1997444e0feb0f2307185f349c703c43bed247955c7d9795d1cc650bed92d358

Sharing

Copy URL Twitter E-mail

General

Target
1997444e0feb0f2307185f349c703c43bed247955c7d9795d1cc650bed92d358
Size 3.6MB
Sample260718-abdn4adx3t
SHA256 1997444e0feb0f2307185f349c703c43bed247955c7d9795d1cc650bed92d358
MD5 f42dd1401c91e0c600501df0ff42b4f9
SHA1 006bd05addc5717efb7f571044d153ed80c706a6
SHA512 79c752f91c741781f9567f122e7771d5a772908c2de08c0684a202ba03892c2ec6aa3dad8b9f051cf35aa9dd737b3ce3daa349a63b5089b0bac8c003440f12a8
SSDEEP 49152:OPd09cq9yNyEuxPjyzbTzrxVWaav9EoPYFawGsJ5EEFYF0WMQA:OiyzbTXxVWFv9HP/
TLSH
T1D6069D21B902D871E45111B29A7DBFAED15CD9182B345AD7E3C43F7A9C603C33E3296A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1997444e0feb0f2307185f349c703c43bed247955c7d9795d1cc650bed92d358

File Explorer

1997444e0feb0f2307185f349c703c43bed247955c7d9795d1cc650bed92d358

.exe 3.6MB

1997444e0feb0f2307185f349c703c43bed247955c7d9795d1cc650bed92d358

IMPHASH b131b45a6ebf0bf4c1378d2fdbea8922
SHA256 1997444e0feb0f2307185f349c703c43bed247955c7d9795d1cc650bed92d358
MD5 f42dd1401c91e0c600501df0ff42b4f9
SHA1 006bd05addc5717efb7f571044d153ed80c706a6
SHA512 79c752f91c741781f9567f122e7771d5a772908c2de08c0684a202ba03892c2ec6aa3dad8b9f051cf35aa9dd737b3ce3daa349a63b5089b0bac8c003440f12a8
SSDEEP 49152:OPd09cq9yNyEuxPjyzbTzrxVWaav9EoPYFawGsJ5EEFYF0WMQA:OiyzbTXxVWFv9HP/
TLSH
T1D6069D21B902D871E45111B29A7DBFAED15CD9182B345AD7E3C43F7A9C603C33E3296A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1865888

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GlobalFree GetModuleFileNameA DeleteFileA GetDriveTypeA GetPrivateProfileStringA lstrlenA GetCurrentDirectoryA MoveFileA GetFileAttributesA ReleaseMutex CreateMutexA FindClose FindNextFileA FindFirstFileA SetFileAttributesA InitializeCriticalSection LeaveCriticalSection SetEndOfFile WriteConsoleW HeapQueryInformation HeapSize CreateDirectoryW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW HeapReAlloc GetTimeZoneInformation CreateProcessW GetExitCodeProcess SetStdHandle ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapAlloc HeapFree EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW EnterCriticalSection VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc SetFilePointerEx GetFileSizeEx GetStdHandle GetModuleFileNameW GetFullPathNameW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileType GetFileInformationByHandle GetDriveTypeW GetModuleHandleExW ExitProcess LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InterlockedPushEntrySList RaiseException RtlUnwind QueryPerformanceFrequency SetLastError GetSystemTimeAsFileTime GetCurrentThreadId GetStartupInfoW IsDebuggerPresent InitializeSListHead TerminateProcess UnhandledExceptionFilter GetModuleHandleW CreateEventW WaitForSingleObjectEx ResetEvent GetFileAttributesExW DeleteCriticalSection WaitForSingleObject SetEvent Sleep GetSystemInfo GetLastError ReadProcessMemory GetCurrentProcess Module32Next CloseHandle Module32First GetCurrentProcessId InitializeCriticalSectionAndSpinCount GetCPInfo CompareStringEx LCMapStringEx InitializeCriticalSectionEx DecodePointer EncodePointer GetStringTypeW CreateFileW IsProcessorFeaturePresent GetProcessHeap HeapValidate QueryPerformanceCounter ReleaseSemaphore GetLocaleInfoA CompareStringA WideCharToMultiByte lstrlenW GlobalLock GlobalUnlock LoadLibraryA GetProcAddress FreeLibrary GetSystemDirectoryA GetVersionExA WriteFile ReadFile OutputDebugStringA WinExec GetModuleHandleA GetCurrentThread SetUnhandledExceptionFilter CreateFileMappingA UnmapViewOfFile MapViewOfFile GetFileSize CreateFileA GlobalAlloc CreateDirectoryA CreateToolhelp32Snapshot GetCurrentDirectoryW MultiByteToWideChar GetDateFormatW GetTickCount

