G:\Serverfiles Tensei\Tensei2\Tensei2\Binario-Tensei2\Binario\Client\bin\metin2client.pdb
Static task
static1
Behavioral task
behavioral1
Sample
8dd07f5bc1eedb1dcded8ef1b2bf65e887b071553f448d6791348d993da305c8.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
8dd07f5bc1eedb1dcded8ef1b2bf65e887b071553f448d6791348d993da305c8.exe
Resource
win10v2004-20240802-en
General
-
Target
8dd07f5bc1eedb1dcded8ef1b2bf65e887b071553f448d6791348d993da305c8
-
Size
5.5MB
-
MD5
805b22b4c66e85774f552b36f679394d
-
SHA1
50651b131e7b54aba2dd39393c2b2916643daf5f
-
SHA256
8dd07f5bc1eedb1dcded8ef1b2bf65e887b071553f448d6791348d993da305c8
-
SHA512
4401ea8a2ce41e5f4fc18cb2a795b541f0d16480ba43897194250c4f5d39daf6b8a74d099978158c7758f62001868ab2f3d0793d07fd48a46f498edd422c51aa
-
SSDEEP
98304:W0y53AiQn/GgOu4W35/B5g7efbf1jjxWdHx:gQ/GgObW31b9jQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8dd07f5bc1eedb1dcded8ef1b2bf65e887b071553f448d6791348d993da305c8
Files
-
8dd07f5bc1eedb1dcded8ef1b2bf65e887b071553f448d6791348d993da305c8.exe windows:6 windows x86 arch:x86
798fcafa9ea0ec4b9d2746b345c49453
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetCurrentProcessId
GetCurrentProcess
GetComputerNameA
GetWindowsDirectoryA
IsProcessorFeaturePresent
GetVolumeInformationA
GetLastError
WriteConsoleW
SetEndOfFile
HeapQueryInformation
HeapSize
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindNextFileA
FindFirstFileA
FindClose
SetFileAttributesA
ReadProcessMemory
Module32Next
Module32First
Process32Next
Process32First
HeapReAlloc
SetStdHandle
SetFileAttributesW
SetCurrentDirectoryW
CreateProcessW
GetExitCodeProcess
GetTimeZoneInformation
CreateDirectoryW
GetFileSizeEx
SetConsoleCtrlHandler
GetConsoleOutputCP
FlushFileBuffers
GetFileAttributesExW
MoveFileExW
DeleteFileW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
ReadConsoleW
GetConsoleMode
SetFilePointerEx
HeapAlloc
HeapFree
GetStdHandle
CreateDirectoryA
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileType
GetFileInformationByHandle
ExitProcess
GetFullPathNameW
GetDriveTypeW
GetModuleHandleExW
ResumeThread
ExitThread
RaiseException
RtlUnwind
CreateToolhelp32Snapshot
WaitForMultipleObjectsEx
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
SetProcessAffinityMask
VirtualFree
VirtualProtect
VirtualAlloc
GetVersionExW
LoadLibraryExW
GetModuleFileNameW
FreeLibraryAndExitThread
OutputDebugStringW
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
CreateThread
SignalObjectAndWait
CreateTimerQueue
GetThreadTimes
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
TerminateProcess
UnhandledExceptionFilter
ResetEvent
FindResourceW
FindResourceA
SizeofResource
LoadResource
LockResource
CreateFileW
InterlockedDecrement
GetProcessHeap
HeapValidate
InterlockedIncrement
GetCurrentDirectoryW
GetTickCount
GetCurrentDirectoryA
DeleteFileA
ReleaseMutex
CreateMutexA
GetModuleFileNameA
GlobalFree
lstrlenA
GetPrivateProfileStringA
MoveFileA
FileTimeToSystemTime
RtlCaptureStackBackTrace
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
GetModuleHandleW
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
GetSystemInfo
OpenProcess
SetThreadPriority
Sleep
CreateEventA
WaitForSingleObject
SetEvent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
CloseHandle
Beep
MultiByteToWideChar
VerifyVersionInfoA
TlsGetValue
TlsAlloc
CreateEventW
