Static task
static1
Behavioral task
behavioral1
Sample
571d40a6f6364bba4ceb9b2b414ffaa74239705a609d3b378068d478254ad6f7.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
571d40a6f6364bba4ceb9b2b414ffaa74239705a609d3b378068d478254ad6f7.exe
Resource
win10v2004-20240802-en
General
-
Target
571d40a6f6364bba4ceb9b2b414ffaa74239705a609d3b378068d478254ad6f7
-
Size
2.8MB
-
MD5
bd0292ab617c6d3d9ff81631678fe63c
-
SHA1
9bf463473cfe11f059f2281d3292c82a6f489e37
-
SHA256
571d40a6f6364bba4ceb9b2b414ffaa74239705a609d3b378068d478254ad6f7
-
SHA512
a4260501269d81b981118d6d66b4dc3fd5ae23dc8ad67cd4a0b49ff8e39ca5736dd172cd8589eddfc2ddc180e84c27f4c63acc73858c5da5e9b8b8ad6c264577
-
SSDEEP
49152:qp8O8uCL18l+DIukelZlQMVAQhVLgJ5oiRU20zN6/d:i2LOlq7kelZqMVAQP1U
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 571d40a6f6364bba4ceb9b2b414ffaa74239705a609d3b378068d478254ad6f7
Files
-
571d40a6f6364bba4ceb9b2b414ffaa74239705a609d3b378068d478254ad6f7.exe windows:6 windows x86 arch:x86
8810bebaa4e2dc91da885eed59185309
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetEndOfFile
HeapQueryInformation
HeapSize
GetProcessHeap
InitializeCriticalSection
LeaveCriticalSection
WriteConsoleW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
HeapReAlloc
SetStdHandle
GetTimeZoneInformation
CreateProcessW
GetExitCodeProcess
GetFileAttributesExW
FlushFileBuffers
CreateDirectoryW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
VirtualProtect
HeapAlloc
ReadConsoleW
HeapFree
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
GetStdHandle
GetFileType
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EnterCriticalSection
RaiseException
SetFileAttributesA
SetLastError
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
CreateEventW
ResetEvent
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetModuleHandleW
GetSystemTimeAsFileTime
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
LCMapStringEx
DecodePointer
EncodePointer
GetStringTypeW
QueryPerformanceFrequency
GetExitCodeThread
WaitForSingleObjectEx
SleepConditionVariableSRW
SleepConditionVariableCS
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
GetCurrentThreadId
TryEnterCriticalSection
DeleteCriticalSection
WaitForSingleObject
SetEvent
Sleep
GetSystemInfo
GetLastError
ReadProcessMemory
GetCurrentProcess
Module32Next
CloseHandle
Module32First
GetCurrentProcessId
FindFirstFileA
FindNextFileA
FindClose
MoveFileA
GetCurrentDirectoryA
lstrlenA
GetPrivateProfileStringA
DeleteFileA
GetModuleFileNameA
RtlUnwind
GlobalFree
InitializeCriticalSectionEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
QueryPerformanceCounter
MulDiv
ReleaseSemaphore
GetLocaleInfoA
CompareStringA
WideCharToMultiByte
GlobalLock
GlobalUnlock
LoadLibraryA
GetProcAddress
FreeLibrary
GetVersionExA
GetSystemDirectoryA
OutputDebugStringA
WinExec
GetModuleHandleA
GetCurrentThread
SetUnhandledExceptionFilter
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
GetFileSize
CreateFileA
CreateDirectoryA
GetModuleFileNameW
lstrlenW
WaitNamedPipeW
CreateFileW
PeekNamedPipe
WriteFile
ReadFile
GlobalAlloc
CreateToolhelp32Snapshot
GetTickCount
GetCurrentDirectoryW
InterlockedPushEntrySList
MultiByteToWideChar
user32
DestroyWindow
LoadStringA
GetSystemMetrics
GetCapture
ShowWindow
DefWindowProcA
UnregisterClassA
RegisterClassExA
CreateWindowExA
IsWindow
SetFocus
UpdateWindow
GetWindowLongA
InvalidateRect
GetDC
FillRect
ReleaseDC
PeekMessageA
ClientToScreen
GetClientRect
OffsetRect
SetRect
GetAsyncKeyState
PostQuitMessage
GetCursorPos
ScreenToClient
FindWindowA
LoadIconA
SetWindowPos
SystemParametersInfoA
GetKeyState
LoadImageA
DestroyCursor
ShowCursor
SetCursor
SetCursorPos
SetCapture
ReleaseCapture
ChangeDisplaySettingsA
CharPrevExA
CharNextExA
MessageBoxA
CharNextW
GetClipboardData
CloseClipboard
OpenClipboard
GetKeyboardLayout
GetKeyboardLayoutNameA
DispatchMessageA
TranslateMessage
GetMessageA
LoadCursorA
AdjustWindowRectEx
GetMenu
RegisterClassA
