01352578ebdb90b87715c721d98c65db05e65014e522a9ae64f746fbe069b8cf

Sharing

Copy URL

Twitter E-mail

General

Target

01352578ebdb90b87715c721d98c65db05e65014e522a9ae64f746fbe069b8cf
Size

5.6MB
MD5

4d7c79a1aeb6888ba3b7b1f97ead633b
SHA1

25690362f657f01bfdde59979b24bc19b23723c9
SHA256

01352578ebdb90b87715c721d98c65db05e65014e522a9ae64f746fbe069b8cf
SHA512

225c0ed6456e5e581acccfa7e4344104595a436dd6a9054344ead20b51ef238de1af6e6874399bd4d0c5edaa7aa5c8b155a3fdc68b9295147da16b24e00be2b7
SSDEEP

98304:JPiIMgwc3no/ivIg+91lfdYQ6nxhC3I7Gs1sI5HsSBbwKn:IFarJcqxp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
01352578ebdb90b87715c721d98c65db05e65014e522a9ae64f746fbe069b8cf

Files

01352578ebdb90b87715c721d98c65db05e65014e522a9ae64f746fbe069b8cf
.exe windows:6 windows x86 arch:x86

79c95ba44152532fe90b9cbb2ac1ed4d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

\\Mac\Home\Desktop\SVN_Client\client\UserInterface\Distribute\metin2client.pdb

Imports

kernel32

GetModuleFileNameA
FindNextFileA
WriteConsoleW
SetEndOfFile
HeapQueryInformation
HeapSize
CreateDirectoryW
OutputDebugStringW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileA
FindClose
MultiByteToWideChar
SetFileAttributesA
GetLastError
FindFirstFileExW
HeapReAlloc
SetStdHandle
DeleteFileW
SetFileAttributesW
SetCurrentDirectoryW
GetTimeZoneInformation
CreateProcessW
GetExitCodeProcess
GetFileSizeEx
SetFilePointerEx
ReadConsoleW
SetConsoleCtrlHandler
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetFileAttributesExW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
HeapAlloc
HeapFree
GetStdHandle
GetModuleFileNameW
GetCurrentProcess
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileType
GetFileInformationByHandle
ExitProcess
Module32Next
GetDriveTypeW
GetModuleHandleExW
FreeLibraryAndExitThread
ResumeThread
ExitThread
CreateThread
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
RaiseException
GetThreadTimes
QueryPerformanceFrequency
SetLastError
GetSystemTimeAsFileTime
GetCurrentThreadId
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
TerminateProcess
UnhandledExceptionFilter
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
InitializeCriticalSectionAndSpinCount
GetCPInfo
CompareStringEx
GetLocaleInfoEx
LCMapStringEx
DecodePointer
EncodePointer
LocalFree
InitializeCriticalSectionEx
GetStringTypeW
FormatMessageA
FindResourceW
FindResourceA
SizeofResource
LoadResource
LockResource
CreateFileW
IsProcessorFeaturePresent
ReadProcessMemory
GetCurrentDirectoryW
GetTickCount
GetCurrentDirectoryA
DeleteFileA
ReleaseMutex
CreateMutexA
GlobalFree
lstrlenA
GetPrivateProfileStringA
MoveFileA
FileTimeToSystemTime
InitOnceExecuteOnce
Module32First
Process32Next
Process32First
CreateToolhelp32Snapshot
GetSystemInfo
OpenProcess
SetThreadPriority
Sleep
CreateEventA
WaitForSingleObject
SetEvent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
InterlockedDecrement
GetProcessHeap
HeapValidate
InterlockedIncrement
QueryPerformanceCounter
CopyFileA
CreateSemaphoreA
ReleaseSemaphore
GetLocaleInfoA
CompareStringA
WideCharToMultiByte
lstrlenW
GlobalLock
GlobalUnlock
LoadLibraryA
GetProcAddress
FreeLibrary
GetVersionExA
GetSystemDirectoryA
WriteFile
SetFilePointer
ReadFile
WinExec
GetModuleHandleA
GetCurrentThread
SetUnhandledExceptionFilter
GetFileSize
CreateFileA
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
OutputDebugStringA
GetTempFileNameA
GetTempPathA
RemoveDirectoryA
CreateDirectoryA
AllocConsole
GlobalAlloc
CloseHandle
VerifyVersionInfoW
GetCurrentProcessId
GetFullPathNameW
VerSetConditionMask

