C:\Users\PC\Desktop\Bin Output\Nksp_vc100.pdb
Static task
static1
Behavioral task
behavioral1
Sample
0656924120f371e366e3e2db9d0b2750bb429dbc0601b069b9d697d07b60db85.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0656924120f371e366e3e2db9d0b2750bb429dbc0601b069b9d697d07b60db85.exe
Resource
win10v2004-20240426-en
General
-
Target
0656924120f371e366e3e2db9d0b2750bb429dbc0601b069b9d697d07b60db85
-
Size
649KB
-
MD5
880c1d259d4c0233965d754a22ff79fe
-
SHA1
32d6bcbd67ce894d5f6011bb0e46c4e431bf2a25
-
SHA256
0656924120f371e366e3e2db9d0b2750bb429dbc0601b069b9d697d07b60db85
-
SHA512
950adaa723229cc6f1beaea2f833cb7ae1e55eb8e2b9ec4845a7c1ac27eee544b14d1fd11d126ea8cd15f2a4edbf70e951353f3d3b3e370d4ddaf8661b2a6cb4
-
SSDEEP
12288:spltaCa+rm8UBSD3ttRJc8tcFCw7EjWKIrWtgimACYEkADXkg:s9a+rmahtRJc8tcUw7VKIrRimADck
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0656924120f371e366e3e2db9d0b2750bb429dbc0601b069b9d697d07b60db85
Files
-
0656924120f371e366e3e2db9d0b2750bb429dbc0601b069b9d697d07b60db85.exe .vbs windows:5 windows x86 arch:x86 polyglot
8f207e9acd1387930df604b4495d087d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
entitiesmp
?CheckMPVersion@@YAXXZ
?CheckEntityVersion@@YAXXZ
kernel32
FreeLibrary
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GetSystemDefaultLangID
GetModuleHandleA
CreateToolhelp32Snapshot
EncodePointer
DecodePointer
InterlockedExchange
InterlockedCompareExchange
HeapSetInformation
GetStartupInfoW
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
GetCurrentDirectoryA
GetTickCount
GetCurrentThreadId
GetSystemTimeAsFileTime
WaitForSingleObject
SetEvent
CreateEventA
OpenEventA
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
OpenFileMappingA
GetFullPathNameA
SetCurrentDirectoryA
FindFirstFileA
FindClose
FindNextFileA
Process32First
OpenProcess
Process32Next
CloseHandle
DeleteFileA
MoveFileA
GetModuleFileNameA
LoadLibraryA
GetProcAddress
GetLastError
CreateFileA
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
Sleep
user32
ChangeDisplaySettingsA
DefWindowProcA
FillRect
GetClientRect
EndPaint
BeginPaint
UpdateWindow
ShowWindow
SetFocus
LoadBitmapA
RegisterClassExA
LoadIconA
DestroyWindow
SetWindowPos
GetSystemMetrics
GetWindowRect
MessageBoxA
ReleaseDC
GetDC
GetDesktopWindow
CreateDialogParamA
SetWindowLongA
CreateWindowExA
IsIconic
PeekMessageA
LoadCursorA
SetClassLongA
DispatchMessageA
TranslateMessage
SendMessageA
ShowCursor
UnregisterClassA
GetMessageA
gdi32
GetDeviceCaps
GetObjectA
DeleteObject
DeleteDC
BitBlt
SelectObject
CreateCompatibleDC
GetStockObject
msvcp100
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?always_noconv@codecvt_base@std@@QBE_NXZ
??1_Lockit@std@@QAE@XZ
