Static task
static1
Behavioral task
behavioral1
Sample
d6961d2825b065340c72e16e6351825c90410bac0a67e757ff21f7e6e9deb416.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d6961d2825b065340c72e16e6351825c90410bac0a67e757ff21f7e6e9deb416.exe
Resource
win10v2004-20241007-en
General
-
Target
d6961d2825b065340c72e16e6351825c90410bac0a67e757ff21f7e6e9deb416
-
Size
3.0MB
-
MD5
e032a5e2dd7c8a8b6349714309b3afaa
-
SHA1
220834e268870f5ac99178b9ee0f45c987af8624
-
SHA256
d6961d2825b065340c72e16e6351825c90410bac0a67e757ff21f7e6e9deb416
-
SHA512
442501d7c8fcd39c362502a7fa59bff582c393d21013c4ae8797efc825e9f430331c0fbaac3b867427de617d894981f2923acaed9a8786dafa040fc6a719fbd0
-
SSDEEP
49152:pl08UPMb1lBkWwNjW1J6HJmU8uyDQGnGFrI5FzPRXXoJ5B/WxNXjZ6fB5i:FjGNjWOHJmHnGAFzR7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d6961d2825b065340c72e16e6351825c90410bac0a67e757ff21f7e6e9deb416
Files
-
d6961d2825b065340c72e16e6351825c90410bac0a67e757ff21f7e6e9deb416.exe windows:5 windows x86 arch:x86
06a8f3de52a37502a0dfc9d45f59eafd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetEndOfFile
CreateProcessA
GetExitCodeProcess
GetFullPathNameW
WriteConsoleW
HeapReAlloc
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SystemTimeToTzSpecificLocalTime
SetFileAttributesA
SetThreadPriority
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
WaitForSingleObject
SetEvent
GetSystemInfo
GetTickCount
GetCurrentDirectoryW
MultiByteToWideChar
FindClose
FindNextFileA
FindFirstFileA
CreateThread
FindFirstFileExW
VirtualProtect
VirtualFree
VirtualAlloc
GetVersionExW
LoadLibraryW
UnregisterWaitEx
InitializeSListHead
FreeLibraryAndExitThread
GetThreadTimes
OutputDebugStringW
GetFileAttributesExW
CreateDirectoryW
ReadConsoleW
FlushFileBuffers
SetFilePointerEx
GetConsoleMode
GetConsoleCP
GetTimeZoneInformation
GetOEMCP
GetACP
IsValidCodePage
HeapSize
SetEnvironmentVariableA
GetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
Sleep
CheckRemoteDebuggerPresent
CreateSemaphoreW
GetStartupInfoW
CreateEventW
InitializeCriticalSectionAndSpinCount
SetLastError
UnhandledExceptionFilter
FileTimeToSystemTime
PeekNamedPipe
GetFileType
GetFileInformationByHandle
FileTimeToLocalFileTime
GetCPInfo
LoadLibraryExW
GetDriveTypeW
RtlUnwind
GetCommandLineA
RaiseException
CreateTimerQueue
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
GetModuleHandleW
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetThreadPriority
SwitchToThread
SignalObjectAndWait
WaitForSingleObjectEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
IsDebuggerPresent
GetModuleFileNameW
ReadProcessMemory
Process32Next
TerminateProcess
OpenProcess
Process32First
Module32Next
Module32First
GetCurrentProcessId
CreateToolhelp32Snapshot
CloseHandle
HeapFree
GetProcessHeap
HeapAlloc
GetLastError
GetCurrentProcess
GetPriorityClass
MoveFileA
GetCurrentDirectoryA
lstrlenA
GetPrivateProfileStringA
DeleteFileA
GetModuleFileNameA
GlobalFree
CompareStringW
AreFileApisANSI
GetModuleHandleExW
ExitProcess
DecodePointer
EncodePointer
GetStringTypeW
DuplicateHandle
GetCurrentThreadId
GetSystemTimeAsFileTime
CreateFileW
IsProcessorFeaturePresent
HeapValidate
QueryPerformanceCounter
ReleaseSemaphore
GetLocaleInfoA
CompareStringA
WideCharToMultiByte
GetVersionExA
GetSystemDirectoryA
LoadLibraryA
lstrlenW
GlobalUnlock
GlobalLock
ReadFile
WriteFile
OutputDebugStringA
WinExec
GetCurrentThread
SetUnhandledExceptionFilter
CreateFileA
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
GetFileSize
RemoveDirectoryA
CreateDirectoryA
GlobalAlloc
GetModuleHandleA
GetProcAddress
FreeLibrary
LCMapStringW
LoadLibraryExA
user32
UpdateWindow
SetFocus
GetWindowLongA
SetWindowLongA
RegisterClassA
GetMenu
AdjustWindowRectEx
LoadCursorA
GetMessageA
TranslateMessage
DispatchMessageA
GetKeyboardLayoutNameA
GetKeyboardLayout
OpenClipboard
CloseClipboard
GetClipboardData
CharNextW
CharNextExA
CharPrevExA
