Static task
static1
Behavioral task
behavioral1
Sample
65ea1b4a52a40840a73fd2c6ff373be08149d9a7fbb4e2f59e78fe626babd8de.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
65ea1b4a52a40840a73fd2c6ff373be08149d9a7fbb4e2f59e78fe626babd8de.exe
Resource
win10v2004-20231023-en
General
-
Target
65ea1b4a52a40840a73fd2c6ff373be08149d9a7fbb4e2f59e78fe626babd8de
-
Size
4.3MB
-
MD5
2de9aae8fcebfadd6895fe14243dc36e
-
SHA1
70f75f6fbcf4a371c26ec31997f05da1a138098d
-
SHA256
65ea1b4a52a40840a73fd2c6ff373be08149d9a7fbb4e2f59e78fe626babd8de
-
SHA512
58d7dfd91502e8d9b1c340be42e62467aec16e3fdc97f602343d2640a2758178729674464bfa959587f07a56994eefd4b28347d8ef106e571f1b6f9770acb424
-
SSDEEP
98304:d+sXEhB0D1t8wh/h+66fzu7MRXUeJDxUy:lgxz8Ml3D1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 65ea1b4a52a40840a73fd2c6ff373be08149d9a7fbb4e2f59e78fe626babd8de
Files
-
65ea1b4a52a40840a73fd2c6ff373be08149d9a7fbb4e2f59e78fe626babd8de.exe windows:5 windows x86 arch:x86
47d7de59f2228433a554bcf8189bfb71
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrlenW
LoadLibraryA
GetSystemDirectoryA
GetVersionExA
CompareStringA
GetLocaleInfoA
QueryPerformanceCounter
CreateDirectoryW
FreeLibrary
ReleaseSemaphore
CreateDirectoryA
WaitNamedPipeW
SetEndOfFile
CreateProcessA
GetExitCodeProcess
GetFullPathNameW
WriteConsoleW
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
VirtualProtect
VirtualFree
VirtualAlloc
GetVersionExW
FreeLibraryAndExitThread
GetThreadTimes
OutputDebugStringW
HeapReAlloc
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetStdHandle
GetFileAttributesExW
FlushFileBuffers
SystemTimeToTzSpecificLocalTime
FindFirstFileExW
GetTimeZoneInformation
SetFilePointerEx
ReadConsoleW
GetConsoleMode
GetConsoleCP
GetOEMCP
GetACP
IsValidCodePage
GetModuleFileNameW
GetStdHandle
HeapSize
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
OutputDebugStringA
ReadFile
WriteFile
GetModuleHandleA
WinExec
GetCurrentThread
SetUnhandledExceptionFilter
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
GetFileSize
GlobalUnlock
GlobalLock
GlobalAlloc
MoveFileA
GetCurrentDirectoryA
GetPrivateProfileStringA
lstrlenA
GlobalFree
CreateThread
FindNextFileA
FindFirstFileA
FindClose
SetFileAttributesA
Sleep
WaitForSingleObject
SetEvent
GetLogicalProcessorInformation
GetThreadPriority
SwitchToThread
SignalObjectAndWait
WaitForSingleObjectEx
CreateTimerQueue
CreateSemaphoreW
GetModuleHandleW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
CreateEventW
InitializeCriticalSectionAndSpinCount
SetLastError
UnhandledExceptionFilter
GetCommandLineA
FileTimeToSystemTime
PeekNamedPipe
GetFileType
GetFileInformationByHandle
FileTimeToLocalFileTime
GetCPInfo
SetEnvironmentVariableA
LoadLibraryExW
GetDriveTypeW
ExitThread
HeapAlloc
IsDebuggerPresent
AreFileApisANSI
GetModuleHandleExW
ExitProcess
RtlUnwind
RaiseException
DecodePointer
EncodePointer
GetSystemTimeAsFileTime
GetStringTypeW
GetExitCodeThread
GetCurrentThreadId
DuplicateHandle
HeapFree
CreateFileW
IsProcessorFeaturePresent
GetProcessHeap
HeapValidate
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
SetThreadPriority
Module32Next
Module32First
GetLastError
GetCurrentProcess
GetCurrentDirectoryW
GetTickCount
CreateToolhelp32Snapshot
WideCharToMultiByte
MultiByteToWideChar
GetVolumeInformationA
GetFileAttributesA
CreateFileA
GetModuleFileNameA
LoadLibraryW
GetSystemInfo
CloseHandle
ReadProcessMemory
TerminateProcess
GetCurrentProcessId
CompareStringW
GetProcAddress
user32
SetCursor
DefWindowProcA
UnregisterClassA
RegisterClassExA
