Static task
static1
Behavioral task
behavioral1
Sample
e7cf5dc16a32719c42417a03e5a959f07f8ce142b5927303b2c74f64db72b738.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
e7cf5dc16a32719c42417a03e5a959f07f8ce142b5927303b2c74f64db72b738.exe
Resource
win10v2004-20231020-en
General
-
Target
e7cf5dc16a32719c42417a03e5a959f07f8ce142b5927303b2c74f64db72b738
-
Size
3.7MB
-
MD5
c9b02b5ef0a7044af072efde0a5f2e14
-
SHA1
6d42fd8516f9d7feb38cb4fcc5fd976ba78d5225
-
SHA256
e7cf5dc16a32719c42417a03e5a959f07f8ce142b5927303b2c74f64db72b738
-
SHA512
05b391fadda06d10fd9d2e86deea38fd4b5ae642e0598036e4addfcd55a863ba26f80ed67e9308c0aa5d577b047e0011c94478b3009608b015eb05b31ab7d07c
-
SSDEEP
49152:0UV4kdm0f+AY0X+G+nEwNXix7frhnbzL7eHCHIBC1wBnN/oucTT/wYZh0hjFYG:0U4n0XCOLrhHLmiIBJ9NA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e7cf5dc16a32719c42417a03e5a959f07f8ce142b5927303b2c74f64db72b738
Files
-
e7cf5dc16a32719c42417a03e5a959f07f8ce142b5927303b2c74f64db72b738.exe windows:6 windows x86
d5f74365889cb4ad1b13bf63d651de89
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WriteFile
WinExec
WriteConsoleW
SetEndOfFile
HeapSize
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
HeapReAlloc
SetStdHandle
CreateProcessW
GetExitCodeProcess
GetTimeZoneInformation
FlushFileBuffers
MoveFileExW
DeleteFileW
CreateDirectoryW
GetFileAttributesExW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetModuleHandleA
HeapAlloc
ReadConsoleW
HeapFree
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
GetStdHandle
GetFileType
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
GetSystemDirectoryA
CreatePipe
SetHandleInformation
CreateProcessA
CloseHandle
ReadFile
MultiByteToWideChar
GetCurrentDirectoryW
GetTickCount
CreateToolhelp32Snapshot
GetCurrentProcessId
Module32First
Module32Next
GetCurrentProcess
ReadProcessMemory
GetLastError
GetSystemInfo
Sleep
SetEvent
WaitForSingleObject
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
SetFileAttributesA
FindFirstFileA
FindNextFileA
FindClose
IsProcessorFeaturePresent
GetSystemFirmwareTable
ExitProcess
GetCurrentDirectoryA
lstrlenA
GetPrivateProfileStringA
DeleteFileA
GetModuleFileNameA
GlobalFree
SetLastError
GetCurrentThread
SetUnhandledExceptionFilter
OutputDebugStringA
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
GetFileSize
CreateFileA
QueryPerformanceCounter
WaitForSingleObjectEx
GetCurrentThreadId
GetVersionExA
ReleaseSemaphore
GetLocaleInfoA
CompareStringA
WideCharToMultiByte
lstrlenW
GlobalLock
GlobalUnlock
LoadLibraryA
GetProcAddress
CreateThread
FreeLibrary
GetExitCodeThread
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeCriticalSectionEx
TryEnterCriticalSection
GetStringTypeW
EncodePointer
CreateDirectoryA
GlobalAlloc
DecodePointer
LCMapStringEx
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
QueryPerformanceFrequency
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
TlsAlloc
RaiseException
InterlockedPushEntrySList
RtlUnwind
GetModuleFileNameW
WaitNamedPipeW
PeekNamedPipe
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
TerminateProcess
UnhandledExceptionFilter
CreateEventW
ResetEvent
InitializeCriticalSectionAndSpinCount
CreateFileW
GetProcessHeap
HeapValidate
GetCPInfo
GetModuleHandleW
GetSystemTimeAsFileTime
user32
CreateWindowExA
RegisterClassExA
UnregisterClassA
DefWindowProcA
InvalidateRect
GetDC
FillRect
ReleaseDC
PeekMessageA
ClientToScreen
GetClientRect
OffsetRect
SetRect
GetAsyncKeyState
PostQuitMessage
MessageBoxA
GetMonitorInfoA
MonitorFromPoint
CharPrevExA
GetCursorPos
ScreenToClient
FindWindowA
LoadIconA
SetWindowPos
SystemParametersInfoA
FlashWindowEx
SendMessageA
GetKeyState
LoadImageA
DestroyCursor
ShowCursor
SetCursor
SetCursorPos
SetCapture
ReleaseCapture
ChangeDisplaySettingsA
ShowWindow
GetCapture
IsWindow
GetSystemMetrics
LoadStringA
CharNextExA
CharNextW
