Static task
static1
Behavioral task
behavioral1
Sample
79a1ec74010aafeba7d0ea376be9b92d539aac2e5098b09222693594537c0d9b.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
79a1ec74010aafeba7d0ea376be9b92d539aac2e5098b09222693594537c0d9b.exe
Resource
win10v2004-20231020-en
General
-
Target
79a1ec74010aafeba7d0ea376be9b92d539aac2e5098b09222693594537c0d9b
-
Size
644KB
-
MD5
b9c4bcb1fe43f8d7ef6751c4fed49312
-
SHA1
7eca3bcca77526983c567d83434214352106d0d7
-
SHA256
79a1ec74010aafeba7d0ea376be9b92d539aac2e5098b09222693594537c0d9b
-
SHA512
072525926c120b9644811f30ef49a0fbd7f8001c6a1cfc92b7a2687d25ed66ed874d099b71fdf1f584d6351bfecdcf06301436f06de7170d499e71926779cec5
-
SSDEEP
12288:5Ku0h8c7DlfyKbzB029IiUli6U2RSsxiI5phUpg8WPQiV5y2AEWIEC6/xb6x6+gf:5Krh7DlfyKbzB029IiUU6U2RSsxiqPUV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 79a1ec74010aafeba7d0ea376be9b92d539aac2e5098b09222693594537c0d9b
Files
-
79a1ec74010aafeba7d0ea376be9b92d539aac2e5098b09222693594537c0d9b.exe windows:4 windows x86 arch:x86
233bebc8d7e11a3805b715f19fb9b990
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetStartupInfoA
Sleep
AllocConsole
FreeConsole
GetModuleFileNameA
CreateFileA
GetFileTime
CloseHandle
FileTimeToLocalFileTime
FileTimeToSystemTime
GetDateFormatA
GetTimeFormatA
GetVersion
FindFirstFileA
SetFileAttributesA
FindNextFileA
FindClose
RemoveDirectoryA
SystemTimeToTzSpecificLocalTime
LoadLibraryA
GetProcAddress
FreeLibrary
MulDiv
GetTickCount
GetTempPathA
DeleteFileA
GetTempFileNameA
GetModuleHandleA
user32
MessageBoxA
SetWindowTextA
SendMessageA
SetCursor
SetCursorPos
GetKeyState
OpenClipboard
GetClipboardData
EmptyClipboard
CloseClipboard
SetCaretPos
ShowCursor
LoadCursorFromFileA
LoadCursorA
ClientToScreen
shell32
SHGetSpecialFolderPathA
shlwapi
PathRemoveFileSpecA
PathFindFileNameA
PathRemoveExtensionA
lualibdll
lua_pushstring
lua_pushnumber
lua_type
lua_tonumber
lua_gettop
lua_tostring
engine
??0KTimer@@QAE@XZ
?g_FileName2Id@@YAKPAD@Z
?g_pIme@@3PAVKIme@@A
?TurnOn@KIme@@QAEXXZ
?LoadBuffer@KLuaScript@@QAEHPAEK@Z
?ExecuteCode@KLuaScript@@QAEHXZ
?Load@KLuaScript@@UAEHPAD@Z
?Init@KLuaScript@@UAEHXZ
?RegisterFunctions@KLuaScript@@QAEHQAUTLua_Funcs@@H@Z
?g_GetRootPath@@YAXPAD@Z
??1KLuaScript@@UAE@XZ
??0KLuaScript@@QAE@XZ
?EraseSection@KIniFile@@QAEXPBD@Z
EDOneTimePad_Decipher
?IsSectionExist@KIniFile@@QAEHPBD@Z
TGetEncodedTextOutputLenPos
TSplitEncodedString
TGetEncodedTextEffectCtrls
?Clear@KIniFile@@QAEXXZ
?Open@KFile@@QAEHPAD@Z
?Read@KFile@@QAEKPAXK@Z
TClearSpecialCtrlInEncodedText
?WriteString@KIniFile@@QAEXPBD00@Z
?WriteStruct@KIniFile@@QAEXPBD0PAXK@Z
?EraseKey@KIniFile@@QAEXPBD0@Z
?GetStruct@KIniFile@@QAEXPBD0PAXK@Z
?g_GetFullPath@@YAXPAD0@Z
?Save@KIniFile@@QAEHPBD@Z
?GetFPS@KTimer@@QAEHPAH@Z
EDOneTimePad_Encipher
