Static task
static1
Behavioral task
behavioral1
Sample
7b58f0155171b280fa8b1f6d0aa8762c94ef385ee5f0c0b03f94d6c10ef0d8e1.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
7b58f0155171b280fa8b1f6d0aa8762c94ef385ee5f0c0b03f94d6c10ef0d8e1.exe
Resource
win10v2004-20231215-en
General
-
Target
7b58f0155171b280fa8b1f6d0aa8762c94ef385ee5f0c0b03f94d6c10ef0d8e1
-
Size
6.0MB
-
MD5
17090de0e0f8f9decb49f93fed659948
-
SHA1
ea27064e080b18ae54633fa99cec4c28712eb3e1
-
SHA256
7b58f0155171b280fa8b1f6d0aa8762c94ef385ee5f0c0b03f94d6c10ef0d8e1
-
SHA512
c9b49e38a0c8fd48a505185a775ee424778932196da70d87626e0044153ec2be372656e382eabea01c16a18aaf70c93429f3be799810768eb039a4bf3b998f32
-
SSDEEP
98304:ZNDkSpV+VxgmSS6IcjYIInCvqerhVVQr6Z6CUWXex4Ca1+D5B2M:Q0+VxgmouCvBrf6CbOx4Ca1u
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7b58f0155171b280fa8b1f6d0aa8762c94ef385ee5f0c0b03f94d6c10ef0d8e1
Files
-
7b58f0155171b280fa8b1f6d0aa8762c94ef385ee5f0c0b03f94d6c10ef0d8e1.exe windows:6 windows x86 arch:x86
eb752342e2870180c1789e6aefa23e8d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetSystemInfo
SetThreadPriority
CreateEventA
SetEndOfFile
HeapQueryInformation
HeapSize
OutputDebugStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
HeapReAlloc
SetStdHandle
DeleteFileW
SetFileAttributesW
SetCurrentDirectoryW
WaitForSingleObject
SetEvent
DeleteCriticalSection
LeaveCriticalSection
SetFileAttributesA
EnterCriticalSection
InitializeCriticalSection
GetPriorityClass
CheckRemoteDebuggerPresent
LoadLibraryA
GetThreadId
ExitProcess
SetEnvironmentVariableW
FindNextFileA
FindFirstFileA
FindClose
Process32Next
CreateDirectoryW
SetConsoleCtrlHandler
GetFileAttributesExW
CreateProcessW
GetExitCodeProcess
GetTimeZoneInformation
ReadConsoleW
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
WriteConsoleW
MultiByteToWideChar
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetFileType
GetFileInformationByHandle
GetFullPathNameW
GetDriveTypeW
FreeLibraryAndExitThread
ResumeThread
ExitThread
GetModuleHandleExW
Process32First
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
RaiseException
GetThreadTimes
SetLastError
WaitNamedPipeW
PeekNamedPipe
GetModuleFileNameW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
UnhandledExceptionFilter
CreateEventW
ResetEvent
InitializeCriticalSectionAndSpinCount
FindResourceW
FindResourceA
SizeofResource
LoadResource
LockResource
CreateFileW
IsProcessorFeaturePresent
InterlockedDecrement
HeapValidate
InterlockedIncrement
GetCPInfo
CompareStringEx
GetLocaleInfoEx
CreateSymbolicLinkW
GetFileInformationByHandleEx
GetModuleHandleW
CloseThreadpoolWait
SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
FreeLibraryWhenCallbackReturns
GetTickCount64
GetSystemTimeAsFileTime
GetCurrentProcessorNumber
GetCurrentDirectoryW
GetTickCount
GetCurrentDirectoryA
DeleteFileA
ReleaseMutex
CreateMutexA
VirtualProtect
GetModuleFileNameA
GlobalFree
lstrlenA
GetPrivateProfileStringA
GetStdHandle
MoveFileA
FlushProcessWriteBuffers
CreateSemaphoreExW
CreateEventExW
InitOnceExecuteOnce
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
ReadProcessMemory
OpenProcess
CreateThread
TerminateProcess
Sleep
Module32Next
Module32First
CreateToolhelp32Snapshot
LoadLibraryExA
GetProcAddress
GetModuleHandleA
FreeLibrary
GetCurrentProcessId
GetCurrentProcess
GetProcessHeap
SetFileInformationByHandle
SleepConditionVariableSRW
