Static task
static1
Behavioral task
behavioral1
Sample
4d192b263908b4d7d5129bddb93080ca88f00237a6d57f1172ea34ac9ab3d253.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
4d192b263908b4d7d5129bddb93080ca88f00237a6d57f1172ea34ac9ab3d253.exe
Resource
win10v2004-20240426-en
General
-
Target
4d192b263908b4d7d5129bddb93080ca88f00237a6d57f1172ea34ac9ab3d253
-
Size
3.3MB
-
MD5
476547a685efba9b4b5a56f573c9ae93
-
SHA1
05370063b098e6691fe456ba035c9cf6b7f0448e
-
SHA256
4d192b263908b4d7d5129bddb93080ca88f00237a6d57f1172ea34ac9ab3d253
-
SHA512
4472030a3650448c9381de554571a8e0cdae5cad67d043c4b528fe04f2a75ca70ca661ccf353e83a76c8e88c9ae19aecc78629b34a34ce9907d619651df7968e
-
SSDEEP
49152:bN+s/UPSCbLPfSIJ2KNnPFaArZFFgbM+tshUtISW5noJ5ryH8QaZtKsq:yJ2KNnNxGbTtVto5y
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4d192b263908b4d7d5129bddb93080ca88f00237a6d57f1172ea34ac9ab3d253
Files
-
4d192b263908b4d7d5129bddb93080ca88f00237a6d57f1172ea34ac9ab3d253.exe windows:5 windows x86 arch:x86
4add533adb941ba98a40bf36d8e0c9eb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
RegisterWaitForSingleObject
UnregisterWait
CreateDirectoryW
FindFirstFileExW
SystemTimeToTzSpecificLocalTime
FreeLibraryAndExitThread
GetVersionExW
VirtualAlloc
VirtualFree
VirtualProtect
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
GetFullPathNameW
LoadLibraryW
GlobalFree
GetModuleFileNameA
ExitProcess
OpenMutexA
CreateMutexA
DeleteFileA
GetPrivateProfileStringA
lstrlenA
GetCurrentDirectoryA
MoveFileA
FindClose
SetThreadAffinityMask
FindFirstFileA
SetFileAttributesA
SetThreadPriority
InitializeCriticalSection
LeaveCriticalSection
GetFileSizeEx
VerifyVersionInfoW
VerSetConditionMask
WaitForMultipleObjects
GetEnvironmentVariableA
WaitForSingleObjectEx
MoveFileExA
FormatMessageW
SleepEx
InitializeCriticalSectionEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetThreadTimes
QueryPerformanceFrequency
WaitNamedPipeW
SetEndOfFile
SetEnvironmentVariableA
EnterCriticalSection
GetExitCodeProcess
WriteConsoleW
OutputDebugStringW
HeapReAlloc
SetStdHandle
DeleteFileW
GetTimeZoneInformation
FreeEnvironmentStringsW
GetNumaHighestNodeNumber
GetProcessAffinityMask
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SwitchToThread
SignalObjectAndWait
DuplicateHandle
GetExitCodeThread
FindNextFileA
CreateTimerQueue
DeleteCriticalSection
WaitForSingleObject
SetEvent
Sleep
GetSystemInfo
GetLastError
ReadProcessMemory
GetCurrentProcess
Module32Next
CloseHandle
Module32First
GetCurrentProcessId
GetEnvironmentStringsW
GetFileAttributesExW
FlushFileBuffers
GetOEMCP
GetACP
IsValidCodePage
ReadConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
HeapSize
GetModuleFileNameW
GetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
CreateSemaphoreW
GetModuleHandleW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
CreateEventW
InitializeCriticalSectionAndSpinCount
SetLastError
UnhandledExceptionFilter
FileTimeToSystemTime
PeekNamedPipe
GetFileType
GetFileInformationByHandle
FileTimeToLocalFileTime
GetCPInfo
LoadLibraryExW
GetCurrentThreadId
GetDriveTypeW
RtlUnwind
RaiseException
GetCommandLineA
AreFileApisANSI
