E:\Projects\8 Ball Pool\x64\Release\8 Ball Pool.pdb
Static task
static1
Behavioral task
behavioral1
Sample
8_Ball_Pool.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8_Ball_Pool.exe
Resource
win10v2004-20240412-en
General
-
Target
8_Ball_Pool.exe
-
Size
826KB
-
MD5
09752dedc143d3b9bf78b4bc98dc7fca
-
SHA1
c124e4dcecc3f2224d47fe54bdecc4b4dc71530e
-
SHA256
81947a1740be727bbb5c4ad073c5bdc7d10a13506276eeaf515b7cd0530abbd5
-
SHA512
d7a620bbe520202f1d0e8a99e82af4538a1c4fef99726a44f157d0055d4200adc9ebaae95d0c08b12f6e91b53bd983de798e24325ecc869e2f98a242d11aba0a
-
SSDEEP
24576:ZmcgtA9aF79UySs3Gne2vhSMXlIhox+w:ZItAsFXP2nZx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8_Ball_Pool.exe
Files
-
8_Ball_Pool.exe.exe windows:6 windows x64 arch:x64
7d56063b1eae90ff2c6ba257283ad38e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
FreeLibrary
QueryPerformanceCounter
CreateMutexA
ReleaseMutex
Sleep
OpenMutexA
Process32First
WriteProcessMemory
OpenProcess
CreateToolhelp32Snapshot
Process32Next
ReadProcessMemory
VirtualQueryEx
GetTickCount64
GlobalFree
CreateThread
InitializeSListHead
GlobalAlloc
QueryPerformanceFrequency
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
GetCPInfoExW
MultiByteToWideChar
GetModuleFileNameW
GetProcAddress
LoadLibraryA
GetModuleHandleA
GlobalUnlock
WideCharToMultiByte
GetCurrentThreadId
lstrlenW
WaitNamedPipeW
GetCurrentProcessId
CloseHandle
GetLastError
CreateFileW
GlobalLock
PeekNamedPipe
WriteFile
GetSystemTimeAsFileTime
ReadFile
user32
MessageBoxA
SendMessageA
DispatchMessageA
GetForegroundWindow
ShowWindow
DefWindowProcA
CreateWindowExA
TranslateMessage
LoadIconA
DestroyWindow
PeekMessageA
UnregisterClassA
PostQuitMessage
RegisterClassExA
UpdateWindow
GetSystemMetrics
TrackMouseEvent
ClientToScreen
GetCapture
ScreenToClient
LoadCursorA
GetKeyState
FindWindowA
FindWindowExA
SetTimer
SetCursor
GetClientRect
ReleaseCapture
SetCursorPos
GetCursorPos
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
IsIconic
SetLayeredWindowAttributes
EnumWindows
RegisterClassA
GetWindowInfo
SetWindowPos
GetWindowThreadProcessId
SetCapture
advapi32
RegCreateKeyExW
RegOpenKeyExA
RegCloseKey
RegSetValueExW
RegQueryValueExA
shell32
ShellExecuteA
msvcp140
??0facet@locale@std@@IEAA@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
??1facet@locale@std@@MEAA@XZ
?_Getfalse@_Locinfo@std@@QEBAPEBDXZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
?_Gettrue@_Locinfo@std@@QEBAPEBDXZ
?_Random_device@std@@YAIXZ
?id@?$numpunct@D@std@@2V0locale@2@A
_Mbrtowc
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?swap@?$basic_ostream@DU?$char_traits@D@std@@@std@@IEAAXAEAV12@@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
_Mtx_current_owns
_Cnd_init_in_situ
?_Throw_Cpp_error@std@@YAXH@Z
?_Throw_C_error@std@@YAXH@Z
_Cnd_timedwait
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_init_in_situ
_Cnd_do_broadcast_at_thread_exit
_Thrd_id
_Xtime_get_ticks
_Thrd_join
_Mtx_unlock
_Cnd_broadcast
_Mtx_trylock
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
imm32
ImmSetCandidateWindow
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
ImmAssociateContextEx
dwmapi
DwmSetWindowAttribute
DwmExtendFrameIntoClientArea
d3d9
Direct3DCreate9
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memchr
_CxxThrowException
__std_exception_destroy
__std_exception_copy
__std_terminate
strstr
memset
__C_specific_handler
__current_exception
memmove
memcpy
memcmp
__current_exception_context
api-ms-win-crt-stdio-l1-1-0
fflush
fclose
fgetc
fputc
__stdio_common_vfprintf
fread
fwrite
__p__commode
_set_fmode
__stdio_common_vsprintf
_fseeki64
__stdio_common_vsscanf
_wfopen
fsetpos
fgetpos
fseek
_get_stream_buffer_pointers
ftell
setvbuf
ungetc
__stdio_common_vswprintf
__acrt_iob_func
api-ms-win-crt-heap-l1-1-0
calloc
_callnewh
_set_new_mode
free
malloc
api-ms-win-crt-math-l1-1-0
_ldsign
cosf
sqrtf
sqrt
sinf
sin
powf
_fdsign
pow
logf
cos
ceilf
__setusermatherr
ceil
atan
acosf
_ldclass
_fdclass
_dclass
log2f
log2
floor
roundf
log
_dsign
fmodf
fmod
api-ms-win-crt-convert-l1-1-0
strtoull
strtod
atof
strtoll
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
api-ms-win-crt-locale-l1-1-0
localeconv
_configthreadlocale
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
terminate
_c_exit
__p___argv
_beginthreadex
__p___argc
_invalid_parameter_noinfo_noreturn
exit
_exit
_initterm_e
_initterm
_get_initial_narrow_environment
_set_app_type
_seh_filter_exe
_errno
_cexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_crt_atexit
api-ms-win-crt-time-l1-1-0
clock
_time64
api-ms-win-crt-string-l1-1-0
strncmp
toupper
strncpy
strcmp
api-ms-win-crt-utility-l1-1-0
srand
qsort
d2d1
ord1
dwrite
DWriteCreateFactory
Sections
.text Size: 506KB - Virtual size: 505KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 210KB - Virtual size: 210KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 86KB - Virtual size: 307KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 21KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 520B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