SleepConditionVariableCS
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
TryEnterCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
QueryPerformanceFrequency
LCMapStringEx
DecodePointer
EncodePointer
LocalFree
InitializeCriticalSectionEx
GetStringTypeW
GetNativeSystemInfo
GetExitCodeThread
GetCurrentThreadId
SwitchToThread
WaitForSingleObjectEx
FormatMessageA
QueryPerformanceCounter
CopyFileA
CreateSemaphoreA
ReleaseSemaphore
GetLocaleInfoA
CompareStringA
WideCharToMultiByte
lstrlenW
GlobalLock
GlobalUnlock
GetVersionExA
GetSystemDirectoryA
WriteFile
SetFilePointer
ReadFile
WinExec
GetCurrentThread
SetUnhandledExceptionFilter
GetFileSize
CreateFileA
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
OutputDebugStringA
GetTempFileNameA
GetTempPathA
RemoveDirectoryA
CreateDirectoryA
AllocConsole
GlobalAlloc
HeapFree
HeapAlloc
GetLastError
LoadLibraryExW
CloseHandle
user32
SetFocus
UpdateWindow
GetWindowLongA
SetWindowLongA
CharNextExA
CharPrevExA
RegisterClassA
GetMenu
SetWindowTextA
GetWindowRect
AdjustWindowRectEx
LoadCursorA
GetMessageA
TranslateMessage
DispatchMessageA
GetKeyboardLayoutNameA
GetKeyboardLayout
OpenClipboard
CloseClipboard
IsWindow
ShowWindow
GetClipboardData
CharNextW
MoveWindow
SetCursorPos
LoadImageA
DestroyCursor
SetCursor
ShowCursor
GetKeyState
SystemParametersInfoA
LoadIconA
ScreenToClient
GetCursorPos
GetAsyncKeyState
SetWindowPos
FlashWindowEx
PostQuitMessage
WindowFromPoint
GetWindowTextA
FindWindowA
FindWindowExA
PostMessageA
SendMessageA
MessageBoxA
DefWindowProcA
UnregisterClassA
RegisterClassExA
ClientToScreen
GetCapture
CreateWindowExA
SetCapture
ReleaseCapture
ChangeDisplaySettingsA
GetSystemMetrics
PeekMessageA
GetDC
ReleaseDC
BeginPaint
EndPaint
InvalidateRect
GetClientRect
FillRect
SetRect
OffsetRect
LoadStringA
DestroyWindow
gdi32
GetCharABCWidthsFloatW
EnumFontFamiliesExA
SelectObject
SetBkColor
SetTextColor
TextOutW
CreateCompatibleDC
DeleteDC
SetBkMode
SetDIBitsToDevice
CreateDIBSection
TextOutA
CreateSolidBrush
DeleteObject
PatBlt
GetStockObject
StretchBlt
GetTextExtentPoint32W
CreateFontIndirectA
GetTextExtentPoint32A
advapi32
AddAccessDeniedAce
RegOpenKeyA
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegOpenKeyExA
RegCloseKey
OpenProcessToken
AddAccessAllowedAce
RegQueryValueExA
AllocateAndInitializeSid
FreeSid
GetLengthSid
GetTokenInformation
InitializeAcl
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityInfo
shell32
SHGetSpecialFolderPathA
ShellExecuteA
ole32
OleUninitialize
OleInitialize
CoGetClassObject
OleSetContainedObject
CoCreateInstance
CoInitialize
CoUninitialize
CoInitializeEx
winmm
timeEndPeriod
timeGetTime
timeBeginPeriod
timeGetDevCaps
d3d8
Direct3DCreate8
python27
_Py_EllipsisObject
PyExc_StopIteration
PyExc_EOFError
PyExc_ValueError
PyFloat_FromDouble
_PyLong_FromByteArray
PyUnicodeUCS2_DecodeUTF8
PyCode_Type
Py_OptimizeFlag
PyMarshal_ReadObjectFromString
PyCode_New
PyEval_GetRestricted
PyErr_NoMemory
PyComplex_FromCComplex
PyEval_EvalCode
PyCode_Addr2Line
PyObject_AsCharBuffer
PyImport_AddModule
PyImport_GetMagicNumber
Py_FlushLine
PyEval_SetTrace
Py_BuildValue
Py_InitModule4
PyModule_AddIntConstant
PyLong_AsLong
PyErr_Occurred
PyTuple_GetItem
PyDict_GetItemString
PyArg_ParseTuple
PyInt_FromLong
PyLong_FromLongLong
PyList_New
PyList_Append
PyInt_AsLong
PyDict_Next
PyDict_Size
PyErr_SetString
PyExc_RuntimeError
PyString_FromString
PyTuple_New
