x86
0b33ece9d7432ea62d088dc7cddae94d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FlushProcessWriteBuffers
GetCurrentProcessorNumber
GetTickCount64
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
CreateThreadpoolTimer
InitializeSRWLock
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
ReleaseSRWLockExclusive
SetThreadpoolWait
CloseThreadpoolWait
GetFileInformationByHandleEx
CreateSymbolicLinkW
MoveFileA
GetPrivateProfileStringA
lstrlenA
GlobalFree
GetModuleFileNameA
CreateMutexA
ReleaseMutex
DeleteFileA
GetCurrentDirectoryA
AcquireSRWLockExclusive
TryEnterCriticalSection
SetFileInformationByHandle
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitOnceExecuteOnce
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
CreateEventExW
CreateThreadpoolWait
CreateSemaphoreExW
GetTickCount
GetCurrentDirectoryW
ReadProcessMemory
GetCurrentProcess
GetLastError
FindNextFileA
FindFirstFileA
FindClose
MultiByteToWideChar
SetFileAttributesA
Module32Next
Module32First
Process32Next
Process32First
CreateToolhelp32Snapshot
GetSystemInfo
OpenProcess
SetThreadPriority
WriteConsoleW
HeapQueryInformation
HeapSize
Sleep
CreateEventA
WaitForSingleObject
SetEvent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetLocalTime
GetFileAttributesA
CreateDirectoryA
GetProcessHeap
HeapFree
HeapAlloc
DeviceIoControl
PeekConsoleInputA
ReadConsoleInputW
GetNumberOfConsoleInputEvents
SetConsoleMode
CloseHandle
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
HeapReAlloc
ReadConsoleW
GetFileSizeEx
GetConsoleMode
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetTimeZoneInformation
UnlockFileEx
LockFileEx
HeapCompact
CreateProcessW
GetTempPathW
FlushFileBuffers
SetFilePointerEx
VirtualQuery
VirtualProtect
VirtualAlloc
SetStdHandle
GetModuleFileNameW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
ExitProcess
GetDriveTypeW
GetModuleHandleExW
FreeLibraryAndExitThread
ResumeThread
ExitThread
CreateThread
LoadLibraryExW
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
RaiseException
GetThreadTimes
GetCurrentThread
FlushViewOfFile
GetStdHandle
ExpandEnvironmentStringsW
SetConsoleCtrlHandler
GetACP
QueryPerformanceFrequency
GetExitCodeProcess
GenerateConsoleCtrlEvent
GetProcessTimes
MoveFileW
GetSystemTime
GetFileType
CreateProcessA
SystemTimeToFileTime
SetEnvironmentVariableA
SetCurrentDirectoryW
DeleteFileW
GetFileAttributesExW
SetFileAttributesW
SetCurrentDirectoryA
GetVersion
DuplicateHandle
GetFileAttributesW
GetEnvironmentVariableA
CreatePipe
SetEnvironmentVariableW
SetFileTime
RemoveDirectoryW
FindNextFileW
GetFullPathNameW
GetFileAttributesExA
FindFirstFileW
CreateDirectoryW
SetErrorMode
LoadLibraryExA
TlsFree
TlsGetValue
TlsAlloc
SetLastError
TlsSetValue
GetFullPathNameA
SetEndOfFile
IsDBCSLeadByte
OutputDebugStringW
GetConsoleCP
GetConsoleOutputCP
GetFileInformationByHandle
GetSystemTimeAsFileTime
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
TerminateProcess
UnhandledExceptionFilter
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
InitializeCriticalSectionAndSpinCount
FindResourceW
FindResourceA
SizeofResource
LoadResource
LockResource