GetClipboardData
CloseClipboard
OpenClipboard
GetKeyboardLayout
GetKeyboardLayoutNameA
DispatchMessageA
TranslateMessage
GetMessageA
LoadCursorA
DestroyWindow
MoveWindow
SetFocus
UpdateWindow
GetWindowLongA
SetWindowLongA
RegisterClassA
GetMenu
SetWindowTextA
AdjustWindowRectEx
gdi32
TextOutW
SetTextColor
SetBkColor
SelectObject
GetTextExtentPoint32W
GetCharABCWidthsFloatW
CreateFontIndirectA
GetStockObject
EnumFontFamiliesExA
CreateCompatibleDC
DeleteDC
SetBkMode
TextOutA
GetDeviceCaps
GetPixel
CreateSolidBrush
DeleteObject
StretchBlt
CreateDIBSection
GetTextExtentPoint32A
shell32
SetCurrentProcessExplicitAppUserModelID
SHGetSpecialFolderPathA
ShellExecuteA
ole32
CoInitialize
CoUninitialize
CoInitializeEx
OleSetContainedObject
OleUninitialize
OleInitialize
CoGetClassObject
CoCreateInstance
winmm
timeEndPeriod
timeGetDevCaps
timeBeginPeriod
timeGetTime
d3d8
Direct3DCreate8
python27
PyErr_SetString
PyExc_RuntimeError
PyTuple_GetItem
PyInt_AsLong
PyList_New
PyString_FromString
PyList_Append
PyTuple_Size
PyDict_GetItemString
PyLong_AsLong
PyArg_ParseTuple
PyLong_FromLongLong
PyTuple_New
PyDict_New
PyDict_SetItemString
PyTuple_SetItem
PyInt_FromLong
PyList_Size
PyList_GetItem
PyDict_Size
PyDict_Next
PyImport_ImportModule
PyString_InternFromString
PyObject_GetAttrString
PyObject_GetAttr
PyCallable_Check
PyLong_AsLongLong
PyLong_AsUnsignedLongLong
PyFloat_AsDouble
PyErr_Clear
PyErr_BadArgument
PyErr_Print
PyFrame_GetLineNumber
PyNumber_Check
_Py_NoneStruct
PyModule_GetDict
PyErr_Fetch
Py_SetProgramName
Py_Initialize
Py_Finalize
PyRun_StringFlags
PyImport_AddModule
PyString_AsString
_PyThreadState_Current
PyModule_AddIntConstant
Py_InitModule4
Py_BuildValue
PyObject_CallObject
imm32
ImmGetIMEFileNameA
ImmGetContext
ImmReleaseContext
ImmAssociateContext
ImmGetCompositionStringW
ImmSetCompositionStringW
ImmGetCandidateListW
ImmGetConversionStatus
ImmSetConversionStatus
ImmGetOpenStatus
ImmNotifyIME
ImmIsIME
version
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
imagehlp
EnumerateLoadedModules
StackWalk
GetTimestampForLoadedLibrary
devil
ilTexImage
ilShutDown
ilGenImages
ilInit
ilSave
ilSetPixels
ilBindImage
ilDeleteImages
ilCopyPixels
ilConvertImage
ilOriginFunc
ilGetInteger
ilLoad
ilEnable
granny2
GrannyPNT332VertexType
_GrannyDeformVertices@24
_GrannyFreeMeshDeformer@4
_GrannyNewMeshDeformer@16
_GrannyCopyMeshIndices@12
_GrannyGetMeshVertices@4
_GrannyGetMeshVertexType@4
_GrannyGetMeshTriangleGroups@4
_GrannyGetMeshTriangleGroupCount@4
_GrannySetTrackGroupLOD@16
_GrannySetTrackGroupTarget@12
_GrannyEndControlledAnimation@4
_GrannyBeginControlledAnimation@8
_GrannyPlayControlledAnimation@12
_GrannySetControlRawLocalClock@8
_GrannyGetControlRawLocalClock@4
_GrannySetControlEaseOutCurve@28
_GrannySetControlEaseOut@8
_GrannySetControlEaseInCurve@28
_GrannySetControlEaseIn@8
_GrannyGetControlLocalDuration@4
_GrannySetControlSpeed@8
_GrannyGetControlSpeed@4
_GrannySetControlLoopCount@8
_GrannyGetControlLoopCount@4
_GrannyFreeControlIfComplete@4
_GrannyControlIsComplete@4
_GrannyCompleteControlAt@8
_GrannyFreeControlOnceUnused@4
_GrannyFreeControl@4
_GrannyFindTrackGroupForModel@12
_GrannyGetSourceModel@4
_GrannyGetMeshIndexCount@4
_GrannyMeshIsRigid@4
_GrannyGetMeshVertexCount@4
_GrannyGetTotalTypeSize@4
_GrannyGetWorldPoseComposite4x4@8
_GrannyGetWorldPose4x4@8
_GrannyFreeWorldPose@4
_GrannyNewWorldPose@4
_GrannyFindBoneByName@12
_GrannyGetMeshBindingToBoneIndices@4
_GrannyFreeMeshBinding@4
_GrannyNewMeshBinding@12
_GrannyFreeModelInstance@4
_GrannyInstantiateModel@4
_GrannyGetWorldPoseComposite4x4Array@4
_GrannyFreeLocalPose@4
_GrannyNewLocalPose@4
_GrannyUpdateModelMatrix@20
_GrannySampleModelAnimationsAccelerated@20
_GrannyFreeCompletedModelControls@4
_GrannySetModelClock@8
_GrannyGetSourceSkeleton@4
_GrannyGetFileInfo@4
_GrannyFreeFile@4