?g_DebugLog@@YAXPADZZ
?GetElapse@KTimer@@QAEKXZ
?Exit@KDirectSound@@QAEXXZ
?g_SetRootPath@@YAXPAD@Z
?g_SetFilePath@@YAXPAD@Z
?g_FindDebugWindow@@YAPAUHWND__@@PAD0@Z
?Open@KPakList@@QAE_NPBD@Z
?Init@KDirectSound@@QAEHXZ
?Start@KTimer@@QAEXXZ
?SetMouseHoverTime@KWin32App@@QAEXI@Z
??0KWin32App@@QAE@XZ
??0KMp3Music@@QAE@XZ
??0KDirectSound@@QAE@XZ
?InitClass@KWin32App@@MAEHPAUHINSTANCE__@@@Z
?InitWindow@KWin32App@@MAEHPAUHINSTANCE__@@@Z
?ShowMouse@KWin32App@@UAEXH@Z
?SetMultiGame@KWin32App@@UAEXH@Z
?MsgProc@KWin32App@@UAEJPAUHWND__@@IIJ@Z
?Init@KWin32App@@UAEHPAUHINSTANCE__@@PAD@Z
?Run@KWin32App@@UAEXXZ
??1KPakList@@QAE@XZ
??0KPakList@@QAE@XZ
??1KDirectSound@@QAE@XZ
TEncodeText
TGetEncodedTextLineCount
??1KIniFile@@QAE@XZ
?GetString@KIniFile@@QAEHPBD00PADK@Z
?GetInteger@KIniFile@@QAEHPBD0HPAH@Z
?Load@KIniFile@@QAEHPBD@Z
??0KIniFile@@QAE@XZ
TFindSpecialCtrlInEncodedText
?g_CreatePath@@YAXPAD@Z
AdviseEngine
UnAdviseEngine
??1KPakFile@@QAE@XZ
??1KFile@@QAE@XZ
?Close@KFile@@QAEXXZ
?Close@KPakFile@@QAEXXZ
?Write@KFile@@QAEKPAXK@Z
?Read@KPakFile@@QAEKPAXI@Z
?Size@KPakFile@@QAEKXZ
?Open@KPakFile@@QAEHPBD@Z
?Create@KFile@@QAEHPAD@Z
??0KFile@@QAE@XZ
??0KPakFile@@QAE@XZ
??0KIme@@QAE@XZ
??1KIme@@QAE@XZ
?CloseIME@KIme@@QAEXXZ
?DisableLanguageChange@KIme@@QAEXXZ
?IsIme@KIme@@QAEHXZ
?SetCaretPos@KIme@@QAEXHH@Z
?OpenIME@KIme@@QAEXXZ
?EnableLanguageChange@KIme@@QAEXXZ
TSplitString
TGetLimitLenString
TRemoveCtrlInEncodedText
?GetInteger2@KIniFile@@QAEXPBD0PAH1@Z
?g_GetMainHWnd@@YAPAUHWND__@@XZ
?KSG_StringToMD5String@@YAHQADQBD@Z
?WriteInteger@KIniFile@@QAEXPBD0H@Z
??1KMp3Music@@UAE@XZ
coreclient
CoreGetShell
msvcrtd
strcmp
strlen
memset
memcpy
sprintf
__CxxFrameHandler
strcpy
free
strcat
strftime
localtime
time
_purecall
strncpy
_CrtDbgReport
??3@YAXPAX@Z
??2@YAPAXI@Z
memmove
atoi
malloc
realloc
memcmp
rand
_mbsicmp
strstr
srand
mktime
fclose
fopen
remove
_ftol
_chkesp
strchr
sscanf
__dllonexit
_onexit
_except_handler3
?terminate@@YAXXZ
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_mbsnbcpy
isdigit
isalpha
toupper
tolower
_mbsspn
_mbscspn
_mbsnbcmp
isalnum
_mbsstr
_mbschr
_ismbcalpha
_assert
_strlwr
_strcmpi
_itoa
isgraph
msvcp60d
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDIABV?$allocator@D@1@@Z
??Mstd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?empty@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE_NXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0_Lockit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?data@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
Sections
.text Size: 560KB - Virtual size: 559KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 40KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 36KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