Static task
static1
Behavioral task
behavioral1
Sample
622e5a32ca3d3ccd6ef26df6725efb7cdeb7e3c194e151aaa7a71275ab92fdbd.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
622e5a32ca3d3ccd6ef26df6725efb7cdeb7e3c194e151aaa7a71275ab92fdbd.exe
Resource
win10v2004-20230915-en
General
-
Target
622e5a32ca3d3ccd6ef26df6725efb7cdeb7e3c194e151aaa7a71275ab92fdbd
-
Size
1.2MB
-
MD5
5621e246911283b8a4651e05d06e6dfe
-
SHA1
d6a683071972ac7eda2c6eb648028c04645172e7
-
SHA256
622e5a32ca3d3ccd6ef26df6725efb7cdeb7e3c194e151aaa7a71275ab92fdbd
-
SHA512
2afd076736abd1be80efa31cbad44a41b75cb1011c92dbf3cbd3c069d428715f0ca19e2709720bfa07a0f4fc936c9e33ce02d5dda6b97b77010210fe6b036b39
-
SSDEEP
24576:CYcJSUpjw1NqwjvDLpZn4PvQ6bqk+M5LNQuKKY9COwF:bcAWWfpZn4PvV+g+uTQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 622e5a32ca3d3ccd6ef26df6725efb7cdeb7e3c194e151aaa7a71275ab92fdbd
Files
-
622e5a32ca3d3ccd6ef26df6725efb7cdeb7e3c194e151aaa7a71275ab92fdbd.exe windows:5 windows x86
c1f7dbe13c2a59faafc4d6e3f51bf587
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
entitiesmp
?CheckEntityVersion@@YAXXZ
kernel32
GetCurrentProcessId
CloseHandle
GetLastError
GetCommandLineW
GetCommandLineA
FindNextFileW
FindFirstFileExW
FindFirstFileExA
GetTimeZoneInformation
LoadLibraryW
WaitForMultipleObjectsEx
UnregisterWaitEx
QueryDepthSList
InterlockedPopEntrySList
ReleaseSemaphore
SetProcessAffinityMask
VirtualFree
VirtualProtect
VirtualAlloc
GetVersionExW
GetModuleHandleA
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SignalObjectAndWait
CreateTimerQueue
SetCurrentDirectoryA
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
SetEnvironmentVariableW
SetEnvironmentVariableA
WaitForSingleObjectEx
OutputDebugStringW
OutputDebugStringA
HeapReAlloc
HeapSize
SetEndOfFile
FreeEnvironmentStringsW
GetEnvironmentStringsW
WriteConsoleW
SetStdHandle
GetProcessHeap
GetCPInfo
GetOEMCP
IsValidCodePage
GetFileAttributesExW
ExitProcess
SetConsoleCtrlHandler
SetFilePointerEx
ReadConsoleW
GetConsoleMode
GetConsoleCP
FlushFileBuffers
RaiseException
GetStringTypeW
DecodePointer
EncodePointer
WideCharToMultiByte
GetStartupInfoW
GetFileType
GetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
LoadLibraryExW
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetModuleHandleW
HeapFree
HeapAlloc
GetACP
GetCurrentThreadId
GetCurrentThread
SetLastError
CreateProcessW
CreateProcessA
GetExitCodeProcess
WaitForSingleObject
GetModuleHandleExW
FreeLibraryAndExitThread
ResumeThread
ExitThread
CreateThread
IsProcessorFeaturePresent
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetEvent
CreateEventA
Thread32Next
Thread32First
GetSystemDefaultLangID
MoveFileA
DeleteFileA
CreateFileA
GetCurrentDirectoryA
GetModuleFileNameA
LoadLibraryA