_GrannyFreeFileSection@8
_GrannyReadEntireFileFromMemory@8
_GrannyConvertSingleObject@20
_GrannyFindMatchingMember@16
_GrannyGetMaterialTextureByType@8
_GrannySetLogCallback@4
_GrannyCopyMeshVertices@12
mss32
_AIL_WAV_info@8
_AIL_decompress_ASI@24
_AIL_file_read@8
_AIL_decompress_ADPCM@12
_AIL_file_type@8
_AIL_open_digital_driver@16
_AIL_auto_update_3D_position@8
_AIL_set_file_callbacks@16
_AIL_open_stream@12
_AIL_close_digital_driver@4
_AIL_enumerate_3D_providers@12
_AIL_open_3D_provider@4
_AIL_close_3D_provider@4
_AIL_open_3D_listener@4
_AIL_close_3D_listener@4
_AIL_set_3D_position@16
_AIL_set_3D_velocity@20
_AIL_set_3D_orientation@28
_AIL_startup@0
_AIL_shutdown@0
_AIL_set_redist_directory@4
_AIL_close_stream@4
_AIL_start_stream@4
_AIL_pause_stream@8
_AIL_set_stream_volume_levels@12
_AIL_stream_volume_levels@12
_AIL_set_stream_loop_count@8
_AIL_stream_status@4
_AIL_last_error@0
_AIL_allocate_sample_handle@4
_AIL_release_sample_handle@4
_AIL_init_sample@4
_AIL_set_sample_file@12
_AIL_start_sample@4
_AIL_stop_sample@4
_AIL_resume_sample@4
_AIL_end_sample@4
_AIL_set_sample_volume_pan@12
_AIL_set_sample_loop_count@8
_AIL_sample_status@4
_AIL_sample_volume_pan@12
_AIL_allocate_3D_sample_handle@4
_AIL_release_3D_sample_handle@4
_AIL_start_3D_sample@4
_AIL_stop_3D_sample@4
_AIL_resume_3D_sample@4
_AIL_end_3D_sample@4
_AIL_set_3D_sample_file@8
_AIL_set_3D_sample_volume@8
_AIL_set_3D_sample_loop_count@8
_AIL_3D_sample_status@4
_AIL_3D_sample_volume@4
_AIL_mem_free_lock@4
speedtreert
?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z
?SetTime@CSpeedTreeRT@@SAXM@Z
?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z
?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z
?SetLightState@CSpeedTreeRT@@SAXI_N@Z
?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z
?SetCamera@CSpeedTreeRT@@SAXPBM0@Z
??0SGeometry@CSpeedTreeRT@@QAE@XZ
??1SGeometry@CSpeedTreeRT@@QAE@XZ
??0STextures@CSpeedTreeRT@@QAE@XZ
??1STextures@CSpeedTreeRT@@QAE@XZ
??0CSpeedTreeRT@@QAE@XZ
??1CSpeedTreeRT@@QAE@XZ
??2CSpeedTreeRT@@SAPAXI@Z
??3CSpeedTreeRT@@SAXPAX@Z
?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z
?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ
?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z
?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z
?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ
?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z
?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ
?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z
?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z
?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ
?SetLocalMatrices@CSpeedTreeRT@@QAEXII@Z
?ComputeLodLevel@CSpeedTreeRT@@QAEXXZ
?SetLodLevel@CSpeedTreeRT@@QAEXM@Z
?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z
?SetLodLimits@CSpeedTreeRT@@QAEXMM@Z
?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z
?GetCurrentError@CSpeedTreeRT@@SAPBDXZ
?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z
?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z
?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z
?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ
dinput8
DirectInput8Create
ws2_32
closesocket
connect
ioctlsocket
WSACleanup
recv
select
send
socket
WSAGetLastError
__WSAFDIsSet
WSAStartup
htons
gethostbyname
inet_addr
ddraw
DirectDrawCreate
advapi32
RegCreateKeyExW
RegOpenKeyExA
RegQueryValueExA
RegOpenKeyA
RegSetValueExW
RegCloseKey
oleaut32
VariantClear
VariantInit
SysAllocString
SysFreeString
Sections
.text Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 496KB - Virtual size: 496KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 185KB - Virtual size: 696KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 296KB - Virtual size: 296KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