Static task
static1
Behavioral task
behavioral1
Sample
a1c946c77977de48c2ba0a80d98e645a2e3c13b3094c8eb2acd803dcab29204f.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
a1c946c77977de48c2ba0a80d98e645a2e3c13b3094c8eb2acd803dcab29204f.exe
Resource
win10v2004-20231215-en
General
-
Target
a1c946c77977de48c2ba0a80d98e645a2e3c13b3094c8eb2acd803dcab29204f
-
Size
6.4MB
-
MD5
e714b8411bb7b3184a0e21a9fd482bfb
-
SHA1
d86672304760dd9ed99485c7deff552ea21a38fb
-
SHA256
a1c946c77977de48c2ba0a80d98e645a2e3c13b3094c8eb2acd803dcab29204f
-
SHA512
59f77afb2402dab672c83ca196813db0f21e94e4741c81cb517c62dd193d70300058842a7d777f702d558b35ec60c3ed1f1b810339330b11b5664c91116c1f07
-
SSDEEP
98304:L3oGT+r3YkTScK3/0c8tz/ZiXleU7Of33In0yX0eXnWHnMHHM2rbbbbpXu4KxIVA:UGCr38cE8tliXlN+a0eXM2rbbbbpq7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a1c946c77977de48c2ba0a80d98e645a2e3c13b3094c8eb2acd803dcab29204f
Files
-
a1c946c77977de48c2ba0a80d98e645a2e3c13b3094c8eb2acd803dcab29204f.exe windows:6 windows x86 arch:x86
a96bf940c0e7af024c2d390ebb72540d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ReleaseSemaphore
QueryPerformanceCounter
FormatMessageA
CreateProcessA
GetStartupInfoA
ReleaseMutex
CreateMutexA
VerifyVersionInfoW
VerSetConditionMask
CreateEventA
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
WaitForSingleObject
SetEvent
OpenProcess
GetSystemInfo
ReadProcessMemory
GetCurrentProcess
OutputDebugStringA
WriteConsoleW
PeekConsoleInputA
ReadConsoleInputW
GetNumberOfConsoleInputEvents
SetConsoleMode
HeapSize
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
HeapReAlloc
ReadConsoleW
GetFileSizeEx
GetConsoleMode
GetTimeZoneInformation
UnlockFileEx
LockFileEx
HeapCompact
FlushFileBuffers
SetFilePointerEx
SetStdHandle
VirtualQuery
VirtualAlloc
GetLocaleInfoA
SystemTimeToTzSpecificLocalTime
GetCommandLineW
GetCommandLineA
GetDriveTypeW
FreeLibraryAndExitThread
ExitThread
CreateThread
GetModuleHandleExW
LoadLibraryExW
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
GetFileSize
CreateFileA
RemoveDirectoryA
GetCurrentThread
GlobalAlloc
GlobalFree
Module32Next
GetModuleFileNameA
WinExec
CreateDirectoryA
GetFileAttributesA
DeleteFileA
GetPrivateProfileStringA
CompareStringA
CloseHandle
Module32First
CreateToolhelp32Snapshot
GetTickCount
InitializeCriticalSectionAndSpinCount
RaiseException
InterlockedPushEntrySList
RtlUnwind
FlushViewOfFile
GetStdHandle
ExpandEnvironmentStringsW
lstrlenA
SetConsoleCtrlHandler
GetACP
GetExitCodeProcess
GenerateConsoleCtrlEvent
GetProcessTimes
MoveFileW
GetSystemTime
GetFileType
SystemTimeToFileTime
SetEnvironmentVariableA
DeleteFileW
SetCurrentDirectoryA
GetVersion
DuplicateHandle
GetEnvironmentVariableA
CreatePipe
RemoveDirectoryW
ReadFile
WideCharToMultiByte
lstrlenW
GlobalLock
GlobalUnlock
LoadLibraryA
GetProcAddress
FreeLibrary
GetVersionExA
GetSystemDirectoryA
WriteFile
SetFilePointer
FileTimeToSystemTime
GetFileAttributesExA
SetErrorMode
LoadLibraryExA
TlsFree
TlsGetValue
HeapAlloc
TlsAlloc
HeapFree
TlsSetValue
SetEndOfFile
IsDBCSLeadByte
GetFullPathNameA
OutputDebugStringW
GetConsoleCP
GetConsoleOutputCP
WaitNamedPipeW
PeekNamedPipe
InitializeSListHead
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentDirectoryA
MoveFileA
VirtualProtect
GetModuleHandleA
GetTickCount64
ExitProcess
GetSystemFirmwareTable