lstrcmpA
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GetProcAddress
FreeLibrary
Sleep
Process32Next
Process32First
CreateToolhelp32Snapshot
TerminateProcess
OpenProcess
MultiByteToWideChar
GetModuleFileNameW
lstrlenW
WaitNamedPipeW
CreateFileW
PeekNamedPipe
ReadFile
WriteFile
FindClose
GetFullPathNameA
FindNextFileA
FindFirstFileA
OpenEventA
MapViewOfFile
OpenFileMappingA
CreateFileMappingA
UnmapViewOfFile
InitializeSListHead
ResetEvent
LocalFree
DuplicateHandle
SwitchToThread
GetExitCodeThread
GetNativeSystemInfo
QueryPerformanceCounter
QueryPerformanceFrequency
TryEnterCriticalSection
FormatMessageW
CreateEventW
GetTickCount
FormatMessageA
RtlCaptureStackBackTrace
user32
InvalidateRect
RegisterClassA
DefWindowProcA
RegisterClassExA
CreateWindowExA
DestroyWindow
ShowWindow
SetWindowPos
CreateDialogParamA
SetFocus
GetSystemMetrics
UpdateWindow
GetDC
ReleaseDC
BeginPaint
EndPaint
GetClientRect
GetWindowRect
MessageBoxA
FillRect
SetWindowLongA
GetDesktopWindow
LoadBitmapA
LoadIconA
ChangeDisplaySettingsA
TranslateMessage
DispatchMessageA
PeekMessageA
SendMessageA
IsIconic
MessageBoxW
ShowCursor
SetClassLongA
FindWindowA
LoadCursorA
gdi32
SelectObject
DeleteDC
CreateCompatibleDC
BitBlt
GetObjectA
GetStockObject
GetDeviceCaps
DeleteObject
advapi32
RegSetValueExW
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
SetFileSecurityA
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
engine
?TrimSpacesRight@CTString@@QAEJXZ
?RemovePrefix@CTString@@QAEHABV1@@Z
?Clear@CTString@@QAEXXZ
?RemReference@CEntity@@QAEXXZ
?AddReference@CEntity@@QAEXXZ
?g_bNoPlaySnd@@3HA
?g_fFramePerSecond@@3MA
?g_iCountry@@3JA
?snd_iFormat@@3JA
?g_szExitError@@3PADA
?DiscordUpdateData@@3_NA
?DiscordLocation@@3PADA
?DiscordGuild@@3PADA
?DiscordLevel@@3HA
?DiscordNickName@@3PADA
?_pEntityClassStock@@3PAVCStock_CEntityClass@@A
?g_bNasTrans@@3HA
?g_nmVER@@3VCTString@@A
?g_nmCID@@3VCTString@@A
?g_nmPW@@3VCTString@@A
?g_nmID@@3VCTString@@A
?g_bAutoLogin@@3HA
?sam_bWideScreen@@3JA
?sam_iGfxAPI@@3JA
?sam_iDisplayAdapter@@3JA
?sam_iDisplayDepth@@3JA
?sam_iScreenSizeJ@@3JA
?sam_iScreenSizeI@@3JA
?_pvpViewPortMain@@3PAVCViewPort@@A
?_pdpNormalMain@@3PAVCDrawPort@@A
?_pdpMain@@3PAVCDrawPort@@A
?_bClientApp@@3HA
?_pfdDisplayFont@@3PAVCFontData@@A
?_pSound@@3PAVCSoundLibrary@@A
?_pNetwork@@3PAVCNetworkLibrary@@A
?_pTimer@@3PAVCTimer@@A
?_strModExt@@3VCTString@@A
?_fnmApplicationPath@@3VCTFileName@@A
?CheckEngineVersion@@YAXXZ
?initialize@CWebAddress@@QAEXXZ
?End@cWeb@@QAEHXZ
?Begin@cWeb@@QAEHXZ
?SetNextStage@StageMgr@@QAEXW4eSTAGE@@0@Z
?Run@StageMgr@@QAEXXZ
?Create@StageMgr@@QAEXXZ
?getSingleton@?$CSingletonBase@VStageMgr@@@@SAPAVStageMgr@@XZ
?setVersion@CUILoginNew@@QAEXPBD@Z
?Create@GameDataManager@@QAEXXZ