GetModuleHandleExW
GetSystemTimeAsFileTime
ExitThread
CreateThread
IsDebuggerPresent
HeapFree
HeapAlloc
DecodePointer
EncodePointer
GetStringTypeW
CreateFileW
IsProcessorFeaturePresent
GetProcessHeap
HeapValidate
QueryPerformanceCounter
ReleaseSemaphore
GetLocaleInfoA
CompareStringA
WideCharToMultiByte
GetVersionExA
GetSystemDirectoryA
LoadLibraryA
lstrlenW
GlobalUnlock
GlobalLock
GetProcAddress
FreeLibrary
ReadFile
WriteFile
OutputDebugStringA
GetModuleHandleA
WinExec
GetCurrentThread
SetUnhandledExceptionFilter
CreateFileA
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
GetFileSize
CreateDirectoryA
GlobalAlloc
CreateToolhelp32Snapshot
GetTickCount
GetCurrentDirectoryW
CreateProcessA
MultiByteToWideChar
user32
PostQuitMessage
GetAsyncKeyState
SetRect
OffsetRect
GetClientRect
ClientToScreen
GetCursorPos
ScreenToClient
FindWindowA
LoadIconA
SetWindowPos
SystemParametersInfoA
GetKeyState
LoadImageA
DestroyCursor
ShowCursor
SetCursor
SetCursorPos
SetCapture
ReleaseCapture
DefWindowProcA
UnregisterClassA
RegisterClassExA
CreateWindowExA
IsWindow
PeekMessageA
ReleaseDC
FillRect
GetDC
DestroyWindow
MoveWindow
LoadStringA
InvalidateRect
SetFocus
UpdateWindow
GetWindowLongA
SetWindowLongA
RegisterClassA
GetMenu
AdjustWindowRectEx
LoadCursorA
GetMessageA
TranslateMessage
DispatchMessageA
GetKeyboardLayoutNameA
GetKeyboardLayout
OpenClipboard
CloseClipboard
GetClipboardData
CharNextW
CharNextExA
CharPrevExA
ChangeDisplaySettingsA
ShowWindow
GetCapture
MessageBoxA
GetSystemMetrics
gdi32
GetTextExtentPoint32A
GetStockObject
EnumFontFamiliesExA
CreateCompatibleDC
DeleteDC
SelectObject
SetBkColor
SetBkMode
SetTextColor
CreateDIBSection
TextOutA
CreateFontIndirectA
GetCharABCWidthsFloatW
GetTextExtentPoint32W
TextOutW
StretchBlt
DeleteObject
CreateSolidBrush
ole32
CoInitializeEx
OleSetContainedObject
OleUninitialize
CoInitialize
CoCreateInstance
CoUninitialize
CoGetClassObject
OleInitialize
winmm
timeGetDevCaps
timeEndPeriod
timeGetTime
timeBeginPeriod
d3d8
Direct3DCreate8
python27
Py_InitModule4
Py_BuildValue
PyModule_AddIntConstant
PyErr_SetString
PyString_FromString
PyList_Append
PyTuple_Size
PyDict_GetItemString
PyLong_AsLong
PyExc_RuntimeError
PyTuple_GetItem
PyLong_FromLongLong
PyTuple_New
PyInt_AsLong
PyDict_SetItemString
PyTuple_SetItem
PyArg_ParseTuple
PyDict_Size
PyDict_Next
PyLong_AsLongLong
PyString_InternFromString
PyObject_GetAttrString
PyObject_GetAttr
PyCallable_Check
PyFloat_AsDouble
PyString_AsString
PyErr_Clear
PyErr_BadArgument
PyErr_Print
PyObject_CallObject
PyNumber_Check
_Py_NoneStruct
PyList_New
PyDict_New
PyModule_GetDict
PyErr_Fetch
Py_SetProgramName
Py_Initialize
Py_Finalize
PyRun_StringFlags
PyImport_AddModule
PyImport_ImportModule
iphlpapi
GetAdaptersInfo
imm32
ImmGetOpenStatus
ImmSetConversionStatus
ImmGetConversionStatus
ImmGetCandidateListW
ImmSetCompositionStringW
ImmGetCompositionStringW
ImmAssociateContext
ImmReleaseContext
ImmGetContext
ImmIsIME
ImmGetIMEFileNameA
ImmNotifyIME
devil
ilInit
ilSetPixels
ilTexImage
ilSave
ilShutDown
ilDeleteImages
ilCopyPixels
ilConvertImage
ilGetInteger
ilLoad
ilOriginFunc
ilGenImages
ilBindImage
