9a7d90f25ed1b3f57777defa8e2b526eb3b3d7c190006d58b06bcaddb8205cc6

Sharing

Copy URL Twitter E-mail

General

Target

9a7d90f25ed1b3f57777defa8e2b526eb3b3d7c190006d58b06bcaddb8205cc6
Size

3.3MB
MD5

26afeac408a82e4037b89302b3079713
SHA1

f8030528dfa2a6e7d77f0811b9a4a0546be4a0c6
SHA256

9a7d90f25ed1b3f57777defa8e2b526eb3b3d7c190006d58b06bcaddb8205cc6
SHA512

d21cc81e7dd8f80d9384065482c5efef24529857ab8472536ef250f03d012aa621e99be1a8d108a3a3381d4a805debef5016cb99eefe49ff5558e08496cbc713
SSDEEP

49152:cRgKjlEDA+s+7X/Gy5A5MXGgtsqaJK5cVJo7VYQKWfwQMWYdjDSsJ5ollVDPF2Le:ch5EDAjqAM5uqag5qK7VY/Wlf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9a7d90f25ed1b3f57777defa8e2b526eb3b3d7c190006d58b06bcaddb8205cc6

Files

9a7d90f25ed1b3f57777defa8e2b526eb3b3d7c190006d58b06bcaddb8205cc6
.exe windows:5 windows x86

7df5d5f73b140530ca4830416c89a675

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WriteConsoleW
SetEndOfFile
HeapSize
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
GetLastError
FindNextFileA
FindFirstFileA
FindClose
TerminateProcess
MultiByteToWideChar
SetFileAttributesA
GetModuleFileNameA
Module32Next
Module32First
FindFirstFileExW
CreateProcessW
GetExitCodeProcess
GetTimeZoneInformation
CreateDirectoryW
GetFileSizeEx
SetFilePointerEx
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetFileAttributesExW
MoveFileExW
DeleteFileW
HeapReAlloc
GetCurrentProcess
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetFileType
GetStdHandle
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
CreateToolhelp32Snapshot
RtlUnwind
RaiseException
SetLastError
WaitNamedPipeW
PeekNamedPipe
GetModuleFileNameW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
UnhandledExceptionFilter
CreateFileW
IsProcessorFeaturePresent
GetCurrentProcessId
GetModuleHandleA
ReadProcessMemory
GetProcAddress
LoadLibraryA
GetCurrentDirectoryW
GetTickCount
GetCurrentDirectoryA
DeleteFileA
GlobalFree
lstrlenA
GetPrivateProfileStringA
EnumSystemLocalesW
HeapValidate
GetModuleHandleW
GetSystemInfo
Sleep
WaitForSingleObject
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetFileAttributesA
CreateDirectoryA
GetProcessHeap
HeapFree
GetSystemTimeAsFileTime
SleepConditionVariableSRW
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
QueryPerformanceFrequency
GetCPInfo
CompareStringEx
LCMapStringEx
DecodePointer
EncodePointer
InitializeCriticalSectionEx
GetStringTypeW
GetExitCodeThread
WaitForSingleObjectEx
QueryPerformanceCounter
CreateThread
GetFullPathNameA
ReleaseSemaphore
GetLocaleInfoA
CompareStringA
WideCharToMultiByte
lstrlenW
GlobalLock
GlobalUnlock
FreeLibrary
GetVersionExA
GetSystemDirectoryA
WriteFile
ReadFile
GetCurrentThreadId
SetUnhandledExceptionFilter
GetFileSize
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
OutputDebugStringA
GlobalAlloc
HeapAlloc
DeviceIoControl
CloseHandle
InterlockedPushEntrySList
CreateFileA

