GrandCutieAnal[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

GrandCutieAnal.exe
Size

8.1MB
MD5

1a0582a6199e32221cd4605123fed3ee
SHA1

1f884108484edbdf01a87c053c58a934548e84d9
SHA256

1e5a3555baae94fe22a3c8d40465810ebc3762181e95aa31014ac3ce033c0357
SHA512

a446d987d6062cbe8aa1e52080c2accaa499a6dee44896492a1e00a3f5fd621e96225d70e53e29c9acc18d190000a729a4b796b24a4749983e27b76acc0ca93a
SSDEEP

196608:LcM313/Lknpk+1Ej3GDlz9bCJjtgHs/T0qE9jB1UmTmKaLUGJ0+uryaKgrIXWxE5:LcMF3TMpk+1Ej3GDlBbCJjtgHs/To0K0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
GrandCutieAnal.exe

Files

GrandCutieAnal.exe
.exe windows:5 windows x86 arch:x86

ef57bb30b2b67456e1b0654362fd255a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\BuildAgent\work\842f9557127e852\build\WindowsStandalonePlayer\UnityPlayer_Symbols.pdb

Imports

kernel32

GlobalMemoryStatusEx
GetUserDefaultLangID
GetTempPathW
SetThreadAffinityMask
GetCurrentThread
GetProcessAffinityMask
MultiByteToWideChar
SetUnhandledExceptionFilter
OutputDebugStringA
FormatMessageA
SetLastError
GetEnvironmentVariableA
GetFileAttributesA
GetModuleFileNameA
GetCurrentDirectoryA
ResumeThread
GetThreadContext
SuspendThread
IsBadReadPtr
GetTickCount
Sleep
CreateEventA
CopyFileW
MoveFileExW
FileTimeToDosDateTime
FileTimeToLocalFileTime
lstrlenA
RaiseException
GetFileTime
VirtualQuery
GlobalMemoryStatus
GetSystemTimeAsFileTime
CreateProcessW
IsDebuggerPresent
SetErrorMode
WritePrivateProfileStringW
HeapValidate
TerminateThread
WaitForMultipleObjects
WideCharToMultiByte
GlobalAlloc
GlobalLock
GlobalUnlock
FindFirstFileW
FindNextFileW
RemoveDirectoryW
DeleteFileW
GetConsoleOutputCP
WriteConsoleA
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
GetProcessHeap
SetStdHandle
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
FindClose
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
InitializeCriticalSectionAndSpinCount
FlushFileBuffers
GetConsoleCP
SetHandleCount
IsValidCodePage
GetOEMCP
GetACP
HeapSize
HeapCreate
GetCPInfo
LCMapStringW
LCMapStringA
GetTimeZoneInformation
GetSystemInfo
SetConsoleMode
ReadConsoleInputA
SetConsoleCtrlHandler
GetDriveTypeA
PeekNamedPipe
GetFileInformationByHandle
FileTimeToSystemTime
ExitThread
WriteConsoleW
GetStartupInfoA
GetCommandLineA
UnhandledExceptionFilter
TerminateProcess
ExitProcess
HeapReAlloc
RtlUnwind
HeapFree
HeapAlloc
InterlockedDecrement
InterlockedIncrement
CreateSemaphoreW
CreateMutexW
GetModuleHandleW
SignalObjectAndWait
GetThreadLocale
FlushConsoleInputBuffer
FindFirstFileA
GetStdHandle
GetFileType
GetVersion
GetSystemDirectoryA
CreateWaitableTimerA
SetWaitableTimer
SetEvent
ResetEvent
OpenEventA
VirtualAlloc
WriteFile
GetFileAttributesW
SetFileAttributesW
GetFileSize
GetLastError
ReadFile
CreateFileW
SetEndOfFile
SetFilePointer
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
GetCurrentThreadId
SleepEx
CreateThread
SetThreadPriority
ReleaseMutex
CreateMutexA
TryEnterCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
QueryPerformanceFrequency
QueryPerformanceCounter
GetCurrentProcess
GetFullPathNameW
ReleaseSemaphore
WaitForSingleObject
CloseHandle
CreateSemaphoreA
LoadLibraryA
GetProcAddress
FreeLibrary
VirtualFree
UnmapViewOfFile
CreateFileA
CreateFileMappingA
MapViewOfFile
lstrcmpiA
GetFullPathNameA
InterlockedExchange
InterlockedCompareExchange
GetVersionExA
GetModuleHandleA
ExpandEnvironmentStringsA
CreateEventW
CancelIo
GetOverlappedResult
GetCommandLineW
LocalFree
lstrcpynW
lstrcpyA
lstrcpynA
GetModuleFileNameW
LoadLibraryW
lstrlenW
GetConsoleMode
GetCurrentProcessId
GetEnvironmentStringsW
CreateDirectoryW
HeapWalk

