Static task
static1
Behavioral task
behavioral1
Sample
f77e396bbf44e0c7a9d020c0f4a219a85131e423227395b774fe820465d8eefc.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
f77e396bbf44e0c7a9d020c0f4a219a85131e423227395b774fe820465d8eefc.exe
Resource
win10v2004-20230915-en
General
-
Target
f77e396bbf44e0c7a9d020c0f4a219a85131e423227395b774fe820465d8eefc
-
Size
4.0MB
-
MD5
6b35ed4228720e50ef96d1b00bfcc547
-
SHA1
b14ac8f8f4dbeb14eafac8c98e5a65c7f5bb5ad5
-
SHA256
f77e396bbf44e0c7a9d020c0f4a219a85131e423227395b774fe820465d8eefc
-
SHA512
3bc00fa3a46ed08c60b557ed07133877c1cc1cf6bee3aad99d1e4f141c527976dd1280b2f72f53e81d306f6bc9f9135fd32c4212d9e72198b824a7449c40e002
-
SSDEEP
98304:5OzTDlmCfs2OXHX8MCxp1CcSyYe7iWEbd:5OXDlmCfsdXHsMCxecSy6d
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f77e396bbf44e0c7a9d020c0f4a219a85131e423227395b774fe820465d8eefc
Files
-
f77e396bbf44e0c7a9d020c0f4a219a85131e423227395b774fe820465d8eefc.exe windows:6 windows x86
9c45209f0f2bb9fe32c03b703154b425
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
TryEnterCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
GlobalFree
GetModuleFileNameA
DeleteFileA
GetPrivateProfileStringA
lstrlenA
GetCurrentDirectoryA
MoveFileA
FindClose
FindNextFileA
FindFirstFileA
SetFileAttributesA
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
WaitForSingleObject
SetEvent
WriteConsoleW
SetEndOfFile
HeapSize
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileW
FindFirstFileExW
SetStdHandle
HeapReAlloc
GetTimeZoneInformation
CreateProcessW
GetExitCodeProcess
GetFileAttributesExW
FlushFileBuffers
MoveFileExW
DeleteFileW
CreateDirectoryW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
Sleep
LCMapStringW
CompareStringW
ReadConsoleW
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
GetStdHandle
GetModuleFileNameW
GetFileType
ExitProcess
GetModuleHandleExW
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RaiseException
GetACP
GetSystemInfo
GetLastError
ReadProcessMemory
GetCurrentProcess
Module32Next
Module32First
GetCurrentProcessId
CreateToolhelp32Snapshot
GetTickCount
GetCurrentDirectoryW
MultiByteToWideChar
HeapFree
GetProcessHeap
InterlockedPushEntrySList
RtlUnwind
QueryPerformanceFrequency
SetLastError
GetSystemTimeAsFileTime
GetCurrentThreadId
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
TerminateProcess
UnhandledExceptionFilter
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
InitializeCriticalSectionAndSpinCount
GetCPInfo
CompareStringEx
LCMapStringEx
InitializeCriticalSectionEx
DecodePointer
EncodePointer
GetStringTypeW
CreateFileW
IsProcessorFeaturePresent
HeapValidate
QueryPerformanceCounter
ReleaseSemaphore
GetLocaleInfoA
CompareStringA
WideCharToMultiByte
lstrlenW
GlobalLock
GlobalUnlock
LoadLibraryA
GetProcAddress
FreeLibrary
GetVersionExA
GetSystemDirectoryA
WriteFile
ReadFile
OutputDebugStringA
WinExec
GetModuleHandleA
GetCurrentThread
SetUnhandledExceptionFilter
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
GetFileSize
CreateDirectoryA
GlobalAlloc
HeapAlloc
CloseHandle
DeviceIoControl
GetLocaleInfoW
CreateFileA
user32
LoadStringA
MessageBoxA
FindWindowA
LoadIconA
SetWindowPos
SystemParametersInfoA
FlashWindowEx
GetKeyState
LoadImageA
DestroyCursor
GetMonitorInfoA
MonitorFromPoint
CharPrevExA
CharNextExA
CharNextW
GetClipboardData
CloseClipboard
OpenClipboard
GetKeyboardLayout
GetKeyboardLayoutNameA
DefWindowProcA
UnregisterClassA
RegisterClassExA
CreateWindowExA
IsWindow
DestroyWindow
MoveWindow
SetFocus
UpdateWindow
GetWindowLongA
SetWindowLongA
RegisterClassA
IsIconic
GetMenu
ScreenToClient
GetCursorPos
PostQuitMessage
GetAsyncKeyState
SetRect
OffsetRect
GetClientRect
ClientToScreen
