Static task
static1
Behavioral task
behavioral1
Sample
b236731863a4b1a92df4e3a3a1393c13569081349eea53087c54471644d0100d.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
b236731863a4b1a92df4e3a3a1393c13569081349eea53087c54471644d0100d.exe
Resource
win10v2004-20240802-en
General
-
Target
b236731863a4b1a92df4e3a3a1393c13569081349eea53087c54471644d0100d
-
Size
3.3MB
-
MD5
ed08298eeaad838e2896591953a57084
-
SHA1
8d31253d665668b7ff346a031e8e64eb11e19446
-
SHA256
b236731863a4b1a92df4e3a3a1393c13569081349eea53087c54471644d0100d
-
SHA512
942969e24873372805b341ea9fa8f6092db3fa5b9f8c5b916f9b6c4bf3550e1fec2b5092906a2aa8a3394d026d3e0c275bfab4a6a4f384114cecab9935c329cb
-
SSDEEP
49152:A76XDyp7JlrbxfbIKbZXNNXJRwcTSffWsInGBUPxZmcZAB5zqliOHBg38JX:Amyp7JlrpHbFvJucTSnWsz3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b236731863a4b1a92df4e3a3a1393c13569081349eea53087c54471644d0100d
Files
-
b236731863a4b1a92df4e3a3a1393c13569081349eea53087c54471644d0100d.exe windows:5 windows x86 arch:x86
0914c9bd8538d21f2df822a409be1d2e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetEnvironmentVariableA
CompareStringW
SetEndOfFile
CreateProcessA
GetExitCodeProcess
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
ReadProcessMemory
GetCurrentProcessId
GetLastError
FindFirstFileA
FindNextFileA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetStringTypeA
InitializeCriticalSectionAndSpinCount
SetStdHandle
GetTimeZoneInformation
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
FlushFileBuffers
GetConsoleMode
GetConsoleCP
SetHandleCount
IsValidCodePage
GetOEMCP
GetACP
GetStdHandle
HeapSize
GetCurrentProcess
TlsFree
FindClose
TlsAlloc
TlsGetValue
GetStringTypeW
LCMapStringW
LCMapStringA
GetCPInfo
ExitProcess
GetModuleHandleW
GetFileType
GetCurrentThreadId
GetStartupInfoA
GetCommandLineA
HeapAlloc
HeapFree
GetSystemTimeAsFileTime
CreateThread
ResumeThread
ExitThread
GetFileAttributesA
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
RaiseException
RtlUnwind
InterlockedExchange
InterlockedCompareExchange
IsProcessorFeaturePresent
InterlockedDecrement
GetProcessHeap
HeapValidate
InterlockedIncrement
QueryPerformanceCounter
GetCurrentDirectoryW
GetTickCount
MoveFileA
GetPrivateProfileStringA
lstrlenA
GetCurrentDirectoryA
DeleteFileA
CreateMutexA
ReleaseMutex
GlobalFree
GetModuleFileNameA
SetLastError
MultiByteToWideChar
SetFileAttributesA
InitializeCriticalSection
CreateEventA
SetThreadPriority
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObject
DeleteCriticalSection
SetEvent
GetSystemInfo
CreateToolhelp32Snapshot
Process32First
OpenProcess
Module32First
ReadFile
WriteFile
SetFilePointer
SetUnhandledExceptionFilter
GetCurrentThread
WinExec
CreateFileA
GetFileSize
UnmapViewOfFile
CreateFileMappingA
OutputDebugStringA
MapViewOfFile
GlobalAlloc
CreateDirectoryA
ReleaseSemaphore
lstrlenW
GlobalLock
GlobalUnlock
GetVersionExA
GetSystemDirectoryA
GetLocaleInfoA
FreeLibrary
LoadLibraryA
GetProcAddress
CompareStringA
WideCharToMultiByte
GetModuleHandleA
Sleep
Module32Next
CloseHandle
TlsSetValue
Process32Next
user32
BeginPaint
GetWindowLongA
RegisterClassExA
UpdateWindow
SetFocus
CharNextW
OpenClipboard
GetClipboardData
CloseClipboard
GetKeyboardLayout
GetKeyboardLayoutNameA
CreateWindowExA
SetWindowLongA
LoadCursorA
RegisterClassA
GetMenu
AdjustWindowRectEx
MoveWindow
IsWindow
DestroyWindow
EndPaint
GetSystemMetrics
GetCapture
ShowWindow
ChangeDisplaySettingsA
ReleaseCapture
SetCapture
ClientToScreen
SetCursorPos
SetCursor
ShowCursor
DestroyCursor
LoadImageA
GetKeyState
FindWindowA
LoadIconA
SetWindowPos
SystemParametersInfoA
GetCursorPos
ScreenToClient
GetAsyncKeyState
PostQuitMessage