MoveWindow
SetWindowLongA
gdi32
GetDeviceCaps
SetBkColor
SetGraphicsMode
SetMapMode
SetTextColor
TextOutW
CreateCompatibleDC
GetCharABCWidthsFloatW
CreateFontIndirectA
EnumFontFamiliesExA
CreateSolidBrush
DeleteObject
StretchBlt
GetTextExtentPoint32A
GetTextExtentPoint32W
SelectObject
GetStockObject
TextOutA
CreateDIBSection
SetBkMode
DeleteDC
ole32
CoCreateInstance
CoUninitialize
CoInitializeEx
OleSetContainedObject
OleUninitialize
OleInitialize
CoGetClassObject
CoInitialize
winmm
timeGetTime
timeBeginPeriod
timeGetDevCaps
timeEndPeriod
d3d9
Direct3DCreate9
d3dx9_43
D3DXQuaternionMultiply
D3DXQuaternionRotationAxis
D3DXVec3Normalize
D3DXMatrixRotationYawPitchRoll
D3DXMatrixInverse
D3DXMatrixMultiply
D3DXMatrixTranslation
D3DXVec3TransformNormal
D3DXMatrixRotationAxis
D3DXVec4Transform
D3DXMatrixScaling
D3DXVec2Normalize
D3DXMatrixDeterminant
D3DXMatrixLookAtRH
D3DXVec3Project
D3DXVec3TransformCoord
D3DXMatrixPerspectiveFovRH
D3DXMatrixOrthoRH
D3DXMatrixOrthoOffCenterRH
D3DXCreateMatrixStack
D3DXCreateCylinder
D3DXCreateSphere
D3DXLoadSurfaceFromSurface
D3DXQuaternionRotationYawPitchRoll
D3DXCreateTexture
D3DXCreateTextureFromFileInMemoryEx
D3DXGetFVFVertexSize
D3DXSaveSurfaceToFileA
D3DXMatrixTranspose
D3DXVec3Transform
D3DXPlaneNormalize
D3DXMatrixRotationZ
D3DXMatrixRotationX
D3DXMatrixRotationQuaternion
python27
PyString_FromString
PyList_Append
Py_InitModule4
PyModule_AddIntConstant
PyTuple_Size
PyDict_GetItemString
PyLong_AsLong
PyTuple_New
PyTuple_SetItem
PyInt_FromLong
PyLong_FromLongLong
PyDict_Size
PyDict_Next
PyLong_AsLongLong
PyImport_ImportModule
PyModule_AddStringConstant
PyString_InternFromString
PyObject_GetAttrString
PyObject_GetAttr
PyCallable_Check
PyFloat_AsDouble
PyString_AsString
PyErr_Clear
PyErr_BadArgument
PyErr_Print
PyObject_CallObject
PyNumber_Check
PyInt_AsLong
PyDict_SetItemString
PyModule_GetDict
PyErr_Fetch
Py_SetProgramName
Py_Initialize
Py_Finalize
PyRun_StringFlags
PyImport_AddModule
PyTuple_GetItem
PyExc_RuntimeError
PyErr_SetString
Py_BuildValue
PyList_New
_Py_NoneStruct
devil
ilOriginFunc
ilEnable
ilBindImage
ilGenImages
ilInit
ilSetPixels
ilTexImage
ilSave
ilShutDown
ilGetInteger
ilDeleteImages
ilCopyPixels
ilConvertImage
ilLoad
imm32
ImmGetOpenStatus
ImmSetConversionStatus
ImmGetConversionStatus
ImmGetCandidateListW
ImmSetCompositionStringW
ImmGetCompositionStringW
ImmAssociateContext
ImmReleaseContext
ImmGetContext
ImmIsIME
ImmGetIMEFileNameA
ImmNotifyIME
version
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
imagehlp
GetTimestampForLoadedLibrary
EnumerateLoadedModules
StackWalk
granny2
_GrannyGetControlLocalDuration@4
_GrannySetControlEaseIn@8
_GrannySetLogCallback@4
_GrannyGetMaterialTextureByType@8
_GrannyFindMatchingMember@16
_GrannyConvertSingleObject@20
_GrannyFreeFileSection@8
_GrannyFreeFile@4
_GrannyGetFileInfo@4
_GrannyGetSourceSkeleton@4
_GrannySetModelClock@8
_GrannyFreeCompletedModelControls@4
_GrannySampleModelAnimationsAccelerated@20
_GrannyUpdateModelMatrix@20
_GrannyNewLocalPose@4
_GrannyFreeLocalPose@4
_GrannyGetWorldPoseComposite4x4Array@4
_GrannyInstantiateModel@4
_GrannyFreeModelInstance@4
_GrannyNewMeshBinding@12
_GrannyFreeMeshBinding@4
_GrannyGetMeshBindingToBoneIndices@4
_GrannyFindBoneByName@12
_GrannyNewWorldPose@4
_GrannyFreeWorldPose@4
_GrannyGetWorldPose4x4@8
_GrannyGetWorldPoseComposite4x4@8
_GrannyGetTotalTypeSize@4
_GrannyGetMeshVertexCount@4
_GrannyMeshIsRigid@4
_GrannyGetMeshIndexCount@4
_GrannyFreeControl@4
_GrannyFreeControlOnceUnused@4
_GrannyCompleteControlAt@8
_GrannyControlIsComplete@4
_GrannyFreeControlIfComplete@4
_GrannyGetControlLoopCount@4
_GrannySetControlLoopCount@8
_GrannyGetControlSpeed@4
_GrannyReadEntireFileFromMemory@8
GrannyPNT332VertexType
_GrannyDeformVertices@24
_GrannyFreeMeshDeformer@4
_GrannyNewMeshDeformer@16
_GrannyCopyMeshIndices@12
_GrannyGetMeshVertices@4
_GrannyCopyMeshVertices@12
_GrannyGetMeshVertexType@4
_GrannyGetMeshTriangleGroups@4
