Static task
static1
Behavioral task
behavioral1
Sample
ad6d6aea4f110bd48d31dde19bf474d47fbc53d5cdd51742c69ef9a21cc99d82.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
ad6d6aea4f110bd48d31dde19bf474d47fbc53d5cdd51742c69ef9a21cc99d82.exe
Resource
win10v2004-20240802-en
General
-
Target
ad6d6aea4f110bd48d31dde19bf474d47fbc53d5cdd51742c69ef9a21cc99d82
-
Size
3.5MB
-
MD5
f55719bf4a64d95dbe1719ba135a0e65
-
SHA1
7e1dd3df464848121706908a402ac29411e21b33
-
SHA256
ad6d6aea4f110bd48d31dde19bf474d47fbc53d5cdd51742c69ef9a21cc99d82
-
SHA512
f218d76e67d1e6aa27584bd953f7ae8eb9b162eeb3b5e39db31c00e85f1e01befe132b2e74bcd909a70027d2b90ee35bf3ce6fa168ccb674c76d21da51707cfd
-
SSDEEP
49152:Y0eEqICmhYKet6MaGO8Mvmz2lBWBtig6bUVi2sJYj/gVdKf8PyIjDZyIigaX3:gyMaGO8MvmMBWBtnriOj/OdK6c
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ad6d6aea4f110bd48d31dde19bf474d47fbc53d5cdd51742c69ef9a21cc99d82
Files
-
ad6d6aea4f110bd48d31dde19bf474d47fbc53d5cdd51742c69ef9a21cc99d82.exe windows:6 windows x86 arch:x86
4cae0af0c38675a82e249b4f8c94c87a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetEndOfFile
HeapQueryInformation
HeapSize
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
SetStdHandle
GetTimeZoneInformation
FlushFileBuffers
CreateProcessW
GetExitCodeProcess
GetConsoleOutputCP
ReadConsoleW
GetConsoleMode
DeleteFileW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
FlsFree
FlsSetValue
FlsGetValue
WriteConsoleW
SetFilePointerEx
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
InterlockedPushEntrySList
RaiseException
RtlUnwind
GetFileSizeEx
VerifyVersionInfoW
VerSetConditionMask
SleepEx
WaitForMultipleObjects
GetFileType
GetStdHandle
GetEnvironmentVariableA
MoveFileExA
FormatMessageW
MultiByteToWideChar
FindClose
FindFirstFileA
FindNextFileA
ReadProcessMemory
GetCurrentDirectoryW
GetTickCount
GetCurrentDirectoryA
DeleteFileA
CheckRemoteDebuggerPresent
GetPriorityClass
GlobalFree
SetLastError
VirtualFree
OpenThread
SetThreadContext
lstrlenA
GetPrivateProfileStringA
FlsAlloc
FlushInstructionCache
GetThreadContext
HeapDestroy
HeapAlloc
SetFileAttributesA
Module32Next
Module32First
Process32Next
Process32First
CreateToolhelp32Snapshot
GetSystemInfo
OpenProcess
Sleep
WaitForSingleObject
DeleteCriticalSection
LeaveCriticalSection
HeapReAlloc
ResumeThread
SuspendThread
Thread32First
Thread32Next
HeapFree
VirtualProtect
HeapCreate
WaitNamedPipeW
PeekNamedPipe
GetModuleFileNameW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
TerminateProcess
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetProcessHeap
HeapValidate
GetCPInfo
GetSystemTimeAsFileTime
SleepConditionVariableSRW
WakeAllConditionVariable
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
QueryPerformanceFrequency
LCMapStringEx
DecodePointer
EncodePointer
InitializeCriticalSectionEx
GetStringTypeW
MoveFileExW
GetModuleHandleW
AreFileApisANSI
GetFullPathNameW
GetFileInformationByHandle
GetFileAttributesExW
FindNextFileW
FindFirstFileExW
CreateFileW
CreateDirectoryW
GetLocaleInfoEx
GetExitCodeThread
WaitForSingleObjectEx
FormatMessageA
QueryPerformanceCounter
ReleaseSemaphore
GetLocaleInfoA
CompareStringA
WideCharToMultiByte
lstrlenW
GlobalLock
GlobalUnlock
FreeLibrary
GetVersionExA
GetSystemDirectoryA
WriteFile
ReadFile
GetCurrentThreadId