user32

CloseClipboard
EmptyClipboard
OpenClipboard
GetClipboardData
IsClipboardFormatAvailable
GetWindowThreadProcessId
GetAncestor
GetProcessWindowStation
GetUserObjectInformationW
SetCapture
ReleaseCapture
SystemParametersInfoW
ClientToScreen
DefWindowProcW
DestroyWindow
ReleaseDC
GetDC
SetClipboardData
ScreenToClient
GetAsyncKeyState
GetKeyState
wsprintfA
SendMessageTimeoutA
EnumWindows
SendMessageA
SetForegroundWindow
ShowWindow
IsIconic
RegisterWindowMessageA
GetUserObjectInformationA
GetThreadDesktop
GetParent
GetWindowRect
GetWindowLongA
SetWindowPos
GetClientRect
CreateDialogParamA
SetWindowLongA
GetDlgItem
ChangeDisplaySettingsA
MessageBoxW
GetCursorPos
WindowFromPoint
CreateWindowExW
wvsprintfA
MonitorFromWindow
EnumDisplayDevicesA
GetCaretBlinkTime
PeekMessageA
DispatchMessageA
GetMessageA
ValidateRect
LoadImageA
DialogBoxParamA
IsDlgButtonChecked
CheckDlgButton
CreateDialogParamW
EnableWindow
PeekMessageW
IsDialogMessageW
TranslateMessage
DispatchMessageW
MsgWaitForMultipleObjects
SetWindowTextW
RegisterClassW
PostQuitMessage
SetWindowLongW
GetWindowLongW
SetFocus
SetCursorPos
ClipCursor
ShowCursor
GetFocus
LoadCursorA
RegisterClassExW
DialogBoxParamW
EndDialog
LoadIconA
SendDlgItemMessageW
SetDlgItemTextA
SetDlgItemTextW
MessageBoxA
CopyRect
OffsetRect
UnregisterClassW
GetDesktopWindow
EnumDisplaySettingsA
AdjustWindowRectEx
GetSystemMetrics

gdi32

GetDeviceCaps
ChoosePixelFormat
GetObjectA
GetObjectW
GetGlyphOutlineW
AddFontMemResourceEx
CreateCompatibleDC
GetFontUnicodeRanges
SetBkMode
SetTextAlign
SetTextColor
CreateFontIndirectW
SelectObject
GetTextFaceW
EnumFontFamiliesExW
DeleteDC
DeleteObject
RemoveFontMemResourceEx
SwapBuffers
GetBitmapBits
BitBlt
CreateCompatibleBitmap
CreateDCA
SetPixelFormat

advapi32

RegisterEventSourceA
CryptImportKey
CryptVerifySignatureA
CryptDestroyKey
RegDeleteValueA
GetUserNameA
RegCreateKeyA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
CryptAcquireContextA
CryptCreateHash
CryptReleaseContext
CryptHashData
CryptDestroyHash
CryptGetHashParam
ReportEventA
DeregisterEventSource

shell32

ShellExecuteW
SHGetFolderPathW
CommandLineToArgvW

ole32

CoUninitialize
CoInitialize
CoSetProxyBlanket
CoTaskMemAlloc
CoTaskMemFree
PropVariantClear
CoCreateInstance
CoCreateGuid

