Static task
static1
Behavioral task
behavioral1
Sample
bcd15294ff78c46b227b054c594d6461e56c1a50fc8c4a08651e55dfea2ebfba.exe
Resource
win7-20230831-en
windows7-x64
Behavioral task
behavioral2
Sample
bcd15294ff78c46b227b054c594d6461e56c1a50fc8c4a08651e55dfea2ebfba.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
General
-
Target
bcd15294ff78c46b227b054c594d6461e56c1a50fc8c4a08651e55dfea2ebfba
-
Size
6.5MB
-
MD5
131d71a5f9bbaf6ab446b4497cf0e1fd
-
SHA1
abc854dd0590918970bcf3f30f76baae3b3ed86a
-
SHA256
bcd15294ff78c46b227b054c594d6461e56c1a50fc8c4a08651e55dfea2ebfba
-
SHA512
84b4ee6e703aea16a71c6e3ce85cec1d1cce8b889c90d6764761688f383737f4e4c5f98daf93279a33e4a51cf5f2e39b019c6e1d2b88621a682890b45e5c8a15
-
SSDEEP
98304:EqSjUGCprcjFD2s+omD5tKaa9ZG23ZMF4+Y3wWypV7Lz:EpEWFStGZ9G4qL7L
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bcd15294ff78c46b227b054c594d6461e56c1a50fc8c4a08651e55dfea2ebfba
Files
-
bcd15294ff78c46b227b054c594d6461e56c1a50fc8c4a08651e55dfea2ebfba.exe windows:6 windows x86
0771cafa1ceba7c5e5b81dabe5ca3467
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetEndOfFile
HeapQueryInformation
HeapSize
OutputDebugStringW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
SetStdHandle
DeleteFileW
SetFileAttributesW
SetCurrentDirectoryW
CreateProcessW
GetExitCodeProcess
WaitForSingleObject
HeapReAlloc
CreateDirectoryW
GetFileSizeEx
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetTimeZoneInformation
GetFileAttributesExW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetTempPathW
SetConsoleCtrlHandler
HeapAlloc
HeapFree
GetModuleHandleA
OpenThread
K32GetMappedFileNameA
IsBadReadPtr
WriteConsoleW
ReadFile
GetFileSize
CreateFileA
Module32Next
FreeLibraryAndExitThread
ResumeThread
ExitThread
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetFileInformationByHandle
GetModuleHandleExW
ExitProcess
GetFullPathNameW
GetDriveTypeW
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RtlUnwind
RaiseException
InterlockedFlushSList
InterlockedPushEntrySList
SetFilePointerEx
GetComputerNameA
GetThreadTimes
ExpandEnvironmentStringsA
WaitForMultipleObjects
GetFileType
GetStdHandle
VerifyVersionInfoA
Module32First
SetLastError
GetModuleFileNameW
WaitNamedPipeW
PeekNamedPipe
GetStartupInfoW
IsDebuggerPresent
TerminateProcess
UnhandledExceptionFilter
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
InitializeSListHead
FindResourceW
FindResourceA
SizeofResource
LoadResource
LockResource
CreateFileW
IsProcessorFeaturePresent
InterlockedDecrement
GetProcessHeap
HeapValidate
InterlockedIncrement
K32GetModuleInformation
CompareStringEx
GetLocaleInfoEx
LCMapStringEx
DecodePointer
EncodePointer
LocalFree
CreateSymbolicLinkW
GetFileInformationByHandleEx
GetModuleHandleW
CloseThreadpoolWait
SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
FreeLibraryWhenCallbackReturns
GetTickCount64
GetSystemTimeAsFileTime
GetCurrentProcessorNumber
FlushProcessWriteBuffers
CreateSemaphoreExW
CreateEventExW
SleepConditionVariableSRW
SleepConditionVariableCS