CreateFileW
IsProcessorFeaturePresent
InterlockedDecrement
HeapValidate
InterlockedIncrement
GetCPInfo
CompareStringEx
GetLocaleInfoEx
LCMapStringEx
DecodePointer
EncodePointer
LocalFree
InitializeCriticalSectionEx
GetStringTypeW
FormatMessageA
QueryPerformanceCounter
CopyFileA
CreateSemaphoreA
ReleaseSemaphore
GetLocaleInfoA
CompareStringA
WideCharToMultiByte
lstrlenW
GlobalLock
GlobalUnlock
FreeLibrary
GetVersionExA
GetSystemDirectoryA
GetModuleHandleA
WriteFile
SetFilePointer
ReadFile
LoadLibraryA
GetProcAddress
GetCurrentThreadId
SetUnhandledExceptionFilter
GetFileSize
CreateFileMappingA
VerSetConditionMask
UnmapViewOfFile
MapViewOfFile
OutputDebugStringA
GetTempFileNameA
GetTempPathA
RemoveDirectoryA
AllocConsole
GlobalAlloc
CreateFileA
VerifyVersionInfoW
GetCurrentProcessId
FreeEnvironmentStringsW
user32
AdjustWindowRectEx
GetWindowRect
SetWindowTextA
GetMenu
FlashWindowEx
DestroyIcon
LoadImageA
PostQuitMessage
SetWindowPos
GetAsyncKeyState
GetCursorPos
ScreenToClient
FindWindowA
LoadIconA
SystemParametersInfoA
GetKeyState
ShowCursor
SetCursor
DestroyCursor
SetCursorPos
ClientToScreen
ShowWindow
GetCapture
SetCapture
ReleaseCapture
LoadCursorA
GetSystemMetrics
PeekMessageA
GetDC
ReleaseDC
BeginPaint
EndPaint
InvalidateRect
GetClientRect
FillRect
SetRect
RegisterClassA
SetWindowLongA
GetWindowLongA
UpdateWindow
SetFocus
MoveWindow
DestroyWindow
IsWindow
CreateWindowExA
RegisterClassExA
UnregisterClassA
OffsetRect
LoadStringA
MessageBoxA
CharNextExA
DefWindowProcA
ChangeDisplaySettingsA
CharPrevExA
GetMessageA
TranslateMessage
DispatchMessageA
GetKeyboardLayoutNameA
GetKeyboardLayout
CharPrevA
CharNextW
GetClipboardData
CloseClipboard
OpenClipboard
gdi32
CreateFontIndirectA
SelectObject
GetCharABCWidthsFloatW
TextOutA
EnumFontFamiliesExA
SetDIBitsToDevice
GetTextExtentPoint32W
DeleteDC
CreateCompatibleDC
TextOutW
CreateDIBSection
GetTextExtentPoint32A
StretchBlt
PatBlt
DeleteObject
CreateSolidBrush
SetTextColor
SetBkColor
GetStockObject
SetBkMode
advapi32
CryptGenRandom
CryptAcquireContextA
RegCreateKeyA
RegSetValueA
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegQueryValueExA
RegDeleteKeyA
RegCreateKeyExA
RegFlushKey
RegQueryValueA
RegSetValueExA
RegLoadKeyA
RegQueryInfoKeyA
RegEnumValueA
RegDeleteValueA
RegConnectRegistryA
RegSaveKeyA
RegEnumKeyExA
CryptReleaseContext
RegOpenKeyA
RegOpenKeyExA
shell32
SHGetSpecialFolderPathA
SetCurrentProcessExplicitAppUserModelID
ShellExecuteW
ShellExecuteA
ole32
OleInitialize
OleSetContainedObject
CoCreateInstance
CoUninitialize
CoInitialize
CoGetClassObject
OleUninitialize
CoInitializeEx
winmm
timeGetDevCaps
timeEndPeriod
timeBeginPeriod
timeGetTime
d3d8
Direct3DCreate8
imm32
ImmGetIMEFileNameA
ImmIsIME
ImmNotifyIME
ImmGetOpenStatus
ImmSetConversionStatus
ImmGetConversionStatus
ImmGetCandidateListW
ImmSetCompositionStringW
ImmGetCompositionStringW
ImmAssociateContext
ImmReleaseContext
ImmGetContext
iphlpapi
GetPerAdapterInfo
GetAdaptersInfo
libconfig++
?readFile@Config@libconfig@@QAEXPBD@Z
??1Config@libconfig@@UAE@XZ
??0Config@libconfig@@QAE@XZ
?getLength@Setting@libconfig@@QBEHXZ
