b8ef59986dd664e69b7327367231c59f881539dab65f4c0c7d923d16fea4e306

Sharing

Copy URL Twitter E-mail

General

Target
b8ef59986dd664e69b7327367231c59f881539dab65f4c0c7d923d16fea4e306
Size 3.7MB
Sample260718-abdzvsdx3v
SHA256 b8ef59986dd664e69b7327367231c59f881539dab65f4c0c7d923d16fea4e306
MD5 35e5261dc316749a8bbd9f76216a3333
SHA1 421eca133607b7244a40c861b082e51a0745f2b1
SHA512 7449c5a69861a87007a78c39524272b137ae1234969663846d1bf9f360432d8a20926ccfac67ec73f0884ed986389b7f702be3ca7704d890cce5157d4a4a57b6
SSDEEP 49152:jrWWTv6Vk5U+5vqQFZVcWxtEBASbHce3caPtiXteQ7mv5DPxg9NBC32DAPRuXHfY:mWTvV5U+5iQ1ckYAwcBWmX99QuXH
TLSH
T1BE065A9073138DA3DD4172F0B978FFAA755C5D240B94D9C3A2E03E6949702C3AEB2A5D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b8ef59986dd664e69b7327367231c59f881539dab65f4c0c7d923d16fea4e306

File Explorer

b8ef59986dd664e69b7327367231c59f881539dab65f4c0c7d923d16fea4e306

.exe 3.7MB

b8ef59986dd664e69b7327367231c59f881539dab65f4c0c7d923d16fea4e306

IMPHASH 9dbc052c5fdd1c3ea1e6454461320047
SHA256 b8ef59986dd664e69b7327367231c59f881539dab65f4c0c7d923d16fea4e306
MD5 35e5261dc316749a8bbd9f76216a3333
SHA1 421eca133607b7244a40c861b082e51a0745f2b1
SHA512 7449c5a69861a87007a78c39524272b137ae1234969663846d1bf9f360432d8a20926ccfac67ec73f0884ed986389b7f702be3ca7704d890cce5157d4a4a57b6
SSDEEP 49152:jrWWTv6Vk5U+5vqQFZVcWxtEBASbHce3caPtiXteQ7mv5DPxg9NBC32DAPRuXHfY:mWTvV5U+5iQ1ckYAwcBWmX99QuXH
TLSH
T1BE065A9073138DA3DD4172F0B978FFAA755C5D240B94D9C3A2E03E6949702C3AEB2A5D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1989452

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

WriteFile CreateFileW GetFileSizeEx SetFilePointerEx GetStdHandle GetDynamicTimeZoneInformation GetConsoleMode WriteConsoleA GetConsoleScreenBufferInfo SetConsoleTextAttribute GetModuleHandleA GetSystemDirectoryA GetVersionExA FreeLibrary GlobalUnlock GlobalLock lstrlenW CompareStringA GetLocaleInfoA ReleaseSemaphore GlobalFree SetCurrentDirectoryA GetPrivateProfileStringA lstrlenA GetCurrentDirectoryA GetModuleFileNameA CreateDirectoryA GetFileAttributesA FindClose GetProcAddress FindFirstFileA SetFileAttributesA CreateEventA InitializeCriticalSection LeaveCriticalSection EnterCriticalSection ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW RaiseException OutputDebugStringA CreateDirectoryW FindFirstFileExW GetCurrentThreadId CreateFileMappingA UnmapViewOfFile GlobalAlloc MapViewOfFile GetFileSize QueryPerformanceFrequency QueryPerformanceCounter LoadLibraryA FindNextFileA SetUnhandledExceptionFilter FindNextFileW GetFileAttributesExW GetFullPathNameW GetModuleHandleW MoveFileExW WaitForSingleObjectEx SwitchToThread GetExitCodeThread GetNativeSystemInfo EncodePointer DecodePointer InitializeCriticalSectionEx DeleteCriticalSection SetEvent Sleep GetSystemInfo GetLastError ReadProcessMemory GetCurrentProcess Module32Next Module32First CreateToolhelp32Snapshot WideCharToMultiByte GetTickCount GetCurrentDirectoryW MultiByteToWideChar HeapFree GetProcessHeap HeapAlloc DeviceIoControl CreateFileA GetCurrentProcessId VerifyVersionInfoW VerSetConditionMask ReadFile LCMapStringEx CloseHandle CreateProcessA SetHandleInformation CreatePipe WriteConsoleW SetEndOfFile HeapQueryInformation HeapSize SetStdHandle GetSystemTimeAsFileTime SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation DeleteFileW HeapReAlloc FlushFileBuffers ReadConsoleW GetConsoleOutputCP GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc ExitProcess GetDriveTypeW GetModuleHandleExW FreeLibraryAndExitThread ExitThread LoadLibraryExW InitializeCriticalSectionAndSpinCount InterlockedPushEntrySList RtlUnwind CreateThread SetLastError ResumeThread GetModuleHandleExA SetErrorMode GetProcessAffinityMask GetCurrentThread lstrcmpA GetEnvironmentVariableA TlsFree TlsSetValue TlsAlloc TlsGetValue WaitNamedPipeW PeekNamedPipe GetModuleFileNameW TerminateProcess GetStartupInfoW UnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent InitializeSListHead GetCPInfo GetStringTypeW