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
InitOnceExecuteOnce
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
SetFileInformationByHandle
GetStringTypeW
GetCurrentThreadId
TryEnterCriticalSection
InitializeCriticalSectionEx
AcquireSRWLockExclusive
TerminateThread
GetCurrentDirectoryW
GetTickCount
GetCurrentDirectoryA
DeleteFileA
ReleaseMutex
CreateMutexA
GlobalFree
lstrlenA
GetPrivateProfileStringA
MoveFileA
GetNativeSystemInfo
GetExitCodeThread
ReadProcessMemory
GetModuleFileNameA
MultiByteToWideChar
SetFileAttributesA
Process32Next
Process32First
CreateToolhelp32Snapshot
K32GetProcessImageFileNameA
K32GetModuleFileNameExA
QueryDosDeviceA
GetLogicalDriveStringsA
CreateThread
GetHandleInformation
IsBadCodePtr
VirtualQuery
ReleaseSRWLockExclusive
InitializeSRWLock
FormatMessageA
QueryPerformanceFrequency
QueryPerformanceCounter
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetLocaleInfoA
CompareStringA
WideCharToMultiByte
lstrlenW
GlobalLock
GlobalUnlock
FreeLibrary
GetVersionExA
GetSystemDirectoryA
WriteFile
GetFullPathNameA
FindNextFileA
FindFirstFileA
FindClose
RemoveVectoredExceptionHandler
AddVectoredExceptionHandler
K32QueryWorkingSetEx
VerifyVersionInfoW
SetFilePointer
WinExec
SetUnhandledExceptionFilter
GetTempFileNameA
GetTempPathA
RemoveDirectoryA
CreateDirectoryA
CreateFileMappingA
UnmapViewOfFile
VirtualProtect
VirtualAlloc
VerSetConditionMask
Sleep
LoadLibraryA
GetProcAddress
WTSGetActiveConsoleSessionId
UnregisterWait
MapViewOfFile
GetSystemInfo
OutputDebugStringA
AllocConsole
GlobalAlloc
GetCPInfo
SwitchToThread
RegisterWaitForSingleObject
OpenProcess
GetCurrentThread
GetCurrentProcessId
GetFileAttributesA
GetCurrentProcess
GetLastError
CloseHandle
SleepEx
user32
ScreenToClient
FindWindowA
LoadIconA
DestroyIcon
SystemParametersInfoA
GetKeyState
ShowCursor
UnregisterClassA
DestroyCursor
LoadImageA
SetCursorPos
ClientToScreen
ShowWindow
GetCapture
SetCapture
ReleaseCapture
CreatePopupMenu
DestroyMenu
InsertMenuA
TrackPopupMenu
SetForegroundWindow
ChangeDisplaySettingsA
GetSystemMetrics
IsWindow
GetMessageA
TranslateMessage
DispatchMessageA
SetWinEventHook
UnhookWinEvent
GetWindowModuleFileNameA
PeekMessageA
GetDC
ReleaseDC
BeginPaint
EndPaint
InvalidateRect
GetClientRect
RegisterClassExA
SetRect
OffsetRect
LoadStringA
MessageBoxA
CreateWindowExA
DestroyWindow
MoveWindow
SetFocus
UpdateWindow
GetWindowLongA
CharNextExA
CharPrevExA
RegisterClassA
GetMenu
SetWindowTextA
GetWindowRect
AdjustWindowRectEx
LoadCursorA
GetKeyboardLayoutNameA
GetKeyboardLayout
OpenClipboard
CloseClipboard
GetClipboardData
CharNextW
SendMessageW
DefWindowProcA
DefWindowProcW
UnregisterClassW
RegisterClassExW
CreateWindowExW
LoadImageW
GetCursorPos
GetAsyncKeyState
SetWindowPos
FlashWindowEx
SendMessageA
PostQuitMessage
RegisterRawInputDevices
GetRawInputData
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExA
GetWindowThreadProcessId
SetWindowLongW
SetWindowLongA
IsWindowUnicode
KillTimer
SetTimer
SetCursor
FillRect
gdi32
GetTextExtentPoint32A
