Static task
static1
Behavioral task
behavioral1
Sample
mb_warband.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
mb_warband.exe
Resource
win10v2004-20240419-en
General
-
Target
mb_warband.exe
-
Size
5.1MB
-
MD5
53d74aa5115751115a9cd5aeec582f2c
-
SHA1
6cf173d585952a74e17479dc0d76c69d88c39269
-
SHA256
16a266d718b7af74ce90e87ee3a97b48689f07f60be7677c6451657a9ba9e71e
-
SHA512
0266535c8b5ac74c3e9bb5532d6ba38c64d7224357a71885c209f7109709258b8ffe4d42c397d984b28374fcd78fd1fc06ef716d60f3dc9af30f6f5e9a2ee210
-
SSDEEP
98304:2R9qxLKeY8zgj0Z1hiBXiJdaAzIGtvWZbz3s5NSe3zwclx1O47ZSzAF:69qJKebZ1hiBXZA8GtelzOO47ZSEF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource mb_warband.exe
Files
-
mb_warband.exe.exe windows:5 windows x86 arch:x86
02be6d3716ea4c068b3d105305145743
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
wininet
InternetOpenA
InternetSetOptionA
InternetReadFile
InternetQueryOptionA
HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetCloseHandle
shfolder
SHGetFolderPathA
d3d9
Direct3DCreate9
d3dx9_42
D3DXCreateTextureFromFileExA
D3DXMatrixMultiply
D3DXMatrixOrthoOffCenterRH
D3DXMatrixPerspectiveOffCenterRH
D3DXMatrixOrthoOffCenterLH
D3DXMatrixPerspectiveOffCenterLH
D3DXCreateEffectFromFileA
D3DXPlaneTransform
D3DXMatrixTranspose
D3DXMatrixInverse
D3DXVec3Normalize
D3DXAssembleShaderFromFileA
D3DXCreateTexture
D3DXSaveTextureToFileA
D3DXCreateCubeTextureFromFileExA
D3DXVec3Transform
D3DXSaveSurfaceToFileA
D3DXCreateTextureFromFileInMemoryEx
dinput8
DirectInput8Create
winmm
timeGetTime
timeBeginPeriod
timeEndPeriod
ws2_32
WSAGetLastError
WSACleanup
closesocket
WSAIoctl
WSASocketA
WSAStartup
ioctlsocket
listen
bind
setsockopt
htons
inet_ntoa
recv
__WSAFDIsSet
send
accept
shutdown
inet_addr
gethostbyname
gethostbyaddr
socket
WSASendTo
ntohs
WSARecvFrom
crypt32
CertFindCertificateInStore
CertFreeCertificateContext
CertCloseStore
CertOpenSystemStoreA
fmodex
?getIndex@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PAH@Z
?setDefaults@Sound@FMOD@@QAG?AW4FMOD_RESULT@@MMMH@Z
?getDefaults@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAM00PAH@Z
?setHardwareChannels@System@FMOD@@QAG?AW4FMOD_RESULT@@H@Z
?createSound@System@FMOD@@QAG?AW4FMOD_RESULT@@PBDIPAUFMOD_CREATESOUNDEXINFO@@PAPAVSound@2@@Z
?setVolume@Channel@FMOD@@QAG?AW4FMOD_RESULT@@M@Z
?setPosition@Channel@FMOD@@QAG?AW4FMOD_RESULT@@II@Z
?getNumDrivers@System@FMOD@@QAG?AW4FMOD_RESULT@@PAH@Z
?setUserData@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PAX@Z
?setPaused@Channel@FMOD@@QAG?AW4FMOD_RESULT@@_N@Z
?getOpenState@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAW4FMOD_OPENSTATE@@PAIPA_N2@Z
?playSound@System@FMOD@@QAG?AW4FMOD_RESULT@@W4FMOD_CHANNELINDEX@@PAVSound@2@_NPAPAVChannel@2@@Z
?setPriority@Channel@FMOD@@QAG?AW4FMOD_RESULT@@H@Z
?setCallback@Channel@FMOD@@QAG?AW4FMOD_RESULT@@P6G?AW43@PAUFMOD_CHANNEL@@W4FMOD_CHANNEL_CALLBACKTYPE@@PAX2@Z@Z
