Static task
static1
Behavioral task
behavioral1
Sample
afec61dd5ef3694277325a3ecda839b29313bdcadeabb14a85b9d8b7c2c6b992.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
afec61dd5ef3694277325a3ecda839b29313bdcadeabb14a85b9d8b7c2c6b992.exe
Resource
win10v2004-20231023-en
General
-
Target
afec61dd5ef3694277325a3ecda839b29313bdcadeabb14a85b9d8b7c2c6b992
-
Size
5.4MB
-
MD5
c856bafa62e3d26db0a5f116a9a5f3a3
-
SHA1
788aaa01513211950ff938fea177dcda27f40e38
-
SHA256
afec61dd5ef3694277325a3ecda839b29313bdcadeabb14a85b9d8b7c2c6b992
-
SHA512
29e13f10650be43c9e2352a3d99b1fac2ec688aa0dc6e773a1b21ed98da9d97cad54be0dff8f2c3629851306d01f7fecb6c7eb99de4dcfa426989eaf52f51534
-
SSDEEP
98304:QUHp68i3Shi4sCSkiLnBpoIfgL1DwGSDia:/pZjsCbiLnnoNDxa
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource afec61dd5ef3694277325a3ecda839b29313bdcadeabb14a85b9d8b7c2c6b992
Files
-
afec61dd5ef3694277325a3ecda839b29313bdcadeabb14a85b9d8b7c2c6b992.exe windows:5 windows x86
05d193238f57e08383430ea424eb1b77
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetLogicalProcessorInformation
GetThreadPriority
SwitchToThread
SignalObjectAndWait
WaitForSingleObjectEx
RtlCaptureStackBackTrace
TryEnterCriticalSection
CreateTimerQueue
GetExitCodeThread
DuplicateHandle
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
WaitForMultipleObjectsEx
LoadLibraryW
GlobalFree
GetModuleFileNameA
ReleaseMutex
CreateMutexA
GetPrivateProfileStringA
lstrlenA
GetCurrentDirectoryA
MoveFileA
SetFileAttributesA
SetThreadPriority
CreateEventA
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
SetEvent
GetSystemInfo
GetLastError
Module32Next
Module32First
GetTickCount
GetCurrentDirectoryW
MultiByteToWideChar
DeleteFileA
GlobalAlloc
FindNextFileA
TerminateProcess
ReadProcessMemory
Process32Next
Process32First
CreateToolhelp32Snapshot
GetThreadTimes
QueryPerformanceFrequency
WaitNamedPipeW
SetEndOfFile
SetEnvironmentVariableA
CreateProcessA
GetExitCodeProcess
OutputDebugStringW
WriteConsoleW
HeapReAlloc
SetStdHandle
FindClose
SetFileAttributesW
CreateTimerQueueTimer
GetTimeZoneInformation
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetFileAttributesExW
FlushFileBuffers
CreateDirectoryW
GetOEMCP
GetACP
IsValidCodePage
SetConsoleCtrlHandler
GetModuleFileNameW
GetStdHandle
ReadConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
HeapSize
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
CreateSemaphoreW
GetModuleHandleW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
CreateEventW
InitializeCriticalSectionAndSpinCount
SetLastError
UnhandledExceptionFilter
FatalAppExitA
FileTimeToSystemTime
PeekNamedPipe
GetFileType
GetFileInformationByHandle
FileTimeToLocalFileTime
GetCPInfo
LoadLibraryExW
GetFullPathNameA
GetDriveTypeW
RtlUnwind
RaiseException
FindFirstFileA
ResumeThread
WaitForSingleObject
OpenProcess
GetCurrentProcess
VirtualAlloc
ExitThread
CloseHandle
OpenThread
GetCurrentThreadId
CreateThread
Sleep
ExitProcess
GetCurrentProcessId
LoadLibraryA
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
HeapQueryInformation
FreeLibraryAndExitThread
GetVersionExW
VirtualFree
SetCurrentDirectoryW
SetProcessAffinityMask
GetCommandLineA
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
IsDebuggerPresent
AreFileApisANSI
GetModuleHandleExW