ilEnable
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
imagehlp
StackWalk
EnumerateLoadedModules
GetTimestampForLoadedLibrary
granny2
_GrannyGetMaterialTextureByType@8
_GrannySetLogCallback@4
_GrannyNewMeshDeformer@16
_GrannyFindMatchingMember@16
_GrannyConvertSingleObject@20
_GrannyReadEntireFileFromMemory@8
_GrannyFreeFileSection@8
_GrannyFreeFile@4
_GrannyGetFileInfo@4
_GrannyGetSourceSkeleton@4
_GrannySetModelClock@8
_GrannyFreeCompletedModelControls@4
_GrannySampleModelAnimationsAccelerated@20
_GrannyUpdateModelMatrix@20
_GrannyNewLocalPose@4
_GrannyFreeLocalPose@4
_GrannyGetWorldPoseComposite4x4Array@4
_GrannyInstantiateModel@4
_GrannyFreeModelInstance@4
_GrannyNewMeshBinding@12
_GrannyFreeMeshBinding@4
_GrannyGetMeshBindingToBoneIndices@4
_GrannyFindBoneByName@12
_GrannyNewWorldPose@4
_GrannyFreeWorldPose@4
_GrannyGetWorldPose4x4@8
_GrannyGetWorldPoseComposite4x4@8
_GrannyGetTotalTypeSize@4
_GrannyGetMeshVertexCount@4
_GrannyMeshIsRigid@4
_GrannyGetSourceModel@4
_GrannyFindTrackGroupForModel@12
_GrannyFreeControl@4
_GrannyFreeControlOnceUnused@4
_GrannyCompleteControlAt@8
_GrannyControlIsComplete@4
_GrannyFreeControlIfComplete@4
_GrannyGetControlLoopCount@4
_GrannySetControlLoopCount@8
_GrannyGetControlSpeed@4
_GrannySetControlSpeed@8
_GrannyGetControlLocalDuration@4
_GrannySetControlEaseIn@8
_GrannySetControlEaseInCurve@28
_GrannySetControlEaseOut@8
_GrannySetControlEaseOutCurve@28
_GrannyGetControlRawLocalClock@4
_GrannySetControlRawLocalClock@8
_GrannyPlayControlledAnimation@12
_GrannyBeginControlledAnimation@8
_GrannyEndControlledAnimation@4
_GrannySetTrackGroupTarget@12
_GrannySetTrackGroupLOD@16
_GrannyGetMeshTriangleGroupCount@4
_GrannyGetMeshTriangleGroups@4
_GrannyGetMeshVertexType@4
_GrannyCopyMeshVertices@12
_GrannyGetMeshVertices@4
_GrannyCopyMeshIndices@12
_GrannyGetMeshIndexCount@4
_GrannyFreeMeshDeformer@4
_GrannyDeformVertices@24
GrannyPNT332VertexType
mss32
_AIL_decompress_ASI@24
_AIL_decompress_ADPCM@12
_AIL_file_type@8
_AIL_open_digital_driver@16
_AIL_open_stream@12
_AIL_close_digital_driver@4
_AIL_enumerate_3D_providers@12
_AIL_open_3D_provider@4
_AIL_close_3D_provider@4
_AIL_open_3D_listener@4
_AIL_close_3D_listener@4
_AIL_set_3D_position@16
_AIL_set_3D_velocity@20
_AIL_set_3D_orientation@28
_AIL_WAV_info@8
_AIL_shutdown@0
_AIL_set_redist_directory@4
_AIL_close_stream@4
_AIL_start_stream@4
_AIL_pause_stream@8
_AIL_set_stream_volume_levels@12
_AIL_stream_volume_levels@12
_AIL_set_stream_loop_count@8
_AIL_stream_status@4
_AIL_last_error@0
_AIL_set_sample_loop_count@8
_AIL_set_file_callbacks@16
_AIL_allocate_sample_handle@4
_AIL_release_sample_handle@4
_AIL_init_sample@4
_AIL_set_sample_file@12
_AIL_file_read@8
_AIL_startup@0
_AIL_start_sample@4
_AIL_stop_sample@4
_AIL_resume_sample@4
_AIL_end_sample@4
_AIL_set_sample_volume_pan@12
_AIL_auto_update_3D_position@8
_AIL_3D_sample_volume@4
_AIL_3D_sample_status@4
_AIL_set_3D_sample_loop_count@8
_AIL_set_3D_sample_volume@8
_AIL_set_3D_sample_file@8
_AIL_end_3D_sample@4
_AIL_resume_3D_sample@4
_AIL_stop_3D_sample@4
_AIL_start_3D_sample@4
_AIL_release_3D_sample_handle@4