user32

CharPrevExA CharNextExA GetClipboardData CloseClipboard MessageBoxA LoadStringA GetCapture ChangeDisplaySettingsA ReleaseCapture SetCapture SetCursorPos SetCursor ShowCursor DestroyCursor LoadImageA GetKeyState SendMessageA FlashWindowEx SetWindowPos GetSystemMetrics SystemParametersInfoA LoadIconA FindWindowA ScreenToClient GetCursorPos PostQuitMessage GetAsyncKeyState SetRect OffsetRect ClientToScreen PeekMessageA ReleaseDC FillRect GetDC InvalidateRect UnregisterClassA DestroyWindow IsWindow MoveWindow SetFocus UpdateWindow ShowWindow OpenClipboard GetClientRect CharNextW RegisterClassExA DefWindowProcA GetKeyboardLayout GetKeyboardLayoutNameA DispatchMessageA CreateWindowExA RegisterClassA GetMenu TranslateMessage GetMessageA LoadCursorA SetWindowLongA GetWindowLongA AdjustWindowRectEx SetWindowTextA

gdi32

DeleteObject SelectObject SetBkColor SetTextColor TextOutW CreateCompatibleDC DeleteDC SetBkMode CreateDIBSection TextOutA GetTextExtentPoint32W CreateFontIndirectA GetStockObject EnumFontFamiliesExA GetTextExtentPoint32A StretchBlt CreateSolidBrush GetCharABCWidthsFloatW

ole32

CoUninitialize CoInitialize CoInitializeEx CoCreateInstance

winmm

timeEndPeriod timeGetDevCaps timeBeginPeriod timeGetTime

d3d8

Direct3DCreate8

python27

PyTuple_New PyTuple_SetItem PyLong_FromLongLong PyInt_FromLong _Py_NoneStruct PyObject_HasAttrString PyInt_AsLong PyArg_ParseTuple PyDict_Size PyDict_Next PyDict_New PyDict_SetItem PyList_SetItem PyBool_FromLong PyModule_AddStringConstant PyModule_AddObject PyString_InternFromString PyCallable_Check PyLong_AsUnsignedLong PyLong_AsLongLong PyFloat_AsDouble PyErr_Clear PyErr_BadArgument PyErr_Print PyObject_CallObject PyNumber_Check PyDict_SetItemString PyModule_GetDict PyErr_Fetch Py_SetProgramName Py_Initialize PyDict_GetItemString PyRun_StringFlags PyImport_AddModule PyImport_ImportModule PyTuple_GetItem PyExc_RuntimeError PyErr_SetString PyFrame_GetLineNumber PyString_AsString _PyThreadState_Current PyModule_AddIntConstant Py_InitModule4 Py_BuildValue PyTuple_Size PyLong_AsLong PyList_Append PyString_FromString Py_Finalize PyList_New PyObject_GetAttrString PyObject_GetAttr

libcef

cef_string_multimap_free cef_string_multimap_alloc cef_string_multimap_append cef_string_multimap_value cef_string_multimap_size cef_string_map_append cef_string_map_value cef_string_map_key cef_string_map_size cef_string_list_append cef_string_list_value cef_string_list_size cef_browser_host_create_browser cef_command_line_get_global cef_string_map_free cef_string_map_alloc cef_v8context_get_current_context cef_api_hash cef_string_utf8_to_utf16 cef_string_utf16_clear cef_string_utf8_clear cef_string_utf16_to_utf8 cef_string_utf16_cmp cef_string_multimap_key cef_run_message_loop cef_shutdown cef_initialize cef_log cef_string_utf16_set cef_string_userfree_utf16_free cef_string_list_alloc cef_string_list_free cef_register_extension cef_execute_process

imm32

ImmGetOpenStatus ImmSetConversionStatus ImmGetConversionStatus ImmGetCandidateListW ImmSetCompositionStringW ImmGetCompositionStringW ImmAssociateContext ImmReleaseContext ImmGetContext ImmIsIME ImmGetIMEFileNameA ImmNotifyIME

devil

ilConvertImage ilGetInteger ilLoad ilOriginFunc ilEnable ilBindImage ilGenImages ilInit ilSetPixels ilTexImage ilSave ilDeleteImages ilShutDown ilCopyPixels

