e156527fc26fade83e0113164c251b4b3d005bbaec601aa029bd21a63725d1d2

Sharing

Copy URL

Twitter E-mail

General

Target

e156527fc26fade83e0113164c251b4b3d005bbaec601aa029bd21a63725d1d2
Size

3.6MB
MD5

0ccac0cac04689fcf8743c9a1fc1fb6c
SHA1

8316c9f442de495b0de7211a899b4bdaea7045ff
SHA256

e156527fc26fade83e0113164c251b4b3d005bbaec601aa029bd21a63725d1d2
SHA512

d071c500f55bf545cde8652d6d0039dddcbdae9971607fdfa1ccdcca5e2b0df887a0f9472d9414d3f061039d1cadb0e32b9d05019e910442c5d2aa8a93b43355
SSDEEP

49152:7Z5Nq4uTyJwTjFQ0XL+P9RZAczVmL2u3AhImHZFoJ5oHbeZVZRmQhIK2PI:rw6wTprXLc9RXBmL2uQmQnwIK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e156527fc26fade83e0113164c251b4b3d005bbaec601aa029bd21a63725d1d2

Files

e156527fc26fade83e0113164c251b4b3d005bbaec601aa029bd21a63725d1d2
.exe windows:6 windows x86 arch:x86

cb3de9f492654882e230e317399f6879

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindNextFileA
FindFirstFileA
GetFileAttributesExA
SetFileAttributesA
InitializeCriticalSection
LeaveCriticalSection
WriteConsoleW
SetEndOfFile
HeapSize
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
HeapReAlloc
SetStdHandle
GetTimeZoneInformation
CreateProcessW
GetExitCodeProcess
MoveFileExW
DeleteFileW
GetFileAttributesExW
FlushFileBuffers
CreateDirectoryW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
SetFilePointerEx
FileTimeToSystemTime
FindClose
GetFileInformationByHandle
ExitProcess
GetFullPathNameW
GetDriveTypeW
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
LoadLibraryExW
TlsFree
TlsSetValue
EnterCriticalSection
TlsAlloc
RaiseException
InterlockedPushEntrySList
RtlUnwind
GetFileSizeEx
VerifyVersionInfoA
VerSetConditionMask
FormatMessageW
SetLastError
WaitForMultipleObjects
GetFileType
GetStdHandle
GetEnvironmentVariableA
MoveFileExA
SleepEx
GetModuleFileNameW
WaitNamedPipeW
PeekNamedPipe
GetStartupInfoW
IsDebuggerPresent
CreateFileA
DeviceIoControl
HeapAlloc
GetProcessHeap
HeapFree
SetUnhandledExceptionFilter
MoveFileA
GetCurrentDirectoryA
lstrlenA
GetPrivateProfileStringA
DeleteFileA
DeleteCriticalSection
WaitForSingleObject
SetEvent
Sleep
GetSystemInfo
GetLastError
ReadProcessMemory
GetCurrentProcess
Module32Next
CloseHandle
Module32First
GetCurrentProcessId
GetModuleFileNameA
SystemTimeToTzSpecificLocalTime
GlobalFree
InitializeSListHead
TerminateProcess
UnhandledExceptionFilter
CreateEventW
ResetEvent
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetModuleHandleW
GetSystemTimeAsFileTime
SleepConditionVariableSRW
SleepConditionVariableCS
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
TryEnterCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
LCMapStringEx
InitializeCriticalSectionEx
DecodePointer
EncodePointer
QueryPerformanceFrequency
GetStringTypeW
GetExitCodeThread
WaitForSingleObjectEx
CreateFileW
IsProcessorFeaturePresent
HeapValidate
QueryPerformanceCounter
ReleaseSemaphore
GetLocaleInfoA
CompareStringA
WideCharToMultiByte
lstrlenW
GlobalLock
GlobalUnlock
FreeLibrary
GetVersionExA
GetSystemDirectoryA
GetModuleHandleA
WriteFile
ReadFile
OutputDebugStringA
LoadLibraryA
GetProcAddress
GetCurrentThreadId
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
GetFileSize
GlobalAlloc
CreateDirectoryA
CreateToolhelp32Snapshot
GetTickCount
GetCurrentDirectoryW
TlsGetValue
MultiByteToWideChar

