Static task
static1
Behavioral task
behavioral1
Sample
9b2989ae93cc9413e5d320796d22282d016123f26cb269fa6f1484158d336ef6.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
9b2989ae93cc9413e5d320796d22282d016123f26cb269fa6f1484158d336ef6.exe
Resource
win10v2004-20231023-en
General
-
Target
9b2989ae93cc9413e5d320796d22282d016123f26cb269fa6f1484158d336ef6
-
Size
3.3MB
-
MD5
9b8a1a952a2188c9f9da1b301182e6a8
-
SHA1
fea430f64774811d3154667562ed6f6189a8d88a
-
SHA256
9b2989ae93cc9413e5d320796d22282d016123f26cb269fa6f1484158d336ef6
-
SHA512
c5ddf5c0815fd4262eb29f66f2495e34a3c8c272e027d8426995d3bfdb9fbd8ccb60d6bd985a2f7065aaa84bc134f2b07944a353832d84fcab46ead00fce6010
-
SSDEEP
49152:rZs+UP25mr7wdd1eQS/JlcqNIocxTj0dIIql0foJ5Q72aDLjCjyObqNL:v5eQSRlyx/02Iq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9b2989ae93cc9413e5d320796d22282d016123f26cb269fa6f1484158d336ef6
Files
-
9b2989ae93cc9413e5d320796d22282d016123f26cb269fa6f1484158d336ef6.exe windows:5 windows x86
3ef9943d23dd67e22f6ed6bdcf14904a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
FreeLibraryAndExitThread
GetVersionExW
VirtualAlloc
VirtualFree
VirtualProtect
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
LoadLibraryW
MoveFileA
GlobalFree
CheckRemoteDebuggerPresent
GetPriorityClass
GetFileAttributesExA
SetFileAttributesA
GetCurrentDirectoryW
MultiByteToWideChar
GetTickCount
FindNextFileA
FindClose
FindFirstFileA
CreateThread
GetThreadTimes
WaitNamedPipeW
SetEnvironmentVariableA
SetEndOfFile
OutputDebugStringW
WriteConsoleW
HeapReAlloc
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetFileAttributesExW
DeleteFileW
MoveFileExW
CreateDirectoryW
ReadConsoleW
GetModuleFileNameW
GetTimeZoneInformation
Process32Next
GetConsoleCP
FlushFileBuffers
SetFilePointerEx
GetStdHandle
GetOEMCP
GetACP
IsValidCodePage
HeapSize
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
CreateSemaphoreW
GetModuleHandleW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
CreateEventW
InitializeCriticalSectionAndSpinCount
SetLastError
UnhandledExceptionFilter
GetNumaHighestNodeNumber
GetFileType
GetCPInfo
LoadLibraryExW
ExitThread
GetCurrentThreadId
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SwitchToThread
SignalObjectAndWait
WaitForSingleObjectEx
SetEvent
DuplicateHandle
GetExitCodeThread
TerminateProcess
ReadProcessMemory
Sleep
OpenProcess
Process32First
GetCurrentProcessId
CloseHandle
Module32Next
CreateToolhelp32Snapshot
LoadLibraryExA
GetModuleHandleA
GetProcAddress
GetLastError
Module32First
GetProcessHeap
RtlUnwind
RaiseException
GetCommandLineA
IsDebuggerPresent
AreFileApisANSI
GetModuleHandleExW
ExitProcess
GetSystemTimeAsFileTime
DecodePointer
EncodePointer
GetStringTypeW
CreateFileW
IsProcessorFeaturePresent
HeapValidate
QueryPerformanceCounter
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
WaitForSingleObject
ReleaseSemaphore
SetThreadPriority
GetLocaleInfoA
CompareStringA
WideCharToMultiByte
GetVersionExA
GetSystemDirectoryA
LoadLibraryA
lstrlenW
GlobalUnlock
GlobalLock
ReadFile
WriteFile
OutputDebugStringA
WinExec
GetCurrentThread
SetUnhandledExceptionFilter
CreateFileA
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
GetSystemInfo
GetFileSize
CreateDirectoryA
GetModuleFileNameA
GlobalAlloc
PeekNamedPipe
CreateTimerQueue
HeapFree
GetCurrentProcess
HeapAlloc
GetConsoleMode
FreeLibrary
user32
ChangeDisplaySettingsA
ClientToScreen
ShowWindow
GetCapture
SetCapture
GetSystemMetrics
SystemParametersInfoA
GetCursorPos
SetWindowPos
FlashWindowEx
LoadIconA
PostQuitMessage
GetMonitorInfoA
DefWindowProcA
RegisterClassA
CreateWindowExA
IsWindow
DestroyWindow
MoveWindow
GetMenu
AdjustWindowRectEx
GetWindowLongA
SetWindowLongA
LoadCursorA
GetMessageA
TranslateMessage
DispatchMessageA
GetKeyboardLayoutNameA
GetKeyboardLayout
OpenClipboard