PyTuple_SetItem
PyModule_AddStringConstant
PyImport_ImportModule
PyString_InternFromString
PyObject_GetAttrString
PyObject_GetAttr
PyCallable_Check
PyLong_AsLongLong
PyFloat_AsDouble
PyString_AsString
PyErr_Clear
PyErr_BadArgument
PyErr_Print
PyObject_CallObject
PyNumber_Check
_Py_NoneStruct
PyDict_SetItem
PyDict_New
PyList_SetItem
PyTuple_Size
PyString_FromStringAndSize
PyDict_SetItemString
PyModule_GetDict
PyErr_Fetch
Py_SetProgramName
Py_Initialize
Py_Finalize
_PyLong_New
PyRun_StringFlags
imm32
ImmGetOpenStatus
ImmSetConversionStatus
ImmGetConversionStatus
ImmGetCandidateListW
ImmSetCompositionStringW
ImmGetCompositionStringW
ImmAssociateContext
ImmReleaseContext
ImmGetContext
ImmIsIME
ImmGetIMEFileNameA
ImmNotifyIME
version
VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
imagehlp
GetTimestampForLoadedLibrary
EnumerateLoadedModules
StackWalk
devil
ilGetInteger
ilLoad
ilConvertImage
ilCopyPixels
ilEnable
ilOriginFunc
ilShutDown
ilSave
ilDeleteImages
ilInit
ilTexImage
ilSetPixels
ilBindImage
ilGenImages
granny2
_GrannyGetTotalTypeSize@4
_GrannyGetWorldPoseComposite4x4@8
_GrannyGetWorldPose4x4@8
_GrannyFreeWorldPose@4
_GrannyNewWorldPose@4
_GrannyFindBoneByName@12
_GrannyGetMeshBindingToBoneIndices@4
_GrannyFreeMeshBinding@4
_GrannyNewMeshBinding@12
_GrannyFreeModelInstance@4
_GrannyInstantiateModel@4
_GrannyGetWorldPoseComposite4x4Array@4
_GrannyFreeLocalPose@4
_GrannyNewLocalPose@4
_GrannyUpdateModelMatrix@20
_GrannySampleModelAnimationsAccelerated@20
_GrannyFreeCompletedModelControls@4
_GrannySetModelClock@8
_GrannyGetSourceSkeleton@4
_GrannyConvertSingleObject@20
_GrannyFindMatchingMember@16
_GrannyGetMaterialTextureByType@8
_GrannyGetFileInfo@4
_GrannyFreeFile@4
_GrannyFreeFileSection@8
_GrannyReadEntireFileFromMemory@8
_GrannySetLogCallback@4
_GrannyGetMeshVertexCount@4
_GrannyMeshIsRigid@4
_GrannyGetMeshIndexCount@4
_GrannyGetSourceModel@4
_GrannyFindTrackGroupForModel@12
_GrannyFreeControl@4
_GrannyFreeControlOnceUnused@4
_GrannyCompleteControlAt@8
_GrannyControlIsComplete@4
_GrannyFreeControlIfComplete@4
_GrannyGetControlLoopCount@4
_GrannySetControlLoopCount@8
_GrannyGetControlSpeed@4
_GrannySetControlSpeed@8
_GrannyGetControlLocalDuration@4
_GrannySetControlEaseIn@8
_GrannySetControlEaseInCurve@28
_GrannySetControlEaseOut@8
_GrannySetControlEaseOutCurve@28
_GrannyGetControlRawLocalClock@4
_GrannySetControlRawLocalClock@8
_GrannyPlayControlledAnimation@12
_GrannyBeginControlledAnimation@8
_GrannyEndControlledAnimation@4
_GrannySetTrackGroupTarget@12
_GrannySetTrackGroupLOD@16
_GrannyGetMeshTriangleGroupCount@4
_GrannyGetMeshTriangleGroups@4
_GrannyGetMeshVertexType@4
_GrannyCopyMeshVertices@12
_GrannyGetMeshVertices@4
GrannyPNT332VertexType
_GrannyDeformVertices@24
_GrannyFreeMeshDeformer@4
_GrannyNewMeshDeformer@16
_GrannyCopyMeshIndices@12
mss32
_AIL_decompress_ADPCM@12
_AIL_file_type@8
_AIL_open_digital_driver@16
_AIL_open_stream@12
_AIL_close_digital_driver@4
_AIL_enumerate_3D_providers@12
_AIL_open_3D_provider@4
_AIL_close_3D_provider@4
_AIL_open_3D_listener@4
_AIL_close_3D_listener@4
_AIL_set_3D_position@16
_AIL_set_3D_velocity@20
_AIL_set_3D_orientation@28
_AIL_startup@0
_AIL_shutdown@0
_AIL_set_redist_directory@4
_AIL_close_stream@4
_AIL_start_stream@4
_AIL_pause_stream@8
_AIL_set_stream_volume_levels@12
_AIL_stream_volume_levels@12
_AIL_set_stream_loop_count@8
_AIL_stream_status@4