PeekMessageA
ShowCursor
ReleaseDC
FillRect
GetDC
InvalidateRect
SetCursor
SetCursorPos
SetCapture
AdjustWindowRectEx
LoadCursorA
GetMessageA
TranslateMessage
DispatchMessageA
GetSystemMetrics
GetCapture
ShowWindow
ReleaseCapture
ChangeDisplaySettingsA
gdi32
CreateDIBSection
TextOutA
GetCharABCWidthsFloatW
GetTextExtentPoint32W
TextOutW
GetDeviceCaps
GetPixel
SetBkMode
SelectObject
DeleteDC
CreateCompatibleDC
EnumFontFamiliesExA
GetStockObject
StretchBlt
DeleteObject
CreateSolidBrush
GetTextExtentPoint32A
SetTextColor
CreateFontIndirectA
SetBkColor
advapi32
CryptGenRandom
CryptReleaseContext
RegQueryValueExA
RegQueryValueExW
CryptAcquireContextA
RegOpenKeyA
RegOpenKeyExW
RegCloseKey
RegOpenKeyExA
ole32
CoInitializeEx
OleUninitialize
OleInitialize
CoGetClassObject
CoCreateInstance
CoInitialize
CoUninitialize
OleSetContainedObject
winmm
timeGetTime
timeGetDevCaps
timeBeginPeriod
timeEndPeriod
d3d8
Direct3DCreate8
python27
PyList_New
PyInt_AsLong
PyTuple_GetItem
PyExc_RuntimeError
PyErr_SetString
Py_InitModule4
Py_BuildValue
PyTuple_SetItem
PyInt_FromLong
PyDict_SetItemString
PyDict_Size
PyDict_Next
PyObject_HasAttrString
PyString_AsString
PyString_FromString
PyDict_New
PyTuple_New
PyLong_FromLongLong
PyObject_GetAttrString
PyDict_SetItem
PyString_InternFromString
PyObject_GetAttr
PyCallable_Check
PyArg_ParseTuple
PyLong_AsLong
PyDict_GetItemString
PyList_SetItem
PyTuple_Size
PyModule_AddIntConstant
PyFloat_AsDouble
PyErr_Clear
PyErr_BadArgument
PyErr_Print
PyObject_CallObject
PyNumber_Check
_Py_NoneStruct
PyModule_GetDict
PyErr_Fetch
Py_SetProgramName
Py_Initialize
Py_Finalize
PyRun_StringFlags
PyImport_AddModule
PyImport_ImportModule
PyLong_AsLongLong
PyList_Append
iphlpapi
GetAdaptersInfo
GetPerAdapterInfo
imm32
ImmGetOpenStatus
ImmSetConversionStatus
ImmGetConversionStatus
ImmGetCandidateListW
ImmSetCompositionStringW
ImmGetCompositionStringW
ImmAssociateContext
ImmReleaseContext
ImmGetContext
ImmIsIME
ImmGetIMEFileNameA
ImmNotifyIME
devil
ilLoad
ilOriginFunc
ilEnable
ilBindImage
ilGenImages
ilInit
ilSetPixels
ilTexImage
ilSave
ilShutDown
ilDeleteImages
ilConvertImage
ilCopyPixels
ilGetInteger
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
imagehlp
StackWalk
EnumerateLoadedModules
GetTimestampForLoadedLibrary
granny2
_GrannyFreeWorldPose@4
_GrannyNewWorldPose@4
_GrannyFindBoneByName@12
_GrannyGetMeshBindingToBoneIndices@4
_GrannyFreeMeshBinding@4
_GrannyNewMeshBinding@12
_GrannyFreeModelInstance@4
_GrannyInstantiateModel@4
_GrannyGetWorldPoseComposite4x4Array@4
_GrannyFreeLocalPose@4
_GrannyNewLocalPose@4
_GrannyGetWorldPose4x4@8
_GrannySampleModelAnimationsAccelerated@20
_GrannyFreeCompletedModelControls@4
_GrannySetModelClock@8
_GrannyGetSourceSkeleton@4
_GrannyGetFileInfo@4
_GrannyFreeFile@4
_GrannyFreeFileSection@8
_GrannyDeformVertices@24
_GrannyConvertSingleObject@20
_GrannyFindMatchingMember@16
_GrannyGetMaterialTextureByType@8
GrannyPNT332VertexType
_GrannyGetWorldPoseComposite4x4@8
_GrannyGetTotalTypeSize@4
_GrannyGetMeshVertexCount@4
_GrannyMeshIsRigid@4
_GrannyGetMeshIndexCount@4
_GrannyFreeControl@4
_GrannyFreeControlOnceUnused@4
_GrannyCompleteControlAt@8
_GrannyControlIsComplete@4
_GrannyFreeControlIfComplete@4
_GrannyGetControlLoopCount@4
_GrannySetControlLoopCount@8
_GrannyGetControlSpeed@4
_GrannySetControlSpeed@8
_GrannyGetControlLocalDuration@4
_GrannySetControlEaseIn@8
_GrannySetControlEaseInCurve@28
_GrannySetControlEaseOut@8
_GrannySetControlEaseOutCurve@28
_GrannyGetControlRawLocalClock@4
_GrannySetControlRawLocalClock@8
_GrannyPlayControlledAnimation@12
_GrannyGetMeshTriangleGroupCount@4
_GrannyGetMeshTriangleGroups@4
_GrannyGetMeshVertexType@4