CloseClipboard
GetClipboardData
CharNextW
CharNextExA
CharPrevExA
ReleaseCapture
MonitorFromPoint
SetCursorPos
FillRect
GetClientRect
GetDC
ScreenToClient
OffsetRect
GetAsyncKeyState
SetRect
InvalidateRect
PeekMessageA
ReleaseDC
WindowFromPoint
GetWindowTextA
FindWindowA
SendMessageA
MessageBoxA
GetKeyState
LoadImageA
DestroyCursor
ShowCursor
SetCursor
gdi32
GetStockObject
GetTextExtentPoint32A
CreateFontIndirectA
GetCharABCWidthsFloatW
SetTextColor
GetTextExtentPoint32W
SelectObject
GetPixel
GetDeviceCaps
TextOutA
CreateDIBSection
SetBkColor
SetBkMode
StretchBlt
DeleteObject
CreateSolidBrush
DeleteDC
CreateCompatibleDC
TextOutW
EnumFontFamiliesExA
advapi32
CryptGenRandom
RegOpenKeyExA
RegQueryValueExA
RegOpenKeyA
CryptReleaseContext
CryptAcquireContextA
RegSetValueExW
RegOpenKeyExW
OpenProcessToken
GetTokenInformation
InitializeSecurityDescriptor
AddAccessDeniedAce
SetSecurityDescriptorDacl
InitializeAcl
AllocateAndInitializeSid
AddAccessAllowedAce
SetSecurityInfo
FreeSid
GetLengthSid
RegQueryValueExW
RegCreateKeyExW
RegCloseKey
shell32
SHGetSpecialFolderPathA
ShellExecuteA
ole32
CoCreateInstance
CoUninitialize
CoInitialize
CoInitializeEx
winmm
timeEndPeriod
timeGetTime
d3d8
Direct3DCreate8
python27
PyTuple_SetItem
PyTuple_GetItem
PyList_Append
PyList_New
PyModule_AddIntConstant
PyLong_FromLongLong
PyString_FromString
PyExc_RuntimeError
PyErr_SetString
Py_InitModule4
Py_BuildValue
PyDict_Next
PyInt_FromLong
PyDict_Size
PyString_InternFromString
PyObject_GetAttrString
PyObject_GetAttr
PyCallable_Check
PyTuple_New
PyArg_ParseTuple
PyLong_AsLong
PyDict_GetItemString
PyLong_AsLongLong
PyFloat_AsDouble
PyString_AsString
PyErr_Clear
PyErr_BadArgument
PyErr_Print
PyObject_CallObject
PyInt_AsLong
PyNumber_Check
_Py_NoneStruct
PyDict_SetItemString
PyModule_GetDict
PyErr_Fetch
Py_SetProgramName
Py_Initialize
Py_Finalize
PyRun_StringFlags
PyImport_AddModule
PyImport_ImportModule
PyTuple_Size
imm32
ImmSetCompositionStringW
ImmNotifyIME
ImmGetOpenStatus
ImmSetConversionStatus
ImmGetConversionStatus
ImmGetCandidateListW
ImmGetIMEFileNameA
ImmGetCompositionStringW
ImmAssociateContext
ImmReleaseContext
ImmGetContext
ImmIsIME
devil
ilLoad
ilInit
ilTexImage
ilSetPixels
ilSave
ilGetInteger
ilOriginFunc
ilCopyPixels
ilDeleteImages
ilEnable
ilConvertImage
ilShutDown
ilBindImage
ilGenImages
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
imagehlp
GetTimestampForLoadedLibrary
EnumerateLoadedModules
StackWalk
granny2
_GrannyNewWorldPose@4
_GrannyFindBoneByName@12
_GrannyGetMeshBindingToBoneIndices@4
_GrannyFreeMeshBinding@4
_GrannyNewMeshBinding@12
_GrannyFreeModelInstance@4
_GrannyInstantiateModel@4
_GrannyGetWorldPoseComposite4x4Array@4
_GrannyFreeLocalPose@4
_GrannyNewLocalPose@4
_GrannyUpdateModelMatrix@20
_GrannySampleModelAnimationsAccelerated@20
_GrannyFreeCompletedModelControls@4
_GrannyFreeWorldPose@4
_GrannyGetSourceSkeleton@4
_GrannyGetFileInfo@4
_GrannyFreeFile@4
_GrannyFreeMeshDeformer@4
_GrannyReadEntireFileFromMemory@8
_GrannyConvertSingleObject@20
_GrannyFindMatchingMember@16
_GrannyGetMaterialTextureByType@8
_GrannyDeformVertices@24
GrannyPNT332VertexType
_GrannyGetWorldPose4x4@8
_GrannyGetWorldPoseComposite4x4@8
_GrannyGetTotalTypeSize@4
_GrannyGetMeshVertexCount@4
_GrannyMeshIsRigid@4
_GrannyGetMeshIndexCount@4
_GrannyFreeControl@4
_GrannyFreeControlOnceUnused@4
_GrannyCompleteControlAt@8
_GrannyControlIsComplete@4
_GrannyFreeControlIfComplete@4
_GrannyGetControlLoopCount@4
_GrannySetControlLoopCount@8
_GrannyGetControlSpeed@4
_GrannySetControlSpeed@8
_GrannyGetControlLocalDuration@4
_GrannySetControlEaseIn@8
_GrannySetControlEaseInCurve@28
_GrannySetControlEaseOut@8
_GrannySetControlEaseOutCurve@28
_GrannyGetControlRawLocalClock@4
_GrannySetControlRawLocalClock@8
_GrannyPlayControlledAnimation@12