CreateWindowExA
IsWindow
DestroyWindow
ShowWindow
MoveWindow
SetFocus
GetMonitorInfoA
MonitorFromPoint
SetWindowTextA
GetActiveWindow
SetWindowPos
OffsetRect
SetRect
FillRect
ClientToScreen
InvalidateRect
ReleaseDC
GetDC
GetAsyncKeyState
PeekMessageA
CharPrevExA
CharNextExA
LoadCursorA
AdjustWindowRectEx
GetMenu
RegisterClassA
DispatchMessageA
TranslateMessage
PostQuitMessage
GetClientRect
UpdateWindow
GetCursorPos
ScreenToClient
FindWindowA
LoadIconA
SystemParametersInfoA
GetKeyState
ShowCursor
ReleaseCapture
DestroyCursor
LoadImageA
SetCursorPos
GetCapture
SetCapture
GetMessageA
ChangeDisplaySettingsA
GetSystemMetrics
MessageBoxA
LoadStringA
GetWindowLongA
SetWindowLongA
OpenClipboard
CloseClipboard
GetClipboardData
GetKeyboardLayoutNameA
GetKeyboardLayout
CharNextW
gdi32
CreateSolidBrush
DeleteObject
StretchBlt
CreateCompatibleDC
DeleteDC
SelectObject
GetPixel
GetDeviceCaps
EnumFontFamiliesExA
GetTextExtentPoint32A
GetStockObject
TextOutW
GetTextExtentPoint32W
GetCharABCWidthsFloatW
CreateFontIndirectA
TextOutA
CreateDIBSection
SetTextColor
SetBkMode
SetBkColor
advapi32
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegOpenKeyA
RegOpenKeyExW
RegQueryValueExW
RegOpenKeyExA
RegQueryValueExA
shell32
SHGetSpecialFolderPathA
ole32
CoCreateInstance
CoInitialize
CoUninitialize
CoInitializeEx
oleaut32
SysFreeString
VariantClear
winmm
timeBeginPeriod
timeGetDevCaps
timeGetTime
timeEndPeriod
d3d8
Direct3DCreate8
python27
Py_BuildValue
PyModule_AddIntConstant
Py_InitModule4
PyErr_SetString
PyExc_RuntimeError
PyInt_AsLong
PyString_FromString
PyTuple_GetItem
PyList_New
PyList_Append
PyLong_AsLongLong
PyTuple_Size
PyDict_GetItemString
PyArg_ParseTuple
PyString_AsString
PyThreadState_Get
PyLong_FromLongLong
PyTuple_New
PyTuple_SetItem
PyDict_New
PyDict_SetItemString
PyDict_SetItem
PyInt_FromLong
PyLong_FromUnsignedLongLong
PyDict_Next
PyDict_Size
PyString_InternFromString
PyModule_GetDict
PyErr_Clear
PyErr_Fetch
Py_SetProgramName
Py_Initialize
Py_Finalize
PyRun_StringFlags
PyImport_AddModule
PyImport_ImportModule
_Py_NoneStruct
PyObject_GetAttrString
PyObject_GetAttr
PyCallable_Check
PyLong_AsUnsignedLongLong
PyFloat_AsDouble
PyErr_BadArgument
PyNumber_Check
PyObject_CallObject
PyErr_Print
imm32
ImmGetCompositionStringW
ImmSetCompositionStringW
ImmGetCandidateListW
ImmGetConversionStatus
ImmSetConversionStatus
ImmGetOpenStatus
ImmNotifyIME
ImmIsIME
ImmAssociateContext
ImmReleaseContext
ImmGetContext
ImmGetIMEFileNameA
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
imagehlp
EnumerateLoadedModules
GetTimestampForLoadedLibrary
StackWalk
devil
ilGenImages
ilGetInteger
ilLoad
ilOriginFunc
ilEnable
ilSave
ilSetPixels
ilTexImage
ilInit
ilCopyPixels
ilDeleteImages
ilShutDown
ilConvertImage
ilBindImage
granny2
_GrannyFreeFileSection@8
_GrannyReadEntireFileFromMemory@8
_GrannyGetWorldPoseComposite4x4Array@4
_GrannyFreeLocalPose@4
_GrannyNewLocalPose@4
_GrannyUpdateModelMatrix@20
_GrannySampleModelAnimationsAccelerated@20
_GrannyFreeCompletedModelControls@4
_GrannySetModelClock@8
_GrannySetTrackGroupLOD@16
_GrannySetTrackGroupTarget@12
_GrannyEndControlledAnimation@4
_GrannyBeginControlledAnimation@8
_GrannyPlayControlledAnimation@12
_GrannySetControlRawLocalClock@8
_GrannyGetControlRawLocalClock@4
_GrannySetControlEaseOutCurve@28
_GrannySetControlEaseOut@8
_GrannySetControlEaseInCurve@28
_GrannySetControlEaseIn@8
_GrannyGetControlLocalDuration@4
_GrannySetControlSpeed@8
_GrannyFreeFile@4
_GrannySetControlLoopCount@8
_GrannyGetControlLoopCount@4
_GrannyFreeControlIfComplete@4