StretchBlt
PatBlt
DeleteObject
CreateSolidBrush
EnumFontFamiliesExA
GetStockObject
CreateFontIndirectA
GetCharABCWidthsFloatW
GetTextExtentPoint32W
SelectObject
SetBkColor
SetTextColor
TextOutW
CreateCompatibleDC
DeleteDC
SetBkMode
SetDIBitsToDevice
CreateDIBSection
TextOutA
advapi32
CryptDestroyKey
CryptImportKey
CryptEncrypt
SetSecurityInfo
ConvertStringSecurityDescriptorToSecurityDescriptorA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
RegOpenKeyA
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
SetKernelObjectSecurity
shell32
ShellExecuteA
SHGetSpecialFolderPathA
Shell_NotifyIconA
ole32
CoInitialize
CoCreateInstance
CoInitializeEx
CoInitializeSecurity
CoUninitialize
OleSetContainedObject
OleUninitialize
OleInitialize
CoGetClassObject
oleaut32
SafeArrayGetUBound
SysStringLen
VariantClear
VariantInit
SafeArrayGetLBound
SysFreeString
SysAllocString
SafeArrayCreate
SafeArrayDestroy
SafeArrayAccessData
winmm
timeGetTime
timeEndPeriod
timeBeginPeriod
timeGetDevCaps
d3d8
Direct3DCreate8
python27
Py_BuildValue
Py_InitModule4
PyModule_AddIntConstant
PyLong_AsLong
PyTuple_Size
PyTuple_GetItem
PyDict_GetItemString
PyInt_FromLong
PyLong_FromLongLong
PyTuple_New
PyTuple_SetItem
PyList_New
PyList_Append
PyDict_New
PyDict_SetItemString
PyInt_AsLong
PyDict_Next
PyDict_Size
PyObject_GetAttrString
PyString_FromString
PyImport_ImportModule
PyObject_CallObject
PyString_AsString
PyThreadState_Get
PyErr_SetString
PyExc_RuntimeError
PyArg_ParseTuple
PyModule_AddStringConstant
PyString_InternFromString
PyObject_GetAttr
PyCallable_Check
PyLong_AsLongLong
PyLong_AsUnsignedLongLong
PyFloat_AsDouble
PyErr_Clear
PyErr_BadArgument
PyErr_Print
PyNumber_Check
_Py_NoneStruct
PyModule_GetDict
PyErr_Fetch
Py_SetProgramName
Py_Initialize
Py_Finalize
PyRun_StringFlags
PyEval_SetTrace
Py_FlushLine
PyImport_GetMagicNumber
PyImport_AddModule
PyObject_AsCharBuffer
PyCode_Addr2Line
PyEval_EvalCode
Py_OptimizeFlag
PyCode_Type
PyUnicodeUCS2_DecodeUTF8
_PyLong_FromByteArray
PyFloat_FromDouble
PyComplex_FromCComplex
PyString_FromStringAndSize
PyList_SetItem
PyDict_SetItem
PyErr_Occurred
PyErr_NoMemory
PyEval_GetRestricted
PyCode_New
PyMarshal_ReadObjectFromString
_PyLong_New
_Py_EllipsisObject
PyExc_StopIteration
PyExc_EOFError
PyExc_ValueError
wtsapi32
WTSSendMessageA
netapi32
Netbios
imm32
ImmGetIMEFileNameA
ImmNotifyIME
ImmGetOpenStatus
ImmSetConversionStatus
ImmGetConversionStatus
ImmGetCandidateListW
ImmSetCompositionStringW
ImmGetCompositionStringW
ImmAssociateContext
ImmReleaseContext
ImmGetContext
ImmIsIME
devil
ilSave
ilShutDown
ilOriginFunc
ilEnable
ilInit
ilSetPixels
ilLoad
ilGetInteger
ilGenImages
ilDeleteImages
ilBindImage
ilConvertImage
ilTexImage
ilCopyPixels
ws2_32
WSAGetLastError
socket
send
select
recv
ioctlsocket
connect
WSACleanup
htonl
htons
inet_addr
ntohl
ntohs
gethostbyname
closesocket
__WSAFDIsSet
WSAStartup
sendto
recvfrom
listen
accept
freeaddrinfo
getaddrinfo
WSAIoctl
setsockopt
getsockopt
getsockname
getpeername
bind
WSASetLastError
gethostname