user32

LoadCursorA
AdjustWindowRectEx
GetMenu
RegisterClassA
CharPrevExA
CharNextExA
SetWindowLongA
GetWindowLongA
UpdateWindow
SetFocus
LoadIconA
SystemParametersInfoA
GetKeyState
ShowCursor
SetCursor
DestroyCursor
LoadImageA
MoveWindow
DestroyWindow
IsWindow
GetMessageA
TranslateMessage
DispatchMessageA
FindWindowA
ScreenToClient
GetCursorPos
GetAsyncKeyState
SetWindowPos
PostQuitMessage
CreateWindowExA
SetCursorPos
MessageBoxA
LoadStringA
OffsetRect
SetRect
FillRect
GetClientRect
InvalidateRect
ClientToScreen
ReleaseDC
GetDC
GetKeyboardLayoutNameA
GetKeyboardLayout
OpenClipboard
CloseClipboard
GetClipboardData
CharNextW
ChangeDisplaySettingsA
ReleaseCapture
SetCapture
GetCapture
PeekMessageA
wvsprintfA
GetSystemMetrics
DefWindowProcA
UnregisterClassA
RegisterClassExA
ShowWindow

gdi32

CreateSolidBrush
CreateFontIndirectA
GetCharABCWidthsFloatW
GetTextExtentPoint32W
SelectObject
SetBkColor
SetTextColor
TextOutW
CreateCompatibleDC
DeleteDC
SetBkMode
CreateDIBSection
TextOutA
DeleteObject
EnumFontFamiliesExA
StretchBlt
GetTextExtentPoint32A
GetStockObject

advapi32

RegCloseKey
RegCreateKeyExW
RegOpenKeyA
RegSetValueExW
RegOpenKeyExA
RegOpenKeyExW
RegQueryValueExA
RegQueryValueExW
RegSetValueExA

ole32

CoCreateInstance
CoInitialize
CoInitializeEx
OleSetContainedObject
OleUninitialize
OleInitialize
CoGetClassObject
CoUninitialize

winmm

timeGetDevCaps
timeBeginPeriod
timeEndPeriod
timeGetTime

d3d8

Direct3DCreate8

python27

PyList_New
PyList_Append
Py_IncRef
PyInt_AsLong
PyDict_SetItem
PyDict_Next
PyDict_Size
PyString_FromStringAndSize
PyString_FromString
PyDict_SetItemString
PyErr_SetString
Py_CompileStringFlags
PyEval_MergeCompilerFlags
PyObject_CallFunction
PyExc_TypeError
PyExc_RuntimeError
PyArg_ParseTuple
PyModule_AddStringConstant
PyImport_ImportModule
PyString_InternFromString
PyTuple_GetItem
PyObject_GetAttr
PyCallable_Check
PyLong_AsLongLong
PyFloat_AsDouble
PyString_AsString
PyErr_Clear
PyErr_BadArgument
PyErr_Print
PyObject_CallObject
PyNumber_Check
_Py_NoneStruct
PyModule_GetDict
PyErr_Fetch
Py_SetProgramName
Py_Initialize
Py_Finalize
PyTuple_Size
PyLong_AsLong
PyModule_AddIntConstant
Py_InitModule4
Py_BuildValue
PyRun_StringFlags
PyImport_AddModule
PyDict_GetItemString
PyObject_GetAttrString

iphlpapi

GetAdaptersInfo
GetPerAdapterInfo

imm32

ImmNotifyIME
ImmGetOpenStatus
ImmSetConversionStatus
ImmGetConversionStatus
ImmGetCandidateListW
ImmSetCompositionStringW
ImmGetCompositionStringW
ImmAssociateContext
ImmGetContext
ImmIsIME
ImmGetIMEFileNameA
ImmReleaseContext

lucasac

ult_094x2429C
ult_041x7130C
ult_P5x94PYT
ult_A23t39AY6
ult_0x0459y7x
ult_C16x29BF2
ult_U93H29RY1
ult_0xAL0X2FB

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

devil

ilBindImage
ilDeleteImages
ilGenImages
ilLoad
ilEnable
ilOriginFunc
ilShutDown
ilSave
ilSetPixels
ilTexImage
ilConvertImage
ilGetInteger
ilInit
ilCopyPixels