_AIL_WAV_info@8
_AIL_allocate_sample_handle@4
_AIL_release_sample_handle@4
_AIL_init_sample@4
_AIL_set_sample_file@12
_AIL_stop_sample@4
_AIL_resume_sample@4
_AIL_end_sample@4
_AIL_set_sample_volume_pan@12
_AIL_set_sample_loop_count@8
_AIL_sample_status@4
_AIL_sample_volume_pan@12
_AIL_allocate_3D_sample_handle@4
_AIL_release_3D_sample_handle@4
_AIL_start_3D_sample@4
_AIL_stop_3D_sample@4
_AIL_resume_3D_sample@4
_AIL_end_3D_sample@4
_AIL_set_3D_sample_file@8
_AIL_set_3D_sample_volume@8
_AIL_set_3D_sample_loop_count@8
_AIL_3D_sample_status@4
_AIL_3D_sample_volume@4
_AIL_update_3D_position@8
_AIL_auto_update_3D_position@8
_AIL_decompress_ASI@24
_AIL_set_file_callbacks@16
_AIL_file_read@8
_AIL_last_error@0
_AIL_start_sample@4
_AIL_mem_free_lock@4
speedtreert
?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z
?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ
?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z
?GetCurrentError@CSpeedTreeRT@@SAPBDXZ
?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z
?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z
?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z
?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ
?SetLodLimits@CSpeedTreeRT@@QAEXMM@Z
?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z
?SetLodLevel@CSpeedTreeRT@@QAEXM@Z
?ComputeLodLevel@CSpeedTreeRT@@QAEXXZ
?SetLocalMatrices@CSpeedTreeRT@@QAEXII@Z
?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z
?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z
?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetLeafLightingAdjustment@CSpeedTreeRT@@QBEMXZ
?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z
?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z
?GetTreeSize@CSpeedTreeRT@@QBEXAAM0@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z
?DeleteTransientData@CSpeedTreeRT@@QAEXXZ
?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ
?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z
??3CSpeedTreeRT@@SAXPAX@Z
??2CSpeedTreeRT@@SAPAXI@Z
??1CSpeedTreeRT@@QAE@XZ
??0CSpeedTreeRT@@QAE@XZ
??1STextures@CSpeedTreeRT@@QAE@XZ
??0STextures@CSpeedTreeRT@@QAE@XZ
??1SGeometry@CSpeedTreeRT@@QAE@XZ
??0SGeometry@CSpeedTreeRT@@QAE@XZ
?SetCamera@CSpeedTreeRT@@SAXPBM0@Z
?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z
?SetLightState@CSpeedTreeRT@@SAXI_N@Z
?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z
?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z
?SetTime@CSpeedTreeRT@@SAXM@Z
?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ
dinput8
DirectInput8Create
ws2_32
inet_addr
htons
htonl
ntohs
WSAStartup
WSAGetLastError
socket
send
select
recv
ioctlsocket
connect
closesocket
ntohl
gethostname
WSACleanup
gethostbyname
__WSAFDIsSet
ddraw
DirectDrawCreate
bcrypt
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
BCryptGenRandom
oleaut32
SysAllocString
SafeArrayCreate
SafeArrayDestroy
SafeArrayAccessData
VariantInit
SysFreeString
VariantClear
Sections
.text Size: 4.3MB - Virtual size: 4.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 717KB - Virtual size: 717KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 192KB - Virtual size: 687KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 637KB - Virtual size: 636KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 190KB - Virtual size: 189KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