?add@Setting@libconfig@@QAEAAV12@W4Type@12@@Z
?add@Setting@libconfig@@QAEAAV12@PBDW4Type@12@@Z
?lookupValue@Setting@libconfig@@QBE_NPBDAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?lookupValue@Setting@libconfig@@QBE_NPBDAA_J@Z
??ASetting@libconfig@@QBEAAV01@H@Z
??ASetting@libconfig@@QBEAAV01@PBD@Z
?getRoot@Config@libconfig@@QBEAAVSetting@2@XZ
??4Setting@libconfig@@QAEAAV01@PBD@Z
??4Setting@libconfig@@QAEAAV01@AB_J@Z
?getPath@SettingException@libconfig@@QBEPBDXZ
?writeFile@Config@libconfig@@QAEXPBD@Z
??4Setting@libconfig@@QAEAAV01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
version
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
devil
ilInit
ilTexImage
ilSetPixels
ilSave
ilShutDown
ilOriginFunc
ilEnable
ilCopyPixels
ilLoad
ilGetInteger
ilGenImages
ilBindImage
ilDeleteImages
ilConvertImage
granny2
_GrannyFindBoneByName@12
_GrannyGetMeshBindingToBoneIndices@4
_GrannyFreeMeshBinding@4
_GrannyNewMeshBinding@12
_GrannyFreeModelInstance@4
_GrannyInstantiateModel@4
_GrannyGetWorldPoseComposite4x4Array@4
_GrannyFreeLocalPose@4
_GrannyNewLocalPose@4
_GrannyUpdateModelMatrix@20
_GrannySampleModelAnimationsAccelerated@20
_GrannyFreeCompletedModelControls@4
_GrannySetModelClock@8
_GrannyGetSourceSkeleton@4
_GrannyGetFileInfo@4
_GrannyFreeFile@4
_GrannyFreeFileSection@8
_GrannyReadEntireFileFromMemory@8
_GrannyConvertSingleObject@20
_GrannyFindMatchingMember@16
_GrannyGetMaterialTextureByType@8
_GrannySetLogCallback@4
_GrannyGetWorldPoseComposite4x4@8
_GrannyGetTotalTypeSize@4
_GrannyGetMeshVertexCount@4
_GrannyMeshIsRigid@4
_GrannyNewWorldPose@4
_GrannyFreeControl@4
_GrannyFreeControlOnceUnused@4
_GrannyControlIsComplete@4
_GrannyFreeControlIfComplete@4
_GrannyGetControlLoopCount@4
_GrannySetControlLoopCount@8
_GrannyGetControlSpeed@4
_GrannySetControlSpeed@8
_GrannyGetControlLocalDuration@4
_GrannySetControlEaseIn@8
_GrannySetControlEaseInCurve@28
_GrannySetControlEaseOut@8
_GrannySetControlEaseOutCurve@28
_GrannyGetControlRawLocalClock@4
_GrannySetControlRawLocalClock@8
_GrannyPlayControlledAnimation@12
_GrannyGetMeshTriangleGroupCount@4
_GrannyGetMeshTriangleGroups@4
_GrannyGetMeshVertexType@4
_GrannyCopyMeshVertices@12
_GrannyGetMeshVertices@4
_GrannyCopyMeshIndices@12
_GrannyNewMeshDeformer@16
_GrannyFreeMeshDeformer@4
_GrannyDeformVertices@24
GrannyPNT332VertexType
_GrannyFreeWorldPose@4
_GrannyGetMeshIndexCount@4
_GrannyGetWorldPose4x4@8
_GrannyCompleteControlAt@8
mss32
_AIL_WAV_info@8
_AIL_decompress_ASI@24
_AIL_decompress_ADPCM@12
_AIL_set_file_callbacks@16
_AIL_file_read@8
_AIL_auto_update_3D_position@8
_AIL_update_3D_position@8
_AIL_3D_sample_volume@4
_AIL_file_type@8
_AIL_open_digital_driver@16
_AIL_open_stream@12
_AIL_close_digital_driver@4
_AIL_enumerate_3D_providers@12
_AIL_open_3D_provider@4
_AIL_close_3D_provider@4
_AIL_open_3D_listener@4
_AIL_close_3D_listener@4
_AIL_3D_sample_status@4
_AIL_set_3D_sample_loop_count@8
_AIL_set_3D_sample_volume@8
_AIL_set_3D_sample_file@8
_AIL_end_3D_sample@4
_AIL_set_3D_position@16
_AIL_mem_free_lock@4
_AIL_set_3D_orientation@28
_AIL_startup@0
_AIL_shutdown@0
_AIL_set_redist_directory@4
_AIL_close_stream@4
_AIL_start_stream@4