user32

SendMessageA SystemParametersInfoA SetWindowPos GetSystemMetrics MonitorFromRect LoadIconA FindWindowA EnumDisplaySettingsA GetMonitorInfoA DestroyCursor ScreenToClient GetCursorPos PostQuitMessage GetAsyncKeyState GetKeyState CharPrevExA LoadImageA FlashWindowEx DestroyIcon InvalidateRect ShowCursor SetCursor SetCursorPos GetWindowRect LoadCursorA AdjustWindowRectEx GetWindowLongA GetMenu SetCapture ReleaseCapture ChangeDisplaySettingsA ShowWindow SetTimer KillTimer GetCapture IsZoomed IsIconic GetDoubleClickTime LoadStringA MessageBoxA DefWindowProcA UnregisterClassA RegisterClassExA CreateWindowExA IsWindow DestroyWindow MoveWindow SetFocus UpdateWindow SetWindowLongA RegisterClassA GetMessageA TranslateMessage DispatchMessageA GetKeyboardLayoutNameA GetKeyboardLayout OpenClipboard CloseClipboard GetClipboardData CharNextW CharNextExA GetDC FillRect SetRect OffsetRect GetClientRect ClientToScreen PeekMessageA ReleaseDC MonitorFromWindow

gdi32

CreateSolidBrush DeleteObject StretchBlt GetStockObject CreateFontIndirectA GetCharABCWidthsFloatW GetTextExtentPoint32W GetTextExtentPoint32A SelectObject SetBkColor SetTextColor TextOutW CreateCompatibleDC DeleteDC SetBkMode CreateDIBSection TextOutA EnumFontFamiliesExA

advapi32

RegSetValueExW CryptAcquireContextA CryptReleaseContext CryptGenRandom RegCloseKey RegQueryValueExA RegOpenKeyExA RegQueryValueExW RegCreateKeyExW RegOpenKeyExW

shell32

ShellExecuteA SetCurrentProcessExplicitAppUserModelID SHGetSpecialFolderPathA

ole32

CoGetClassObject OleInitialize OleUninitialize OleSetContainedObject CoInitializeEx CoUninitialize CoCreateInstance CoInitialize

oleaut32

SysFreeString VariantClear VariantInit SysAllocString

winmm

timeBeginPeriod timeGetTime timeEndPeriod timeGetDevCaps

d3d9

Direct3DCreate9

d3dx9_43

D3DXVec3Project D3DXPlaneTransform D3DXMatrixPerspectiveFovRH D3DXMatrixOrthoRH D3DXMatrixOrthoOffCenterRH D3DXCreateMatrixStack D3DXCreateCylinder D3DXCreateSphere D3DXGetImageInfoFromFileInMemory D3DXMatrixLookAtRH D3DXCreateTexture D3DXCreateTextureFromFileInMemoryEx D3DXGetFVFVertexSize D3DXMatrixRotationY D3DXMatrixMultiplyTranspose D3DXAssembleShader D3DXCreateTextureFromFileInMemory D3DXPlaneNormalize D3DXQuaternionRotationYawPitchRoll D3DXVec3Transform D3DXMatrixScaling D3DXMatrixDeterminant D3DXLoadSurfaceFromSurface D3DXVec3Normalize D3DXMatrixRotationZ D3DXVec3TransformCoord D3DXMatrixTranslation D3DXMatrixMultiply D3DXMatrixRotationYawPitchRoll D3DXQuaternionMultiply D3DXMatrixTranspose D3DXQuaternionRotationAxis D3DXMatrixRotationQuaternion D3DXMatrixInverse D3DXMatrixRotationX D3DXVec3TransformNormal D3DXMatrixRotationAxis D3DXVec4Transform D3DXMatrixTransformation D3DXVec2Normalize