GetFileSize
CreateFileA
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
OutputDebugStringA
CreateDirectoryA
GlobalAlloc
EnterCriticalSection
InitializeCriticalSection
K32GetModuleInformation
LocalFree
LocalAlloc
LoadLibraryA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
VirtualQuery
GetCurrentProcessId
GetCurrentProcess
GetLastError
SetUnhandledExceptionFilter
DuplicateHandle
CloseHandle
user32
CreateWindowExA
IsWindow
DestroyWindow
MoveWindow
SetFocus
RegisterClassExA
DefWindowProcA
UpdateWindow
GetWindowLongA
SetWindowLongA
CharNextExA
CharPrevExA
RegisterClassA
GetMenu
GetWindowRect
AdjustWindowRectEx
LoadCursorA
GetMessageA
TranslateMessage
DispatchMessageA
GetKeyboardLayoutNameA
GetKeyboardLayout
OpenClipboard
CloseClipboard
PostQuitMessage
FlashWindowEx
SetWindowPos
GetAsyncKeyState
GetCursorPos
ScreenToClient
FindWindowA
LoadIconA
SystemParametersInfoA
BlockInput
GetKeyState
ShowCursor
SetCursor
DestroyCursor
GetClipboardData
CharNextW
GetDesktopWindow
MessageBoxA
LoadStringA
OffsetRect
SetRect
FillRect
GetClientRect
InvalidateRect
ReleaseDC
GetDC
PeekMessageA
GetSystemMetrics
ChangeDisplaySettingsA
ReleaseCapture
SetCapture
GetCapture
ShowWindow
ClientToScreen
SetCursorPos
LoadImageA
UnregisterClassA
gdi32
EnumFontFamiliesExA
GetStockObject
CreateFontIndirectA
GetCharABCWidthsFloatW
GetTextExtentPoint32W
SelectObject
SetBkColor
SetTextColor
TextOutW
DeleteDC
SetBkMode
StretchBlt
GetTextExtentPoint32A
CreateCompatibleDC
GetPixel
TextOutA
CreateDIBSection
CreateSolidBrush
DeleteObject
advapi32
RegCloseKey
RegOpenKeyExA
GetCurrentHwProfileA
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegQueryValueExA
RegOpenKeyA
RegCreateKeyExW
ole32
CoInitializeEx
CoCreateInstance
CoInitialize
OleSetContainedObject
CoGetClassObject
OleInitialize
OleUninitialize
CoUninitialize
winmm
timeGetDevCaps
timeGetTime
timeEndPeriod
timeBeginPeriod
d3d8
Direct3DCreate8
python27
Py_InitModule4
Py_BuildValue
PyModule_AddIntConstant
PyList_New
PyList_Append
PyLong_AsLong
PyTuple_Size
PyTuple_GetItem
PyDict_GetItemString
PyTuple_New
PyTuple_SetItem
PyDict_New
PyDict_SetItemString
PyInt_AsLong
PyDict_Next
PyDict_Size
PyErr_SetString
PyExc_RuntimeError
PyString_FromString
PyModule_AddStringConstant
PyImport_ImportModule
PyString_InternFromString
PyObject_GetAttrString
PyObject_GetAttr
PyCallable_Check
PyLong_AsLongLong
PyFloat_AsDouble
PyString_AsString
PyErr_Clear
PyErr_BadArgument
PyObject_CallObject
PyNumber_Check
_Py_NoneStruct
PyModule_GetDict
PyErr_Fetch
Py_SetProgramName
Py_Initialize
Py_Finalize
PyRun_StringFlags
PyImport_AddModule
PyErr_Print
imm32
ImmIsIME
ImmGetConversionStatus
ImmGetContext
ImmReleaseContext
ImmNotifyIME
ImmGetOpenStatus
ImmSetConversionStatus
ImmGetIMEFileNameA
ImmGetCandidateListW
ImmSetCompositionStringW
ImmGetCompositionStringW
ImmAssociateContext
iphlpapi
IcmpCloseHandle
IcmpSendEcho
IcmpCreateFile
version
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
devil
ilInit
ilTexImage
ilSetPixels
ilSave
ilShutDown
ilOriginFunc
ilEnable
ilCopyPixels
ilConvertImage
ilLoad
ilGetInteger
ilGenImages
ilDeleteImages
ilBindImage
granny2
_GrannyPlayControlledAnimation@12
_GrannySetControlRawLocalClock@8
_GrannyGetControlRawLocalClock@4
_GrannySetControlEaseOutCurve@28