_AIL_pause_stream@8
_AIL_set_stream_volume_levels@12
_AIL_stream_volume_levels@12
_AIL_set_stream_loop_count@8
_AIL_stream_status@4
_AIL_last_error@0
_AIL_allocate_sample_handle@4
_AIL_release_sample_handle@4
_AIL_init_sample@4
_AIL_set_sample_file@12
_AIL_start_sample@4
_AIL_stop_sample@4
_AIL_resume_sample@4
_AIL_end_sample@4
_AIL_set_sample_volume_pan@12
_AIL_set_sample_loop_count@8
_AIL_sample_status@4
_AIL_sample_volume_pan@12
_AIL_allocate_3D_sample_handle@4
_AIL_release_3D_sample_handle@4
_AIL_start_3D_sample@4
_AIL_stop_3D_sample@4
_AIL_resume_3D_sample@4
_AIL_set_3D_velocity@20
speedtreert
?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z
?SetLightState@CSpeedTreeRT@@SAXI_N@Z
?SetTime@CSpeedTreeRT@@SAXM@Z
?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z
?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z
?SetCamera@CSpeedTreeRT@@SAXPBM0@Z
?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z
?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ
?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z
?GetCurrentError@CSpeedTreeRT@@SAPBDXZ
?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z
?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z
?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z
?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ
?SetLodLimits@CSpeedTreeRT@@QAEXMM@Z
?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z
?SetLodLevel@CSpeedTreeRT@@QAEXM@Z
?ComputeLodLevel@CSpeedTreeRT@@QAEXXZ
?SetLocalMatrices@CSpeedTreeRT@@QAEXII@Z
?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z
?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z
?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetLeafLightingAdjustment@CSpeedTreeRT@@QBEMXZ
?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z
?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ
?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z
?GetTreeSize@CSpeedTreeRT@@QBEXAAM0@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z
?DeleteTransientData@CSpeedTreeRT@@QAEXXZ
?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ
?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z
??3CSpeedTreeRT@@SAXPAX@Z
??2CSpeedTreeRT@@SAPAXI@Z
??1CSpeedTreeRT@@QAE@XZ
??0CSpeedTreeRT@@QAE@XZ
??1STextures@CSpeedTreeRT@@QAE@XZ
??0STextures@CSpeedTreeRT@@QAE@XZ
??1SGeometry@CSpeedTreeRT@@QAE@XZ
??0SGeometry@CSpeedTreeRT@@QAE@XZ
?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ
dinput8
DirectInput8Create
ws2_32
ntohs
ntohl
inet_addr
htons
gethostbyname
WSACleanup
gethostname
WSAGetLastError
socket
send
closesocket
select
recv
ioctlsocket
connect
__WSAFDIsSet
WSAStartup
htonl
ddraw
DirectDrawCreate
oleaut32
SysFreeString
VariantClear
VariantInit
SafeArrayAccessData
SysAllocString
SafeArrayCreate
SafeArrayDestroy
Sections
.text Size: 5.1MB - Virtual size: 5.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 478KB - Virtual size: 825KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 210KB - Virtual size: 210KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 277KB - Virtual size: 276KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