?DestroyRenderTarget@CUIManager@@QAEXXZ
?InitRenderTarget@CUIManager@@QAEXHH@Z
?SetTitleName@CUIManager@@QAEXJHH@Z
?MsgProc@CUIManager@@QAEXPAUtagMSG@@PAH@Z
?AdjustUIPos@CUIManager@@QAEXPAVCDrawPort@@@Z
?ResetUIPos@CUIManager@@QAEXPAVCDrawPort@@@Z
?SetGameHandle@CUIManager@@QAEXPAVCGame@@@Z
?Create@CUIManager@@QAEXXZ
?Release@CStock_CEntityClass@@QAEXPAVCEntityClass@@@Z
?Obtain_t@CStock_CEntityClass@@QAEPAVCEntityClass@@ABVCTFileName@@@Z
?GetGameMode@CGameState@@QAEAAJXZ
?SE_Destroy_WebAddressPtr@@YAXXZ
?SE_Get_GameDataManagerPtr@@YAPAVGameDataManager@@XZ
?SE_Get_UIManagerPtr@@YAPAVCUIManager@@XZ
?SE_Get_WebAddressPtr@@YAPAVCWebAddress@@XZ
?SE_LoadDefaultFonts@@YAXXZ
?SE_EndEngine@@YAXXZ
?SE_InitEngine@@YAXVCTString@@@Z
?SwapBuffers@CViewPort@@QAEXH@Z
?UpdateSounds@CSoundLibrary@@QAEXXZ
?SetFormat@CSoundLibrary@@QAEXW4SoundFormat@1@H@Z
?SetVolume@CSoundObject@@QAEXMH@Z
??1CSoundObject@@QAE@XZ
?TranslateConst@@YAPBDPBDJ@Z
?GameInactive@CNetworkLibrary@@QAEXXZ
?InitPos@CUIBase@@QAEXHHHH@Z
?Fill@CDrawPort@@QBEXK@Z
?Unlock@CDrawPort@@QAEXXZ
?Lock@CDrawPort@@QAEHXZ
?PutTexture@CDrawPort@@QBEXPAVCTextureObject@@ABV?$AABBox@J$01@@1KK@Z
?PutText@CDrawPort@@QBEXABVCTString@@JJK@Z
?SetTextShadow@CDrawPort@@QAEXM@Z
?SetTextAspect@CDrawPort@@QAEXM@Z
?SetTextScaling@CDrawPort@@QAEXM@Z
?SetFont@CDrawPort@@QAEXPAVCFontData@@@Z
?GetHeight@CDrawPort@@QBEJXZ
?GetWidth@CDrawPort@@QBEJXZ
?IsTripleHead@CDrawPort@@QAEHXZ
?IsDualHead@CDrawPort@@QAEHXZ
?MakeWideScreen@CDrawPort@@QAEXPAV1@@Z
??0CDrawPort@@QAE@PAV0@J@Z
??1CDrawPort@@QAE@XZ
??0CDrawPort@@QAE@XZ
??1CTextureObject@@QAE@XZ
?SetData_t@CTextureObject@@QAEXABVCTFileName@@@Z
??0CTextureObject@@QAE@XZ
?Force@CTextureData@@QAEXK@Z
?GetPixWidth@CTextureData@@QBEJXZ
?GetWidth@CTextureData@@QBEJXZ
?Benchmark@CGfxLibrary@@QAEXPAVCViewPort@@PAVCDrawPort@@@Z
?DestroyWindowCanvas@CGfxLibrary@@QAEXPAVCViewPort@@@Z
?CreateWindowCanvas@CGfxLibrary@@QAEXPAXPAPAVCViewPort@@PAPAVCDrawPort@@@Z
?IsCurrentModeAccelerated@CGfxLibrary@@QAEHXZ
?ResetDisplayMode@CGfxLibrary@@QAEHW4GfxAPIType@@@Z
?LerpColor@@YAKKKM@Z
?IsWideScreen@CDisplayMode@@QAEHXZ
?IsTripleHead@CDisplayMode@@QAEHXZ
?IsDualHead@CDisplayMode@@QAEHXZ
?DepthString@CDisplayMode@@QBE?AVCTString@@XZ
??0CDisplayMode@@QAE@XZ
?GetHighPrecisionTimer@CTimer@@QAE?AVCTimerValue@@XZ
?GetRealTimeTick@CTimer@@QBEMXZ
?ExpandFilePath@@YAJKABVCTFileName@@AAV1@@Z
?ExceptionFatalError@CTStream@@SAXXZ
?ExceptionFilter@CTStream@@SAHKPAU_EXCEPTION_POINTERS@@@Z
?ClearStreamHandling@CTStream@@SAXXZ
?DisableStreamHandling@CTStream@@SAXXZ
?EnableStreamHandling@CTStream@@SAXXZ
?FileName@CTFileName@@QBE?AV1@XZ
?FileDir@CTFileName@@QBE?AV1@XZ
??0CTFileName@@QAE@PBDH@Z
?FinishTranslationTable@@YAXXZ
?AddTranslationTablesDir_t@@YAXABVCTFileName@@0@Z