_GrannySetControlEaseOut@8
_GrannySetControlEaseInCurve@28
_GrannySetControlEaseIn@8
_GrannyGetControlLocalDuration@4
_GrannySetControlSpeed@8
_GrannyGetControlSpeed@4
_GrannySetControlLoopCount@8
_GrannyGetControlLoopCount@4
_GrannyGetMeshTriangleGroupCount@4
_GrannyControlIsComplete@4
_GrannyCompleteControlAt@8
_GrannyFreeControlOnceUnused@4
_GrannyFreeControl@4
_GrannyGetMeshIndexCount@4
_GrannyMeshIsRigid@4
_GrannyGetMeshVertexCount@4
_GrannyGetTotalTypeSize@4
_GrannyGetWorldPoseComposite4x4@8
_GrannyGetWorldPose4x4@8
_GrannyFreeWorldPose@4
_GrannyNewWorldPose@4
_GrannyFindBoneByName@12
_GrannyGetMeshTriangleGroups@4
_GrannyFreeControlIfComplete@4
_GrannyCopyMeshVertices@12
_GrannyGetMeshBindingToBoneIndices@4
_GrannyFreeMeshBinding@4
_GrannyNewMeshBinding@12
_GrannyFreeModelInstance@4
_GrannyInstantiateModel@4
_GrannyGetWorldPoseComposite4x4Array@4
_GrannyFreeLocalPose@4
_GrannyNewLocalPose@4
_GrannyUpdateModelMatrix@20
_GrannySampleModelAnimationsAccelerated@20
_GrannyFreeCompletedModelControls@4
_GrannySetModelClock@8
_GrannyGetSourceSkeleton@4
_GrannyGetFileInfo@4
_GrannyFreeFile@4
_GrannyFreeFileSection@8
_GrannyReadEntireFileFromMemory@8
_GrannyConvertSingleObject@20
_GrannyFindMatchingMember@16
_GrannyGetMaterialTextureByType@8
_GrannySetLogCallback@4
_GrannyGetMeshVertices@4
_GrannyCopyMeshIndices@12
_GrannyNewMeshDeformer@16
_GrannyFreeMeshDeformer@4
GrannyPNT332VertexType
_GrannyDeformVertices@24
_GrannyGetMeshVertexType@4
mss32
_AIL_file_read@8
_AIL_set_file_callbacks@16
_AIL_WAV_info@8
_AIL_decompress_ASI@24
_AIL_decompress_ADPCM@12
_AIL_file_type@8
_AIL_open_digital_driver@16
_AIL_open_stream@12
_AIL_close_digital_driver@4
_AIL_enumerate_3D_providers@12
_AIL_open_3D_provider@4
_AIL_close_3D_provider@4
_AIL_open_3D_listener@4
_AIL_close_3D_listener@4
_AIL_set_3D_position@16
_AIL_set_3D_velocity@20
_AIL_set_3D_orientation@28
_AIL_startup@0
_AIL_shutdown@0
_AIL_set_redist_directory@4
_AIL_close_stream@4
_AIL_start_stream@4
_AIL_pause_stream@8
_AIL_set_stream_volume_levels@12
_AIL_stream_volume_levels@12
_AIL_set_stream_loop_count@8
_AIL_stream_status@4
_AIL_last_error@0
_AIL_mem_free_lock@4
_AIL_release_sample_handle@4
_AIL_init_sample@4
_AIL_auto_update_3D_position@8
_AIL_3D_sample_volume@4
_AIL_3D_sample_status@4
_AIL_set_sample_file@12
_AIL_start_sample@4
_AIL_stop_sample@4
_AIL_resume_sample@4
_AIL_end_sample@4
_AIL_set_sample_volume_pan@12
_AIL_set_sample_loop_count@8
_AIL_sample_status@4
_AIL_sample_volume_pan@12
_AIL_allocate_3D_sample_handle@4
_AIL_release_3D_sample_handle@4
_AIL_start_3D_sample@4
_AIL_stop_3D_sample@4
_AIL_resume_3D_sample@4
_AIL_end_3D_sample@4
_AIL_set_3D_sample_file@8
_AIL_set_3D_sample_volume@8
_AIL_set_3D_sample_loop_count@8
_AIL_allocate_sample_handle@4
speedtreert
?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetLocalMatrices@CSpeedTreeRT@@QAEXII@Z
?ComputeLodLevel@CSpeedTreeRT@@QAEXXZ
?SetLodLevel@CSpeedTreeRT@@QAEXM@Z
?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z
?SetLodLimits@CSpeedTreeRT@@QAEXMM@Z
?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ
?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z
?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z
?GetCurrentError@CSpeedTreeRT@@SAPBDXZ
?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z