_GrannyControlIsComplete@4
_GrannyCompleteControlAt@8
_GrannyFreeControlOnceUnused@4
_GrannyFreeControl@4
_GrannyFindTrackGroupForModel@12
_GrannyGetSourceModel@4
_GrannyGetWorldPoseComposite4x4@8
_GrannyFreeWorldPose@4
_GrannyNewWorldPose@4
_GrannyFindBoneByName@12
_GrannyGetSourceSkeleton@4
_GrannyFreeModelInstance@4
_GrannyInstantiateModel@4
_GrannyGetWorldPose4x4@8
_GrannyGetMeshIndexCount@4
_GrannyGetTotalTypeSize@4
GrannyPNT332VertexType
_GrannyDeformVertices@24
_GrannyFreeMeshDeformer@4
_GrannyGetFileInfo@4
_GrannyGetControlSpeed@4
_GrannyNewMeshDeformer@16
_GrannyGetMeshBindingToBoneIndices@4
_GrannyFreeMeshBinding@4
_GrannyNewMeshBinding@12
_GrannyCopyMeshIndices@12
_GrannyMeshIsRigid@4
_GrannyGetMeshVertices@4
_GrannyCopyMeshVertices@12
_GrannyGetMeshVertexCount@4
_GrannyGetMeshVertexType@4
_GrannySetLogCallback@4
_GrannyGetMeshTriangleGroups@4
_GrannyGetMeshTriangleGroupCount@4
_GrannyConvertSingleObject@20
_GrannyFindMatchingMember@16
_GrannyGetMaterialTextureByType@8
mss32
_AIL_decompress_ASI@24
_AIL_decompress_ADPCM@12
_AIL_file_type@8
_AIL_last_error@0
_AIL_allocate_sample_handle@4
_AIL_release_sample_handle@4
_AIL_init_sample@4
_AIL_set_sample_file@12
_AIL_start_sample@4
_AIL_stop_sample@4
_AIL_resume_sample@4
_AIL_end_sample@4
_AIL_set_sample_volume_pan@12
_AIL_set_sample_loop_count@8
_AIL_sample_status@4
_AIL_sample_volume_pan@12
_AIL_release_3D_sample_handle@4
_AIL_start_3D_sample@4
_AIL_stop_3D_sample@4
_AIL_resume_3D_sample@4
_AIL_end_3D_sample@4
_AIL_set_3D_sample_file@8
_AIL_set_3D_sample_volume@8
_AIL_WAV_info@8
_AIL_3D_sample_status@4
_AIL_3D_sample_volume@4
_AIL_set_3D_position@16
_AIL_set_3D_velocity@20
_AIL_auto_update_3D_position@8
_AIL_close_stream@4
_AIL_start_stream@4
_AIL_pause_stream@8
_AIL_set_stream_volume_levels@12
_AIL_stream_volume_levels@12
_AIL_set_stream_loop_count@8
_AIL_stream_status@4
_AIL_open_digital_driver@16
_AIL_close_digital_driver@4
_AIL_enumerate_3D_providers@12
_AIL_open_3D_provider@4
_AIL_close_3D_provider@4
_AIL_open_3D_listener@4
_AIL_close_3D_listener@4
_AIL_set_3D_orientation@28
_AIL_open_stream@12
_AIL_allocate_3D_sample_handle@4
_AIL_set_file_callbacks@16
_AIL_file_read@8
_AIL_mem_free_lock@4
_AIL_set_redist_directory@4
_AIL_shutdown@0
_AIL_set_3D_sample_loop_count@8
_AIL_startup@0
speedtreert
?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z
?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetTime@CSpeedTreeRT@@SAXM@Z
?SetLightState@CSpeedTreeRT@@SAXI_N@Z
?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z
?SetCamera@CSpeedTreeRT@@SAXPBM0@Z
??0SGeometry@CSpeedTreeRT@@QAE@XZ
??1SGeometry@CSpeedTreeRT@@QAE@XZ
??0STextures@CSpeedTreeRT@@QAE@XZ
??1STextures@CSpeedTreeRT@@QAE@XZ
??0CSpeedTreeRT@@QAE@XZ
??1CSpeedTreeRT@@QAE@XZ
??2CSpeedTreeRT@@SAPAXI@Z
??3CSpeedTreeRT@@SAXPAX@Z
?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z
?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ
?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z
?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z
?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ
?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z
?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z
?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ
?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z
?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z
?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetLocalMatrices@CSpeedTreeRT@@QAEXII@Z
?ComputeLodLevel@CSpeedTreeRT@@QAEXXZ
?SetLodLevel@CSpeedTreeRT@@QAEXM@Z