DecodePointer
EncodePointer
GetStringTypeW
FindResourceW
FindResourceA
SizeofResource
LoadResource
LockResource
CreateFileW
IsProcessorFeaturePresent
InterlockedDecrement
GetProcessHeap
HeapValidate
InterlockedIncrement
QueryPerformanceCounter
CopyFileA
CreateSemaphoreA
ReleaseSemaphore
GetLocaleInfoA
CompareStringA
WideCharToMultiByte
GetVersionExA
GetSystemDirectoryA
lstrlenW
GlobalUnlock
GlobalLock
FreeLibrary
SetFilePointer
ReadFile
WriteFile
OutputDebugStringA
WinExec
GetCurrentThread
SetUnhandledExceptionFilter
CreateFileA
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
GetFileSize
RemoveDirectoryA
CreateDirectoryA
GetTempFileNameA
GetTempPathA
AllocConsole
VirtualProtect
GetModuleHandleA
lstrcmpiA
DeleteFileW
GetProcAddress
user32
LoadCursorA
GetMessageA
TranslateMessage
GetWindowRect
SetWindowTextA
LoadStringA
GetCapture
ShowWindow
ChangeDisplaySettingsA
ReleaseCapture
SetCapture
GetMenu
SetCursorPos
SetCursor
ShowCursor
DestroyCursor
LoadImageA
GetKeyState
SystemParametersInfoA
SetWindowPos
LoadIconA
ScreenToClient
GetCursorPos
PostQuitMessage
GetAsyncKeyState
SetRect
OffsetRect
GetClientRect
ClientToScreen
PeekMessageA
ReleaseDC
FillRect
GetDC
EndPaint
BeginPaint
InvalidateRect
FindWindowA
EnumWindows
GetSystemMetrics
GetClassNameA
GetWindowTextA
GetWindowThreadProcessId
MessageBoxA
DefWindowProcA
RegisterClassA
SetWindowLongA
GetWindowLongA
UpdateWindow
SetFocus
MoveWindow
DestroyWindow
IsWindow
CreateWindowExA
DispatchMessageA
GetKeyboardLayoutNameA
GetKeyboardLayout
OpenClipboard
CloseClipboard
GetClipboardData
RegisterClassExA
UnregisterClassA
AdjustWindowRectEx
CharNextW
CharNextExA
CharPrevExA
gdi32
GetStockObject
EnumFontFamiliesExA
CreateFontIndirectA
GetTextExtentPoint32W
TextOutA
CreateDIBSection
SetDIBitsToDevice
SetBkMode
GetCharABCWidthsFloatW
StretchBlt
DeleteObject
CreateSolidBrush
PatBlt
CreateCompatibleDC
TextOutW
SetTextColor
SetBkColor
SelectObject
GetTextExtentPoint32A
DeleteDC
advapi32
CryptGenRandom
RegOpenKeyExA
RegQueryValueExA
RegOpenKeyA
CryptReleaseContext
CryptAcquireContextA
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
InitializeAcl
AddAccessDeniedAce
AddAccessAllowedAce
SetSecurityInfo
FreeSid
RegCloseKey
ole32
CoInitializeEx
OleUninitialize
OleInitialize
CoGetClassObject
CoCreateInstance
CoInitialize
CoUninitialize
OleSetContainedObject
winmm
timeGetTime
timeBeginPeriod
timeGetDevCaps
timeEndPeriod
d3d8
Direct3DCreate8
python27
PyMarshal_ReadObjectFromString
PyTuple_GetItem
PyExc_RuntimeError
PyErr_SetString
Py_BuildValue
PyCode_New
PyEval_GetRestricted
PyErr_NoMemory
PyErr_Occurred
PyDict_SetItem
PyList_New
PyList_SetItem
PyString_FromString
PyList_Append
_PyLong_New
_Py_EllipsisObject
PyString_FromStringAndSize
PyComplex_FromCComplex
PyFloat_FromDouble
_PyLong_FromByteArray
PyInt_FromLong
PyUnicodeUCS2_DecodeUTF8
PyCode_Type
Py_OptimizeFlag
PyEval_EvalCode
PyExc_StopIteration
PyExc_ValueError
PyDict_New
PyExc_EOFError
PyCode_Addr2Line
PyObject_AsCharBuffer
Py_InitModule4
PyModule_AddIntConstant
PyTuple_Size
PyDict_GetItemString
PyLong_AsLong
PyArg_ParseTuple
PyTuple_New
PyTuple_SetItem
PyLong_FromLongLong
PyDict_Size
PyDict_Next
PyString_InternFromString
PyObject_GetAttrString
PyObject_GetAttr
PyCallable_Check
PyLong_AsLongLong