crypt32
CertFreeCertificateContext
wldap32
ord79
ord26
ord60
ord211
ord50
ord41
ord46
ord143
ord27
ord32
ord33
ord35
ord301
ord200
ord30
ord22
normaliz
IdnToUnicode
IdnToAscii
version
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
imagehlp
StackWalk
EnumerateLoadedModules
GetTimestampForLoadedLibrary
granny2
_GrannySetLogCallback@4
GrannyPNT332VertexType
_GrannyFreeMeshDeformer@4
_GrannyNewMeshDeformer@16
_GrannyCopyMeshIndices@12
_GrannyReadEntireFileFromMemory@8
_GrannyDeformVertices@24
_GrannyCopyMeshVertices@12
_GrannyGetMeshVertexType@4
_GrannyGetMeshTriangleGroups@4
_GrannyGetMeshTriangleGroupCount@4
_GrannySetTrackGroupLOD@16
_GrannySetTrackGroupTarget@12
_GrannyEndControlledAnimation@4
_GrannyBeginControlledAnimation@8
_GrannyGetMeshVertices@4
_GrannySetControlSpeed@8
_GrannyFreeFileSection@8
_GrannyFreeFile@4
_GrannyGetFileInfo@4
_GrannyGetMaterialTextureByType@8
_GrannyPlayControlledAnimation@12
_GrannySetControlRawLocalClock@8
_GrannyGetControlRawLocalClock@4
_GrannySetControlEaseOutCurve@28
_GrannyFindMatchingMember@16
_GrannyConvertSingleObject@20
_GrannyGetSourceSkeleton@4
_GrannySetModelClock@8
_GrannyFreeCompletedModelControls@4
_GrannySampleModelAnimationsAccelerated@20
_GrannyUpdateModelMatrix@20
_GrannyNewLocalPose@4
_GrannyFreeLocalPose@4
_GrannyGetWorldPoseComposite4x4Array@4
_GrannyInstantiateModel@4
_GrannyFreeModelInstance@4
_GrannyNewMeshBinding@12
_GrannyFreeMeshBinding@4
_GrannyGetMeshBindingToBoneIndices@4
_GrannyFindBoneByName@12
_GrannyNewWorldPose@4
_GrannyFreeWorldPose@4
_GrannyGetWorldPose4x4@8
_GrannyGetWorldPoseComposite4x4@8
_GrannyGetTotalTypeSize@4
_GrannyGetMeshVertexCount@4
_GrannyMeshIsRigid@4
_GrannyGetMeshIndexCount@4
_GrannyGetSourceModel@4
_GrannyFindTrackGroupForModel@12
_GrannyFreeControl@4
_GrannyFreeControlOnceUnused@4
_GrannyCompleteControlAt@8
_GrannyControlIsComplete@4
_GrannyFreeControlIfComplete@4
_GrannyGetControlLoopCount@4
_GrannySetControlLoopCount@8
_GrannyGetControlSpeed@4
_GrannyGetControlLocalDuration@4
_GrannySetControlEaseIn@8
_GrannySetControlEaseInCurve@28
_GrannySetControlEaseOut@8
mss32
_AIL_stop_3D_sample@4
_AIL_resume_3D_sample@4
_AIL_end_3D_sample@4
_AIL_set_3D_sample_file@8
_AIL_set_3D_sample_volume@8
_AIL_set_3D_sample_loop_count@8
_AIL_3D_sample_status@4
_AIL_3D_sample_volume@4
_AIL_open_3D_provider@4
_AIL_auto_update_3D_position@8
_AIL_close_3D_provider@4
_AIL_start_3D_sample@4
_AIL_enumerate_3D_providers@12
_AIL_close_digital_driver@4
_AIL_mem_free_lock@4
_AIL_file_read@8
_AIL_set_file_callbacks@16
_AIL_WAV_info@8
_AIL_decompress_ASI@24
_AIL_decompress_ADPCM@12
_AIL_file_type@8
_AIL_update_3D_position@8
_AIL_end_sample@4
_AIL_release_3D_sample_handle@4
_AIL_allocate_3D_sample_handle@4
_AIL_sample_volume_pan@12
_AIL_sample_status@4
_AIL_set_sample_loop_count@8
_AIL_set_sample_volume_pan@12
_AIL_open_stream@12
_AIL_resume_sample@4
_AIL_stop_sample@4
_AIL_open_digital_driver@16
_AIL_open_3D_listener@4
_AIL_close_3D_listener@4
_AIL_set_3D_position@16
_AIL_set_3D_velocity@20