InitializeCriticalSectionAndSpinCount
SetLastError
DecodePointer
EncodePointer
GetStringTypeW
TryEnterCriticalSection
QueryPerformanceFrequency
GetNativeSystemInfo
GetExitCodeThread
GetCurrentThreadId
SwitchToThread
WaitForSingleObjectEx
DuplicateHandle
FormatMessageW
QueryPerformanceCounter
CopyFileA
CreateSemaphoreA
ReleaseSemaphore
GetLocaleInfoA
CompareStringA
WideCharToMultiByte
lstrlenW
GlobalLock
GlobalUnlock
GetSystemDirectoryA
GetVersionExA
WriteFile
SetFilePointer
ReadFile
WinExec
GetModuleHandleA
GetCurrentThread
SetUnhandledExceptionFilter
GetFileSize
CreateFileA
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
OutputDebugStringA
GetTempFileNameA
GetTempPathA
RemoveDirectoryA
AllocConsole
GlobalAlloc
LoadLibraryA
GetProcAddress
FreeLibrary
LoadLibraryW
VerSetConditionMask
user32
RegisterClassA
SetWindowLongA
GetWindowLongA
UpdateWindow
SetFocus
SetWindowTextA
GetWindowRect
AdjustWindowRectEx
LoadCursorA
CharNextExA
CharPrevExA
GetMessageA
TranslateMessage
DispatchMessageA
GetKeyboardLayoutNameA
GetKeyboardLayout
InvalidateRect
OpenClipboard
CloseClipboard
GetClipboardData
CharNextW
MonitorFromPoint
GetMonitorInfoA
GetCapture
ShowWindow
SetCursorPos
LoadImageA
DestroyCursor
SetCursor
ShowCursor
GetKeyState
SystemParametersInfoA
LoadIconA
FindWindowA
ScreenToClient
GetCursorPos
SetWindowPos
FlashWindowEx
PostQuitMessage
OffsetRect
ClientToScreen
MessageBoxA
GetClientRect
GetAsyncKeyState
FillRect
SetRect
LoadStringA
DestroyWindow
IsWindow
MoveWindow
CreateWindowExA
RegisterClassExA
UnregisterClassA
DefWindowProcA
SetCapture
GetMenu
EndPaint
BeginPaint
ReleaseCapture
ChangeDisplaySettingsA
GetSystemMetrics
PeekMessageA
GetDC
ReleaseDC
gdi32
CreateSolidBrush
GetStockObject
PatBlt
CreateFontIndirectA
GetCharABCWidthsFloatW
GetTextExtentPoint32W
SelectObject
SetBkColor
SetTextColor
TextOutW
CreateCompatibleDC
DeleteDC
SetBkMode
SetDIBitsToDevice
CreateDIBSection
TextOutA
GetDeviceCaps
GetPixel
GetTextExtentPoint32A
DeleteObject
EnumFontFamiliesExA
StretchBlt
advapi32
LookupPrivilegeValueA
AdjustTokenPrivileges
RegQueryValueExA
RegOpenKeyA
OpenProcessToken
RegOpenKeyExA
RegCloseKey
shell32
SetCurrentProcessExplicitAppUserModelID
SHGetFolderPathA
SHGetSpecialFolderPathA
ole32
OleInitialize
CoGetClassObject
OleSetContainedObject
OleUninitialize
CoInitializeEx
CoCreateInstance
CoInitialize
CoUninitialize
winmm
timeGetTime
timeGetDevCaps
timeBeginPeriod
timeEndPeriod
d3d8
Direct3DCreate8
python27
PyUnicodeUCS2_DecodeUTF8
_PyLong_New
_Py_EllipsisObject
PyExc_StopIteration
PyExc_EOFError
PyExc_ValueError
PyCode_Type
PyEval_GetRestricted
PyErr_NoMemory
PyErr_Occurred
PyCode_New
PyDict_SetItem
Py_OptimizeFlag
PyEval_EvalCode
PyCode_Addr2Line
PyObject_AsCharBuffer
PyImport_AddModule
PyImport_GetMagicNumber
Py_FlushLine
Py_BuildValue
PyModule_AddIntConstant
Py_InitModule4
PyTuple_New
PyTuple_SetItem
PyLong_AsLong
PyList_SetItem
PyTuple_GetItem
PyDict_GetItemString
PyArg_ParseTuple
PyLong_FromLongLong
PyDict_New
PyDict_SetItemString
PyString_AsString
PyThreadState_Get
PyModule_AddStringConstant
PyInt_AsLong
PyDict_Next
PyDict_Size
PyList_New
PyList_Append
PyErr_SetString
PyExc_RuntimeError
PyString_FromString
PyInt_FromLong
PyImport_ImportModule
PyString_InternFromString
PyObject_GetAttrString
PyObject_GetAttr
PyCallable_Check
PyLong_AsLongLong
PyLong_AsUnsignedLongLong
PyFloat_AsDouble