?getPosition@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PAII@Z
?getLength@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAII@Z
?getDriverCaps@System@FMOD@@QAG?AW4FMOD_RESULT@@HPAIPAHPAW4FMOD_SPEAKERMODE@@@Z
?setSpeakerMode@System@FMOD@@QAG?AW4FMOD_RESULT@@W4FMOD_SPEAKERMODE@@@Z
?setDSPBufferSize@System@FMOD@@QAG?AW4FMOD_RESULT@@IH@Z
?getDriverInfo@System@FMOD@@QAG?AW4FMOD_RESULT@@HPADHPAUFMOD_GUID@@@Z
?setSoftwareFormat@System@FMOD@@QAG?AW4FMOD_RESULT@@HW4FMOD_SOUND_FORMAT@@HHW4FMOD_DSP_RESAMPLER@@@Z
?setOutput@System@FMOD@@QAG?AW4FMOD_RESULT@@W4FMOD_OUTPUTTYPE@@@Z
?init@System@FMOD@@QAG?AW4FMOD_RESULT@@HIPAX@Z
?getUserData@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PAPAX@Z
FMOD_System_Create
?isPlaying@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PA_N@Z
?getMode@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PAI@Z
?stop@Channel@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?getChannelsPlaying@System@FMOD@@QAG?AW4FMOD_RESULT@@PAH@Z
?set3DListenerAttributes@System@FMOD@@QAG?AW4FMOD_RESULT@@HPBUFMOD_VECTOR@@000@Z
?getChannel@System@FMOD@@QAG?AW4FMOD_RESULT@@HPAPAVChannel@2@@Z
?set3DAttributes@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PBUFMOD_VECTOR@@0@Z
?release@Sound@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?setFrequency@Channel@FMOD@@QAG?AW4FMOD_RESULT@@M@Z
?setMode@Channel@FMOD@@QAG?AW4FMOD_RESULT@@I@Z
?createStream@System@FMOD@@QAG?AW4FMOD_RESULT@@PBDIPAUFMOD_CREATESOUNDEXINFO@@PAPAVSound@2@@Z
?set3DSettings@System@FMOD@@QAG?AW4FMOD_RESULT@@MMM@Z
?update@System@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?getVolume@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PAM@Z
?set3DMinMaxDistance@Sound@FMOD@@QAG?AW4FMOD_RESULT@@MM@Z
?close@System@FMOD@@QAG?AW4FMOD_RESULT@@XZ
kernel32
FlushFileBuffers
SetFilePointer
SetCurrentDirectoryA
GetCurrentDirectoryA
LCMapStringW
LCMapStringA
LoadLibraryW
GetConsoleMode
GetConsoleCP
WriteFile
SetHandleCount
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoA
GetCommandLineA
SetStdHandle
MoveFileA
HeapSize
InitializeCriticalSectionAndSpinCount
VirtualQuery
FreeEnvironmentStringsA
GetEnvironmentStrings
CreateThread
ResumeThread
ExitThread
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsAlloc
ExitProcess
GetModuleHandleW
HeapAlloc
HeapFree
GetDriveTypeA
FileTimeToLocalFileTime
FileTimeToSystemTime
GetModuleFileNameW
GetFileType
WriteConsoleW
RtlUnwind
HeapCreate
FreeEnvironmentStringsW
VirtualFree
HeapReAlloc
GetEnvironmentStringsW
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
GetTimeZoneInformation
SetEndOfFile
GetProcessHeap
SetEvent
ResetEvent
WaitForSingleObject
Sleep
lstrlenA
lstrcatA
lstrcpyA
QueryPerformanceCounter
QueryPerformanceFrequency
MulDiv
lstrcmpA
MultiByteToWideChar
WideCharToMultiByte
CloseHandle
CreateFileA
GetFullPathNameA
FreeLibrary
GetProcAddress
LoadLibraryA
GetModuleFileNameA
GetFileAttributesA
TlsGetValue
FindClose
