Static task
static1
Behavioral task
behavioral1
Sample
b4a85eb07aa2acf4ffae59ebe47b51fbdcca9a1277ae03a6d0ed31da788a8d05.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
b4a85eb07aa2acf4ffae59ebe47b51fbdcca9a1277ae03a6d0ed31da788a8d05.exe
Resource
win10v2004-20231023-en
General
-
Target
b4a85eb07aa2acf4ffae59ebe47b51fbdcca9a1277ae03a6d0ed31da788a8d05
-
Size
3.6MB
-
MD5
b0273a94d593173c33d3c025c1a9027c
-
SHA1
c5ed4f08758159310630313c9aa00f74f709b08c
-
SHA256
b4a85eb07aa2acf4ffae59ebe47b51fbdcca9a1277ae03a6d0ed31da788a8d05
-
SHA512
aa2e52bae3dbd92c0340c3910497c4f48eb0947bb396ad35c1371e481f4e21c7a045adfaa2623d4f1076e7bf7d659ff2ea3e0e6b97e21730ed1df1d8caf01990
-
SSDEEP
98304:XlP+Ifu5IURPaGGosNttweE1NpcZrlVK9:4Ifu5IURPbGoyOeElcN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b4a85eb07aa2acf4ffae59ebe47b51fbdcca9a1277ae03a6d0ed31da788a8d05
Files
-
b4a85eb07aa2acf4ffae59ebe47b51fbdcca9a1277ae03a6d0ed31da788a8d05.exe windows:6 windows x86
efcd45bc071eff804d242516bf082b69
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
RegisterWaitForSingleObject
UnregisterWait
CreateDirectoryW
FindFirstFileExW
SystemTimeToTzSpecificLocalTime
FreeLibraryAndExitThread
GetVersionExW
VirtualAlloc
VirtualFree
VirtualProtect
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
GetFullPathNameW
LoadLibraryW
MoveFileA
GetPrivateProfileStringA
lstrlenA
GlobalFree
GetModuleFileNameA
CreateMutexA
ReleaseMutex
DeleteFileA
GetCurrentDirectoryA
GetTickCount
GetCurrentDirectoryW
ReadProcessMemory
GetCurrentProcessId
GetCurrentProcess
GetLastError
FindNextFileA
FindFirstFileA
GetFileSizeEx
VerifyVersionInfoW
VerSetConditionMask
WaitForMultipleObjects
GetEnvironmentVariableA
WaitForSingleObjectEx
MoveFileExA
FormatMessageW
SleepEx
InitializeCriticalSectionEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetThreadTimes
QueryPerformanceFrequency
WaitNamedPipeW
SetEndOfFile
SetEnvironmentVariableA
CreateProcessA
FindClose
OutputDebugStringW
WriteConsoleW
HeapReAlloc
SetStdHandle
DeleteFileW
GetTimeZoneInformation
FreeEnvironmentStringsW
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SwitchToThread
SignalObjectAndWait
DuplicateHandle
MultiByteToWideChar
SetFileAttributesA
Module32Next
Module32First
Process32Next
Process32First
CreateToolhelp32Snapshot
GetSystemInfo
OpenProcess
SetThreadPriority
Sleep
CreateEventA
WaitForSingleObject
CreateTimerQueue
DeleteCriticalSection
GetEnvironmentStringsW
GetModuleFileNameW
SetFilePointerEx
ReadConsoleW
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetStdHandle
GetOEMCP
GetACP
IsValidCodePage
GetFileAttributesExW
HeapSize
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
CreateSemaphoreW
GetModuleHandleW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
CreateEventW
InitializeCriticalSectionAndSpinCount
SetLastError
UnhandledExceptionFilter
FileTimeToSystemTime
PeekNamedPipe
GetFileType
GetFileInformationByHandle
FileTimeToLocalFileTime
GetCPInfo
LoadLibraryExW
GetCurrentThreadId
GetDriveTypeW
GetCommandLineA
AreFileApisANSI
GetModuleHandleExW
ExitProcess
HeapAlloc
HeapFree
GetSystemTimeAsFileTime
ResumeThread
ExitThread
CreateThread