_GrannyGetMeshTriangleGroupCount@4
_GrannyPlayControlledAnimation@12
_GrannySetControlRawLocalClock@8
_GrannyGetControlRawLocalClock@4
_GrannySetControlEaseOutCurve@28
_GrannySetControlEaseOut@8
_GrannySetControlSpeed@8
_GrannySetControlEaseInCurve@28
mss32
_AIL_3D_sample_volume@4
_AIL_3D_sample_status@4
_AIL_set_3D_sample_loop_count@8
_AIL_set_3D_sample_volume@8
_AIL_set_3D_sample_file@8
_AIL_end_3D_sample@4
_AIL_resume_3D_sample@4
_AIL_stop_3D_sample@4
_AIL_start_3D_sample@4
_AIL_auto_update_3D_position@8
_AIL_allocate_3D_sample_handle@4
_AIL_sample_status@4
_AIL_set_sample_loop_count@8
_AIL_set_sample_volume_pan@12
_AIL_end_sample@4
_AIL_resume_sample@4
_AIL_stop_sample@4
_AIL_start_sample@4
_AIL_set_sample_file@12
_AIL_init_sample@4
_AIL_release_sample_handle@4
_AIL_allocate_sample_handle@4
_AIL_release_3D_sample_handle@4
_AIL_stream_status@4
_AIL_set_stream_loop_count@8
_AIL_stream_volume_levels@12
_AIL_set_stream_volume_levels@12
_AIL_pause_stream@8
_AIL_start_stream@4
_AIL_close_stream@4
_AIL_set_redist_directory@4
_AIL_shutdown@0
_AIL_startup@0
_AIL_set_3D_orientation@28
_AIL_set_3D_velocity@20
_AIL_set_3D_position@16
_AIL_close_3D_listener@4
_AIL_open_3D_listener@4
_AIL_close_3D_provider@4
_AIL_open_3D_provider@4
_AIL_enumerate_3D_providers@12
_AIL_close_digital_driver@4
_AIL_open_stream@12
_AIL_open_digital_driver@16
_AIL_file_type@8
_AIL_decompress_ADPCM@12
_AIL_decompress_ASI@24
_AIL_WAV_info@8
_AIL_set_file_callbacks@16
_AIL_file_read@8
_AIL_mem_free_lock@4
_AIL_last_error@0
_AIL_sample_volume_pan@12
speedtreert
?SetLodLevel@CSpeedTreeRT@@QAEXM@Z
?ComputeLodLevel@CSpeedTreeRT@@QAEXXZ
?SetLocalMatrices@CSpeedTreeRT@@QAEXII@Z
?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z
?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z
?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ
?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z
?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ
?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z
?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z
?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ
?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z
??3CSpeedTreeRT@@SAXPAX@Z
??2CSpeedTreeRT@@SAPAXI@Z
??1CSpeedTreeRT@@QAE@XZ
??0CSpeedTreeRT@@QAE@XZ
??1STextures@CSpeedTreeRT@@QAE@XZ
??0STextures@CSpeedTreeRT@@QAE@XZ
??1SGeometry@CSpeedTreeRT@@QAE@XZ
??0SGeometry@CSpeedTreeRT@@QAE@XZ
?SetCamera@CSpeedTreeRT@@SAXPBM0@Z
?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z
?SetLightState@CSpeedTreeRT@@SAXI_N@Z
?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z
?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ
?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z
?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z
?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z
?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z
?GetCurrentError@CSpeedTreeRT@@SAPBDXZ
?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z
?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ
?SetTime@CSpeedTreeRT@@SAXM@Z
?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z
dinput8
DirectInput8Create
ws2_32
WSAGetLastError
WSAStartup
WSACleanup
htons
inet_addr
gethostbyname
closesocket
send
select
recv
socket
connect
__WSAFDIsSet
ioctlsocket
ddraw
DirectDrawCreate
advapi32
CryptGenRandom
CryptReleaseContext
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
CryptAcquireContextA
shell32
SHGetSpecialFolderPathA
oleaut32
VariantInit
SysAllocString
VariantClear
SysFreeString
Sections
.text Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 546KB - Virtual size: 545KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 126KB - Virtual size: 636KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.fptable Size: 512B - Virtual size: 128B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 183KB - Virtual size: 182KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