DefWindowProcA
GetMessageA
TranslateMessage
DispatchMessageA
CharPrevExA
CharNextExA
InvalidateRect
ReleaseDC
FillRect
GetDC
PeekMessageA
OffsetRect
GetClientRect
SetRect
LoadStringA
MessageBoxA
UnregisterClassA
gdi32
SelectObject
GetStockObject
TextOutW
GetCharABCWidthsFloatW
GetTextExtentPoint32W
SetBkColor
SetTextColor
DeleteDC
CreateDIBSection
CreateCompatibleDC
SetBkMode
EnumFontFamiliesExA
PatBlt
CreateSolidBrush
StretchBlt
GetTextExtentPoint32A
CreateFontIndirectA
DeleteObject
TextOutA
ole32
OleUninitialize
CoGetClassObject
OleSetContainedObject
CoInitializeEx
OleInitialize
CoCreateInstance
CoUninitialize
CoInitialize
winmm
timeGetTime
timeEndPeriod
timeBeginPeriod
timeGetDevCaps
d3d8
Direct3DCreate8
python27
PyString_InternFromString
Py_BuildValue
PyModule_AddIntConstant
Py_InitModule4
PyLong_AsLong
PyDict_GetItemString
PyTuple_GetItem
PyTuple_Size
PyInt_AsLong
PyDict_Size
PyErr_SetString
PyExc_RuntimeError
PyList_Append
PyString_FromString
PyList_New
PyErr_BadArgument
_Py_NoneStruct
PyFloat_AsDouble
PyString_AsString
PyErr_Print
PyObject_CallObject
PyCallable_Check
PyErr_Clear
PyObject_GetAttrString
PyObject_GetAttr
PyNumber_Check
Py_Finalize
PyErr_Fetch
Py_Initialize
PyRun_StringFlags
PyDict_Next
PyDict_SetItemString
PyImport_ImportModule
PyModule_GetDict
PyImport_AddModule
Py_SetProgramName
imm32
ImmSetCompositionStringW
ImmAssociateContext
ImmIsIME
ImmGetOpenStatus
ImmGetIMEFileNameA
ImmNotifyIME
ImmGetCompositionStringW
ImmGetConversionStatus
ImmGetContext
ImmSetConversionStatus
ImmReleaseContext
ImmGetCandidateListW
devil
ilConvertImage
ilCopyPixels
ilGenImages
ilBindImage
ilLoad
ilGetInteger
ilDeleteImages
ilInit
ilSetPixels
ilTexImage
ilSave
ilOriginFunc
ilShutDown
ilEnable
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
imagehlp
StackWalk
GetTimestampForLoadedLibrary
EnumerateLoadedModules
granny2
_GrannyGetTotalTypeSize@4
_GrannyGetMeshVertexCount@4
_GrannyGetMeshIndexCount@4
_GrannySampleModelAnimationsAccelerated@20
_GrannyFreeCompletedModelControls@4
_GrannyGetWorldPoseComposite4x4Array@4
_GrannyNewLocalPose@4
_GrannyFreeLocalPose@4
_GrannyUpdateModelMatrix@16
_GrannySetModelClock@8
_GrannyNewMeshBinding@12
_GrannyFreeMeshBinding@4
_GrannyGetMeshBindingToBoneIndices@4
_GrannyGetWorldPoseComposite4x4@8
_GrannyGetWorldPose4x4@8
_GrannyFindBoneByName@12
_GrannyFreeModelInstance@4
_GrannyInstantiateModel@4
_GrannyFreeWorldPose@4
_GrannyGetSourceSkeleton@4
_GrannyNewWorldPose@4
_GrannyReadEntireFileFromMemory@8
_GrannyGetFileInfo@4
_GrannyFreeFileSection@8
_GrannyFreeFile@4
_GrannyGetMaterialTextureByType@8
_GrannyFindMatchingMember@12
_GrannyConvertSingleObject@16
_GrannySetLogCallback@4
_GrannyMeshIsRigid@4
_GrannyGetMeshVertexType@4
_GrannyNewMeshDeformer@12
_GrannyFreeMeshDeformer@4
_GrannyGetMeshTriangleGroupCount@4
_GrannyGetMeshTriangleGroups@4
_GrannyGetMeshVertices@4
_GrannyDeformVertices@24
_GrannyCopyMeshVertices@12
_GrannyCopyMeshIndices@12
GrannyPNT332VertexType
_GrannyFreeControl@4
_GrannyGetControlSpeed@4
_GrannyGetControlLoopCount@4
_GrannyGetControlRawLocalClock@4
_GrannyGetControlLocalDuration@4
_GrannySetControlRawLocalClock@8
_GrannySetControlEaseIn@8
_GrannySetControlEaseOut@8
_GrannySetControlEaseOutCurve@28
_GrannyCompleteControlAt@8
_GrannyFreeControlIfComplete@4
_GrannyPlayControlledAnimation@12
_GrannySetControlSpeed@8
_GrannySetControlLoopCount@8
_GrannySetControlEaseInCurve@28
_GrannyFreeControlOnceUnused@4
_GrannyControlIsComplete@4
mss32
_AIL_file_type@8
_AIL_file_read@8
_AIL_set_file_callbacks@16
_AIL_close_3D_provider@4
_AIL_close_3D_listener@4
_AIL_set_3D_orientation@28
_AIL_set_3D_position@16
_AIL_set_3D_velocity@20