_AIL_allocate_3D_sample_handle@4
_AIL_sample_volume_pan@12
_AIL_sample_status@4
_AIL_mem_free_lock@4
speedtreert
?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z
?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ
?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z
?SetTime@CSpeedTreeRT@@SAXM@Z
?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z
?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z
?SetLightState@CSpeedTreeRT@@SAXI_N@Z
?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z
?SetCamera@CSpeedTreeRT@@SAXPBM0@Z
??0SGeometry@CSpeedTreeRT@@QAE@XZ
??1SGeometry@CSpeedTreeRT@@QAE@XZ
??0STextures@CSpeedTreeRT@@QAE@XZ
??1STextures@CSpeedTreeRT@@QAE@XZ
??0CSpeedTreeRT@@QAE@XZ
??1CSpeedTreeRT@@QAE@XZ
??2CSpeedTreeRT@@SAPAXI@Z
??3CSpeedTreeRT@@SAXPAX@Z
?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z
?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ
?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z
?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z
?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ
?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z
?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ
?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z
?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z
?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetLocalMatrices@CSpeedTreeRT@@QAEXII@Z
?ComputeLodLevel@CSpeedTreeRT@@QAEXXZ
?SetLodLevel@CSpeedTreeRT@@QAEXM@Z
?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z
?SetLodLimits@CSpeedTreeRT@@QAEXMM@Z
?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ
?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z
?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z
?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z
?GetCurrentError@CSpeedTreeRT@@SAPBDXZ
dinput8
DirectInput8Create
ws2_32
recvfrom
freeaddrinfo
gethostname
gethostbyname
ntohs
getaddrinfo
inet_addr
htons
htonl
WSACleanup
WSAStartup
WSAGetLastError
socket
send
select
recv
ioctlsocket
connect
closesocket
__WSAFDIsSet
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAResetEvent
WSAWaitForMultipleEvents
bind
getpeername
getsockname
getsockopt
setsockopt
WSASetLastError
WSAIoctl
accept
listen
sendto
ddraw
DirectDrawCreate
bcrypt
BCryptGenRandom
advapi32
RegCloseKey
RegQueryValueExA
RegOpenKeyA
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptEncrypt
RegOpenKeyExA
shell32
SHGetSpecialFolderPathA
oleaut32
VariantClear
VariantInit
SysAllocString
SysFreeString
crypt32
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CryptStringToBinaryA
PFXImportCertStore
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
CertOpenStore
wldap32
ord35
ord33
ord32
ord27
ord26
ord22
ord79
ord50
ord45
ord60
ord211
ord46
ord217
ord143
ord30
ord200
ord301
ord41
normaliz
IdnToAscii
Sections
.text Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 494KB - Virtual size: 494KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 132KB - Virtual size: 660KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 231KB - Virtual size: 230KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