?InitTranslation@@YAXXZ
?GetWindowsError@@YA?BVCTString@@K@Z
?ThrowF_t@@YAXPADZZ
?DeleteChars@CTString@@QAEXJJ@Z
?IsEqualCaseSensitive@CTString@@QBEHABV1@@Z
?TrimRight@CTString@@QAEJJ@Z
?FindSubstr@CTString@@QAEJABV1@@Z
?Length@CTString@@QBEJXZ
?g_web@@3VcWeb@@A
?_hDlgWeb@@3PAUHWND__@@A
?_hwndMain@@3PAUHWND__@@A
?_pGameState@@3PAVCGameState@@A
?sam_bFullScreenActive@@3JA
?_hInstanceMain@@3PAUHINSTANCE__@@A
?_bWindowChanging@@3HA
?UpdatePos@cWeb@@QAEXXZ
??1CTFileStream@@UAE@XZ
?OpenWebPage@cWeb@@QAEHPAUHWND__@@@Z
?QuitScreen@CGameState@@QAEAAHXZ
?Running@CGameState@@QAEAAHXZ
?SE_UpdateWindowHandle@@YAXPAUHWND__@@0@Z
?FatalError@@YAXPBDZZ
?_pGfx@@3PAVCGfxLibrary@@A
?_pShell@@3PAVCShell@@A
?Execute@CShell@@QAEXABVCTString@@@Z
?DeclareSymbol@CShell@@QAEXABVCTString@@PAX@Z
?GetLine_t@CTStream@@QAEXAAVCTString@@D@Z
?GetValue@CShell@@QAE?AVCTString@@ABV2@@Z
?SetValue@CShell@@QAEXABVCTString@@0@Z
?Open_t@CTFileStream@@QAEXABVCTFileName@@W4OpenMode@CTStream@@@Z
??0CSoundObject@@QAE@XZ
?CloseWebPage@cWeb@@QAEHPAUHWND__@@@Z
??0CTString@@QAE@XZ
??0CTString@@QAE@ABV0@@Z
??0CTString@@QAE@PBD@Z
??0CTString@@QAA@JPBDZZ
??1CTString@@QAE@XZ
??BCTString@@QBEPBDXZ
??4CTString@@QAEAAV0@PBD@Z
??4CTString@@QAEAAV0@ABV0@@Z
?TrimSpacesLeft@CTString@@QAEJXZ
??8CTString@@QBEHPBD@Z
??9CTString@@QBEHPBD@Z
??HCTString@@QBE?AV0@ABV0@@Z
??YCTString@@QAEAAV0@ABV0@@Z
??H@YA?AVCTString@@PBDABV0@@Z
?Split@CTString@@QAEXJAAV1@0@Z
?DeleteChar@CTString@@QAEXJ@Z
?ScanF@CTString@@QAAJPBDZZ
?Translate@@YAPADPADJ@Z
??4CTFileName@@QAEXABVCTString@@@Z
?_fnmMod@@3VCTFileName@@A
?_fnmCDPath@@3VCTFileName@@A
?_strLogFile@@3VCTString@@A
?cmd_iWindowLeft@@3JA
?cmd_iWindowTop@@3JA
??8CTString@@QBEHABV0@@Z
?Matches@CTString@@QBEHABV1@@Z
?PrintF@CTString@@QAAJPBDZZ
?WarningMessage@@YAXPBDZZ
??0CListNode@@QAE@XZ
??1CListNode@@QAE@XZ
?IsTailMarker@CListNode@@QBEHXZ
?IterationSucc@CListNode@@QBEAAV1@XZ
??0CListHead@@QAE@XZ
?IterationHead@CListHead@@QBEAAVCListNode@@XZ
?AddTail@CListHead@@QAEXAAVCListNode@@@Z
??0CTFileName@@QAE@XZ
??0CTFileName@@QAE@ABVCTString@@@Z
??1CTFileName@@QAE@XZ
?AtEOF@CTStream@@QAEHXZ
?GetLine_t@CTStream@@QAEXPADJD@Z
??0CTFileStream@@QAE@XZ
?CPrintF@@YAXPBDZZ
psapi
EnumProcessModules
GetModuleBaseNameA
GetModuleBaseNameW
GetModuleFileNameExA
GetModuleFileNameExW
shlwapi
PathFileExistsA
PathAppendA
version
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
Sections
.text Size: 728KB - Virtual size: 727KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 149KB - Virtual size: 149KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 19KB - Virtual size: 240KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 342KB - Virtual size: 342KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