user32

GetKeyState
GetAsyncKeyState
SetWindowPos
ShowWindow
PostQuitMessage
LoadImageA
DestroyIcon
FlashWindowEx
MessageBoxA
GetCursorPos
ShowCursor
SetCursor
DestroyCursor
SetCursorPos
ClientToScreen
GetCapture
SetCapture
CharNextW
GetClipboardData
CloseClipboard
OpenClipboard
GetKeyboardLayout
GetKeyboardLayoutNameA
DispatchMessageA
LoadStringA
ScreenToClient
GetMessageA
AdjustWindowRect
CharNextExA
LoadCursorA
AdjustWindowRectEx
GetWindowRect
SetWindowTextA
GetMenu
RegisterClassA
GetWindowLongA
UpdateWindow
SetFocus
MoveWindow
DestroyWindow
IsWindow
CreateWindowExA
RegisterClassExA
UnregisterClassA
DefWindowProcA
ReleaseCapture
GetSystemMetrics
PeekMessageA
GetDC
ReleaseDC
BeginPaint
EndPaint
InvalidateRect
GetClientRect
SystemParametersInfoA
SetRect
OffsetRect
CharPrevExA
SetWindowLongA
FindWindowA
LoadIconA
ChangeDisplaySettingsA
TranslateMessage
FillRect

gdi32

GetCharABCWidthsFloatW
EnumFontFamiliesExA
SelectObject
SetBkColor
SetTextColor
TextOutW
CreateCompatibleDC
DeleteDC
SetBkMode
SetDIBitsToDevice
CreateDIBSection
TextOutA
GetStockObject
DeleteObject
PatBlt
StretchBlt
GetTextExtentPoint32A
CreateFontIndirectA
GetTextExtentPoint32W
CreateSolidBrush

shell32

SetCurrentProcessExplicitAppUserModelID
SHGetSpecialFolderPathA

ole32

CoInitialize
CoUninitialize
CoCreateInstance
CoInitializeEx
OleSetContainedObject
OleUninitialize
OleInitialize
CoGetClassObject

winmm

timeEndPeriod
timeBeginPeriod
timeGetDevCaps
timeGetTime

d3d8

Direct3DCreate8

python27

PyDict_GetItemString
PyTuple_New
PyTuple_SetItem
PyDict_New
PyDict_SetItemString
PyInt_AsLong
PyDict_Next
PyDict_Size
PyString_FromString
PyList_New
PyList_Append
PyErr_SetString
PyExc_RuntimeError
PyRun_SimpleStringFlags
PyArg_ParseTuple
PyInt_FromLong
PyString_InternFromString
PyObject_GetAttrString
PyObject_GetAttr
PyCallable_Check
PyLong_AsUnsignedLong
PyLong_AsLongLong
PyFloat_AsDouble
PyString_AsString
PyErr_Clear
PyErr_BadArgument
PyErr_Print
PyObject_CallObject
PyNumber_Check
PyTuple_GetItem
PyModule_GetDict
PyErr_Fetch
Py_SetProgramName
Py_Initialize
Py_Finalize
PyRun_StringFlags
PyEval_SetTrace
Py_FlushLine
PyImport_GetMagicNumber
PyImport_AddModule
PyImport_ImportModule
PyObject_AsCharBuffer
PyCode_Addr2Line
PyEval_EvalCode
Py_OptimizeFlag
PyCode_Type
PyUnicodeUCS2_DecodeUTF8
_PyLong_FromByteArray
PyFloat_FromDouble
PyComplex_FromCComplex
PyString_FromStringAndSize
PyList_SetItem
PyDict_SetItem
PyErr_Occurred
PyEval_GetRestricted
PyCode_New
PyMarshal_ReadObjectFromString
_PyLong_New
_Py_EllipsisObject
PyExc_StopIteration
PyExc_EOFError
PyExc_ValueError
PyTuple_Size
PyLong_AsLong
PyModule_AddIntConstant
Py_BuildValue
Py_InitModule4
_Py_NoneStruct
PyErr_NoMemory