IsDebuggerPresent
RtlUnwind
RaiseException
DecodePointer
EncodePointer
GetStringTypeW
CreateFileW
IsProcessorFeaturePresent
GetProcessHeap
HeapValidate
QueryPerformanceCounter
ReleaseSemaphore
GetLocaleInfoA
CompareStringA
WideCharToMultiByte
LoadLibraryA
lstrlenW
GlobalUnlock
GlobalLock
GetProcAddress
FreeLibrary
GetVersionExA
GetSystemDirectoryA
WriteFile
ReadFile
WinExec
GetModuleHandleA
GetCurrentThread
SetUnhandledExceptionFilter
GetFileSize
CreateFileA
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
OutputDebugStringA
CreateDirectoryA
GlobalAlloc
SetEvent
GetExitCodeThread
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetExitCodeProcess
CloseHandle
user32
SetCursorPos
ClientToScreen
ShowWindow
GetCapture
SetCapture
ReleaseCapture
ChangeDisplaySettingsA
GetSystemMetrics
PeekMessageA
GetDC
ReleaseDC
BeginPaint
EndPaint
InvalidateRect
DefWindowProcA
UnregisterClassA
RegisterClassExA
CreateWindowExA
IsWindow
DestroyWindow
MoveWindow
SetFocus
DestroyCursor
SetCursor
ShowCursor
GetKeyState
SystemParametersInfoA
PostQuitMessage
FlashWindowEx
SetWindowPos
UpdateWindow
GetWindowLongA
SetWindowLongA
GetAsyncKeyState
GetCursorPos
CharNextExA
LoadIconA
CharPrevExA
RegisterClassA
GetMenu
SetWindowTextA
AdjustWindowRectEx
LoadCursorA
GetMessageA
TranslateMessage
DispatchMessageA
GetKeyboardLayoutNameA
GetKeyboardLayout
OpenClipboard
CloseClipboard
GetClipboardData
CharNextW
ScreenToClient
FindWindowA
LoadImageA
MessageBoxA
LoadStringA
OffsetRect
SetRect
FillRect
GetClientRect
gdi32
GetTextExtentPoint32A
EnumFontFamiliesExA
GetStockObject
CreateFontIndirectA
GetCharABCWidthsFloatW
GetTextExtentPoint32W
SelectObject
SetBkColor
SetTextColor
TextOutW
CreateCompatibleDC
DeleteDC
SetBkMode
CreateDIBSection
TextOutA
StretchBlt
CreateSolidBrush
DeleteObject
PatBlt
ole32
CoInitializeEx
OleSetContainedObject
OleUninitialize
CoUninitialize
CoInitialize
CoCreateInstance
CoGetClassObject
OleInitialize
winmm
timeBeginPeriod
timeGetDevCaps
timeGetTime
timeEndPeriod
d3d8
Direct3DCreate8
python27
Py_BuildValue
PyModule_AddIntConstant
Py_InitModule4
PyLong_FromLongLong
PyTuple_New
PyTuple_SetItem
PyDict_New
PyDict_SetItemString
PyLong_AsLong
PyTuple_Size
PyTuple_GetItem
PyInt_AsLong
PyDict_GetItemString
PyDict_Size
PyList_New
PyList_Append
PyErr_SetString
PyExc_RuntimeError
PyString_FromString
PyArg_ParseTuple
PyString_InternFromString
PyObject_GetAttrString
PyObject_GetAttr
PyCallable_Check
PyLong_AsLongLong
PyFloat_AsDouble
PyString_AsString
PyErr_Clear
PyErr_BadArgument
PyErr_Print
PyObject_CallObject
PyNumber_Check
PyDict_Next
_Py_NoneStruct
PyModule_GetDict
PyErr_Fetch
Py_SetProgramName
Py_Initialize
Py_Finalize
PyRun_StringFlags
PyImport_AddModule
PyImport_ImportModule
imm32
ImmGetCandidateListW
ImmIsIME
ImmNotifyIME
ImmGetOpenStatus
ImmSetConversionStatus
ImmGetConversionStatus
ImmGetIMEFileNameA
ImmSetCompositionStringW
ImmGetCompositionStringW
ImmAssociateContext
ImmReleaseContext
ImmGetContext
devil
ilInit
ilTexImage
ilSetPixels
ilSave
ilShutDown
ilOriginFunc
ilEnable
ilCopyPixels
ilConvertImage
ilLoad
ilGetInteger
ilBindImage
ilDeleteImages
ilGenImages
version