PyErr_Clear
PyErr_BadArgument
PyErr_Print
PyObject_CallObject
PyNumber_Check
PyString_FromStringAndSize
PyComplex_FromCComplex
PyFloat_FromDouble
PyTuple_Size
_PyLong_FromByteArray
_Py_NoneStruct
PyModule_GetDict
PyErr_Fetch
Py_SetProgramName
Py_Initialize
Py_Finalize
PyRun_StringFlags
PyMarshal_ReadObjectFromString
PyEval_SetTrace
imm32
ImmGetOpenStatus
ImmSetConversionStatus
ImmGetConversionStatus
ImmGetCandidateListW
ImmSetCompositionStringW
ImmGetCompositionStringW
ImmAssociateContext
ImmReleaseContext
ImmGetContext
ImmIsIME
ImmGetIMEFileNameA
ImmNotifyIME
version
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
imagehlp
GetTimestampForLoadedLibrary
EnumerateLoadedModules
StackWalk
devil
ilCopyPixels
ilConvertImage
ilLoad
ilGetInteger
ilGenImages
ilDeleteImages
ilBindImage
ilInit
ilOriginFunc
ilShutDown
ilSave
ilSetPixels
ilTexImage
ilEnable
granny2
_GrannyMeshIsRigid@4
_GrannyGetMeshVertexCount@4
_GrannyGetTotalTypeSize@4
_GrannyGetWorldPoseComposite4x4@8
_GrannyGetWorldPose4x4@8
_GrannyFreeWorldPose@4
_GrannyNewWorldPose@4
_GrannyFindBoneByName@12
_GrannyGetMeshBindingToBoneIndices@4
_GrannyFreeMeshBinding@4
_GrannyNewMeshBinding@12
_GrannyFreeModelInstance@4
_GrannyInstantiateModel@4
_GrannyGetWorldPoseComposite4x4Array@4
_GrannyFreeLocalPose@4
_GrannyNewLocalPose@4
_GrannyUpdateModelMatrix@20
_GrannySampleModelAnimationsAccelerated@20
_GrannyFreeCompletedModelControls@4
_GrannySetModelClock@8
_GrannyGetSourceSkeleton@4
_GrannyGetFileInfo@4
_GrannyFreeFile@4
_GrannyFreeFileSection@8
_GrannyReadEntireFileFromMemory@8
_GrannyConvertSingleObject@20
_GrannyFindMatchingMember@16
_GrannyGetMaterialTextureByType@8
_GrannyGetLogMessageOriginString@4
_GrannyGetLogMessageTypeString@4
_GrannySetLogCallback@4
_GrannyGetMeshIndexCount@4
_GrannyGetSourceModel@4
_GrannyFindTrackGroupForModel@12
_GrannyFreeControl@4
_GrannyFreeControlOnceUnused@4
_GrannyCompleteControlAt@8
_GrannyControlIsComplete@4
_GrannyFreeControlIfComplete@4
_GrannyGetControlLoopCount@4
_GrannySetControlLoopCount@8
_GrannyGetControlSpeed@4
_GrannySetControlSpeed@8
_GrannyGetControlLocalDuration@4
_GrannySetControlEaseIn@8
_GrannySetControlEaseInCurve@28
_GrannySetControlEaseOut@8
_GrannySetControlEaseOutCurve@28
_GrannyGetControlRawLocalClock@4
_GrannySetControlRawLocalClock@8
_GrannyPlayControlledAnimation@12
_GrannyBeginControlledAnimation@8
GrannyPNT332VertexType
_GrannyDeformVertices@24
_GrannyFreeMeshDeformer@4
_GrannyNewMeshDeformer@16
_GrannyCopyMeshIndices@12
_GrannyGetMeshVertices@4
_GrannyCopyMeshVertices@12
_GrannyGetMeshVertexType@4
_GrannyGetMeshTriangleGroups@4
_GrannyGetMeshTriangleGroupCount@4
_GrannySetTrackGroupLOD@16
_GrannySetTrackGroupTarget@12
_GrannyEndControlledAnimation@4
mss32
_AIL_decompress_ADPCM@12
_AIL_file_type@8
_AIL_open_digital_driver@16
_AIL_open_stream@12
_AIL_close_digital_driver@4
_AIL_enumerate_3D_providers@12
_AIL_open_3D_provider@4
_AIL_close_3D_provider@4
_AIL_open_3D_listener@4
_AIL_close_3D_listener@4
_AIL_set_3D_position@16
_AIL_set_3D_velocity@20
_AIL_set_3D_orientation@28
_AIL_startup@0
_AIL_shutdown@0
_AIL_set_redist_directory@4
_AIL_close_stream@4
_AIL_start_stream@4
_AIL_pause_stream@8
_AIL_set_stream_volume_levels@12
_AIL_stream_volume_levels@12
_AIL_set_stream_loop_count@8
_AIL_stream_status@4
_AIL_WAV_info@8
_AIL_allocate_sample_handle@4
_AIL_release_sample_handle@4
