Static task
static1
Behavioral task
behavioral1
Sample
6b89d6e6cd45bc478cd0a33e24c4e25988d05ed41fc158d9c35521b2cccdf4ed.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
6b89d6e6cd45bc478cd0a33e24c4e25988d05ed41fc158d9c35521b2cccdf4ed.exe
Resource
win10v2004-20231215-en
General
-
Target
6b89d6e6cd45bc478cd0a33e24c4e25988d05ed41fc158d9c35521b2cccdf4ed
-
Size
5.7MB
-
MD5
ff30963b2410333ee75b1e1fcec1983b
-
SHA1
2ea3ca85fd69dce4496f47ceaf44d81a75091934
-
SHA256
6b89d6e6cd45bc478cd0a33e24c4e25988d05ed41fc158d9c35521b2cccdf4ed
-
SHA512
dce925f8e92c011762016c4ce991686f98f630603d0147689db8f19190864e3fe8181406edba02501dbbe53daea01bea7b7f4b9d315277ec9691e156d4953cd8
-
SSDEEP
98304:z/+TqbKIyX+StbFx+qDTHJNvRMKNk5pD:z2Ft5xRS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6b89d6e6cd45bc478cd0a33e24c4e25988d05ed41fc158d9c35521b2cccdf4ed
Files
-
6b89d6e6cd45bc478cd0a33e24c4e25988d05ed41fc158d9c35521b2cccdf4ed.exe windows:6 windows x86 arch:x86
382a8247797afd428155fbd10664a564
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameA
DeleteFileA
GetPrivateProfileStringA
lstrlenA
GetCurrentDirectoryA
MoveFileA
FindClose
FindNextFileA
FindFirstFileA
SetFileAttributesA
CreateEventA
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
WaitForSingleObject
SetEvent
Sleep
OpenProcess
GlobalFree
ResetEvent
FlushViewOfFile
ExpandEnvironmentStringsW
GetSystemTime
GetVersion
DuplicateHandle
FindNextFileW
CreatePipe
SystemTimeToTzSpecificLocalTime
FindFirstFileExW
HeapCompact
UnlockFileEx
LockFileEx
ReadConsoleInputW
SetConsoleMode
ReadConsoleInputA
PeekConsoleInputA
GetNumberOfConsoleInputEvents
VirtualQuery
GetSystemInfo
GetLastError
ReadProcessMemory
GetCurrentProcess
Module32Next
Module32First
CreateToolhelp32Snapshot
GetTickCount
GetCurrentDirectoryW
MultiByteToWideChar
HeapFree
GetProcessHeap
HeapAlloc
CloseHandle
DeviceIoControl
VirtualProtect
QueryPerformanceFrequency
RemoveDirectoryW
MoveFileW
SetCurrentDirectoryA
GetEnvironmentVariableA
GetFileAttributesW
GetProcessTimes
SetFileTime
GenerateConsoleCtrlEvent
GetFileAttributesExA
SetEnvironmentVariableW
SystemTimeToFileTime
FindFirstFileW
GetFullPathNameW
LoadLibraryExA
SetErrorMode
GetFileAttributesA
GetConsoleOutputCP
IsDBCSLeadByte
LocalFree
FormatMessageA
SetEndOfFile
SetEnvironmentVariableA
CreateProcessA
GetExitCodeProcess
WriteConsoleW
OutputDebugStringW
HeapReAlloc
SetStdHandle
SetFileAttributesW
SetCurrentDirectoryW
FreeEnvironmentStringsW
GetEnvironmentStringsW
DeleteFileW
GetTimeZoneInformation
GetFileAttributesExW
SetConsoleCtrlHandler
FlushFileBuffers
CreateDirectoryW
ReadConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
GetOEMCP
GetACP
IsValidCodePage
GetModuleFileNameW
GetStdHandle
HeapSize
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetModuleHandleW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
InitializeCriticalSectionAndSpinCount
SetLastError
UnhandledExceptionFilter
FileTimeToSystemTime
PeekNamedPipe
GetFileType
GetFileInformationByHandle
FileTimeToLocalFileTime
AreFileApisANSI
GetModuleHandleExW
ExitProcess
GetCPInfo
LoadLibraryExW
GetCurrentThreadId
GetFullPathNameA
GetDriveTypeW
RtlUnwind
RaiseException
GetCommandLineA
GetSystemTimeAsFileTime
ExitThread
CreateThread
IsDebuggerPresent
CreateFileW
IsProcessorFeaturePresent
HeapValidate
DecodePointer
EncodePointer
GetStringTypeW
QueryPerformanceCounter
ReleaseSemaphore
GetLocaleInfoA
CompareStringA
LoadLibraryA
lstrlenW
GlobalUnlock
GlobalLock
GetProcAddress
FreeLibrary
GetVersionExA
GetSystemDirectoryA
WideCharToMultiByte
WriteFile
SetFilePointer
ReadFile
OutputDebugStringA
WinExec
GetModuleHandleA
GetCurrentThread
SetUnhandledExceptionFilter
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
GetFileSize
GetTempPathA
RemoveDirectoryA
CreateDirectoryA
GlobalAlloc
CreateFileA
GetCurrentProcessId
VerifyVersionInfoW
VirtualAlloc
VerSetConditionMask
user32
GetKeyboardLayout