IsProcessorFeaturePresent
GetLocalTime
LocalFree
FindClose
FindNextFileA
FindFirstFileA
SetFileAttributesA
SearchPathA
IsDebuggerPresent
GetCPInfo
GetSystemTimeAsFileTime
LCMapStringEx
InitializeCriticalSectionEx
DecodePointer
EncodePointer
SleepConditionVariableSRW
WakeAllConditionVariable
GetStringTypeW
GetFileInformationByHandleEx
MoveFileExW
CopyFileW
AreFileApisANSI
GetTempPathW
SetFileTime
SetFileInformationByHandle
SetFileAttributesW
GetFullPathNameW
GetFileInformationByHandle
GetFileAttributesExW
GetFileAttributesW
FindNextFileW
FindFirstFileExW
FindFirstFileW
CreateDirectoryW
GetLocaleInfoEx
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
CloseThreadpoolWork
WaitForThreadpoolWorkCallbacks
SubmitThreadpoolWork
CreateThreadpoolWork
QueryPerformanceFrequency
GetNativeSystemInfo
GetExitCodeThread
GetCurrentThreadId
WaitForSingleObjectEx
CreateFileW
GetProcessHeap
HeapValidate
GetCurrentDirectoryW
MultiByteToWideChar
GetThreadId
SetCurrentDirectoryW
SetLastError
TerminateProcess
CreateProcessW
GetModuleHandleW
LoadLibraryW
Sleep
GetLastError
SetEnvironmentVariableW
GetCurrentProcessId
ResetEvent
GetShortPathNameA
GetModuleFileNameW
user32
ScreenToClient
GetCursorPos
GetAsyncKeyState
SetRect
CharPrevA
OffsetRect
ClientToScreen
PeekMessageA
ReleaseDC
FillRect
GetDC
InvalidateRect
UnregisterClassA
DestroyWindow
IsWindow
FindWindowA
LoadIconA
SetWindowPos
SystemParametersInfoA
SetWindowDisplayAffinity
GetWindowDisplayAffinity
GetKeyState
LoadImageA
DestroyCursor
ShowCursor
SetCursor
SetCursorPos
SetCapture
ReleaseCapture
ChangeDisplaySettingsA
GetCapture
GetSystemMetrics
SetWinEventHook
LoadStringA
GetWindowLongA
SetWindowLongA
RegisterClassA
GetMenu
AdjustWindowRectEx
LoadCursorA
GetMessageA
TranslateMessage
DispatchMessageA
GetKeyboardLayoutNameA
GetKeyboardLayout
OpenClipboard
CloseClipboard
GetClipboardData
CharNextW
CharNextExA
CharPrevExA
MessageBoxA
MoveWindow
SetFocus
UpdateWindow
ShowWindow
GetClientRect
CreateWindowExA
RegisterClassExA
DefWindowProcA
PostQuitMessage
gdi32
TextOutW
TextOutA
CreateDIBSection
SetBkMode
DeleteDC
CreateCompatibleDC
SetTextColor
SetBkColor
SelectObject
GetTextExtentPoint32W
GetCharABCWidthsFloatW
CreateFontIndirectA
EnumFontFamiliesExA
GetStockObject
StretchBlt
DeleteObject
CreateSolidBrush
GetTextExtentPoint32A
advapi32
CryptGenRandom
RegCreateKeyA
RegSetValueA
RegDeleteKeyA
RegCreateKeyExA
RegFlushKey
RegQueryValueA
RegSetValueExA
RegLoadKeyA
RegQueryInfoKeyA
RegEnumValueA
RegDeleteValueA
RegConnectRegistryA
RegSaveKeyA
RegEnumKeyExA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
CryptReleaseContext
RegOpenKeyA
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
CryptAcquireContextA
shell32
ShellExecuteA
ShellExecuteW
SHGetSpecialFolderPathA
ole32
CoInitialize
CoUninitialize
CoGetClassObject
CoCreateInstance
OleUninitialize
OleSetContainedObject
CoInitializeEx
OleInitialize
oleaut32
VariantInit
SysFreeString
VariantClear
SysAllocString
winmm
timeEndPeriod
timeGetTime
timeBeginPeriod
timeGetDevCaps
d3d8
Direct3DCreate8
imm32
ImmNotifyIME
ImmGetOpenStatus
ImmSetConversionStatus
ImmGetConversionStatus
ImmGetCandidateListW
ImmSetCompositionStringW
ImmGetCompositionStringW
ImmAssociateContext
ImmReleaseContext
ImmGetContext
ImmIsIME
ImmGetIMEFileNameA
libcef
