Static task
static1
Behavioral task
behavioral1
Sample
af33cd05ff70fe9fe4a6b7b36f1bcba352089e9e8921d572f32a830d69fd8580.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
af33cd05ff70fe9fe4a6b7b36f1bcba352089e9e8921d572f32a830d69fd8580.exe
Resource
win10v2004-20240508-en
General
-
Target
af33cd05ff70fe9fe4a6b7b36f1bcba352089e9e8921d572f32a830d69fd8580
-
Size
2.9MB
-
MD5
91482e269ded7ce410cbbb1c32dbb321
-
SHA1
ce5caf0b8140262015bead7a357bdcec9babed44
-
SHA256
af33cd05ff70fe9fe4a6b7b36f1bcba352089e9e8921d572f32a830d69fd8580
-
SHA512
835116740e5de39a10ddf82c9aeaafda9b25bc42627553fdc8f28aa4a11d216224a20e91eb37beac8fe402528309c943e50c8d12a0fdba6497410433c04bb0d5
-
SSDEEP
49152:jq0EUPQVGrzokdwqOjjbZUcle9zEjiSd8gIfcd1toJ5xb54DJ50nCtDn0WaEZ4mU:80dwq0jbwEjhegI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource af33cd05ff70fe9fe4a6b7b36f1bcba352089e9e8921d572f32a830d69fd8580
Files
-
af33cd05ff70fe9fe4a6b7b36f1bcba352089e9e8921d572f32a830d69fd8580.exe windows:5 windows x86 arch:x86
32ab2b0b068db308d740d5c84a74786f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
SetEndOfFile
SetEnvironmentVariableA
CreateProcessA
GetExitCodeProcess
OutputDebugStringW
WriteConsoleW
HeapReAlloc
SetStdHandle
GetTimeZoneInformation
FreeEnvironmentStringsW
GetSystemInfo
GetLastError
ReadProcessMemory
Module32Next
Module32First
CreateToolhelp32Snapshot
GetTickCount
GetCurrentDirectoryW
MultiByteToWideChar
DeleteFileA
GlobalAlloc
FindNextFileA
FindClose
FindFirstFileA
ResumeThread
GetEnvironmentStringsW
GetFileAttributesExW
FlushFileBuffers
CreateDirectoryW
GetOEMCP
GetACP
IsValidCodePage
GetModuleFileNameW
WaitForSingleObject
ReadConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
HeapSize
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetModuleHandleW
GetStartupInfoW
TlsFree
TlsGetValue
TlsAlloc
TerminateProcess
InitializeCriticalSectionAndSpinCount
SetLastError
UnhandledExceptionFilter
GetFileType
GetCPInfo
LoadLibraryExW
RtlUnwind
RaiseException
GetCommandLineA
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
IsDebuggerPresent
AreFileApisANSI
GetModuleHandleExW
DecodePointer
EncodePointer
GetStringTypeW
CreateFileW
IsProcessorFeaturePresent
GetProcessHeap
HeapValidate
QueryPerformanceCounter
ReleaseSemaphore
GetLocaleInfoA
CompareStringA
WideCharToMultiByte
GetVersionExA
GetSystemDirectoryA
lstrlenW
MapViewOfFile
CreateFileMappingA
CreateFileA
DuplicateHandle
OpenProcess
GetCurrentProcess
VirtualAlloc
ExitThread
CloseHandle
OpenThread
GetCurrentThreadId
CreateThread
Sleep
ExitProcess
GetCurrentProcessId
SetFileAttributesA
MoveFileA
GetCurrentDirectoryA
lstrlenA
GetPrivateProfileStringA
GetModuleFileNameA
GlobalFree
TlsSetValue
GlobalUnlock
GlobalLock
FreeLibrary
ReadFile
WriteFile
OutputDebugStringA
WinExec
GetCurrentThread
SetUnhandledExceptionFilter
UnmapViewOfFile
GetFileSize
CreateDirectoryA
LoadLibraryA
VirtualProtect
GetProcAddress
GetStdHandle
GetModuleHandleA
user32
FindWindowA
EnumWindows
GetDC
FillRect
ReleaseDC
PeekMessageA
ClientToScreen
GetClientRect
OffsetRect
SetRect
GetAsyncKeyState
PostQuitMessage
GetCursorPos
ScreenToClient
LoadIconA
CharPrevExA
CharNextExA
CharNextW
GetClipboardData
CloseClipboard
OpenClipboard
GetKeyboardLayout
GetKeyboardLayoutNameA
DispatchMessageA
TranslateMessage
GetMessageA
LoadCursorA
AdjustWindowRectEx
GetMenu
RegisterClassA
SetWindowLongA
GetWindowLongA
UpdateWindow
SetFocus
GetSystemMetrics
GetClassNameA
GetWindowTextA
GetWindowThreadProcessId
MessageBoxA
MoveWindow
DestroyWindow
IsWindow
CreateWindowExA
RegisterClassExA
UnregisterClassA
DefWindowProcA
SetWindowPos
SystemParametersInfoA
GetKeyState
LoadImageA
DestroyCursor
ShowCursor
SetCursor
SetCursorPos
SetCapture