?_Incref@facet@locale@std@@QAEXXZ
?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??Bid@locale@std@@QAEIXZ
?id@?$codecvt@DDH@std@@2V0locale@2@A
??0_Lockit@std@@QAE@H@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?_Xlength_error@std@@YAXPBD@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?_Xout_of_range@std@@YAXPBD@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?good@ios_base@std@@QBE_NXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?width@ios_base@std@@QAE_J_J@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?flags@ios_base@std@@QBEHXZ
?width@ios_base@std@@QBE_JXZ
?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z
?_BADOFF@std@@3_JB
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAJ@Z
?_Decref@facet@locale@std@@QAEPAV123@XZ
engine
?ExpandFilePath@@YAJKABVCTFileName@@AAV1@@Z
?_strModExt@@3VCTString@@A
?IsWideScreen@CDisplayMode@@QAEHXZ
?GetValue@CShell@@QAE?AVCTString@@ABV2@@Z
?SetValue@CShell@@QAEXABVCTString@@0@Z
?Clear@CTString@@QAEXXZ
?TranslateConst@@YAPBDPBDJ@Z
?GetLine_t@CTStream@@QAEXAAVCTString@@D@Z
?RemovePrefix@CTString@@QAEHABV1@@Z
?TrimSpacesRight@CTString@@QAEJXZ
?AddReference@CEntity@@QAEXXZ
?RemReference@CEntity@@QAEXXZ
??1ZZZZZZZF@@QAE@XZ
??0ZZZZZZZF@@QAE@XZ
?InitSEEDEncrypt@CNonDegage@@SAXXZ
?EnableStreamHandling@CTStream@@SAXXZ
?ExceptionFilter@CTStream@@SAHKPAU_EXCEPTION_POINTERS@@@Z
?ExceptionFatalError@CTStream@@SAXXZ
?DisableStreamHandling@CTStream@@SAXXZ
?ClearStreamHandling@CTStream@@SAXXZ
?setVersion@CUILoginNew@@QAEXPBD@Z
?g_szExitError@@3PADA
?MsgProc@CUIManager@@QAEXPAUtagMSG@@PAH@Z
?g_fFramePerSecond@@3MA
?g_bNoPlaySnd@@3HA
?IsEqualCaseSensitive@CTString@@QBEHABV1@@Z
?SE_CheckEngine@@YA_NXZ
?SE_InitEngine@@YAXVCTString@@@Z
?g_bNasTrans@@3HA
?SE_LoadDefaultFonts@@YAXXZ
?InitTranslation@@YAXXZ
?AddTranslationTablesDir_t@@YAXABVCTFileName@@0@Z
?FinishTranslationTable@@YAXXZ
?sam_bWideScreen@@3JA
?Obtain_t@CStock_CEntityClass@@QAEPAVCEntityClass@@ABVCTFileName@@@Z
?_bClientApp@@3HA
?snd_iFormat@@3JA
?SetFormat@CSoundLibrary@@QAEXW4SoundFormat@1@H@Z
?SE_Get_GameDataManagerPtr@@YAPAVGameDataManager@@XZ
?Create@GameDataManager@@QAEXXZ
?Create@StageMgr@@QAEXXZ
?Create@CUIManager@@QAEXXZ
?SetGameHandle@CUIManager@@QAEXPAVCGame@@@Z
?ResetUIPos@CUIManager@@QAEXPAVCDAWPTF@@@Z
?SE_Get_WebAddressPtr@@YAPAVCWebAddress@@XZ
?Initialeme@CWebAddress@@QAEXXZ
?Begin@cWeb@@QAEHXZ
?CheckEngineVersion@@YAXXZ
?Release@CStock_CEntityClass@@QAEXPAVCEntityClass@@@Z
?_pEntityClassStock@@3PAVCStock_CEntityClass@@A
?SE_EndEngine@@YAXXZ
?FileDir@CTFileName@@QBE?AV1@XZ
??0CSoundObject@@QAE@XZ
??0CTFileName@@QAE@PBDH@Z
?SetVolume@CSoundObject@@QAEXMH@Z
?UpdateSounds@CSoundLibrary@@QAEXXZ