_GrannyGetMeshTriangleGroupCount@4
_GrannyGetMeshTriangleGroups@4
_GrannyGetMeshVertexType@4
_GrannyCopyMeshVertices@12
_GrannyGetMeshVertices@4
_GrannyCopyMeshIndices@12
_GrannySetModelClock@8
_GrannyNewMeshDeformer@16
_GrannyFreeFileSection@8
mss32
_AIL_mem_free_lock@4
_AIL_auto_update_3D_position@8
_AIL_3D_sample_volume@4
_AIL_3D_sample_status@4
_AIL_set_3D_sample_loop_count@8
_AIL_set_3D_sample_volume@8
_AIL_set_3D_sample_file@8
_AIL_end_3D_sample@4
_AIL_resume_3D_sample@4
_AIL_stop_3D_sample@4
_AIL_file_read@8
_AIL_release_3D_sample_handle@4
_AIL_allocate_3D_sample_handle@4
_AIL_sample_volume_pan@12
_AIL_sample_status@4
_AIL_set_sample_loop_count@8
_AIL_set_sample_volume_pan@12
_AIL_end_sample@4
_AIL_resume_sample@4
_AIL_stop_sample@4
_AIL_start_sample@4
_AIL_set_sample_file@12
_AIL_set_file_callbacks@16
_AIL_release_sample_handle@4
_AIL_allocate_sample_handle@4
_AIL_last_error@0
_AIL_stream_status@4
_AIL_set_stream_loop_count@8
_AIL_stream_volume_levels@12
_AIL_set_stream_volume_levels@12
_AIL_pause_stream@8
_AIL_start_stream@4
_AIL_close_stream@4
_AIL_set_redist_directory@4
_AIL_shutdown@0
_AIL_startup@0
_AIL_set_3D_orientation@28
_AIL_set_3D_velocity@20
_AIL_set_3D_position@16
_AIL_close_3D_listener@4
_AIL_open_3D_listener@4
_AIL_close_3D_provider@4
_AIL_open_3D_provider@4
_AIL_enumerate_3D_providers@12
_AIL_close_digital_driver@4
_AIL_open_stream@12
_AIL_open_digital_driver@16
_AIL_file_type@8
_AIL_decompress_ADPCM@12
_AIL_decompress_ASI@24
_AIL_WAV_info@8
_AIL_init_sample@4
_AIL_start_3D_sample@4
speedtreert
?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z
?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ
?SetLodLimits@CSpeedTreeRT@@QAEXMM@Z
?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z
?SetLodLevel@CSpeedTreeRT@@QAEXM@Z
?ComputeLodLevel@CSpeedTreeRT@@QAEXXZ
?SetLocalMatrices@CSpeedTreeRT@@QAEXII@Z
?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z
?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z
?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z
?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z
?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z
?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ
?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z
?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ
?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z
??3CSpeedTreeRT@@SAXPAX@Z
??2CSpeedTreeRT@@SAPAXI@Z
??1CSpeedTreeRT@@QAE@XZ
?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z
?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ
??0CSpeedTreeRT@@QAE@XZ
??1STextures@CSpeedTreeRT@@QAE@XZ
??0STextures@CSpeedTreeRT@@QAE@XZ
??1SGeometry@CSpeedTreeRT@@QAE@XZ
??0SGeometry@CSpeedTreeRT@@QAE@XZ
?GetCurrentError@CSpeedTreeRT@@SAPBDXZ
?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ
?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetCamera@CSpeedTreeRT@@SAXPBM0@Z
?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z
?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z
?SetTime@CSpeedTreeRT@@SAXM@Z
?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z
?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z
?SetLightState@CSpeedTreeRT@@SAXI_N@Z
dinput8
DirectInput8Create
ws2_32
closesocket
connect
recv
select
__WSAFDIsSet
WSAGetLastError
WSAStartup
WSACleanup
htons
inet_addr
gethostbyname
socket
send
ioctlsocket
ddraw
DirectDrawCreate
oleaut32
SysFreeString
VariantClear
Sections
.text Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 492KB - Virtual size: 491KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 159KB - Virtual size: 672KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 160KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 125KB - Virtual size: 125KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