PyLong_AsUnsignedLongLong
PyFloat_AsDouble
PyString_AsString
PyErr_Clear
PyErr_BadArgument
PyErr_Print
PyObject_CallObject
PyNumber_Check
_Py_NoneStruct
PyDict_SetItemString
PyModule_GetDict
PyErr_Fetch
Py_SetProgramName
Py_Initialize
Py_Finalize
PyRun_StringFlags
PyEval_SetTrace
Py_FlushLine
PyImport_GetMagicNumber
PyImport_AddModule
PyInt_AsLong
PyImport_ImportModule
devil
ilOriginFunc
ilInit
ilSetPixels
ilTexImage
ilSave
ilShutDown
ilDeleteImages
ilCopyPixels
ilConvertImage
ilGetInteger
ilLoad
ilEnable
ilBindImage
ilGenImages
imm32
ImmGetOpenStatus
ImmSetConversionStatus
ImmGetConversionStatus
ImmGetCandidateListW
ImmSetCompositionStringW
ImmGetCompositionStringW
ImmAssociateContext
ImmReleaseContext
ImmGetContext
ImmIsIME
ImmGetIMEFileNameA
ImmNotifyIME
psapi
GetModuleFileNameExA
EnumProcessModules
imagehlp
StackWalk
EnumerateLoadedModules
GetTimestampForLoadedLibrary
version
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
granny2
_GrannyFindBoneByName@12
_GrannyGetMeshBindingToBoneIndices@4
_GrannyFreeMeshBinding@4
_GrannyNewMeshBinding@12
_GrannyFreeModelInstance@4
_GrannyInstantiateModel@4
_GrannyGetWorldPoseComposite4x4Array@4
_GrannyGetWorldPose4x4@8
_GrannyNewLocalPose@4
_GrannyUpdateModelMatrix@20
_GrannySampleModelAnimationsAccelerated@20
_GrannyFreeCompletedModelControls@4
_GrannyNewWorldPose@4
_GrannyGetSourceSkeleton@4
_GrannyGetFileInfo@4
_GrannyFreeFile@4
_GrannyFreeFileSection@8
_GrannyReadEntireFileFromMemory@8
_GrannyConvertSingleObject@20
_GrannyFindMatchingMember@16
_GrannyGetMaterialTextureByType@8
_GrannyGetWorldPoseComposite4x4@8
_GrannyGetTotalTypeSize@4
_GrannyGetMeshVertexCount@4
_GrannyMeshIsRigid@4
_GrannySetModelClock@8
_GrannyGetMeshIndexCount@4
_GrannyFreeControl@4
_GrannyFreeControlOnceUnused@4
_GrannyCompleteControlAt@8
_GrannyControlIsComplete@4
_GrannyFreeControlIfComplete@4
_GrannyGetControlLoopCount@4
_GrannySetControlLoopCount@8
_GrannyGetControlSpeed@4
_GrannySetControlSpeed@8
_GrannySetControlEaseOutCurve@28
_GrannyGetControlRawLocalClock@4
_GrannyFreeWorldPose@4
_GrannyGetControlLocalDuration@4
_GrannySetControlEaseIn@8
_GrannySetControlEaseInCurve@28
_GrannySetControlEaseOut@8
_GrannyFreeLocalPose@4
_GrannySetControlRawLocalClock@8
GrannyPNT332VertexType
_GrannyDeformVertices@24
_GrannyFreeMeshDeformer@4
_GrannyNewMeshDeformer@16
_GrannyCopyMeshIndices@12
_GrannyGetMeshVertices@4
_GrannyCopyMeshVertices@12
_GrannyGetMeshVertexType@4
_GrannyGetMeshTriangleGroups@4
_GrannyGetMeshTriangleGroupCount@4
_GrannyPlayControlledAnimation@12
mss32
_AIL_decompress_ASI@24
_AIL_decompress_ADPCM@12
_AIL_file_type@8
_AIL_open_digital_driver@16
_AIL_open_stream@12
_AIL_close_digital_driver@4
_AIL_enumerate_3D_providers@12
_AIL_open_3D_provider@4
_AIL_close_3D_provider@4
_AIL_open_3D_listener@4
_AIL_close_3D_listener@4
_AIL_set_3D_position@16
_AIL_set_3D_velocity@20
_AIL_set_3D_orientation@28
_AIL_startup@0
_AIL_shutdown@0
_AIL_set_redist_directory@4
_AIL_close_stream@4
_AIL_start_stream@4
_AIL_pause_stream@8
_AIL_set_stream_volume_levels@12
_AIL_stream_volume_levels@12
_AIL_set_stream_loop_count@8
_AIL_stream_status@4
_AIL_last_error@0
_AIL_WAV_info@8
_AIL_release_sample_handle@4
_AIL_set_sample_file@12
_AIL_start_sample@4
_AIL_stop_sample@4
