Static task
static1
Behavioral task
behavioral1
Sample
f5a1442168653fce361c559657833a7449adc4e54aa532ec99f3b7b44159676e.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
f5a1442168653fce361c559657833a7449adc4e54aa532ec99f3b7b44159676e.exe
Resource
win10v2004-20231025-en
General
-
Target
f5a1442168653fce361c559657833a7449adc4e54aa532ec99f3b7b44159676e
-
Size
2.9MB
-
MD5
6ac8a41eb426c1072072bc217d57487d
-
SHA1
2d04a05d15eff53b6ba56c8ec1f5a5d458a046d6
-
SHA256
f5a1442168653fce361c559657833a7449adc4e54aa532ec99f3b7b44159676e
-
SHA512
eab9c8c0488950fda3d21d46e13570fd6216140067b8a8ad23d6cdd56981f7573ed5cade613ec65ad60777ba902740b80ae6829f8caa9fc6a33b673e72c33d59
-
SSDEEP
49152:Fnt8OJxQzg5cxax6QQ7wZOpxn1Rr+TFHqZsKhoJ5MhwWIjDFWh8:VxQzg5cxaUvEZYx1B+TFHqdp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f5a1442168653fce361c559657833a7449adc4e54aa532ec99f3b7b44159676e
Files
-
f5a1442168653fce361c559657833a7449adc4e54aa532ec99f3b7b44159676e.exe windows:6 windows x86 arch:x86
216ffe129ff223a160c3890dd19df653
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GlobalAlloc
Sleep
GetSystemInfo
CreateDirectoryA
GetFileSize
MapViewOfFile
UnmapViewOfFile
WriteConsoleW
HeapSize
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
HeapReAlloc
SetStdHandle
CreateProcessW
GetExitCodeProcess
GetTimeZoneInformation
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
GetLastError
GetLocaleInfoW
LCMapStringW
CompareStringW
ReadConsoleW
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
SetFilePointerEx
GetModuleFileNameW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
ExitProcess
GetDriveTypeW
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RaiseException
InterlockedPushEntrySList
RtlUnwind
QueryPerformanceFrequency
ExpandEnvironmentStringsA
WaitForMultipleObjects
PeekNamedPipe
GetFileType
GetStdHandle
IsValidCodePage
SetEvent
GlobalFree
GetModuleFileNameA
DeleteFileA
GetPrivateProfileStringA
lstrlenA
GetCurrentDirectoryA
MoveFileA
GetLocalTime
FindClose
FindNextFileA
FindFirstFileA
SetFileAttributesA
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
SetEndOfFile
WaitForSingleObject
VerifyVersionInfoA
VerSetConditionMask
SleepEx
SetLastError
GetTickCount64
GetSystemTimeAsFileTime
GetCurrentThreadId
GetStartupInfoW
IsDebuggerPresent
TerminateProcess
UnhandledExceptionFilter
CreateEventW
WaitForSingleObjectEx
ResetEvent
InitializeCriticalSectionAndSpinCount
InitializeSListHead
GetCPInfo
LCMapStringEx
ReadProcessMemory
GetCurrentProcess
Module32Next
InitializeCriticalSectionEx
DecodePointer
EncodePointer
GetStringTypeW
GetFileInformationByHandleEx
Module32First
GetCurrentProcessId
CreateToolhelp32Snapshot
GetTickCount
GetCurrentDirectoryW
MultiByteToWideChar
HeapFree
GetProcessHeap
GetModuleHandleW
AreFileApisANSI
SetFileInformationByHandle
GetFullPathNameW
GetFileInformationByHandle
GetFileAttributesExW
FindNextFileW
FindFirstFileExW
FindFirstFileW
CreateDirectoryW
GetLocaleInfoEx
LocalFree
CreateFileMappingA
SetUnhandledExceptionFilter
HeapAlloc
CloseHandle
DeviceIoControl
IsValidLocale
FormatMessageA
GetCurrentThread
CreateFileW
IsProcessorFeaturePresent
HeapValidate
QueryPerformanceCounter
ReleaseSemaphore
GetLocaleInfoA
CompareStringA
WideCharToMultiByte
lstrlenW
GlobalLock
GlobalUnlock
LoadLibraryA
GetProcAddress
FreeLibrary
GetVersionExA
GetSystemDirectoryA
WriteFile
ReadFile
OutputDebugStringA
WinExec
GetModuleHandleA
CreateFileA
user32
GetSystemMetrics
GetCapture
ShowWindow
ChangeDisplaySettingsA
DefWindowProcA
ReleaseCapture
SetCapture
SetCursorPos
CharPrevExA
CharNextExA
CharNextW
GetClipboardData
CloseClipboard
OpenClipboard
GetKeyboardLayout
GetKeyboardLayoutNameA
DispatchMessageA
TranslateMessage
GetMessageA
LoadCursorA
AdjustWindowRectEx
MessageBoxA
ShowCursor
DestroyCursor
LoadImageA
GetKeyState
SystemParametersInfoA
SetWindowPos
LoadIconA
FindWindowA
ScreenToClient
GetCursorPos
PostQuitMessage