LoadIconA
ScreenToClient
LoadStringA
GetCursorPos
PostQuitMessage
GetAsyncKeyState
SetRect
OffsetRect
GetClientRect
ClientToScreen
PeekMessageA
ReleaseDC
FillRect
GetDC
InvalidateRect
GetWindowTextA
WindowFromPoint
FindWindowA
SendMessageA
MessageBoxA
ChangeDisplaySettingsA
ReleaseCapture
SetCapture
SetCursorPos
MoveWindow
DestroyWindow
IsWindow
GetSystemMetrics
GetCapture
CreateWindowExA
RegisterClassExA
UnregisterClassA
DefWindowProcA
SetWindowPos
SystemParametersInfoA
GetKeyState
LoadImageA
DestroyCursor
ShowCursor
SetCursor
ShowWindow
gdi32
EnumFontFamiliesExA
GetCharABCWidthsFloatW
GetTextExtentPoint32W
SelectObject
SetBkColor
SetTextColor
TextOutW
CreateCompatibleDC
DeleteDC
SetBkMode
CreateSolidBrush
DeleteObject
StretchBlt
CreateFontIndirectA
GetStockObject
GetTextExtentPoint32A
TextOutA
CreateDIBSection
advapi32
GetLengthSid
RegOpenKeyExA
RegQueryValueExA
RegOpenKeyA
CryptAcquireContextA
CryptReleaseContext
CryptGenRandom
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
RegCloseKey
InitializeAcl
AddAccessDeniedAce
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityInfo
FreeSid
shell32
SHGetFolderPathA
SHGetSpecialFolderPathA
ShellExecuteA
ole32
CoInitializeEx
OleUninitialize
OleInitialize
CoGetClassObject
OleSetContainedObject
CoUninitialize
CoInitialize
CoCreateInstance
winmm
timeEndPeriod
timeBeginPeriod
timeGetTime
timeGetDevCaps
d3d8
Direct3DCreate8
python27
PyImport_ImportModule
PyImport_AddModule
Py_BuildValue
PyErr_SetString
PyTuple_GetItem
PyInt_AsLong
PyList_New
PyString_FromString
PyList_Append
Py_InitModule4
PyModule_AddIntConstant
PyTuple_Size
PyDict_GetItemString
PyLong_AsLong
PyArg_ParseTuple
PyTuple_New
PyTuple_SetItem
PyInt_FromLong
PyDict_Size
PyDict_Next
PyString_InternFromString
PyObject_GetAttrString
PyObject_GetAttr
PyCallable_Check
PyLong_AsLongLong
PyFloat_AsDouble
PyString_AsString
PyErr_Clear
PyErr_BadArgument
PyErr_Print
PyObject_CallObject
PyNumber_Check
PyExc_RuntimeError
_Py_NoneStruct
PyDict_SetItemString
PyModule_GetDict
PyErr_Fetch
Py_SetProgramName
Py_Initialize
Py_Finalize
PyRun_StringFlags
iphlpapi
GetAdaptersInfo
devil
ilOriginFunc
ilLoad
ilGetInteger
ilConvertImage
ilCopyPixels
ilDeleteImages
ilShutDown
ilSave
ilTexImage
ilBindImage
ilInit
ilSetPixels
ilGenImages
ilEnable
imm32
ImmGetOpenStatus
ImmSetConversionStatus
ImmGetConversionStatus
ImmGetCandidateListW
ImmSetCompositionStringW
ImmGetCompositionStringW
ImmAssociateContext
ImmReleaseContext
ImmGetContext
ImmIsIME
ImmGetIMEFileNameA
ImmNotifyIME
imagehlp
StackWalk
EnumerateLoadedModules
GetTimestampForLoadedLibrary
version
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
granny2
_GrannyFindBoneByName@12
_GrannyGetMeshBindingToBoneIndices@4
_GrannyFreeMeshBinding@4
_GrannyNewMeshBinding@12
_GrannyFreeModelInstance@4
_GrannyInstantiateModel@4
_GrannyGetWorldPoseComposite4x4Array@4
_GrannyFreeLocalPose@4
_GrannyNewLocalPose@4
_GrannyUpdateModelMatrix@20
_GrannySampleModelAnimationsAccelerated@20
_GrannyFreeCompletedModelControls@4
_GrannySetModelClock@8
_GrannyGetSourceSkeleton@4
_GrannyGetFileInfo@4
_GrannyFreeFile@4
_GrannyFreeFileSection@8
_GrannyReadEntireFileFromMemory@8
_GrannyConvertSingleObject@20
_GrannyFindMatchingMember@16
_GrannyGetMaterialTextureByType@8
_GrannySetLogCallback@4
_GrannyNewWorldPose@4
_GrannyFreeWorldPose@4
_GrannyGetWorldPose4x4@8
_GrannyGetWorldPoseComposite4x4@8
_GrannyGetTotalTypeSize@4
_GrannyGetMeshVertexCount@4
_GrannyMeshIsRigid@4
_GrannyGetMeshIndexCount@4
_GrannyFreeControl@4
_GrannyFreeControlOnceUnused@4
_GrannyCompleteControlAt@8
_GrannyControlIsComplete@4
_GrannyFreeControlIfComplete@4
_GrannyGetControlLoopCount@4
_GrannySetControlLoopCount@8
_GrannyGetControlSpeed@4
_GrannySetControlSpeed@8
_GrannyGetControlLocalDuration@4
_GrannySetControlEaseIn@8
_GrannySetControlEaseInCurve@28
_GrannySetControlEaseOut@8
_GrannySetControlEaseOutCurve@28