CharNextExA
CharNextW
GetClipboardData
CloseClipboard
LoadImageA
FlashWindowEx
DestroyIcon
InvalidateRect
GetDC
FillRect
ReleaseDC
PeekMessageA
ClientToScreen
GetClientRect
OffsetRect
SetRect
OpenClipboard
DefWindowProcA
UnregisterClassA
RegisterClassExA
CreateWindowExA
IsWindow
DestroyWindow
MoveWindow
SetFocus
UpdateWindow
GetWindowLongA
GetAsyncKeyState
PostQuitMessage
GetCursorPos
ScreenToClient
FindWindowA
LoadIconA
SetWindowPos
SystemParametersInfoA
GetKeyState
DestroyCursor
ShowCursor
SetCursor
SetCursorPos
SetCapture
ReleaseCapture
ChangeDisplaySettingsA
ShowWindow
GetCapture
FindWindowExA
EnableWindow
FindWindowW
IsIconic
GetWindowRect
GetSystemMetrics
LoadStringA
MessageBoxA
SetWindowLongA
RegisterClassA
CharPrevA
GetKeyboardLayoutNameA
DispatchMessageA
TranslateMessage
GetMessageA
LoadCursorA
AdjustWindowRectEx
GetMenu
CharPrevExA
gdi32
CreateDIBSection
SetBkMode
CreateFontIndirectA
EnumFontFamiliesExA
GetStockObject
TextOutW
SetTextColor
SetBkColor
CreateSolidBrush
DeleteObject
StretchBlt
CreateCompatibleDC
GetCharABCWidthsFloatW
SelectObject
BitBlt
DeleteDC
TextOutA
GetTextExtentPoint32W
GetTextExtentPoint32A
CreateCompatibleBitmap
advapi32
RegSaveKeyA
RegQueryValueExW
RegOpenKeyExW
RegEnumValueA
RegLoadKeyA
RegFlushKey
RegConnectRegistryA
CryptAcquireContextA
CryptGenRandom
RegQueryValueA
RegDeleteValueA
RegQueryInfoKeyA
RegCreateKeyExA
RegCreateKeyA
RegEnumKeyExA
RegDeleteKeyA
RegSetValueExA
RegSetValueA
CryptReleaseContext
RegOpenKeyA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
shell32
ShellExecuteA
SHGetSpecialFolderPathA
ShellExecuteW
SetCurrentProcessExplicitAppUserModelID
ole32
CoInitializeEx
OleSetContainedObject
OleUninitialize
OleInitialize
CoGetClassObject
CoCreateInstance
CoInitialize
CoUninitialize
CreateStreamOnHGlobal
CLSIDFromString
winmm
timeGetTime
timeBeginPeriod
timeGetDevCaps
timeEndPeriod
d3d8
Direct3DCreate8
imm32
ImmGetCandidateListW
ImmIsIME
ImmNotifyIME
ImmGetOpenStatus
ImmSetConversionStatus
ImmGetConversionStatus
ImmGetIMEFileNameA
ImmSetCompositionStringW
ImmGetCompositionStringW
ImmAssociateContext
ImmReleaseContext
ImmGetContext
devil
ilSetPixels
ilTexImage
ilSave
ilShutDown
ilDeleteImages
ilCopyPixels
ilConvertImage
ilGetInteger
ilLoad
ilOriginFunc
ilEnable
ilBindImage
ilGenImages
ilInit
iphlpapi
GetAdaptersInfo
GetPerAdapterInfo
gdiplus
GdipFree
GdipAlloc
GdipDisposeImage
GdipCloneImage
GdipSaveImageToStream
GdipCreateBitmapFromStream
GdipCreateBitmapFromHBITMAP
GdiplusStartup
GdiplusShutdown
GdipSaveImageToFile
version
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
imagehlp
GetTimestampForLoadedLibrary
StackWalk
EnumerateLoadedModules
granny2
_GrannyFreeFile@4
_GrannyFreeFileSection@8
_GrannyReadEntireFileFromMemory@8
_GrannyConvertSingleObject@20
_GrannyFindMatchingMember@16
_GrannyGetMaterialTextureByType@8
_GrannySetLogCallback@4
_GrannyGetFileInfo@4
_GrannyFreeControl@4
_GrannyNewWorldPose@4
_GrannyFreeWorldPose@4
_GrannyGetWorldPose4x4@8
_GrannyGetWorldPoseComposite4x4@8
_GrannyGetTotalTypeSize@4
_GrannyGetMeshVertexCount@4
_GrannyGetSourceSkeleton@4
_GrannySetModelClock@8
_GrannyFreeCompletedModelControls@4
_GrannySampleModelAnimationsAccelerated@20
_GrannyUpdateModelMatrix@20
_GrannyNewLocalPose@4
_GrannyFreeLocalPose@4
_GrannyGetMeshBindingToBoneIndices@4
_GrannyGetWorldPoseComposite4x4Array@4
_GrannyInstantiateModel@4
_GrannyFreeModelInstance@4
_GrannyNewMeshBinding@12
_GrannyFreeMeshBinding@4
_GrannyFindBoneByName@12
_GrannyMeshIsRigid@4
_GrannyGetMeshIndexCount@4
_GrannyFreeControlOnceUnused@4
_GrannyCompleteControlAt@8
_GrannyFreeControlIfComplete@4
_GrannyGetControlLoopCount@4
_GrannySetControlLoopCount@8
_GrannyGetControlSpeed@4
_GrannySetControlSpeed@8
_GrannyGetControlLocalDuration@4
_GrannySetControlEaseIn@8
_GrannySetControlEaseInCurve@28
_GrannySetControlEaseOut@8
_GrannySetControlEaseOutCurve@28
_GrannyGetControlRawLocalClock@4