GetAsyncKeyState
SetRect
OffsetRect
GetClientRect
ClientToScreen
PeekMessageA
ReleaseDC
FillRect
GetDC
InvalidateRect
SetCursor
GetMenu
RegisterClassA
SetWindowLongA
GetWindowLongA
UpdateWindow
SetFocus
MoveWindow
DestroyWindow
IsWindow
CreateWindowExA
RegisterClassExA
UnregisterClassA
LoadStringA
gdi32
TextOutW
CreateCompatibleDC
DeleteDC
SetBkMode
SetTextColor
TextOutA
GetTextExtentPoint32A
StretchBlt
DeleteObject
CreateSolidBrush
CreateDIBSection
SetBkColor
GetStockObject
EnumFontFamiliesExA
CreateFontIndirectA
GetCharABCWidthsFloatW
GetTextExtentPoint32W
SelectObject
advapi32
CryptAcquireContextA
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
RegQueryValueExW
CryptGenRandom
CryptReleaseContext
RegOpenKeyExW
RegOpenKeyA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
ole32
CoUninitialize
OleSetContainedObject
OleUninitialize
CoInitialize
CoInitializeEx
OleInitialize
CoGetClassObject
CoCreateInstance
winmm
timeGetTime
timeGetDevCaps
timeBeginPeriod
timeEndPeriod
d3d8
Direct3DCreate8
python27
PyDict_GetItemString
PyLong_AsLong
PyLong_FromLongLong
PyArg_ParseTuple
PyTuple_New
PyTuple_SetItem
PyInt_FromLong
Py_IncRef
PyTuple_Size
PyModule_AddIntConstant
Py_InitModule4
PyList_Append
PyList_New
PyInt_AsLong
PyTuple_GetItem
PyExc_RuntimeError
PyErr_SetString
Py_BuildValue
PyDict_Size
PyDict_Next
PyString_InternFromString
PyObject_GetAttrString
PyObject_GetAttr
PyCallable_Check
PyLong_AsUnsignedLong
PyString_FromString
PyLong_AsLongLong
PyFloat_AsDouble
PyString_AsString
PyErr_Clear
PyErr_BadArgument
PyErr_Print
PyObject_CallObject
PyNumber_Check
_Py_NoneStruct
PyDict_SetItemString
PyModule_GetDict
PyErr_Fetch
Py_SetProgramName
Py_Initialize
Py_Finalize
PyRun_StringFlags
PyImport_AddModule
PyImport_ImportModule
iphlpapi
GetAdaptersInfo
GetPerAdapterInfo
devil
ilEnable
ilLoad
ilGetInteger
ilBindImage
ilOriginFunc
ilConvertImage
ilCopyPixels
ilDeleteImages
ilShutDown
ilSave
ilTexImage
ilSetPixels
ilInit
ilGenImages
imm32
ImmGetIMEFileNameA
ImmIsIME
ImmGetContext
ImmReleaseContext
ImmAssociateContext
ImmGetCompositionStringW
ImmNotifyIME
ImmGetCandidateListW
ImmSetCompositionStringW
ImmGetConversionStatus
ImmSetConversionStatus
ImmGetOpenStatus
ws2_32
__WSAFDIsSet
closesocket
connect
ioctlsocket
recv
select
send
socket
WSAGetLastError
WSAStartup
WSACleanup
htonl
htons
inet_addr
ntohl
ntohs
gethostbyname
gethostname
sendto
WSASetLastError
bind
getpeername
getsockname
getsockopt
setsockopt
WSAIoctl
getaddrinfo
freeaddrinfo
accept
listen
recvfrom
crypt32
CertFreeCertificateContext
wldap32
ord50
ord41
ord60
ord26
ord46
ord32
ord33
ord35
ord79
ord30
ord200
ord301
ord27
ord143
ord22
ord211
normaliz
IdnToAscii
version
VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
imagehlp
StackWalk
EnumerateLoadedModules
GetTimestampForLoadedLibrary
granny2
_GrannyFreeControl@4
_GrannyFreeControlOnceUnused@4
_GrannyCompleteControlAt@8
_GrannyControlIsComplete@4
_GrannyFreeControlIfComplete@4
_GrannyGetControlLoopCount@4
_GrannyGetMeshIndexCount@4
_GrannyGetControlSpeed@4
_GrannySetControlSpeed@8
_GrannyFreeMeshDeformer@4
_GrannyDeformVertices@24
GrannyPNT332VertexType
_GrannySetControlEaseIn@8
_GrannyGetControlLocalDuration@4
_GrannyMeshIsRigid@4
_GrannyGetMeshVertexCount@4
_GrannyGetTotalTypeSize@4
_GrannyGetWorldPoseComposite4x4@8
_GrannyGetWorldPose4x4@8
_GrannyCopyMeshVertices@12
_GrannyGetMeshVertices@4
_GrannyCopyMeshIndices@12
_GrannyNewMeshDeformer@16
_GrannySetLogCallback@4
_GrannyGetMaterialTextureByType@8
_GrannyFindMatchingMember@16
_GrannyConvertSingleObject@20
_GrannyReadEntireFileFromMemory@8
_GrannyFreeFileSection@8
_GrannyFreeFile@4
_GrannyGetFileInfo@4
_GrannyGetSourceSkeleton@4
_GrannySetModelClock@8
_GrannyFreeCompletedModelControls@4
_GrannySampleModelAnimationsAccelerated@20
_GrannyUpdateModelMatrix@20
_GrannyNewLocalPose@4
_GrannyFreeLocalPose@4
_GrannyGetWorldPoseComposite4x4Array@4
_GrannyInstantiateModel@4