python27

PyList_Append PyTuple_GetItem PyInt_AsLong PyTuple_New PyTuple_SetItem PyDict_New PyDict_SetItem PyTuple_Size PyDict_GetItemString PyLong_AsLong PyList_SetItem _Py_NoneStruct PyInt_FromLong PyInt_FromSize_t PyBool_FromLong PyDict_SetItemString PyImport_ImportModule PyObject_HasAttrString PyObject_GetAttrString Py_IncRef PyList_Size PyList_GetItem PyArg_ParseTuple Py_BuildValue PyDict_Size PyDict_Next PyFloat_FromDouble PyLong_FromLong PyModule_AddStringConstant PyString_InternFromString PyObject_GetAttr PyCallable_Check PyLong_AsLongLong PyFloat_AsDouble PyErr_Clear PyErr_BadArgument PyErr_Print PyNumber_Check PyModule_GetDict Py_SetProgramName Py_Initialize Py_Finalize PyRun_StringFlags PyImport_AddModule Py_NoSiteFlag Py_IgnoreEnvironmentFlag Py_DontWriteBytecodeFlag Py_NoUserSiteDirectory PyString_FromString PyList_New PyLong_FromLongLong PyModule_AddIntConstant _PyThreadState_Current PyString_AsString PyFrame_GetLineNumber PyErr_SetString PyObject_CallObject PyExc_RuntimeError Py_InitModule4

iphlpapi

GetAdaptersInfo GetPerAdapterInfo

imm32

ImmGetIMEFileNameA ImmIsIME ImmGetContext ImmReleaseContext ImmAssociateContext ImmGetCompositionStringW ImmSetCompositionStringW ImmGetCandidateListW ImmGetConversionStatus ImmGetOpenStatus ImmNotifyIME ImmSetConversionStatus

wininet

InternetReadFile InternetOpenA InternetOpenUrlA InternetCloseHandle

granny2

_GrannySetControlEaseOutCurve@28 _GrannySetControlRawLocalClock@8 _GrannySetControlEaseInCurve@28 _GrannySetControlEaseIn@8 _GrannyGetControlLocalDuration@4 _GrannySetControlSpeed@8 _GrannyGetControlSpeed@4 _GrannySetControlLoopCount@8 _GrannyGetControlLoopCount@4 _GrannyFreeControlIfComplete@4 _GrannyControlIsComplete@4 _GrannyCompleteControlAt@8 _GrannyFreeControlOnceUnused@4 _GrannyFreeControl@4 _GrannyFindTrackGroupForModel@12 _GrannyGetSourceModel@4 _GrannyGetMeshIndexCount@4 _GrannyMeshIsRigid@4 _GrannyGetMeshVertexCount@4 _GrannyGetTotalTypeSize@4 _GrannyGetWorldPoseComposite4x4@8 _GrannyGetWorldPose4x4@8 _GrannyFreeWorldPose@4 _GrannyNewWorldPose@4 _GrannyFindBoneByName@12 _GrannyGetMeshBindingToBoneIndices@4 _GrannyFreeMeshBinding@4 _GrannyNewMeshBinding@12 _GrannyFreeModelInstance@4 _GrannyInstantiateModel@4 _GrannyGetWorldPoseComposite4x4Array@4 _GrannyFreeLocalPose@4 _GrannyPlayControlledAnimation@12 _GrannyBeginControlledAnimation@8 _GrannyEndControlledAnimation@4 _GrannySetTrackGroupTarget@12 _GrannySetTrackGroupLOD@16 _GrannyGetMeshTriangleGroupCount@4 _GrannyGetMeshTriangleGroups@4 _GrannyGetMeshVertexType@4 _GrannyGetMeshVertices@4 _GrannyCopyMeshIndices@12 _GrannyNewMeshDeformer@16 _GrannyFreeMeshDeformer@4 _GrannyDeformVertices@24 GrannyPNT332VertexType _GrannyGetMaterialTextureByType@8 _GrannySetLogCallback@4 _GrannyGetControlRawLocalClock@4 _GrannySetControlEaseOut@8 _GrannyCopyMeshVertices@12 _GrannyNewLocalPose@4 _GrannyUpdateModelMatrix@20 _GrannySampleModelAnimationsAccelerated@20 _GrannyFreeCompletedModelControls@4 _GrannySetModelClock@8 _GrannyGetSourceSkeleton@4 _GrannyGetFileInfo@4 _GrannyFreeFile@4 _GrannyFreeFileSection@8 _GrannyReadEntireFileFromMemory@8 _GrannyConvertSingleObject@20 _GrannyFindMatchingMember@16