_AIL_resume_sample@4
_AIL_end_sample@4
_AIL_set_sample_volume_pan@12
_AIL_set_sample_loop_count@8
_AIL_sample_status@4
_AIL_sample_volume_pan@12
_AIL_allocate_3D_sample_handle@4
_AIL_release_3D_sample_handle@4
_AIL_start_3D_sample@4
_AIL_stop_3D_sample@4
_AIL_resume_3D_sample@4
_AIL_end_3D_sample@4
_AIL_set_3D_sample_file@8
_AIL_set_3D_sample_volume@8
_AIL_set_3D_sample_loop_count@8
_AIL_3D_sample_status@4
_AIL_3D_sample_volume@4
_AIL_update_3D_position@8
_AIL_auto_update_3D_position@8
_AIL_set_file_callbacks@16
_AIL_mem_free_lock@4
_AIL_file_read@8
_AIL_allocate_sample_handle@4
_AIL_init_sample@4
speedtreert
?SetLodLimits@CSpeedTreeRT@@QAEXMM@Z
?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z
?SetLodLevel@CSpeedTreeRT@@QAEXM@Z
?ComputeLodLevel@CSpeedTreeRT@@QAEXXZ
?SetLocalMatrices@CSpeedTreeRT@@QAEXII@Z
?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z
?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z
?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetLeafLightingAdjustment@CSpeedTreeRT@@QBEMXZ
?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ
?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z
?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ
?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z
?GetTreeSize@CSpeedTreeRT@@QBEXAAM0@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z
?DeleteTransientData@CSpeedTreeRT@@QAEXXZ
?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ
?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z
??3CSpeedTreeRT@@SAXPAX@Z
??2CSpeedTreeRT@@SAPAXI@Z
??1CSpeedTreeRT@@QAE@XZ
??0CSpeedTreeRT@@QAE@XZ
??1STextures@CSpeedTreeRT@@QAE@XZ
?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ
?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z
?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z
?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z
?GetCurrentError@CSpeedTreeRT@@SAPBDXZ
?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z
?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ
?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z
?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
??0STextures@CSpeedTreeRT@@QAE@XZ
??1SGeometry@CSpeedTreeRT@@QAE@XZ
??0SGeometry@CSpeedTreeRT@@QAE@XZ
?SetCamera@CSpeedTreeRT@@SAXPBM0@Z
?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z
?SetLightState@CSpeedTreeRT@@SAXI_N@Z
?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z
?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z
?SetTime@CSpeedTreeRT@@SAXM@Z
?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ
dinput8
DirectInput8Create
ws2_32
gethostname
gethostbyname
ntohs
ntohl
closesocket
connect
ioctlsocket
recv
select
send
socket
WSAGetLastError
WSAStartup
inet_addr
htons
htonl
__WSAFDIsSet
WSACleanup
ddraw
DirectDrawCreate
shell32
SHGetSpecialFolderPathA
oleaut32
SafeArrayDestroy
SysFreeString
VariantClear
VariantInit
SysAllocString
SafeArrayCreate
SafeArrayAccessData
Sections
.text Size: 4.3MB - Virtual size: 4.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 736KB - Virtual size: 735KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 229KB - Virtual size: 738KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 190KB - Virtual size: 189KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