_GrannyGetControlRawLocalClock@4
_GrannySetControlRawLocalClock@8
_GrannyPlayControlledAnimation@12
_GrannyGetMeshTriangleGroupCount@4
GrannyPNT332VertexType
_GrannyDeformVertices@24
_GrannyFreeMeshDeformer@4
_GrannyNewMeshDeformer@16
_GrannyCopyMeshIndices@12
_GrannyGetMeshVertices@4
_GrannyCopyMeshVertices@12
_GrannyGetMeshVertexType@4
_GrannyGetMeshTriangleGroups@4
mss32
_AIL_decompress_ASI@24
_AIL_decompress_ADPCM@12
_AIL_file_type@8
_AIL_open_digital_driver@16
_AIL_open_stream@12
_AIL_close_digital_driver@4
_AIL_enumerate_3D_providers@12
_AIL_open_3D_provider@4
_AIL_close_3D_provider@4
_AIL_open_3D_listener@4
_AIL_close_3D_listener@4
_AIL_set_3D_position@16
_AIL_set_3D_velocity@20
_AIL_set_3D_orientation@28
_AIL_startup@0
_AIL_shutdown@0
_AIL_set_redist_directory@4
_AIL_close_stream@4
_AIL_start_stream@4
_AIL_pause_stream@8
_AIL_set_stream_volume_levels@12
_AIL_stream_volume_levels@12
_AIL_set_stream_loop_count@8
_AIL_stream_status@4
_AIL_WAV_info@8
_AIL_allocate_sample_handle@4
_AIL_release_sample_handle@4
_AIL_set_sample_file@12
_AIL_start_sample@4
_AIL_stop_sample@4
_AIL_resume_sample@4
_AIL_end_sample@4
_AIL_set_sample_volume_pan@12
_AIL_set_sample_loop_count@8
_AIL_sample_status@4
_AIL_sample_volume_pan@12
_AIL_allocate_3D_sample_handle@4
_AIL_release_3D_sample_handle@4
_AIL_start_3D_sample@4
_AIL_stop_3D_sample@4
_AIL_resume_3D_sample@4
_AIL_end_3D_sample@4
_AIL_set_3D_sample_file@8
_AIL_set_3D_sample_volume@8
_AIL_set_3D_sample_loop_count@8
_AIL_3D_sample_status@4
_AIL_3D_sample_volume@4
_AIL_auto_update_3D_position@8
_AIL_set_file_callbacks@16
_AIL_file_read@8
_AIL_last_error@0
_AIL_init_sample@4
_AIL_mem_free_lock@4
speedtreert
?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z
?GetCurrentError@CSpeedTreeRT@@SAPBDXZ
?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z
?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ
?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z
?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ
?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z
?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z
?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ
?SetLodLimits@CSpeedTreeRT@@QAEXMM@Z
?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z
?SetLodLevel@CSpeedTreeRT@@QAEXM@Z
?ComputeLodLevel@CSpeedTreeRT@@QAEXXZ
?SetLocalMatrices@CSpeedTreeRT@@QAEXII@Z
?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z
?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z
?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ
?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z
?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ
?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z
?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ
?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z
??3CSpeedTreeRT@@SAXPAX@Z
??2CSpeedTreeRT@@SAPAXI@Z
??1CSpeedTreeRT@@QAE@XZ
??0CSpeedTreeRT@@QAE@XZ
??1STextures@CSpeedTreeRT@@QAE@XZ
??0STextures@CSpeedTreeRT@@QAE@XZ
??1SGeometry@CSpeedTreeRT@@QAE@XZ
??0SGeometry@CSpeedTreeRT@@QAE@XZ
?SetCamera@CSpeedTreeRT@@SAXPBM0@Z
?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z
?SetLightState@CSpeedTreeRT@@SAXI_N@Z
?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z
?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z
?SetTime@CSpeedTreeRT@@SAXM@Z
dinput8
DirectInput8Create
ws2_32
inet_addr
htons
WSACleanup
WSAStartup
WSAGetLastError
send
select
recv
ioctlsocket
connect
closesocket
__WSAFDIsSet
socket
gethostbyname
ddraw
DirectDrawCreate
oleaut32
VariantClear
SysAllocString
VariantInit
SysFreeString
Sections
.text Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 489KB - Virtual size: 489KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 197KB - Virtual size: 486KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 55KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