?_pSound@@3PAVCSoundLibrary@@A
??1CSoundObject@@QAE@XZ
??0CDAWPTF@@QAE@PAV0@J@Z
??0CDAWPTF@@QAE@XZ
?MakeWideScreen@CDAWPTF@@QAEXPAV1@@Z
?GetPixWidth@CTextureData@@QBEJXZ
?GetWidth@CTextureData@@QBEJXZ
?LerpColor@@YAKKKM@Z
?GREEEGHH@CDAWPTF@@QBEXPAVZZZZZZZF@@ABV?$AABBox@J$01@@1KK@Z
?AdjustUIPos@CUIManager@@QAEXPAVCDAWPTF@@@Z
?SetTitleName@CUIManager@@QAEXJHH@Z
?InitPos@CUIBase@@QAEXHHHH@Z
?DestroyWindowCanvas@CGfxLibrary@@QAEXPAVCViewPort@@@Z
?_pdpNormalMain@@3PAVCDAWPTF@@A
?ResetDisplayMode@CGfxLibrary@@QAEHW4GfxAPIType@@@Z
?CreateWindowCanvas@CGfxLibrary@@QAEXPAXPAPAVCViewPort@@PAPAVCDAWPTF@@@Z
?IsCurrentModeAccelerated@CGfxLibrary@@QAEHXZ
?sam_iScreenSizeI@@3JA
?sam_iScreenSizeJ@@3JA
?sam_iDisplayDepth@@3JA
?sam_iDisplayAdapter@@3JA
?sam_iGfxAPI@@3JA
?SE_Get_UIManagerPtr@@YAPAVCUIManager@@XZ
?DestroyRenderTarget@CUIManager@@QAEXXZ
?InitRenderTarget@CUIManager@@QAEXHH@Z
?SetData_t@ZZZZZZZF@@QAEXABVCTFileName@@@Z
?Force@CTextureData@@QAEXK@Z
?GetHighPrecisionTimer@CTimer@@QAE?AVCTimtrVolue@@XZ
??1CDAWPTF@@QAE@XZ
?FileName@CTFileName@@QBE?AV1@XZ
?getSingleton@?$CSingletonBase@VStageMgr@@@@SAPAVStageMgr@@XZ
?GetGameMode@CGameState@@QAEAAJXZ
?_pNetwork@@3PAVCNetworkLibrari@@A
?SetNextStage@StageMgr@@QAEXW4eSTAGE@@0@Z
?Run@StageMgr@@QAEXXZ
?GameInactive@CNetworkLibrari@@QAEXXZ
?Lock@CDAWPTF@@QAEHXZ
?Unlock@CDAWPTF@@QAEXXZ
?Fill@CDAWPTF@@QBEXK@Z
?SwapBuffers@CViewPort@@QAEXH@Z
?_pTimer@@3PAVCTimer@@A
?GetRealTimeTick@CTimer@@QBEMXZ
?GetWidth@CDAWPTF@@QBEJXZ
?GetHeight@CDAWPTF@@QBEJXZ
?IsDualHead@CDAWPTF@@QAEHXZ
?IsTripleHead@CDAWPTF@@QAEHXZ
??0CDisplayMode@@QAE@XZ
?DepthString@CDisplayMode@@QBE?AVCTString@@XZ
?IsDualHead@CDisplayMode@@QAEHXZ
?IsTripleHead@CDisplayMode@@QAEHXZ
?GetWindowsError@@YA?BVCTString@@K@Z
?_pfdDisplayFont@@3PAVCFontData@@A
?SetFont@CDAWPTF@@QAEXPAVCFontData@@@Z
?SetTextScaling@CDAWPTF@@QAEXM@Z
?SetTextShadow@CDAWPTF@@QAEXM@Z
?SetTextAspect@CDAWPTF@@QAEXM@Z
?PutText@CDAWPTF@@QBEXABVCTString@@JJK@Z
?SE_Destroy_WebAddressPtr@@YAXXZ
??0CTString@@QAE@ABV0@@Z
??4CTString@@QAEAAV0@ABV0@@Z
?DeleteChar@CTString@@QAEXJ@Z
?Split@CTString@@QAEXJAAV1@0@Z
??0CTString@@QAE@XZ
??4CTString@@QAEAAV0@PBD@Z
??1CTString@@QAE@XZ
??YCTString@@QAEAAV0@ABV0@@Z
??0CTString@@QAA@JPBDZZ
?Translate@@YAPADPADJ@Z
??BCTString@@QBEPBDXZ
??0CTString@@QAE@PBD@Z
??8CTString@@QBEHPBD@Z
?TrimSpacesLeft@CTString@@QAEJXZ
?_strLogFile@@3VCTString@@A
?cmd_iWindowTop@@3JA
?cmd_iWindowLeft@@3JA
?_fnmCDPath@@3VCTFileName@@A
??4CTFileName@@QAEXABVCTString@@@Z
?_fnmMod@@3VCTFileName@@A
??HCTString@@QBE?AV0@ABV0@@Z
??H@YA?AVCTString@@PBDABV0@@Z
??9CTString@@QBEHPBD@Z
?ScanF@CTString@@QAAJPBDZZ
?Matches@CTString@@QBEHABV1@@Z
??1CListNode@@QAE@XZ