_AIL_init_sample@4
_AIL_set_sample_file@12
_AIL_start_sample@4
_AIL_stop_sample@4
_AIL_resume_sample@4
_AIL_end_sample@4
_AIL_set_sample_loop_count@8
_AIL_sample_status@4
_AIL_sample_volume_pan@12
_AIL_allocate_3D_sample_handle@4
_AIL_release_3D_sample_handle@4
_AIL_start_3D_sample@4
_AIL_stop_3D_sample@4
_AIL_resume_3D_sample@4
_AIL_end_3D_sample@4
_AIL_set_3D_sample_file@8
_AIL_set_3D_sample_volume@8
_AIL_set_3D_sample_loop_count@8
_AIL_3D_sample_status@4
_AIL_3D_sample_volume@4
_AIL_update_3D_position@8
_AIL_auto_update_3D_position@8
_AIL_decompress_ASI@24
_AIL_set_file_callbacks@16
_AIL_file_read@8
_AIL_last_error@0
_AIL_set_sample_volume_pan@12
_AIL_mem_free_lock@4
speedtreert
?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ
?SetLodLimits@CSpeedTreeRT@@QAEXMM@Z
?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z
?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z
?GetCurrentError@CSpeedTreeRT@@SAPBDXZ
?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z
?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ
?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z
?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ
?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z
?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z
?SetLodLevel@CSpeedTreeRT@@QAEXM@Z
?ComputeLodLevel@CSpeedTreeRT@@QAEXXZ
?SetLocalMatrices@CSpeedTreeRT@@QAEXII@Z
?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z
?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z
?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetLeafLightingAdjustment@CSpeedTreeRT@@QBEMXZ
?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z
?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ
?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z
?GetTreeSize@CSpeedTreeRT@@QBEXAAM0@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z
?DeleteTransientData@CSpeedTreeRT@@QAEXXZ
?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ
?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z
??3CSpeedTreeRT@@SAXPAX@Z
??2CSpeedTreeRT@@SAPAXI@Z
??1CSpeedTreeRT@@QAE@XZ
??0CSpeedTreeRT@@QAE@XZ
??1STextures@CSpeedTreeRT@@QAE@XZ
??0STextures@CSpeedTreeRT@@QAE@XZ
??1SGeometry@CSpeedTreeRT@@QAE@XZ
??0SGeometry@CSpeedTreeRT@@QAE@XZ
?SetCamera@CSpeedTreeRT@@SAXPBM0@Z
?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z
?SetLightState@CSpeedTreeRT@@SAXI_N@Z
?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z
?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z
?SetTime@CSpeedTreeRT@@SAXM@Z
dinput8
DirectInput8Create
ws2_32
gethostbyname
gethostname
ntohl
select
inet_addr
htons
htonl
send
WSACleanup
ioctlsocket
connect
closesocket
__WSAFDIsSet
WSAStartup
ntohs
WSAGetLastError
socket
recv
ddraw
DirectDrawCreate
bcrypt
BCryptCloseAlgorithmProvider
BCryptGenRandom
BCryptOpenAlgorithmProvider
oleaut32
SysAllocString
SafeArrayCreate
SafeArrayDestroy
SafeArrayAccessData
VariantInit
VariantClear
SysFreeString
Sections
.text Size: 4.4MB - Virtual size: 4.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 737KB - Virtual size: 736KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 186KB - Virtual size: 488KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 45KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 197KB - Virtual size: 197KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