user32

ScreenToClient
FindWindowA
DefWindowProcA
RegisterClassA
CreateWindowExA
IsWindow
DestroyWindow
MoveWindow
GetMenu
AdjustWindowRectEx
GetWindowLongA
SetWindowLongA
LoadCursorA
GetMessageA
TranslateMessage
DispatchMessageA
GetKeyboardLayoutNameA
GetKeyboardLayout
OpenClipboard
CloseClipboard
GetClipboardData
CharNextW
CharNextExA
CharPrevExA
MonitorFromPoint
GetMonitorInfoA
LoadStringA
ReleaseCapture
GetSystemMetrics
GetCapture
ShowWindow
ChangeDisplaySettingsA
LoadIconA
SetCapture
SetCursorPos
SetCursor
ShowCursor
DestroyCursor
LoadImageA
GetKeyState
FlashWindowEx
SetWindowTextA
SystemParametersInfoA
SetWindowPos
GetCursorPos
PostQuitMessage
GetAsyncKeyState
SetRect
OffsetRect
GetClientRect
ClientToScreen
PeekMessageA
ReleaseDC
FillRect
GetDC
InvalidateRect
MessageBoxA

gdi32

CreateFontIndirectA
GetCharABCWidthsFloatW
GetStockObject
GetTextExtentPoint32A
GetTextExtentPoint32W
SelectObject
SetBkColor
SetTextColor
TextOutW
CreateCompatibleDC
DeleteDC
SetBkMode
StretchBlt
DeleteObject
GetDeviceCaps
TextOutA
CreateDIBSection
EnumFontFamiliesExA
CreateSolidBrush
GetPixel

advapi32

RegOpenKeyExA
RegQueryValueExA
RegQueryValueExW
RegOpenKeyExW
RegOpenKeyA
RegSetValueExW
RegCreateKeyExW
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptGenRandom
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptEncrypt
RegCloseKey

shell32

SHGetSpecialFolderPathA
ShellExecuteA

ole32

CoInitialize
CoUninitialize
CoCreateInstance
CoInitializeEx

winmm

timeGetTime
timeGetDevCaps
timeEndPeriod
timeBeginPeriod

d3d8

Direct3DCreate8

python27

PyErr_SetString
PyExc_RuntimeError
PyLong_FromLongLong
PyList_New
PyString_FromString
PyList_Append
PyModule_AddIntConstant
PyTuple_Size
PyTuple_GetItem
PyDict_GetItemString
PyLong_AsLong
PyTuple_New
PyDict_New
PyDict_SetItemString
PyTuple_SetItem
Py_BuildValue
PyList_SetItem
PyArg_ParseTuple
PyInt_FromLong
PyEval_MergeCompilerFlags
PyString_FromStringAndSize
PyExc_TypeError
Py_CompileStringFlags
PyObject_CallFunction
PyDict_Size
PyDict_Next
PyInt_AsLong
PyString_AsString
PyObject_GetAttrString
PyDict_SetItem
PyImport_ImportModule
PyModule_AddStringConstant
PyString_InternFromString
Py_InitModule4
PyCallable_Check
PyLong_AsLongLong
PyFloat_AsDouble
PyErr_Clear
PyErr_BadArgument
PyErr_Print
PyObject_CallObject
PyNumber_Check
_Py_NoneStruct
PyModule_GetDict
PyErr_Fetch
Py_SetProgramName
Py_Initialize
Py_Finalize
PyRun_StringFlags
PyImport_AddModule
PyObject_GetAttr

imm32

ImmIsIME
ImmGetContext
ImmNotifyIME
ImmGetOpenStatus
ImmSetConversionStatus
ImmGetConversionStatus
ImmGetCandidateListW
ImmGetIMEFileNameA
ImmSetCompositionStringW
ImmGetCompositionStringW
ImmAssociateContext
ImmReleaseContext

devil

ilInit
ilSetPixels
ilTexImage
ilSave
ilShutDown
ilDeleteImages
ilCopyPixels
ilConvertImage
ilGetInteger
ilLoad
ilOriginFunc
ilEnable
ilBindImage
ilGenImages

iphlpapi

GetPerAdapterInfo
GetAdaptersInfo

ws2_32

recvfrom
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
freeaddrinfo
getaddrinfo
listen
accept
WSAIoctl
WSASetLastError
setsockopt
getsockopt
getsockname
getpeername
bind
sendto
__WSAFDIsSet
closesocket
connect
ioctlsocket
recv
select
gethostname
gethostbyname
ntohs
ntohl
inet_addr
htons
htonl
WSACleanup
WSAStartup
WSAGetLastError
socket
send