_AIL_set_3D_orientation@28
_AIL_start_sample@4
_AIL_set_sample_file@12
_AIL_init_sample@4
_AIL_release_sample_handle@4
_AIL_allocate_sample_handle@4
_AIL_last_error@0
_AIL_stream_status@4
_AIL_set_stream_loop_count@8
_AIL_stream_volume_levels@12
_AIL_set_stream_volume_levels@12
_AIL_pause_stream@8
_AIL_start_stream@4
_AIL_close_stream@4
_AIL_set_redist_directory@4
_AIL_shutdown@0
_AIL_startup@0
speedtreert
?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z
?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetLocalMatrices@CSpeedTreeRT@@QAEXII@Z
?ComputeLodLevel@CSpeedTreeRT@@QAEXXZ
?SetLodLevel@CSpeedTreeRT@@QAEXM@Z
?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z
?DeleteTransientData@CSpeedTreeRT@@QAEXXZ
?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ
?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z
??3CSpeedTreeRT@@SAXPAX@Z
??2CSpeedTreeRT@@SAPAXI@Z
??1CSpeedTreeRT@@QAE@XZ
?SetLodLimits@CSpeedTreeRT@@QAEXMM@Z
??1STextures@CSpeedTreeRT@@QAE@XZ
??0STextures@CSpeedTreeRT@@QAE@XZ
??1SGeometry@CSpeedTreeRT@@QAE@XZ
??0SGeometry@CSpeedTreeRT@@QAE@XZ
?SetCamera@CSpeedTreeRT@@SAXPBM0@Z
?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z
?SetLightState@CSpeedTreeRT@@SAXI_N@Z
?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z
?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z
?SetTime@CSpeedTreeRT@@SAXM@Z
?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z
?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ
?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z
?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z
?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ
?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z
?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ
?GetLeafLightingAdjustment@CSpeedTreeRT@@QBEMXZ
?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ
?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z
?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ
?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z
?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z
?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z
??0CSpeedTreeRT@@QAE@XZ
?GetCurrentError@CSpeedTreeRT@@SAPBDXZ
?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z
?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?GetTreeSize@CSpeedTreeRT@@QBEXAAM0@Z
dinput8
DirectInput8Create
ddraw
DirectDrawCreate
resource
RegisterSkill
LoadGameNPC
PythonPlayerSettingsModuleLibRegisterVariables
PythonPlayerSettingsModuleLibRegisterFunctions
LoadPythonPlayerSettingsModuleLibrary
GetHorsePathNameByMode
iphlpapi
GetAdaptersInfo
Sections
.text Size: 5.1MB - Virtual size: 5.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 936KB - Virtual size: 936KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 208KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 122KB - Virtual size: 121KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 219KB - Virtual size: 219KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