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

imagehlp

StackWalk GetTimestampForLoadedLibrary EnumerateLoadedModules

granny2

_GrannyGetMeshIndexCount@4 _GrannyMeshIsRigid@4 _GrannyGetMeshVertexCount@4 _GrannyGetTotalTypeSize@4 _GrannyGetWorldPoseComposite4x4@8 _GrannyGetWorldPose4x4@8 _GrannyFreeWorldPose@4 _GrannyNewWorldPose@4 _GrannyFindBoneByName@12 _GrannyGetMeshBindingToBoneIndices@4 _GrannyFreeMeshBinding@4 _GrannyNewMeshBinding@12 _GrannyFreeModelInstance@4 _GrannyInstantiateModel@4 _GrannyGetWorldPoseComposite4x4Array@4 _GrannyFreeLocalPose@4 _GrannyNewLocalPose@4 _GrannyUpdateModelMatrix@20 _GrannySampleModelAnimationsAccelerated@20 _GrannyFreeCompletedModelControls@4 _GrannySetModelClock@8 _GrannyGetSourceSkeleton@4 _GrannyGetFileInfo@4 _GrannyFreeFile@4 _GrannyFreeFileSection@8 _GrannyReadEntireFileFromMemory@8 _GrannyConvertSingleObject@20 _GrannyFindMatchingMember@16 _GrannyGetMaterialTextureByType@8 _GrannySetLogCallback@4 _GrannyFreeControl@4 _GrannyFreeControlOnceUnused@4 _GrannyCompleteControlAt@8 _GrannyControlIsComplete@4 _GrannyFreeControlIfComplete@4 _GrannyGetControlLoopCount@4 _GrannySetControlLoopCount@8 _GrannyGetControlSpeed@4 _GrannySetControlSpeed@8 _GrannyGetControlLocalDuration@4 _GrannySetControlEaseIn@8 _GrannySetControlEaseInCurve@28 _GrannySetControlEaseOut@8 _GrannySetControlEaseOutCurve@28 _GrannyGetControlRawLocalClock@4 _GrannySetControlRawLocalClock@8 _GrannyPlayControlledAnimation@12 _GrannyGetMeshTriangleGroupCount@4 _GrannyGetMeshTriangleGroups@4 _GrannyCopyMeshVertices@12 _GrannyGetMeshVertices@4 _GrannyFreeMeshDeformer@4 _GrannyDeformVertices@24 GrannyPNT332VertexType _GrannyCopyMeshIndices@12 _GrannyGetMeshVertexType@4 _GrannyNewMeshDeformer@16

mss32

_AIL_allocate_sample_handle@4 _AIL_release_sample_handle@4 _AIL_file_read@8 _AIL_set_file_callbacks@16 _AIL_init_sample@4 _AIL_set_sample_file@12 _AIL_start_sample@4 _AIL_stop_sample@4 _AIL_resume_sample@4 _AIL_end_sample@4 _AIL_set_sample_volume_pan@12 _AIL_set_sample_loop_count@8 _AIL_sample_status@4 _AIL_sample_volume_pan@12 _AIL_allocate_3D_sample_handle@4 _AIL_release_3D_sample_handle@4 _AIL_start_3D_sample@4 _AIL_stop_3D_sample@4 _AIL_resume_3D_sample@4 _AIL_end_3D_sample@4 _AIL_set_3D_sample_file@8 _AIL_set_3D_sample_volume@8 _AIL_set_3D_sample_loop_count@8 _AIL_3D_sample_status@4 _AIL_WAV_info@8 _AIL_decompress_ASI@24 _AIL_decompress_ADPCM@12 _AIL_file_type@8 _AIL_3D_sample_volume@4 _AIL_auto_update_3D_position@8 _AIL_open_digital_driver@16 _AIL_last_error@0 _AIL_open_stream@12 _AIL_close_digital_driver@4 _AIL_enumerate_3D_providers@12 _AIL_open_3D_provider@4 _AIL_close_3D_provider@4 _AIL_open_3D_listener@4 _AIL_close_3D_listener@4 _AIL_set_3D_position@16 _AIL_set_3D_velocity@20 _AIL_set_3D_orientation@28 _AIL_startup@0 _AIL_shutdown@0 _AIL_set_redist_directory@4 _AIL_close_stream@4 _AIL_start_stream@4 _AIL_pause_stream@8 _AIL_set_stream_volume_levels@12 _AIL_stream_volume_levels@12 _AIL_set_stream_loop_count@8 _AIL_stream_status@4 _AIL_mem_free_lock@4