_GrannyFreeModelInstance@4
_GrannyNewMeshBinding@12
_GrannyFreeMeshBinding@4
_GrannyGetMeshBindingToBoneIndices@4
_GrannyFindBoneByName@12
_GrannyNewWorldPose@4
_GrannySetControlLoopCount@8
_GrannyGetMeshVertexType@4
_GrannyGetMeshTriangleGroups@4
_GrannyGetMeshTriangleGroupCount@4
_GrannyPlayControlledAnimation@12
_GrannySetControlRawLocalClock@8
_GrannyGetControlRawLocalClock@4
_GrannySetControlEaseOutCurve@28
_GrannySetControlEaseOut@8
_GrannySetControlEaseInCurve@28
_GrannyFreeWorldPose@4
mss32
_AIL_WAV_info@8
_AIL_decompress_ASI@24
_AIL_decompress_ADPCM@12
_AIL_file_type@8
_AIL_open_digital_driver@16
_AIL_open_stream@12
_AIL_enumerate_3D_providers@12
_AIL_open_3D_provider@4
_AIL_close_3D_provider@4
_AIL_open_3D_listener@4
_AIL_close_3D_listener@4
_AIL_set_3D_position@16
_AIL_set_3D_velocity@20
_AIL_set_3D_orientation@28
_AIL_startup@0
_AIL_shutdown@0
_AIL_set_redist_directory@4
_AIL_close_stream@4
_AIL_start_stream@4
_AIL_pause_stream@8
_AIL_set_stream_volume_levels@12
_AIL_stream_volume_levels@12
_AIL_set_stream_loop_count@8
_AIL_stream_status@4
_AIL_file_read@8
_AIL_allocate_sample_handle@4
_AIL_release_sample_handle@4
_AIL_init_sample@4
_AIL_set_sample_file@12
_AIL_start_sample@4
_AIL_stop_sample@4
_AIL_resume_sample@4
_AIL_end_sample@4
_AIL_set_sample_volume_pan@12
_AIL_set_sample_loop_count@8
_AIL_sample_status@4
_AIL_sample_volume_pan@12
_AIL_allocate_3D_sample_handle@4
_AIL_release_3D_sample_handle@4
_AIL_start_3D_sample@4
_AIL_stop_3D_sample@4
_AIL_resume_3D_sample@4
_AIL_end_3D_sample@4
_AIL_set_3D_sample_file@8
_AIL_close_digital_driver@4
_AIL_set_3D_sample_loop_count@8
_AIL_3D_sample_status@4
_AIL_3D_sample_volume@4
_AIL_auto_update_3D_position@8
_AIL_set_file_callbacks@16
_AIL_mem_free_lock@4
_AIL_last_error@0
_AIL_set_3D_sample_volume@8
speedtreert
?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ
?SetLodLevel@CSpeedTreeRT@@QAEXM@Z
?ComputeLodLevel@CSpeedTreeRT@@QAEXXZ
?SetLocalMatrices@CSpeedTreeRT@@QAEXII@Z
?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z
?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z
?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ
?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z
?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ
?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z
?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ
?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z
?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ
?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z
?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z
??3CSpeedTreeRT@@SAXPAX@Z
??2CSpeedTreeRT@@SAPAXI@Z
??1CSpeedTreeRT@@QAE@XZ
??0CSpeedTreeRT@@QAE@XZ
??1STextures@CSpeedTreeRT@@QAE@XZ
??0STextures@CSpeedTreeRT@@QAE@XZ
??1SGeometry@CSpeedTreeRT@@QAE@XZ
??0SGeometry@CSpeedTreeRT@@QAE@XZ
?SetCamera@CSpeedTreeRT@@SAXPBM0@Z
?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z
?SetLightState@CSpeedTreeRT@@SAXI_N@Z
?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z
?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z
?SetTime@CSpeedTreeRT@@SAXM@Z
?SetLodLimits@CSpeedTreeRT@@QAEXMM@Z
?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ
?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z
?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z
?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z
?GetCurrentError@CSpeedTreeRT@@SAPBDXZ
?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z
dinput8
DirectInput8Create
ddraw
DirectDrawCreate
shell32
SHGetSpecialFolderPathA
oleaut32
SysAllocString
SysFreeString
VariantInit
VariantClear
shlwapi
PathIsRelativeA
Sections
.text Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 424KB - Virtual size: 423KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 138KB - Virtual size: 397KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 48KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