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

granny2

_GrannyGetControlLocalDuration@4
_GrannySetControlSpeed@8
_GrannyGetMaterialTextureByType@8
_GrannySetControlEaseOutCurve@28
_GrannyGetControlRawLocalClock@4
_GrannySetControlRawLocalClock@8
_GrannyFindMatchingMember@16
_GrannyConvertSingleObject@20
_GrannyReadEntireFileFromMemory@8
_GrannyFreeFileSection@8
_GrannyFreeFile@4
_GrannyGetFileInfo@4
_GrannyGetSourceSkeleton@4
_GrannySetModelClock@8
_GrannyFreeCompletedModelControls@4
_GrannySampleModelAnimationsAccelerated@20
_GrannyUpdateModelMatrix@20
_GrannyNewLocalPose@4
_GrannyFreeLocalPose@4
_GrannyGetWorldPoseComposite4x4Array@4
_GrannyInstantiateModel@4
_GrannyFreeModelInstance@4
_GrannyNewMeshBinding@12
_GrannyFreeMeshBinding@4
_GrannyGetMeshBindingToBoneIndices@4
_GrannyFindBoneByName@12
_GrannyNewWorldPose@4
_GrannyFreeWorldPose@4
_GrannySetControlEaseOut@8
_GrannyGetWorldPoseComposite4x4@8
_GrannyGetTotalTypeSize@4
_GrannyGetMeshVertexCount@4
_GrannyMeshIsRigid@4
_GrannyGetMeshIndexCount@4
_GrannyGetSourceModel@4
_GrannyFindTrackGroupForModel@12
_GrannyFreeControl@4
_GrannyFreeControlOnceUnused@4
_GrannyCompleteControlAt@8
_GrannyControlIsComplete@4
_GrannyFreeControlIfComplete@4
_GrannyGetControlLoopCount@4
_GrannyPlayControlledAnimation@12
_GrannyBeginControlledAnimation@8
_GrannyEndControlledAnimation@4
_GrannySetTrackGroupTarget@12
_GrannySetTrackGroupLOD@16
_GrannyGetMeshTriangleGroupCount@4
_GrannyGetMeshTriangleGroups@4
_GrannyGetMeshVertexType@4
_GrannyCopyMeshVertices@12
_GrannyGetMeshVertices@4
_GrannyCopyMeshIndices@12
_GrannyNewMeshDeformer@16
_GrannyFreeMeshDeformer@4
_GrannyDeformVertices@24
GrannyPNT332VertexType
_GrannySetControlEaseIn@8
_GrannyGetWorldPose4x4@8
_GrannySetControlLoopCount@8
_GrannyGetControlSpeed@4
_GrannySetControlEaseInCurve@28

mss32

_AIL_auto_update_3D_position@8
_AIL_mem_free_lock@4
_AIL_file_read@8
_AIL_set_file_callbacks@16
_AIL_WAV_info@8
_AIL_decompress_ASI@24
_AIL_decompress_ADPCM@12
_AIL_file_type@8
_AIL_open_digital_driver@16
_AIL_open_stream@12
_AIL_close_digital_driver@4
_AIL_enumerate_3D_providers@12
_AIL_open_3D_provider@4
_AIL_close_3D_provider@4
_AIL_open_3D_listener@4
_AIL_close_3D_listener@4
_AIL_set_3D_position@16
_AIL_3D_sample_volume@4
_AIL_3D_sample_status@4
_AIL_set_3D_sample_loop_count@8
_AIL_set_3D_sample_volume@8
_AIL_set_3D_sample_file@8
_AIL_end_3D_sample@4
_AIL_resume_3D_sample@4
_AIL_stop_3D_sample@4
_AIL_start_3D_sample@4
_AIL_release_3D_sample_handle@4
_AIL_allocate_3D_sample_handle@4
_AIL_sample_volume_pan@12
_AIL_sample_status@4
_AIL_set_sample_loop_count@8
_AIL_set_sample_volume_pan@12
_AIL_end_sample@4
_AIL_resume_sample@4
_AIL_stop_sample@4
_AIL_start_sample@4
_AIL_set_sample_file@12
_AIL_init_sample@4
_AIL_release_sample_handle@4
_AIL_allocate_sample_handle@4
_AIL_last_error@0
_AIL_stream_status@4
_AIL_set_stream_loop_count@8
_AIL_stream_volume_levels@12
_AIL_set_stream_volume_levels@12
_AIL_pause_stream@8
_AIL_start_stream@4
_AIL_close_stream@4
_AIL_set_redist_directory@4
_AIL_shutdown@0
_AIL_startup@0
_AIL_set_3D_orientation@28
_AIL_set_3D_velocity@20