imm32

ImmGetOpenStatus
ImmSetConversionStatus
ImmGetConversionStatus
ImmGetCandidateListW
ImmSetCompositionStringW
ImmGetCompositionStringW
ImmAssociateContext
ImmReleaseContext
ImmGetContext
ImmIsIME
ImmGetIMEFileNameA
ImmNotifyIME

devil

ilCopyPixels
ilConvertImage
ilLoad
ilGetInteger
ilGenImages
ilDeleteImages
ilBindImage
ilInit
ilTexImage
ilSetPixels
ilSave
ilOriginFunc
ilShutDown
ilEnable

sys/mss32

_AIL_decompress_ASI@24
_AIL_decompress_ADPCM@12
_AIL_file_type@8
_AIL_open_digital_driver@16
_AIL_open_stream@12
_AIL_close_digital_driver@4
_AIL_enumerate_3D_providers@12
_AIL_open_3D_provider@4
_AIL_close_3D_provider@4
_AIL_open_3D_listener@4
_AIL_close_3D_listener@4
_AIL_set_3D_position@16
_AIL_set_3D_velocity@20
_AIL_set_3D_orientation@28
_AIL_startup@0
_AIL_shutdown@0
_AIL_set_redist_directory@4
_AIL_close_stream@4
_AIL_set_file_callbacks@16
_AIL_pause_stream@8
_AIL_set_stream_volume_levels@12
_AIL_stream_volume_levels@12
_AIL_set_stream_loop_count@8
_AIL_stream_status@4
_AIL_last_error@0
_AIL_allocate_sample_handle@4
_AIL_release_sample_handle@4
_AIL_init_sample@4
_AIL_set_sample_file@12
_AIL_stop_sample@4
_AIL_resume_sample@4
_AIL_end_sample@4
_AIL_set_sample_volume_pan@12
_AIL_set_sample_loop_count@8
_AIL_sample_status@4
_AIL_sample_volume_pan@12
_AIL_allocate_3D_sample_handle@4
_AIL_WAV_info@8
_AIL_file_read@8
_AIL_mem_free_lock@4
_AIL_start_stream@4
_AIL_start_3D_sample@4
_AIL_release_3D_sample_handle@4
_AIL_auto_update_3D_position@8
_AIL_update_3D_position@8
_AIL_3D_sample_volume@4
_AIL_3D_sample_status@4
_AIL_set_3D_sample_loop_count@8
_AIL_set_3D_sample_volume@8
_AIL_set_3D_sample_file@8
_AIL_end_3D_sample@4
_AIL_resume_3D_sample@4
_AIL_stop_3D_sample@4
_AIL_start_sample@4

