Granada[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

Granada.exe
Size

285KB
MD5

e250798286f6111b53ae06dc89c1de35
SHA1

137c91420bdf0f8e8df868e1ab7bcef5d0817388
SHA256

4b5b45f04766441cf9b5f790f5ccd1d86e576aeaeaa739070374c7acbd959ab8
SHA512

b9e0906fcb9a00900a61da0b8c3865cac573778a92619905f3e5133115fa35ed98951ac0364b6cc718159ef25339596acb05112c0691f7a12c4991d80a5e8f39
SSDEEP

3072:QnwQVzCgFQLFSMHsl/TxOEMq4edp8mNLkGziRRkKmROZSatYbTGUKcowBAFSpXrC:QwQVz12r+xi+ZkGrXTGsWSpgUne7JmW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Granada.exe

Files

Granada.exe
.exe windows:6 windows x64 arch:x64

8ba88572cd4757b47d1a2d589b124345

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\Michele\Desktop\Client\Autoclicker2\Source\VisualStudio\Release\Ettelen.pdb

Imports

d3d9

Direct3DCreate9

kernel32

GlobalLock
GlobalUnlock
QueryPerformanceFrequency
QueryPerformanceCounter
GetModuleHandleA
CloseHandle
CreateThread
GetTickCount
GetModuleHandleW
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
GlobalAlloc
WaitForSingleObjectEx
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
ResetEvent
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
GlobalFree
EnterCriticalSection
RtlVirtualUnwind
GetProcAddress

user32

PeekMessageA
SendMessageA
TranslateMessage
CreateWindowExA
PostQuitMessage
UnhookWindowsHookEx
SetWindowsHookExA
GetAsyncKeyState
ShowWindow
CallNextHookEx
DestroyWindow
DispatchMessageA
GetMessageA
UnregisterClassA
SetClipboardData
FindWindowA
RegisterClassExA
UpdateWindow
SendInput
GetKeyState
LoadCursorA
GetClipboardData
EmptyClipboard
DefWindowProcA
CloseClipboard
OpenClipboard
GetCursorPos
ScreenToClient
SetCursorPos
ReleaseCapture
GetCapture
ClientToScreen
IsChild
GetForegroundWindow
SetCapture
SetCursor
GetClientRect

imm32

ImmSetCompositionWindow
ImmGetContext
ImmReleaseContext

xinput1_4

ord2
ord4

vcruntime140

memcpy
memset
__C_specific_handler
__std_terminate
__CxxFrameHandler3
memmove
memchr
strstr

api-ms-win-crt-stdio-l1-1-0

ftell
__p__commode
_set_fmode
__stdio_common_vsscanf
fread
__acrt_iob_func
_wfopen
fwrite
__stdio_common_vsprintf
__stdio_common_vfprintf
fseek
fclose
fflush

api-ms-win-crt-string-l1-1-0

strncpy
strcmp

api-ms-win-crt-utility-l1-1-0

qsort
rand
srand

api-ms-win-crt-heap-l1-1-0

_set_new_mode
free
malloc

api-ms-win-crt-runtime-l1-1-0

__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_wassert
_exit
exit
terminate
_initterm_e
_initterm
_get_initial_narrow_environment
_set_app_type
_seh_filter_exe
__p___argc
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-math-l1-1-0

sqrtf
ceilf
sinf
__setusermatherr
fmodf
cosf
floorf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 198KB - Virtual size: 198KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8ba88572cd4757b47d1a2d589b124345

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

d3d9

kernel32

user32

imm32

xinput1_4

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 198KB - Virtual size: 198KB

.rdata Size: 75KB - Virtual size: 74KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 9KB - Virtual size: 9KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 512B - Virtual size: 128B

.text
Size: 198KB - Virtual size: 198KB

.rdata
Size: 75KB - Virtual size: 74KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 9KB - Virtual size: 9KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 512B - Virtual size: 128B