speedtreert

?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z
?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ
?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z
?GetCurrentError@CSpeedTreeRT@@SAPBDXZ
?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z
?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z
?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z
?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ
?SetLodLimits@CSpeedTreeRT@@QAEXMM@Z
?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z
?SetLodLevel@CSpeedTreeRT@@QAEXM@Z
?ComputeLodLevel@CSpeedTreeRT@@QAEXXZ
?SetLocalMatrices@CSpeedTreeRT@@QAEXII@Z
?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z
?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z
?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ
?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z
?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ
?SetTime@CSpeedTreeRT@@SAXM@Z
?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z
?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z
?SetLightState@CSpeedTreeRT@@SAXI_N@Z
?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z
?SetCamera@CSpeedTreeRT@@SAXPBM0@Z
??0SGeometry@CSpeedTreeRT@@QAE@XZ
??1SGeometry@CSpeedTreeRT@@QAE@XZ
??0STextures@CSpeedTreeRT@@QAE@XZ
??1STextures@CSpeedTreeRT@@QAE@XZ
??0CSpeedTreeRT@@QAE@XZ
??1CSpeedTreeRT@@QAE@XZ
??2CSpeedTreeRT@@SAPAXI@Z
??3CSpeedTreeRT@@SAXPAX@Z
?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z
?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ
?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z
?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z

dinput8

DirectInput8Create

ddraw

DirectDrawCreate

oleaut32

SysFreeString
VariantClear

crypt32

CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CryptStringToBinaryA
PFXImportCertStore
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertCloseStore
CertFreeCertificateChain
CertOpenStore

wldap32

ord301
ord200
ord30
ord79
ord35
ord33
ord32
ord27
ord26
ord22
ord41
ord50
ord45
ord60
ord211
ord46
ord217
ord143

normaliz

IdnToAscii

Exports

Exports

AmdPowerXpressRequestHighPerformance
LZ4_compress
LZ4_compressBound
LZ4_compress_continue
LZ4_compress_default
LZ4_compress_destSize
LZ4_compress_fast
LZ4_compress_fast_continue
LZ4_compress_fast_extState
LZ4_compress_limitedOutput
LZ4_compress_limitedOutput_continue
LZ4_compress_limitedOutput_withState
LZ4_compress_withState
LZ4_create
LZ4_createStream
LZ4_createStreamDecode
LZ4_decoderRingBufferSize
LZ4_decompress_fast
LZ4_decompress_fast_continue
LZ4_decompress_fast_usingDict
LZ4_decompress_fast_withPrefix64k
LZ4_decompress_safe
LZ4_decompress_safe_continue
LZ4_decompress_safe_partial
LZ4_decompress_safe_usingDict
LZ4_decompress_safe_withPrefix64k
LZ4_freeStream
LZ4_freeStreamDecode
LZ4_initStream
LZ4_loadDict
LZ4_resetStream
LZ4_resetStreamState
LZ4_resetStream_fast
LZ4_saveDict
LZ4_setStreamDecode
LZ4_sizeofState
LZ4_sizeofStreamState
LZ4_slideInputBuffer
LZ4_uncompress
LZ4_uncompress_unknownOutputSize
LZ4_versionNumber
LZ4_versionString
NvOptimusEnablement

Sections

.text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 457KB - Virtual size: 457KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 164KB - Virtual size: 659KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data1
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 223KB - Virtual size: 223KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 129KB - Virtual size: 129KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cb3de9f492654882e230e317399f6879

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

winmm

d3d8

python27

imm32

devil

iphlpapi

ws2_32

version

granny2

mss32

speedtreert

dinput8

ddraw

oleaut32

crypt32

wldap32

normaliz

Exports

Exports

Sections

.text Size: 2.6MB - Virtual size: 2.6MB

.rdata Size: 457KB - Virtual size: 457KB

.data Size: 164KB - Virtual size: 659KB

.data1 Size: 2KB - Virtual size: 2KB

.rsrc Size: 223KB - Virtual size: 223KB

.reloc Size: 129KB - Virtual size: 129KB

.text
Size: 2.6MB - Virtual size: 2.6MB

.rdata
Size: 457KB - Virtual size: 457KB

.data
Size: 164KB - Virtual size: 659KB

.data1
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 223KB - Virtual size: 223KB

.reloc
Size: 129KB - Virtual size: 129KB