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
GetFileVersionInfoW
GetFileVersionInfoSizeW

opengl32

glDepthMask
glDepthFunc
glStencilMask
glStencilOp
glStencilFunc
glClear
glClearStencil
glClearDepth
glClearColor
glFrontFace
glLoadMatrixf
glMatrixMode
glMultMatrixf
glGetFloatv
glColorMaterial
glLightModeli
glMaterialf
glMaterialfv
glColor4fv
glViewport
glScissor
glBindTexture
glTexGenfv
glTexGeni
glLightfv
glLightf
glLightModelfv
glFogfv
glFogf
glFogi
glIsTexture
glDeleteTextures
glFinish
glVertex3f
glCullFace
glColor4f
glTexCoord3f
glBegin
glEnd
glReadPixels
glLoadIdentity
glLightModelf
glHint
glTexEnvfv
glTexParameteri
wglDeleteContext
glGenTextures
glTexImage2D
glDrawArrays
glReadBuffer
glDrawBuffer
glCopyTexSubImage2D
glPixelStorei
glTexSubImage2D
glVertexPointer
glNormalPointer
glPolygonOffset
glColorMask
glDisable
glBlendFunc
glAlphaFunc
glTexEnvi
glTexEnvf
glDisableClientState
wglCreateContext
wglMakeCurrent
glGetIntegerv
glEnable
wglGetCurrentContext
wglGetCurrentDC
wglShareLists
wglGetProcAddress
glGetError
glGetString
glDrawElements
glTexCoordPointer
glColorPointer
glNormal3f
glEnableClientState

winmm

waveInGetNumDevs
timeBeginPeriod
timeEndPeriod
waveOutClose
waveOutOpen
timeGetTime
waveOutGetNumDevs
waveOutGetDevCapsA
waveInUnprepareHeader
waveOutPrepareHeader
waveInReset
waveInClose
waveInOpen
waveInStart
waveInGetDevCapsW
waveInGetDevCapsA
waveOutGetDevCapsW
waveInPrepareHeader
waveInAddBuffer
waveOutGetPosition
waveOutReset
waveOutWrite
waveOutUnprepareHeader

ws2_32

freeaddrinfo
getaddrinfo
WSACleanup
WSAStartup
htonl
inet_addr
closesocket
gethostbyname
connect
htons
inet_ntoa
gethostname
WSAGetLastError
socket
getsockname

shlwapi

SHDeleteKeyA
PathFileExistsW
PathIsDirectoryW

oleaut32

SysFreeString
SysAllocString

imm32

ImmGetContext
ImmAssociateContext
ImmAssociateContextEx
ImmGetCompositionStringW
ImmSetCompositionStringW
ImmSetOpenStatus

hid

HidD_FreePreparsedData
HidD_GetPreparsedData
HidD_GetProductString
HidP_GetCaps
HidP_GetButtonCaps
HidP_GetValueCaps
HidP_GetData
HidP_MaxDataListLength

wsock32

inet_ntoa
gethostbyaddr
recv
send
select
WSACancelAsyncRequest
WSAAsyncGetHostByName
listen
bind
accept
ntohs
getsockopt
getpeername
setsockopt
sendto
recvfrom
WSASetLastError
__WSAFDIsSet
shutdown

msacm32

acmFormatSuggest
acmStreamPrepareHeader
acmStreamSize
acmStreamOpen
acmStreamUnprepareHeader
acmStreamConvert

Exports

Exports

AgPmDestroySourceConnection
AgPmEventEnabled
AgPmEventLoggingEnabled
AgPmSubmitEvent
NxCreateCoreSDK

Sections

.text
Size: 6.6MB - Virtual size: 6.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 142KB - Virtual size: 612KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.trace
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 348KB - Virtual size: 347KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ef57bb30b2b67456e1b0654362fd255a

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

version

opengl32

winmm

ws2_32

shlwapi

oleaut32

imm32

hid

wsock32

msacm32

Exports

Exports

Sections

.text Size: 6.6MB - Virtual size: 6.6MB

.rdata Size: 1.0MB - Virtual size: 1.0MB

.data Size: 142KB - Virtual size: 612KB

.trace Size: 22KB - Virtual size: 21KB

.rsrc Size: 348KB - Virtual size: 347KB

.text
Size: 6.6MB - Virtual size: 6.6MB

.rdata
Size: 1.0MB - Virtual size: 1.0MB

.data
Size: 142KB - Virtual size: 612KB

.trace
Size: 22KB - Virtual size: 21KB

.rsrc
Size: 348KB - Virtual size: 347KB