ReleaseCapture
ChangeDisplaySettingsA
ShowWindow
GetCapture
LoadStringA
InvalidateRect
gdi32
EnumFontFamiliesExA
GetStockObject
GetCharABCWidthsFloatW
GetTextExtentPoint32W
SelectObject
SetBkColor
SetTextColor
TextOutW
CreateCompatibleDC
DeleteDC
SetBkMode
CreateDIBSection
TextOutA
CreateSolidBrush
DeleteObject
StretchBlt
GetTextExtentPoint32A
CreateFontIndirectA
advapi32
LookupPrivilegeValueA
CryptReleaseContext
CryptGenRandom
RegOpenKeyA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
OpenProcessToken
CryptAcquireContextA
AdjustTokenPrivileges
GetTokenInformation
AllocateAndInitializeSid
InitializeAcl
AddAccessDeniedAce
AddAccessAllowedAce
SetSecurityInfo
FreeSid
ole32
CoInitializeEx
OleUninitialize
OleInitialize
CoGetClassObject
OleSetContainedObject
CoUninitialize
CoInitialize
CoCreateInstance
winmm
timeGetTime
timeEndPeriod
timeGetDevCaps
timeBeginPeriod
d3d8
Direct3DCreate8
python27
Py_BuildValue
PyErr_SetString
PyExc_RuntimeError
PyTuple_GetItem
PyList_New
PyString_FromString
PyList_Append
Py_InitModule4
PyModule_AddIntConstant
PyTuple_Size
PyDict_GetItemString
PyLong_AsLong
PyInt_FromLong
PyDict_Size
PyDict_Next
PyString_InternFromString
PyObject_GetAttrString
PyObject_GetAttr
PyCallable_Check
PyLong_AsLongLong
PyFloat_AsDouble
PyString_AsString
PyErr_Clear
PyErr_BadArgument
PyErr_Print
PyObject_CallObject
PyNumber_Check
_Py_NoneStruct
PyDict_SetItemString
PyModule_GetDict
PyErr_Fetch
PyInt_AsLong
Py_SetProgramName
Py_Initialize
Py_Finalize
PyRun_StringFlags
PyImport_AddModule
PyImport_ImportModule
devil
ilOriginFunc
ilLoad
ilGetInteger
ilEnable
ilCopyPixels
ilDeleteImages
ilShutDown
ilSave
ilTexImage
ilBindImage
ilConvertImage
ilInit
ilSetPixels
ilGenImages
imm32
ImmGetOpenStatus
ImmSetConversionStatus
ImmGetConversionStatus
ImmGetCandidateListW
ImmSetCompositionStringW
ImmGetCompositionStringW
ImmAssociateContext
ImmReleaseContext
ImmGetContext
ImmIsIME
ImmGetIMEFileNameA
ImmNotifyIME
psapi
GetModuleFileNameExA
EnumProcessModules
imagehlp
StackWalk
EnumerateLoadedModules
GetTimestampForLoadedLibrary
version
VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
granny2
_GrannyGetSourceSkeleton@4
_GrannySetModelClock@8
_GrannyFreeCompletedModelControls@4
GrannyPNT332VertexType
_GrannyDeformVertices@24
_GrannyFreeMeshDeformer@4
_GrannyNewMeshDeformer@16
_GrannyCopyMeshIndices@12
_GrannyGetMeshVertices@4
_GrannyCopyMeshVertices@12
_GrannyGetMeshVertexType@4
_GrannyGetMeshTriangleGroups@4
_GrannyGetMeshTriangleGroupCount@4
_GrannyGetFileInfo@4
_GrannyFreeFile@4
_GrannyFreeFileSection@8
_GrannyReadEntireFileFromMemory@8
_GrannyConvertSingleObject@20
_GrannyFindMatchingMember@16
_GrannyGetMaterialTextureByType@8
_GrannySetLogCallback@4
_GrannyPlayControlledAnimation@12
_GrannySetControlRawLocalClock@8
_GrannyGetControlRawLocalClock@4
_GrannySetControlEaseOutCurve@28
_GrannySetControlEaseOut@8
_GrannySetControlEaseInCurve@28
_GrannySetControlEaseIn@8
_GrannyGetControlLocalDuration@4
_GrannySetControlSpeed@8
_GrannyGetControlSpeed@4
_GrannySetControlLoopCount@8
_GrannyGetControlLoopCount@4
_GrannyFreeControlIfComplete@4
_GrannyControlIsComplete@4
_GrannyCompleteControlAt@8
_GrannyFreeControlOnceUnused@4
_GrannyFreeControl@4
_GrannyGetMeshIndexCount@4
_GrannyMeshIsRigid@4
_GrannyGetMeshVertexCount@4
_GrannyGetTotalTypeSize@4
_GrannyGetWorldPoseComposite4x4@8
_GrannyGetWorldPose4x4@8
_GrannyFreeWorldPose@4
_GrannyNewWorldPose@4
_GrannyFindBoneByName@12
_GrannyGetMeshBindingToBoneIndices@4
_GrannyFreeMeshBinding@4
_GrannyNewMeshBinding@12
_GrannyFreeModelInstance@4
_GrannyInstantiateModel@4
_GrannyGetWorldPoseComposite4x4Array@4
_GrannyFreeLocalPose@4
_GrannyNewLocalPose@4
_GrannyUpdateModelMatrix@20