_GrannySetControlRawLocalClock@8
_GrannyPlayControlledAnimation@12
_GrannyGetMeshTriangleGroupCount@4
_GrannyGetMeshTriangleGroups@4
_GrannyGetMeshVertexType@4
_GrannyCopyMeshVertices@12
_GrannyGetMeshVertices@4
_GrannyCopyMeshIndices@12
_GrannyNewMeshDeformer@16
_GrannyFreeMeshDeformer@4
_GrannyDeformVertices@24
GrannyPNT332VertexType
_GrannyControlIsComplete@4
mss32
_AIL_auto_update_3D_position@8
_AIL_mem_free_lock@4
_AIL_3D_sample_volume@4
_AIL_3D_sample_status@4
_AIL_file_read@8
_AIL_set_file_callbacks@16
_AIL_WAV_info@8
_AIL_decompress_ASI@24
_AIL_decompress_ADPCM@12
_AIL_file_type@8
_AIL_open_digital_driver@16
_AIL_open_stream@12
_AIL_close_digital_driver@4
_AIL_enumerate_3D_providers@12
_AIL_open_3D_provider@4
_AIL_close_3D_provider@4
_AIL_open_3D_listener@4
_AIL_close_3D_listener@4
_AIL_set_3D_position@16
_AIL_set_3D_velocity@20
_AIL_set_3D_orientation@28
_AIL_startup@0
_AIL_shutdown@0
_AIL_set_redist_directory@4
_AIL_close_stream@4
_AIL_start_stream@4
_AIL_pause_stream@8
_AIL_set_stream_volume_levels@12
_AIL_stream_volume_levels@12
_AIL_set_stream_loop_count@8
_AIL_stream_status@4
_AIL_last_error@0
_AIL_allocate_sample_handle@4
_AIL_release_sample_handle@4
_AIL_init_sample@4
_AIL_set_sample_file@12
_AIL_set_3D_sample_loop_count@8
_AIL_set_3D_sample_volume@8
_AIL_set_3D_sample_file@8
_AIL_end_3D_sample@4
_AIL_resume_3D_sample@4
_AIL_start_sample@4
_AIL_stop_sample@4
_AIL_resume_sample@4
_AIL_end_sample@4
_AIL_set_sample_volume_pan@12
_AIL_set_sample_loop_count@8
_AIL_sample_status@4
_AIL_sample_volume_pan@12
_AIL_allocate_3D_sample_handle@4
_AIL_release_3D_sample_handle@4
_AIL_start_3D_sample@4
_AIL_stop_3D_sample@4
speedtreert
?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ
?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z
?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ
?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z
?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z
?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetLocalMatrices@CSpeedTreeRT@@QAEXII@Z
?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z
?SetLodLevel@CSpeedTreeRT@@QAEXM@Z
?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z
?SetLodLimits@CSpeedTreeRT@@QAEXMM@Z
?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ
?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z
?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z
?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z
?GetCurrentError@CSpeedTreeRT@@SAPBDXZ
?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z
?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ
?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z
??0SGeometry@CSpeedTreeRT@@QAE@XZ
?SetCamera@CSpeedTreeRT@@SAXPBM0@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z
??1SGeometry@CSpeedTreeRT@@QAE@XZ
?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ
?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z
??3CSpeedTreeRT@@SAXPAX@Z
??2CSpeedTreeRT@@SAPAXI@Z
??1CSpeedTreeRT@@QAE@XZ
??0CSpeedTreeRT@@QAE@XZ
??1STextures@CSpeedTreeRT@@QAE@XZ
?ComputeLodLevel@CSpeedTreeRT@@QAEXXZ
??0STextures@CSpeedTreeRT@@QAE@XZ
?SetTime@CSpeedTreeRT@@SAXM@Z
?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z
?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z
?SetLightState@CSpeedTreeRT@@SAXI_N@Z
?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z
dinput8
DirectInput8Create
ws2_32
inet_addr
htons
socket
connect
closesocket
send
recv
__WSAFDIsSet
ioctlsocket
select
WSAGetLastError
WSAStartup
gethostbyname
WSACleanup
ddraw
DirectDrawCreate
oleaut32
SysFreeString
VariantClear
VariantInit
SysAllocString
Sections
.text Size: 3.5MB - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 477KB - Virtual size: 789KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 476KB - Virtual size: 475KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