?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ
?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z
?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z
?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z
?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ
?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z
?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ
?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z
?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ
?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z
?SetTime@CSpeedTreeRT@@SAXM@Z
?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z
?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z
?SetLightState@CSpeedTreeRT@@SAXI_N@Z
?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z
?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ
?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z
??3CSpeedTreeRT@@SAXPAX@Z
??2CSpeedTreeRT@@SAPAXI@Z
??1CSpeedTreeRT@@QAE@XZ
??0CSpeedTreeRT@@QAE@XZ
??1STextures@CSpeedTreeRT@@QAE@XZ
??0STextures@CSpeedTreeRT@@QAE@XZ
??1SGeometry@CSpeedTreeRT@@QAE@XZ
??0SGeometry@CSpeedTreeRT@@QAE@XZ
?SetCamera@CSpeedTreeRT@@SAXPBM0@Z
dinput8
DirectInput8Create
ws2_32
getpeername
closesocket
recvfrom
freeaddrinfo
getaddrinfo
listen
getsockname
bind
accept
WSAIoctl
setsockopt
WSASetLastError
WSAWaitForMultipleEvents
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
getsockopt
connect
ioctlsocket
recv
select
htonl
WSACleanup
send
WSAGetLastError
sendto
ntohs
socket
__WSAFDIsSet
gethostbyname
htons
gethostname
WSAStartup
inet_addr
ddraw
DirectDrawCreate
cshield
?clientCode@@3KA
??$dData@J@@YAJABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??$dData@K@@YAKABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?eData@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PBXI@Z
?CheckMovespeed@@YA_NM@Z
?charName@@3PADA
?GetCShieldLoginKey@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PBD@Z
?InitializeCShield@@YA?AU_CShieldData@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0K@Z
?CheckValues@@YA_NXZ
?GenKey@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_NK@Z
?GetH@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
bcrypt
BCryptGenRandom
shell32
SHGetSpecialFolderPathA
oleaut32
VariantClear
SysFreeString
SysAllocString
VariantInit
crypt32
CertFreeCertificateChain
CertCreateCertificateChainEngine
CryptQueryObject
CertGetCertificateChain
CertFindCertificateInStore
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
CertFreeCertificateContext
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFreeCertificateChainEngine
wldap32
ord33
ord27
ord26
ord22
ord41
ord50
ord45
ord60
ord211
ord46
ord217
ord35
ord79
ord30
ord200
ord32
ord301
ord143
normaliz
IdnToUnicode
IdnToAscii
Sections
.text Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 469KB - Virtual size: 469KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 134KB - Virtual size: 624KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.fptable Size: 512B - Virtual size: 128B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 45KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 137KB - Virtual size: 137KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