FindFirstFileA
InitializeCriticalSection
DeleteCriticalSection
FindNextFileA
EnterCriticalSection
LeaveCriticalSection
GetExitCodeThread
SetThreadAffinityMask
GetCurrentThread
GetProcessAffinityMask
GetCurrentProcess
GetLastError
GetFileSize
ReadFile
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
CreateDirectoryA
GetSystemInfo
GlobalMemoryStatus
GetModuleHandleA
GetVersionExA
CreateEventA
GetStdHandle
RaiseException
GlobalUnlock
GlobalLock
ReleaseMutex
InterlockedIncrement
InterlockedDecrement
GlobalAlloc
RemoveDirectoryA
DeleteFileA
SetFileAttributesA
CreateProcessA
GetUserDefaultLCID
CreateMutexA
CompareStringA
CompareStringW
SetEnvironmentVariableA
InterlockedExchangeAdd
CreateSemaphoreA
VirtualAlloc
ReleaseSemaphore
user32
GetClassLongA
SetWindowPos
DefWindowProcA
DefWindowProcW
IsWindowUnicode
PostQuitMessage
DestroyWindow
DestroyMenu
DestroyAcceleratorTable
DispatchMessageW
TranslateMessage
TranslateAcceleratorA
GetMessageW
PeekMessageW
PeekMessageA
LoadAcceleratorsA
GetDlgItem
PostMessageA
EnableWindow
IsDlgButtonChecked
wsprintfA
CheckRadioButton
SendDlgItemMessageA
EndDialog
DialogBoxParamA
SetFocus
EnumDisplayDevicesA
EndPaint
BeginPaint
SetDlgItemTextA
SetDlgItemInt
SetMenu
SetWindowTextA
GetWindowTextA
ClipCursor
CloseClipboard
GetClipboardData
IsClipboardFormatAvailable
OpenClipboard
GetDlgItemTextA
SetClipboardData
EmptyClipboard
LoadImageA
SetCursorPos
ClientToScreen
ScreenToClient
GetCursorPos
RedrawWindow
DestroyIcon
SetCursor
SetForegroundWindow
SetActiveWindow
CreateDialogParamA
DrawMenuBar
SetMenuItemInfoA
LoadMenuA
CreateWindowExW
UpdateWindow
GetWindowLongA
GetWindowRect
GetClientRect
GetMenu
GetSystemMetrics
SetRect
AdjustWindowRect
LoadIconA
ShowWindow
MessageBoxA
SendMessageA
GetDlgItemInt
SetWindowLongA
LoadCursorA
DispatchMessageA
RegisterClassExW
gdi32
SetTextAlign
BitBlt
SetTextColor
CreateDIBSection
DeleteObject
SelectObject
SetMapMode
CreateCompatibleDC
CreateFontIndirectA
GetObjectA
GetStockObject
DeleteDC
GetTextExtentPoint32A
ExtTextOutA
GetDeviceCaps
CreateFontA
SetBkColor
advapi32
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
shell32
ShellExecuteA
ole32
CoCreateInstance
CoUninitialize
CoInitialize
oleaut32
VariantInit
VariantClear
skinmagic
ord3
ord2
ord9
ord1
winhttp
WinHttpCloseHandle
WinHttpReadData
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpSetOption
WinHttpOpen
WinHttpConnect
WinHttpOpenRequest
WinHttpQueryDataAvailable
imm32
ImmGetCompositionStringW
ImmGetContext
ImmReleaseContext
ImmAssociateContext
xinput1_3
ord3
ord2
ord5
wsock32
select
WSAAsyncSelect
connect
gethostname
Sections
.text Size: 3.7MB - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 636KB - Virtual size: 636KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 54KB - Virtual size: 37.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 714KB - Virtual size: 713KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