granny2

_GrannyGetMeshTriangleGroups@4
_GrannyGetMeshTriangleGroupCount@4
_GrannyPlayControlledAnimation@12
_GrannySetControlRawLocalClock@8
_GrannyGetWorldPoseComposite4x4@8
_GrannyGetControlRawLocalClock@4
_GrannySetControlEaseOutCurve@28
_GrannySetControlEaseOut@8
_GrannySetControlEaseInCurve@28
_GrannySetControlEaseIn@8
_GrannyGetControlLocalDuration@4
_GrannySetControlSpeed@8
_GrannyCopyMeshIndices@12
_GrannySetControlLoopCount@8
_GrannyCopyMeshVertices@12
_GrannyFreeControlIfComplete@4
_GrannyControlIsComplete@4
_GrannyCompleteControlAt@8
_GrannyFreeControlOnceUnused@4
_GrannyFreeControl@4
_GrannyGetMeshIndexCount@4
_GrannyMeshIsRigid@4
_GrannyGetMeshVertexCount@4
_GrannyGetTotalTypeSize@4
_GrannyGetWorldPose4x4@8
_GrannyFreeWorldPose@4
_GrannyNewWorldPose@4
_GrannyFindBoneByName@12
_GrannyGetMeshBindingToBoneIndices@4
_GrannyFreeMeshBinding@4
_GrannyNewMeshBinding@12
_GrannyFreeModelInstance@4
_GrannyInstantiateModel@4
_GrannyGetWorldPoseComposite4x4Array@4
_GrannyFreeLocalPose@4
_GrannyNewLocalPose@4
_GrannyUpdateModelMatrix@20
_GrannySampleModelAnimationsAccelerated@20
_GrannyFreeCompletedModelControls@4
_GrannySetModelClock@8
_GrannyGetSourceSkeleton@4
_GrannyGetFileInfo@4
_GrannyFreeFile@4
_GrannyFreeFileSection@8
_GrannyReadEntireFileFromMemory@8
_GrannyConvertSingleObject@20
_GrannyFindMatchingMember@16
_GrannyGetMaterialTextureByType@8
_GrannyNewMeshDeformer@16
_GrannyGetMeshVertexType@4
_GrannyGetControlLoopCount@4
_GrannyGetMeshVertices@4
_GrannyFreeMeshDeformer@4
_GrannyDeformVertices@24
GrannyPNT332VertexType
_GrannyGetControlSpeed@4

resource

PythonPlayerSettingsModuleLibRegisterVariables
LoadGameNPC
RegisterSkill
GetHorsePathNameByMode
PythonPlayerSettingsModuleLibRegisterFunctions
LoadPythonPlayerSettingsModuleLibrary

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

imagehlp

GetTimestampForLoadedLibrary
EnumerateLoadedModules
StackWalk

dinput8

DirectInput8Create

ws2_32

__WSAFDIsSet
closesocket
connect
ioctlsocket
recv
select
send
socket
WSAGetLastError
WSAStartup
WSACleanup
htonl
htons
inet_addr
ntohl
ntohs
gethostbyname
gethostname

ddraw

DirectDrawCreate

advapi32

RegOpenKeyExA
RegQueryValueExA
CryptGenRandom
CryptReleaseContext
RegOpenKeyA
CryptAcquireContextA
RegCloseKey

oleaut32

VariantInit
VariantClear
SysFreeString
SafeArrayDestroy
SysAllocString
SafeArrayAccessData
SafeArrayCreate

Sections

.text
Size: 4.4MB - Virtual size: 4.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 798KB - Virtual size: 798KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 174KB - Virtual size: 694KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data1
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 202KB - Virtual size: 202KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

79c95ba44152532fe90b9cbb2ac1ed4d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

shell32

ole32

winmm

d3d8

python27

imm32

devil

sys/mss32

granny2

resource

version

imagehlp

dinput8

ws2_32

ddraw

advapi32

oleaut32

Sections

.text Size: 4.4MB - Virtual size: 4.4MB

.rdata Size: 798KB - Virtual size: 798KB

.data Size: 174KB - Virtual size: 694KB

.data1 Size: 2KB - Virtual size: 2KB

.rsrc Size: 202KB - Virtual size: 202KB

.text
Size: 4.4MB - Virtual size: 4.4MB

.rdata
Size: 798KB - Virtual size: 798KB

.data
Size: 174KB - Virtual size: 694KB

.data1
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 202KB - Virtual size: 202KB