granny2

_GrannyFreeWorldPose@4
_GrannyNewWorldPose@4
_GrannyFindBoneByName@12
_GrannyGetMeshBindingToBoneIndices@4
_GrannyFreeMeshBinding@4
_GrannyNewMeshBinding@12
_GrannyFreeModelInstance@4
_GrannyCopyMeshVertices@12
_GrannyGetWorldPoseComposite4x4Array@4
_GrannyFreeLocalPose@4
_GrannyNewLocalPose@4
_GrannyUpdateModelMatrix@20
_GrannySampleModelAnimationsAccelerated@20
_GrannyFreeCompletedModelControls@4
_GrannyGetMeshVertexCount@4
_GrannyGetSourceSkeleton@4
_GrannyConvertSingleObject@20
_GrannyFindMatchingMember@16
_GrannyGetMaterialTextureByType@8
_GrannyGetFileInfo@4
_GrannyFreeFile@4
_GrannyFreeFileSection@8
_GrannyReadEntireFileFromMemory@8
_GrannySetLogCallback@4
_GrannyMeshIsRigid@4
_GrannyGetWorldPose4x4@8
_GrannyGetSourceModel@4
_GrannyFindTrackGroupForModel@12
_GrannyGetMeshVertices@4
_GrannyCopyMeshIndices@12
_GrannyNewMeshDeformer@16
_GrannyFreeMeshDeformer@4
_GrannyDeformVertices@24
GrannyPNT332VertexType
_GrannyGetWorldPoseComposite4x4@8
_GrannyFreeControl@4
_GrannyFreeControlOnceUnused@4
_GrannyCompleteControlAt@8
_GrannyControlIsComplete@4
_GrannyFreeControlIfComplete@4
_GrannyGetControlLoopCount@4
_GrannySetControlLoopCount@8
_GrannyGetControlSpeed@4
_GrannySetControlSpeed@8
_GrannyGetControlLocalDuration@4
_GrannySetControlEaseIn@8
_GrannySetControlEaseInCurve@28
_GrannySetControlEaseOut@8
_GrannySetControlEaseOutCurve@28
_GrannyGetControlRawLocalClock@4
_GrannySetControlRawLocalClock@8
_GrannyPlayControlledAnimation@12
_GrannyBeginControlledAnimation@8
_GrannyGetMeshIndexCount@4
_GrannyGetTotalTypeSize@4
_GrannyEndControlledAnimation@4
_GrannySetTrackGroupTarget@12
_GrannySetTrackGroupLOD@16
_GrannyGetMeshTriangleGroupCount@4
_GrannyGetMeshTriangleGroups@4
_GrannySetModelClock@8
_GrannyGetMeshVertexType@4
_GrannyInstantiateModel@4

mss32

_AIL_mem_free_lock@4
_AIL_file_read@8
_AIL_set_file_callbacks@16
_AIL_WAV_info@8
_AIL_decompress_ASI@24
_AIL_decompress_ADPCM@12
_AIL_file_type@8
_AIL_open_digital_driver@16
_AIL_open_stream@12
_AIL_close_digital_driver@4
_AIL_enumerate_3D_providers@12
_AIL_auto_update_3D_position@8
_AIL_3D_sample_volume@4
_AIL_3D_sample_status@4
_AIL_set_3D_sample_loop_count@8
_AIL_set_3D_sample_volume@8
_AIL_set_3D_sample_file@8
_AIL_end_3D_sample@4
_AIL_open_3D_provider@4
_AIL_stop_3D_sample@4
_AIL_start_3D_sample@4
_AIL_release_3D_sample_handle@4
_AIL_allocate_3D_sample_handle@4
_AIL_sample_volume_pan@12
_AIL_sample_status@4
_AIL_set_sample_loop_count@8
_AIL_set_sample_volume_pan@12
_AIL_end_sample@4
_AIL_resume_sample@4
_AIL_stop_sample@4
_AIL_start_sample@4
_AIL_set_sample_file@12
_AIL_init_sample@4
_AIL_release_sample_handle@4
_AIL_allocate_sample_handle@4
_AIL_last_error@0
_AIL_stream_status@4
_AIL_set_stream_loop_count@8
_AIL_stream_volume_levels@12
_AIL_set_stream_volume_levels@12
_AIL_pause_stream@8
_AIL_start_stream@4
_AIL_close_stream@4
_AIL_set_redist_directory@4
_AIL_shutdown@0
_AIL_startup@0
_AIL_set_3D_orientation@28
_AIL_set_3D_velocity@20
_AIL_set_3D_position@16
_AIL_close_3D_listener@4
_AIL_open_3D_listener@4
_AIL_close_3D_provider@4
_AIL_resume_3D_sample@4