_GrannySampleModelAnimationsAccelerated@20
mss32
_AIL_decompress_ASI@24
_AIL_decompress_ADPCM@12
_AIL_file_type@8
_AIL_open_digital_driver@16
_AIL_open_stream@12
_AIL_close_digital_driver@4
_AIL_enumerate_3D_providers@12
_AIL_close_3D_provider@4
_AIL_open_3D_listener@4
_AIL_close_3D_listener@4
_AIL_set_3D_position@16
_AIL_set_3D_velocity@20
_AIL_set_3D_orientation@28
_AIL_startup@0
_AIL_shutdown@0
_AIL_set_redist_directory@4
_AIL_close_stream@4
_AIL_start_stream@4
_AIL_pause_stream@8
_AIL_set_stream_volume_levels@12
_AIL_stream_volume_levels@12
_AIL_set_stream_loop_count@8
_AIL_stream_status@4
_AIL_last_error@0
_AIL_WAV_info@8
_AIL_release_sample_handle@4
_AIL_init_sample@4
_AIL_set_sample_file@12
_AIL_start_sample@4
_AIL_stop_sample@4
_AIL_resume_sample@4
_AIL_end_sample@4
_AIL_set_sample_volume_pan@12
_AIL_set_sample_loop_count@8
_AIL_sample_status@4
_AIL_sample_volume_pan@12
_AIL_allocate_3D_sample_handle@4
_AIL_release_3D_sample_handle@4
_AIL_start_3D_sample@4
_AIL_stop_3D_sample@4
_AIL_resume_3D_sample@4
_AIL_end_3D_sample@4
_AIL_set_3D_sample_file@8
_AIL_set_3D_sample_volume@8
_AIL_set_3D_sample_loop_count@8
_AIL_3D_sample_status@4
_AIL_3D_sample_volume@4
_AIL_auto_update_3D_position@8
_AIL_set_file_callbacks@16
_AIL_file_read@8
_AIL_allocate_sample_handle@4
_AIL_open_3D_provider@4
_AIL_mem_free_lock@4
speedtreert
?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z
?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ
?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z
??3CSpeedTreeRT@@SAXPAX@Z
??2CSpeedTreeRT@@SAPAXI@Z
??1CSpeedTreeRT@@QAE@XZ
??0CSpeedTreeRT@@QAE@XZ
??1STextures@CSpeedTreeRT@@QAE@XZ
?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ
?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z
?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ
??0SGeometry@CSpeedTreeRT@@QAE@XZ
?SetCamera@CSpeedTreeRT@@SAXPBM0@Z
?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z
?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z
?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ
?SetLodLimits@CSpeedTreeRT@@QAEXMM@Z
?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z
?SetLodLevel@CSpeedTreeRT@@QAEXM@Z
?ComputeLodLevel@CSpeedTreeRT@@QAEXXZ
?SetLocalMatrices@CSpeedTreeRT@@QAEXII@Z
?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z
?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z
?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z
?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z
?GetCurrentError@CSpeedTreeRT@@SAPBDXZ
?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z
?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ
?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z
??0STextures@CSpeedTreeRT@@QAE@XZ
??1SGeometry@CSpeedTreeRT@@QAE@XZ
?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ
?SetLightState@CSpeedTreeRT@@SAXI_N@Z
?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z
?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z
?SetTime@CSpeedTreeRT@@SAXM@Z
?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ
dinput8
DirectInput8Create
ws2_32
gethostbyname
inet_addr
htons
recv
WSACleanup
WSAStartup
WSAGetLastError
socket
ioctlsocket
send
select
__WSAFDIsSet
closesocket
connect
ddraw
DirectDrawCreate
shell32
SHGetSpecialFolderPathA
oleaut32
VariantClear
SysAllocString
VariantInit
SysFreeString
Sections
.text Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 468KB - Virtual size: 468KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 185KB - Virtual size: 462KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 45KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 117KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