?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z
?SetLodLimits@CSpeedTreeRT@@QAEXMM@Z
?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ
?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z
?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z
?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z
?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z
?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ
?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z
?GetCurrentError@CSpeedTreeRT@@SAPBDXZ
dinput8
DirectInput8Create
ws2_32
WSACleanup
WSAStartup
socket
connect
closesocket
__WSAFDIsSet
gethostbyname
recv
send
WSAGetLastError
select
ioctlsocket
inet_addr
htons
ddraw
DirectDrawCreate
libcurl
curl_easy_perform
curl_easy_setopt
curl_easy_init
curl_easy_strerror
curl_slist_append
curl_easy_cleanup
irisprotect
?MauseButton_Left@GameEvent@iProtect@@SA_NIIIIABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?MauseButton_Rigt@GameEvent@iProtect@@SA_NIIIIABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?KeyPress_Up@GameEvent@iProtect@@SA_NH_N@Z
?KeyPress_Down@GameEvent@iProtect@@SA_NH_N@Z
?GetGameLang@ProtectSetup@iProtect@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?GetPanelUrl@ProtectSetup@iProtect@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?GetDebugLevel@ProtectSetup@iProtect@@SA_JXZ
?GetPanelID@ProtectSetup@iProtect@@SAIXZ
?SetClientKey@ProtectSetup@iProtect@@SAHPAPADH@Z
?GetClientKey@ProtectSetup@iProtect@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?GetFingerPrint@ProtectSetup@iProtect@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?GetHwID_Api@ProtectSetup@iProtect@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?GetHwID_Wmic@ProtectSetup@iProtect@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?Error_Observation@GameEvent@iProtect@@SA_NIABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
?Process@ProtectLoop@iProtect@@SA_NXZ
?ProcessCore@ProtectLoop@iProtect@@SA_NI@Z
?ProcessAck@ProtectLoop@iProtect@@SA_NGABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@000GGHHHHHHH@Z
?AttackPacket@ProtectPacket@iProtect@@SAXAB_KAA_K@Z
?ClientReport@ProtectSetup@iProtect@@SAXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_N@Z
?GetBigAccess@ProtectSetup@iProtect@@SA_NXZ
?Start@ProtectSetup@iProtect@@SAX_N@Z
libcef
cef_string_utf16_clear
cef_string_utf8_to_utf16
cef_string_utf8_clear
cef_string_utf16_cmp
cef_string_utf16_to_utf8
cef_string_utf16_set
cef_string_ascii_to_utf16
cef_string_multimap_append
cef_string_multimap_value
cef_string_multimap_key
cef_string_multimap_size
cef_string_map_append
cef_string_map_value
cef_string_map_key
cef_string_map_size
cef_string_list_append
cef_string_list_value
cef_string_list_size
cef_browser_host_create_browser
cef_command_line_get_global
cef_string_map_free
cef_string_map_alloc
cef_v8context_get_current_context
cef_api_hash
cef_run_message_loop
cef_shutdown
cef_initialize
cef_execute_process
cef_register_extension
cef_string_list_free
cef_string_list_alloc
cef_string_userfree_utf16_free
cef_log
cef_string_multimap_free
cef_string_multimap_alloc
Sections
.text Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 622KB - Virtual size: 621KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 139KB - Virtual size: 674KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 327KB - Virtual size: 326KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 167KB - Virtual size: 167KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