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

devil

ilSave ilShutDown ilDeleteImages ilCopyPixels ilConvertImage ilGetInteger ilLoad ilEnable ilBindImage ilGenImages ilSetPixels ilInit ilTexImage ilOriginFunc

mss32

_AIL_mem_free_lock@4 _AIL_file_read@8 _AIL_WAV_info@8 _AIL_decompress_ASI@24 _AIL_decompress_ADPCM@12 _AIL_file_type@8 _AIL_open_digital_driver@16 _AIL_open_stream@12 _AIL_close_digital_driver@4 _AIL_enumerate_3D_providers@12 _AIL_open_3D_provider@4 _AIL_close_3D_provider@4 _AIL_open_3D_listener@4 _AIL_close_3D_listener@4 _AIL_set_3D_position@16 _AIL_set_3D_velocity@20 _AIL_set_3D_orientation@28 _AIL_startup@0 _AIL_shutdown@0 _AIL_set_redist_directory@4 _AIL_close_stream@4 _AIL_start_stream@4 _AIL_pause_stream@8 _AIL_set_stream_volume_levels@12 _AIL_stream_volume_levels@12 _AIL_set_stream_loop_count@8 _AIL_stream_status@4 _AIL_last_error@0 _AIL_allocate_sample_handle@4 _AIL_release_sample_handle@4 _AIL_init_sample@4 _AIL_set_sample_file@12 _AIL_start_sample@4 _AIL_stop_sample@4 _AIL_resume_sample@4 _AIL_end_sample@4 _AIL_set_sample_volume_pan@12 _AIL_set_sample_loop_count@8 _AIL_sample_status@4 _AIL_sample_volume_pan@12 _AIL_allocate_3D_sample_handle@4 _AIL_release_3D_sample_handle@4 _AIL_start_3D_sample@4 _AIL_stop_3D_sample@4 _AIL_resume_3D_sample@4 _AIL_end_3D_sample@4 _AIL_set_3D_sample_file@8 _AIL_set_3D_sample_volume@8 _AIL_set_3D_sample_loop_count@8 _AIL_3D_sample_status@4 _AIL_3D_sample_volume@4 _AIL_auto_update_3D_position@8 _AIL_set_file_callbacks@16

speedtreert

?SetLightState@CSpeedTreeRT@@SAXI_N@Z ?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z ?SetCamera@CSpeedTreeRT@@SAXPBM0@Z ??0SGeometry@CSpeedTreeRT@@QAE@XZ ??1SGeometry@CSpeedTreeRT@@QAE@XZ ??0STextures@CSpeedTreeRT@@QAE@XZ ??1STextures@CSpeedTreeRT@@QAE@XZ ??0CSpeedTreeRT@@QAE@XZ ??1CSpeedTreeRT@@QAE@XZ ??2CSpeedTreeRT@@SAPAXI@Z ??3CSpeedTreeRT@@SAXPAX@Z ?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z ?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ ?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z ?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z ?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z ?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ ?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z ?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z ?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z ?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z ?GetLeafLightingAdjustment@CSpeedTreeRT@@QBEMXZ ?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ ?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ ?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ ?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z ?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z ?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z ?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z ?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z ?SetLocalMatrices@CSpeedTreeRT@@QAEXII@Z ?SetLodLevel@CSpeedTreeRT@@QAEXM@Z ?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z ?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ ?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ ?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ ?GetLeafBillboardTable@CSpeedTreeRT@@QBEPBMAAI@Z ?GetLeafLodSizeAdjustments@CSpeedTreeRT@@QAEPBMXZ ?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z ?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z ?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z ?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z ?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z ?GetCurrentError@CSpeedTreeRT@@SAPBDXZ ?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z ?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ ?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z ?SetTime@CSpeedTreeRT@@SAXM@Z

dinput8

DirectInput8Create

ws2_32

setsockopt inet_pton gethostbyname inet_addr htons WSACleanup WSAStartup WSAGetLastError socket send select recv ioctlsocket connect closesocket __WSAFDIsSet

ddraw

DirectDrawCreate

Name

.text

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

535KB

Virtual Size

535KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

131KB

Virtual Size

612KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

195KB

Virtual Size

195KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

153KB

Virtual Size

152KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=46, id=259, version=35222,

count=6, id=170, productName=VS2010 build 30319, version=30319,

count=13, id=260, version=31329,

count=43, id=260, version=34436,

count=215, id=261, version=35222,

count=2, id=262, version=35222,

count=58, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,

count=1, id=48, version=9044,

count=2, id=257, productName=VS2015 [14.0] build 23026, version=23026,

count=2, id=203, productName=VS2012 UPD3 build 60610, version=60610,

count=52, id=261, version=34436,

count=1, id=259, productName=VS2019 v16.9.2 build 29913, version=29913,

count=17, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,

count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=5, id=261, productName=VS2019 v16.11.1 build 30133, version=30133,

count=2, id=253, version=35207,

count=26, id=259, version=35207,

count=17, id=260, version=35207,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=156, version=21202,

count=2, id=123, productName=VS2005 build 50727, version=50727,

count=99, id=261, version=35207,

count=44, id=260, version=35222,

count=33, id=257, version=35222,

count=616, id=1, productName=Unmarked objects,

count=209, id=261, version=35228,

count=1, id=260, version=35228,

count=120, id=265, version=35228,

count=1, id=256, version=35228,

count=1, id=255, version=35228,

count=1, id=151,

count=1, id=258, version=35228,