_GrannyCopyMeshVertices@12
_GrannyGetMeshVertices@4
_GrannyCopyMeshIndices@12
_GrannyNewMeshDeformer@16
_GrannyUpdateModelMatrix@20
_GrannyFreeMeshDeformer@4
_GrannyReadEntireFileFromMemory@8
mss32
_AIL_mem_free_lock@4
_AIL_file_read@8
_AIL_set_file_callbacks@16
_AIL_WAV_info@8
_AIL_decompress_ASI@24
_AIL_decompress_ADPCM@12
_AIL_file_type@8
_AIL_open_digital_driver@16
_AIL_open_stream@12
_AIL_close_digital_driver@4
_AIL_auto_update_3D_position@8
_AIL_3D_sample_volume@4
_AIL_3D_sample_status@4
_AIL_enumerate_3D_providers@12
_AIL_set_3D_sample_volume@8
_AIL_set_3D_sample_file@8
_AIL_end_3D_sample@4
_AIL_resume_3D_sample@4
_AIL_stop_3D_sample@4
_AIL_start_3D_sample@4
_AIL_release_3D_sample_handle@4
_AIL_allocate_3D_sample_handle@4
_AIL_open_3D_provider@4
_AIL_sample_status@4
_AIL_set_sample_loop_count@8
_AIL_set_sample_volume_pan@12
_AIL_end_sample@4
_AIL_resume_sample@4
_AIL_stop_sample@4
_AIL_start_sample@4
_AIL_set_sample_file@12
_AIL_init_sample@4
_AIL_release_sample_handle@4
_AIL_allocate_sample_handle@4
_AIL_last_error@0
_AIL_stream_status@4
_AIL_set_stream_loop_count@8
_AIL_stream_volume_levels@12
_AIL_set_stream_volume_levels@12
_AIL_pause_stream@8
_AIL_start_stream@4
_AIL_close_stream@4
_AIL_set_redist_directory@4
_AIL_shutdown@0
_AIL_startup@0
_AIL_set_3D_orientation@28
_AIL_set_3D_velocity@20
_AIL_set_3D_position@16
_AIL_close_3D_listener@4
_AIL_open_3D_listener@4
_AIL_close_3D_provider@4
_AIL_sample_volume_pan@12
_AIL_set_3D_sample_loop_count@8
speedtreert
?GetCurrentError@CSpeedTreeRT@@SAPBDXZ
?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z
?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z
?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z
?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ
?SetLodLimits@CSpeedTreeRT@@QAEXMM@Z
?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z
?SetLodLevel@CSpeedTreeRT@@QAEXM@Z
?ComputeLodLevel@CSpeedTreeRT@@QAEXXZ
?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z
?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z
?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z
?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z
?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ
?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z
?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ
?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z
?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ
?SetLocalMatrices@CSpeedTreeRT@@QAEXII@Z
?SetTime@CSpeedTreeRT@@SAXM@Z
?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z
?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z
?SetLightState@CSpeedTreeRT@@SAXI_N@Z
?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z
?SetCamera@CSpeedTreeRT@@SAXPBM0@Z
??0SGeometry@CSpeedTreeRT@@QAE@XZ
??1SGeometry@CSpeedTreeRT@@QAE@XZ
??0STextures@CSpeedTreeRT@@QAE@XZ
??1STextures@CSpeedTreeRT@@QAE@XZ
??0CSpeedTreeRT@@QAE@XZ
??1CSpeedTreeRT@@QAE@XZ
??2CSpeedTreeRT@@SAPAXI@Z
??3CSpeedTreeRT@@SAXPAX@Z
?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z
?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ
dinput8
DirectInput8Create
ws2_32
connect
ioctlsocket
recv
closesocket
__WSAFDIsSet
socket
WSAGetLastError
WSACleanup
htons
inet_addr
send
select
WSAStartup
gethostbyname
ddraw
DirectDrawCreate
shell32
SHGetSpecialFolderPathA
oleaut32
VariantClear
VariantInit
SysAllocString
SysFreeString
Sections
.text Size: 3.2MB - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 598KB - Virtual size: 598KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 189KB - Virtual size: 486KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 60KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