cef_string_multimap_free
cef_string_multimap_alloc
cef_string_utf8_to_utf16
cef_string_utf16_clear
cef_string_utf8_clear
cef_string_utf16_cmp
cef_string_ascii_to_utf16
cef_string_utf16_to_utf8
cef_string_multimap_append
cef_string_multimap_value
cef_string_multimap_key
cef_string_multimap_size
cef_string_map_append
cef_string_map_value
cef_string_map_key
cef_string_map_size
cef_string_list_append
cef_string_list_value
cef_string_list_size
cef_browser_host_create_browser
cef_command_line_get_global
cef_string_map_free
cef_string_map_alloc
cef_v8context_get_current_context
cef_string_utf16_set
cef_string_userfree_utf16_free
cef_string_list_alloc
cef_string_list_free
cef_register_extension
cef_execute_process
cef_initialize
cef_shutdown
cef_run_message_loop
cef_api_hash
cef_log
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
imagehlp
SymInitialize
SymGetLineFromAddr
SymGetModuleBase
SymGetModuleInfo
SymFunctionTableAccess
SymCleanup
GetTimestampForLoadedLibrary
StackWalk
SymGetSymFromAddr
devil
ilBindImage
ilInit
ilSetPixels
ilTexImage
ilSave
ilShutDown
ilDeleteImages
ilCopyPixels
ilConvertImage
ilGetInteger
ilLoad
ilOriginFunc
ilEnable
ilGenImages
granny2
_GrannyGetMeshVertexCount@4
_GrannyGetTotalTypeSize@4
_GrannyGetWorldPoseComposite4x4@8
_GrannyGetWorldPose4x4@8
_GrannyFreeWorldPose@4
_GrannyNewWorldPose@4
_GrannyFindBoneByName@12
_GrannyGetMeshBindingToBoneIndices@4
_GrannyFreeMeshBinding@4
_GrannyNewMeshBinding@12
_GrannyFreeModelInstance@4
_GrannyInstantiateModel@4
_GrannyGetWorldPoseComposite4x4Array@4
_GrannyFreeLocalPose@4
_GrannyNewLocalPose@4
_GrannyUpdateModelMatrix@20
_GrannySampleModelAnimationsAccelerated@20
_GrannyFreeCompletedModelControls@4
_GrannySetModelClock@8
_GrannyGetSourceSkeleton@4
_GrannyGetSourceModel@4
_GrannyFreeFile@4
_GrannyFreeFileSection@8
_GrannyMeshIsRigid@4
_GrannyConvertSingleObject@20
_GrannyFindMatchingMember@16
_GrannyGetMaterialTextureByType@8
_GrannyFindTrackGroupForModel@12
_GrannyFreeControl@4
_GrannyFreeControlOnceUnused@4
_GrannyCompleteControlAt@8
_GrannyControlIsComplete@4
_GrannyFreeControlIfComplete@4
_GrannyGetControlLoopCount@4
_GrannySetControlLoopCount@8
_GrannyGetControlSpeed@4
_GrannySetControlSpeed@8
_GrannyEndControlledAnimation@4
_GrannySetTrackGroupTarget@12
_GrannySetTrackGroupLOD@16
_GrannyGetMeshTriangleGroupCount@4
_GrannyGetControlLocalDuration@4
_GrannySetControlEaseIn@8
_GrannySetControlEaseInCurve@28
_GrannyBeginControlledAnimation@8
_GrannySetControlEaseOut@8
_GrannySetControlEaseOutCurve@28
_GrannyGetControlRawLocalClock@4
_GrannyReadEntireFileFromMemory@8
_GrannyGetMeshIndexCount@4
_GrannySetControlRawLocalClock@8
_GrannyGetMeshTriangleGroups@4
_GrannyGetMeshVertexType@4
_GrannyCopyMeshVertices@12
_GrannyGetMeshVertices@4
_GrannyCopyMeshIndices@12
_GrannyNewMeshDeformer@16
_GrannyFreeMeshDeformer@4
_GrannyDeformVertices@24
GrannyPNT332VertexType
_GrannyPlayControlledAnimation@12
_GrannyGetFileInfo@4
mss32
_AIL_last_error@0
_AIL_allocate_sample_handle@4
_AIL_release_sample_handle@4
_AIL_init_sample@4
_AIL_set_sample_file@12
_AIL_start_sample@4
_AIL_stop_sample@4
_AIL_resume_sample@4
_AIL_end_sample@4
_AIL_set_sample_volume_pan@12
_AIL_set_sample_loop_count@8
_AIL_sample_status@4
_AIL_sample_volume_pan@12
_AIL_allocate_3D_sample_handle@4
_AIL_release_3D_sample_handle@4