speedtreert

?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z ?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z ?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ ?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ ?SetLodLimits@CSpeedTreeRT@@QAEXMM@Z ?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z ?SetLodLevel@CSpeedTreeRT@@QAEXM@Z ?ComputeLodLevel@CSpeedTreeRT@@QAEXXZ ?SetLocalMatrices@CSpeedTreeRT@@QAEXII@Z ?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z ?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z ?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z ?GetCurrentError@CSpeedTreeRT@@SAPBDXZ ?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z ?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ ?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ ?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ ?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z ?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z ?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z ?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z ?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ ?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z ?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z ?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z ?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ ?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z ?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z ?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z ?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ ?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z ?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ ?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z ??3CSpeedTreeRT@@SAXPAX@Z ??2CSpeedTreeRT@@SAPAXI@Z ??1CSpeedTreeRT@@QAE@XZ ??0CSpeedTreeRT@@QAE@XZ ??1STextures@CSpeedTreeRT@@QAE@XZ ??0STextures@CSpeedTreeRT@@QAE@XZ ??1SGeometry@CSpeedTreeRT@@QAE@XZ ??0SGeometry@CSpeedTreeRT@@QAE@XZ ?SetCamera@CSpeedTreeRT@@SAXPBM0@Z ?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z ?SetLightState@CSpeedTreeRT@@SAXI_N@Z ?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z ?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z ?SetTime@CSpeedTreeRT@@SAXM@Z

dinput8

DirectInput8Create

ws2_32

gethostbyname socket select recv ioctlsocket connect closesocket __WSAFDIsSet inet_addr htons WSACleanup WSAStartup send WSAGetLastError

ddraw

DirectDrawCreate

advapi32

CryptAcquireContextA CryptGenRandom RegOpenKeyExA RegQueryValueExA CryptReleaseContext RegCloseKey RegOpenKeyA

shell32

SetCurrentProcessExplicitAppUserModelID SHGetSpecialFolderPathA

oleaut32

VariantClear SysFreeString

Name

.text

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

510KB

Virtual Size

510KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

191KB

Virtual Size

467KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data1

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

273KB

Virtual Size

273KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

generic

count=43, id=224, productName=VS2013 build 21005, version=21005,

count=47, id=259, version=33145,

count=220, id=261, version=33145,

count=4, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=59, id=261, productName=VS2019 v16.7.1 build 29111, version=29111,

count=1, id=262, version=33145,

count=1, id=48, version=9044,

count=2, id=203, productName=VS2012 UPD3 build 60610, version=60610,

count=60, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,

count=117, id=261, productName=VS2019 v16.4.4 build 28316, version=28316,

count=2, id=253, version=28518,

count=20, id=260, version=30034,

count=28, id=259, version=30034,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=96, id=261, version=30034,

count=5, id=28, version=9178,

count=76, id=29, version=9178,

count=1, id=18, version=8444,

count=10, productName=Unmarked objects (old),

count=4, id=25, version=9210,

count=211, id=261, version=30159,

count=32, id=260, version=33145,

count=27, id=257, version=33145,

count=673, id=1, productName=Unmarked objects,

count=115, id=265, version=30159,

count=1, id=255, version=30159,

count=1, id=151,

count=1, id=258, version=30159,