speedtreert

?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ
?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z
?GetCurrentError@CSpeedTreeRT@@SAPBDXZ
?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z
?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z
?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z
?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ
?SetLodLimits@CSpeedTreeRT@@QAEXMM@Z
?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z
?SetLodLevel@CSpeedTreeRT@@QAEXM@Z
?ComputeLodLevel@CSpeedTreeRT@@QAEXXZ
?SetLocalMatrices@CSpeedTreeRT@@QAEXII@Z
?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z
?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z
?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z
?SetTime@CSpeedTreeRT@@SAXM@Z
?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z
?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z
?SetLightState@CSpeedTreeRT@@SAXI_N@Z
?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z
?SetCamera@CSpeedTreeRT@@SAXPBM0@Z
??0SGeometry@CSpeedTreeRT@@QAE@XZ
??1SGeometry@CSpeedTreeRT@@QAE@XZ
??0STextures@CSpeedTreeRT@@QAE@XZ
??1STextures@CSpeedTreeRT@@QAE@XZ
??0CSpeedTreeRT@@QAE@XZ
??1CSpeedTreeRT@@QAE@XZ
??2CSpeedTreeRT@@SAPAXI@Z
??3CSpeedTreeRT@@SAXPAX@Z
?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z
?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ
?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z
?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z
?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ
?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z
?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z

dinput8

DirectInput8Create

ws2_32

recv
select
send
socket
ioctlsocket
WSAStartup
connect
htons
inet_addr
sendto
closesocket
__WSAFDIsSet
WSACleanup
WSAGetLastError
gethostbyname

ddraw

DirectDrawCreate

shell32

SHGetSpecialFolderPathA

oleaut32

VariantInit
SysAllocString
SysFreeString
VariantClear

Exports

Exports

AmdPowerXpressRequestHighPerformance
LZ4_compress
LZ4_compressBound
LZ4_compress_continue
LZ4_compress_default
LZ4_compress_destSize
LZ4_compress_fast
LZ4_compress_fast_continue
LZ4_compress_fast_extState
LZ4_compress_limitedOutput
LZ4_compress_limitedOutput_continue
LZ4_compress_limitedOutput_withState
LZ4_compress_withState
LZ4_create
LZ4_createStream
LZ4_createStreamDecode
LZ4_decoderRingBufferSize
LZ4_decompress_fast
LZ4_decompress_fast_continue
LZ4_decompress_fast_usingDict
LZ4_decompress_fast_withPrefix64k
LZ4_decompress_safe
LZ4_decompress_safe_continue
LZ4_decompress_safe_partial
LZ4_decompress_safe_usingDict
LZ4_decompress_safe_withPrefix64k
LZ4_freeStream
LZ4_freeStreamDecode
LZ4_initStream
LZ4_loadDict
LZ4_resetStream
LZ4_resetStreamState
LZ4_resetStream_fast
LZ4_saveDict
LZ4_setStreamDecode
LZ4_sizeofState
LZ4_sizeofStreamState
LZ4_slideInputBuffer
LZ4_uncompress
LZ4_uncompress_unknownOutputSize
LZ4_versionNumber
LZ4_versionString
NvOptimusEnablement

Sections

.text
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 449KB - Virtual size: 449KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 148KB - Virtual size: 650KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data1
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 129KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7df5d5f73b140530ca4830416c89a675

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

ole32

winmm

d3d8

python27

iphlpapi

imm32

lucasac

version

devil

granny2

mss32

speedtreert

dinput8

ws2_32

ddraw

shell32

oleaut32

Exports

Exports

Sections

.text Size: 2.5MB - Virtual size: 2.5MB

.rdata Size: 449KB - Virtual size: 449KB

.data Size: 148KB - Virtual size: 650KB

.data1 Size: 2KB - Virtual size: 2KB

.rsrc Size: 45KB - Virtual size: 44KB

.reloc Size: 129KB - Virtual size: 128KB

.text
Size: 2.5MB - Virtual size: 2.5MB

.rdata
Size: 449KB - Virtual size: 449KB

.data
Size: 148KB - Virtual size: 650KB

.data1
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 45KB - Virtual size: 44KB

.reloc
Size: 129KB - Virtual size: 128KB