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
imagehlp
GetTimestampForLoadedLibrary
EnumerateLoadedModules
StackWalk
granny2
GrannyPNT332VertexType
_GrannySetLogCallback@4
_GrannyGetMaterialTextureByType@8
_GrannyFindMatchingMember@12
_GrannyConvertSingleObject@16
_GrannyReadEntireFileFromMemory@8
_GrannyFreeFileSection@8
_GrannyFreeFile@4
_GrannyGetFileInfo@4
_GrannyGetSourceSkeleton@4
_GrannySetModelClock@8
_GrannyFreeCompletedModelControls@4
_GrannySampleModelAnimationsAccelerated@20
_GrannyUpdateModelMatrix@16
_GrannyNewLocalPose@4
_GrannyFreeLocalPose@4
_GrannyGetWorldPoseComposite4x4Array@4
_GrannyInstantiateModel@4
_GrannyFreeModelInstance@4
_GrannyNewMeshBinding@12
_GrannyFreeMeshBinding@4
_GrannyGetMeshBindingToBoneIndices@4
_GrannyFindBoneByName@12
_GrannyNewWorldPose@4
_GrannyGetWorldPose4x4@8
_GrannyGetWorldPoseComposite4x4@8
_GrannyGetTotalTypeSize@4
_GrannyGetMeshVertexCount@4
_GrannyMeshIsRigid@4
_GrannyGetMeshIndexCount@4
_GrannyFreeControl@4
_GrannyFreeControlOnceUnused@4
_GrannyCompleteControlAt@8
_GrannyControlIsComplete@4
_GrannyFreeControlIfComplete@4
_GrannyGetControlLoopCount@4
_GrannySetControlLoopCount@8
_GrannyGetControlSpeed@4
_GrannySetControlSpeed@8
_GrannyGetControlLocalDuration@4
_GrannySetControlEaseIn@8
_GrannySetControlEaseInCurve@28
_GrannySetControlEaseOut@8
_GrannySetControlEaseOutCurve@28
_GrannyGetControlRawLocalClock@4
_GrannySetControlRawLocalClock@8
_GrannyPlayControlledAnimation@12
_GrannyGetMeshTriangleGroupCount@4
_GrannyGetMeshTriangleGroups@4
_GrannyGetMeshVertexType@4
_GrannyCopyMeshVertices@12
_GrannyGetMeshVertices@4
_GrannyCopyMeshIndices@12
_GrannyNewMeshDeformer@12
_GrannyFreeMeshDeformer@4
_GrannyDeformVertices@24
_GrannyFreeWorldPose@4
mss32
_AIL_decompress_ASI@24
_AIL_decompress_ADPCM@12
_AIL_file_type@8
_AIL_open_digital_driver@16
_AIL_open_stream@12
_AIL_close_digital_driver@4
_AIL_enumerate_3D_providers@12
_AIL_open_3D_provider@4
_AIL_close_3D_provider@4
_AIL_open_3D_listener@4
_AIL_close_3D_listener@4
_AIL_set_3D_position@16
_AIL_set_3D_velocity@20
_AIL_set_3D_orientation@28
_AIL_startup@0
_AIL_shutdown@0
_AIL_set_redist_directory@4
_AIL_close_stream@4
_AIL_WAV_info@8
_AIL_pause_stream@8
_AIL_set_stream_volume_levels@12
_AIL_stream_volume_levels@12
_AIL_set_stream_loop_count@8
_AIL_stream_status@4
_AIL_last_error@0
_AIL_mem_free_lock@4
_AIL_set_file_callbacks@16
_AIL_allocate_sample_handle@4
_AIL_release_sample_handle@4
_AIL_init_sample@4
_AIL_set_sample_file@12
_AIL_start_sample@4
_AIL_stop_sample@4
_AIL_resume_sample@4
_AIL_end_sample@4
_AIL_set_sample_volume_pan@12
_AIL_set_sample_loop_count@8
_AIL_sample_status@4
_AIL_file_read@8
_AIL_start_stream@4
_AIL_sample_volume_pan@12
_AIL_allocate_3D_sample_handle@4
_AIL_release_3D_sample_handle@4
_AIL_start_3D_sample@4
_AIL_stop_3D_sample@4
_AIL_resume_3D_sample@4
_AIL_end_3D_sample@4
_AIL_auto_update_3D_position@8
_AIL_3D_sample_volume@4
_AIL_3D_sample_status@4
_AIL_set_3D_sample_loop_count@8
_AIL_set_3D_sample_volume@8
_AIL_set_3D_sample_file@8
speedtreert
?SetCamera@CSpeedTreeRT@@SAXPBM0@Z
??0SGeometry@CSpeedTreeRT@@QAE@XZ
??1SGeometry@CSpeedTreeRT@@QAE@XZ