_AIL_start_3D_sample@4
_AIL_stop_3D_sample@4
_AIL_resume_3D_sample@4
_AIL_end_3D_sample@4
_AIL_set_3D_sample_file@8
_AIL_set_3D_sample_volume@8
_AIL_set_3D_sample_loop_count@8
_AIL_3D_sample_status@4
_AIL_3D_sample_volume@4
_AIL_auto_update_3D_position@8
_AIL_pause_stream@8
_AIL_start_stream@4
_AIL_close_stream@4
_AIL_set_redist_directory@4
_AIL_shutdown@0
_AIL_startup@0
_AIL_set_3D_orientation@28
_AIL_set_3D_velocity@20
_AIL_set_3D_position@16
_AIL_close_3D_listener@4
_AIL_open_3D_listener@4
_AIL_close_3D_provider@4
_AIL_open_3D_provider@4
_AIL_enumerate_3D_providers@12
_AIL_close_digital_driver@4
_AIL_open_stream@12
_AIL_open_digital_driver@16
_AIL_file_type@8
_AIL_decompress_ADPCM@12
_AIL_decompress_ASI@24
_AIL_WAV_info@8
_AIL_set_file_callbacks@16
_AIL_set_stream_loop_count@8
_AIL_stream_volume_levels@12
_AIL_file_read@8
_AIL_mem_free_lock@4
_AIL_stream_status@4
_AIL_set_stream_volume_levels@12
speedtreert
??0STextures@CSpeedTreeRT@@QAE@XZ
?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z
?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ
?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z
?GetCurrentError@CSpeedTreeRT@@SAPBDXZ
?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z
?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z
?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z
?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ
?SetLodLimits@CSpeedTreeRT@@QAEXMM@Z
?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z
?SetLodLevel@CSpeedTreeRT@@QAEXM@Z
?ComputeLodLevel@CSpeedTreeRT@@QAEXXZ
?SetLocalMatrices@CSpeedTreeRT@@QAEXII@Z
?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetTime@CSpeedTreeRT@@SAXM@Z
?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z
?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z
?SetLightState@CSpeedTreeRT@@SAXI_N@Z
?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z
?SetCamera@CSpeedTreeRT@@SAXPBM0@Z
??0SGeometry@CSpeedTreeRT@@QAE@XZ
??1SGeometry@CSpeedTreeRT@@QAE@XZ
?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
??1STextures@CSpeedTreeRT@@QAE@XZ
??0CSpeedTreeRT@@QAE@XZ
??1CSpeedTreeRT@@QAE@XZ
??2CSpeedTreeRT@@SAPAXI@Z
??3CSpeedTreeRT@@SAXPAX@Z
?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z
?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ
?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z
?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z
?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ
?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z
?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ
?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z
?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z
dinput8
DirectInput8Create
ws2_32
__WSAFDIsSet
gethostbyname
inet_addr
htons
WSACleanup
WSAStartup
WSAGetLastError
socket
send
select
recv
ioctlsocket
connect
closesocket
ddraw
DirectDrawCreate
crypt32
CryptProtectData
CryptUnprotectData
crashrpt
ord24
ord9
ord8
ord30
ord27
ord16
ord20
Sections
.text Size: 4.1MB - Virtual size: 4.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 441KB - Virtual size: 998KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 45KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 235KB - Virtual size: 235KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