_AIL_open_3D_listener@4
_AIL_open_3D_provider@4
_AIL_enumerate_3D_providers@12
_AIL_open_digital_driver@16
_AIL_open_stream@12
_AIL_close_digital_driver@4
_AIL_shutdown@0
_AIL_startup@0
_AIL_set_redist_directory@4
_AIL_release_3D_sample_handle@4
_AIL_allocate_3D_sample_handle@4
_AIL_auto_update_3D_position@8
_AIL_last_error@0
_AIL_set_3D_sample_file@8
_AIL_3D_sample_status@4
_AIL_start_3D_sample@4
_AIL_mem_free_lock@4
_AIL_stop_3D_sample@4
_AIL_resume_3D_sample@4
_AIL_end_3D_sample@4
_AIL_3D_sample_volume@4
_AIL_set_3D_sample_volume@8
_AIL_close_stream@4
_AIL_stream_status@4
_AIL_start_stream@4
_AIL_set_stream_loop_count@8
_AIL_pause_stream@8
_AIL_stream_volume_levels@12
_AIL_set_stream_volume_levels@12
_AIL_release_sample_handle@4
_AIL_allocate_sample_handle@4
_AIL_set_sample_file@12
_AIL_init_sample@4
_AIL_sample_status@4
_AIL_start_sample@4
_AIL_set_sample_loop_count@8
_AIL_stop_sample@4
_AIL_resume_sample@4
_AIL_end_sample@4
_AIL_sample_volume_pan@12
_AIL_set_sample_volume_pan@12
_AIL_decompress_ASI@24
_AIL_WAV_info@8
_AIL_set_3D_sample_loop_count@8
_AIL_decompress_ADPCM@12
speedtreert
?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z
?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z
?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z
?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z
?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z
?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z
?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ
?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetLodLimits@CSpeedTreeRT@@QAEXMM@Z
??0STextures@CSpeedTreeRT@@QAE@XZ
?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z
?GetCurrentError@CSpeedTreeRT@@SAPBDXZ
?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z
?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z
?SetLocalMatrices@CSpeedTreeRT@@QAEXII@Z
??0CSpeedTreeRT@@QAE@XZ
??2CSpeedTreeRT@@SAPAXI@Z
?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ
?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ
??0SGeometry@CSpeedTreeRT@@QAE@XZ
?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z
?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ
?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ
?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z
?ComputeLodLevel@CSpeedTreeRT@@QAEXXZ
?SetLodLevel@CSpeedTreeRT@@QAEXM@Z
?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ
?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z
??1CSpeedTreeRT@@QAE@XZ
??3CSpeedTreeRT@@SAXPAX@Z
??1SGeometry@CSpeedTreeRT@@QAE@XZ
??1STextures@CSpeedTreeRT@@QAE@XZ
?SetCamera@CSpeedTreeRT@@SAXPBM0@Z
?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z
?SetLightState@CSpeedTreeRT@@SAXI_N@Z
?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z
?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z
?SetTime@CSpeedTreeRT@@SAXM@Z
?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
dinput8
DirectInput8Create
ws2_32
closesocket
htons
WSAGetLastError
recv
connect
ioctlsocket
socket
send
__WSAFDIsSet
select
WSACleanup
WSAStartup
inet_addr
gethostbyname
ddraw
DirectDrawCreate
advapi32
RegCloseKey
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyA
shell32
SHGetSpecialFolderPathA
oleaut32
SysFreeString
VariantClear
SysAllocString
VariantInit
Sections
.text Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 425KB - Virtual size: 424KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 181KB - Virtual size: 472KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 45KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 181KB - Virtual size: 181KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