??0STextures@CSpeedTreeRT@@QAE@XZ
??1STextures@CSpeedTreeRT@@QAE@XZ
??0CSpeedTreeRT@@QAE@XZ
??1CSpeedTreeRT@@QAE@XZ
??2CSpeedTreeRT@@SAPAXI@Z
??3CSpeedTreeRT@@SAXPAX@Z
?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z
?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ
?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z
?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z
?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ
?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z
?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z
?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ
?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z
?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ
?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z
?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z
?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetLocalMatrices@CSpeedTreeRT@@QAEXII@Z
?ComputeLodLevel@CSpeedTreeRT@@QAEXXZ
?SetLodLevel@CSpeedTreeRT@@QAEXM@Z
?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z
?SetLodLimits@CSpeedTreeRT@@QAEXMM@Z
?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ
?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z
?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z
?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z
?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z
?GetCurrentError@CSpeedTreeRT@@SAPBDXZ
?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z
?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ
?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z
?SetTime@CSpeedTreeRT@@SAXM@Z
?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ
?SetLightState@CSpeedTreeRT@@SAXI_N@Z
?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ
dinput8
DirectInput8Create
ws2_32
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAResetEvent
getaddrinfo
gethostname
gethostbyname
ntohs
inet_addr
htons
htonl
WSACleanup
WSAStartup
WSAGetLastError
socket
send
select
recv
ioctlsocket
connect
closesocket
__WSAFDIsSet
WSAWaitForMultipleEvents
bind
setsockopt
freeaddrinfo
recvfrom
sendto
getpeername
getsockname
getsockopt
WSASetLastError
WSAIoctl
accept
listen
ddraw
DirectDrawCreate
bcrypt
BCryptGenRandom
advapi32
RegCloseKey
RegQueryValueExA
RegOpenKeyA
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptEncrypt
RegOpenKeyExA
shell32
SHGetSpecialFolderPathA
oleaut32
SysFreeString
VariantClear
SysAllocString
VariantInit
crypt32
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CryptStringToBinaryA
PFXImportCertStore
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
CertOpenStore
wldap32
ord26
ord22
ord41
ord50
ord27
ord60
ord211
ord46
ord217
ord143
ord32
ord33
ord35
ord79
ord30
ord200
ord301
ord45
normaliz
IdnToAscii
Sections
.text Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 513KB - Virtual size: 513KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 122KB - Virtual size: 627KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 69KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 123KB - Virtual size: 123KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