??0CTFileName@@QAE@XZ
??0CListNode@@QAE@XZ
?IterationHead@CListHead@@QBEAAVCListNode@@XZ
?IterationSucc@CListNode@@QBEAAV1@XZ
?IsTailMarker@CListNode@@QBEHXZ
?WarningMessage@@YAXPBDZZ
??1CTFileStream@@UAE@XZ
?DeclareSymbol@CShell@@QAEXABVCTString@@PAX@Z
?_pShell@@3PAVCShell@@A
?AtEOF@CTStream@@QAEHXZ
?AddTail@CListHead@@QAEXAAVCListNode@@@Z
?GetLine_t@CTStream@@QAEXPADJD@Z
??1CTFileName@@QAE@XZ
?Open_t@CTFileStream@@QAEXABVCTFileName@@W4OpenMode@CTStream@@@Z
??0CTFileName@@QAE@ABVCTString@@@Z
??0CTFileStream@@QAE@XZ
?Execute@CShell@@QAEXABVCTString@@@Z
?PrintF@CTString@@QAAJPBDZZ
??8CTString@@QBEHABV0@@Z
?_pGfx@@3PAVCGfxLibrary@@A
?CPrintF@@YAXPBDZZ
??0CListHead@@QAE@XZ
?QuitScreen@CGameState@@QAEAAHXZ
?Running@CGameState@@QAEAAHXZ
?_pGameState@@3PAVCGameState@@A
?CloseWebPage@cWeb@@QAEHPAUHWND__@@@Z
?sam_bFullScreenActive@@3JA
?UpdatePos@cWeb@@QAEXXZ
?g_web@@3VcWeb@@A
?OpenWebPage@cWeb@@QAEHPAUHWND__@@@Z
?_bWindowChanging@@3HA
?_hInstanceMain@@3PAUHINSTANCE__@@A
?_hwndMain@@3PAUHWND__@@A
?_hDlgWeb@@3PAUHWND__@@A
?SE_UpdateWindowHandle@@YAXPAUHWND__@@0@Z
?FatalError@@YAXPBDZZ
?g_bAutoLogin@@3HA
?g_iCountry@@3JA
?Length@CTString@@QBEJXZ
?DeleteChars@CTString@@QAEXJJ@Z
?g_nmPW@@3VCTString@@A
?g_nmID@@3VCTString@@A
?g_nmCID@@3VCTString@@A
?g_nmVER@@3VCTString@@A
?TrimRight@CTString@@QAEJJ@Z
?FindSubstr@CTString@@QAEJABV1@@Z
?Benchmark@CGfxLibrary@@QAEXPAVCViewPort@@PAVCDAWPTF@@@Z
?_pvpViewPortMain@@3PAVCViewPort@@A
?_pdpMain@@3PAVCDAWPTF@@A
?_fnmApplicationPath@@3VCTFileName@@A
?SE_GetEngineDllRefCnt@@YA?BHXZ
?ThrowF_t@@YAXPADZZ
?End@cWeb@@QAEHXZ
msvcr100
_configthreadlocale
strchr
isspace
__CxxFrameHandler3
_stricmp
??3@YAXPAX@Z
??_V@YAXPAX@Z
??2@YAPAXI@Z
sscanf
memset
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
memcpy
_controlfp
fclose
fopen
strncpy
_execv
??0bad_cast@std@@QAE@PBD@Z
_CxxThrowException
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABV01@@Z
fgetc
fputc
ungetc
memmove
_lock_file
_unlock_file
fflush
setvbuf
memcpy_s
fwrite
fgetpos
_fseeki64
fsetpos
_unlock
__dllonexit
_lock
_onexit
?terminate@@YAXXZ
_except_handler4_common
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
exit
_acmdln
_initterm
_initterm_e
_strdup
__setusermatherr
_commode
_fmode
__set_app_type
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
free
_strnicmp
version
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
shlwapi
PathAppendA
PathFileExistsA
advapi32
LookupPrivilegeValueA
SetFileSecurityA
AdjustTokenPrivileges
OpenProcessToken
Sections
.text Size: 55KB - Virtual size: 54KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 564KB - Virtual size: 563KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