f03674c5e8f39e62b5d723233d2c1ce0a66450dde1d2665430f2c982f20bd948

Sharing

Copy URL Twitter E-mail

General

Target
f03674c5e8f39e62b5d723233d2c1ce0a66450dde1d2665430f2c982f20bd948
Size 15.6MB
Sample260802-tptr1sce36
SHA256 f03674c5e8f39e62b5d723233d2c1ce0a66450dde1d2665430f2c982f20bd948
MD5 6d2d1b0feb99ffe34a8391c24b84caa1
SHA1 54a310ff58a1f330ba8408ad2f2e35c8411b6c45
SHA512 45a96dfbe03b21e83e80290f669f3c6a252aa234c0ff937dbcc33b3fd9190d7a625876f0682176688fc5356d031f5013f43d7d00ab4cd009f7c02ea4c7a131e2
SSDEEP 393216:LnWunqBQI4HpWyUIVWsgE0wdaTlI8USmqCiDriW1YcrhE4IP2nDQhmr6:LLqj4HpWyU6WIQF64Qhm
TLSH
T115F6CF21F602D452E5D101B193BEAFA66A3C1A78036855E363C069FCED74AD27F3A707
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f03674c5e8f39e62b5d723233d2c1ce0a66450dde1d2665430f2c982f20bd948

File Explorer

f03674c5e8f39e62b5d723233d2c1ce0a66450dde1d2665430f2c982f20bd948

.exe 15.6MB

f03674c5e8f39e62b5d723233d2c1ce0a66450dde1d2665430f2c982f20bd948

IMPHASH 06832ff07ce20fb7c5c07e58f40e09db
SHA256 f03674c5e8f39e62b5d723233d2c1ce0a66450dde1d2665430f2c982f20bd948
MD5 6d2d1b0feb99ffe34a8391c24b84caa1
SHA1 54a310ff58a1f330ba8408ad2f2e35c8411b6c45
SHA512 45a96dfbe03b21e83e80290f669f3c6a252aa234c0ff937dbcc33b3fd9190d7a625876f0682176688fc5356d031f5013f43d7d00ab4cd009f7c02ea4c7a131e2
SSDEEP 393216:LnWunqBQI4HpWyUIVWsgE0wdaTlI8USmqCiDriW1YcrhE4IP2nDQhmr6:LLqj4HpWyU6WIQF64Qhm
TLSH
T115F6CF21F602D452E5D101B193BEAFA66A3C1A78036855E363C069FCED74AD27F3A707
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2285222

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

ResumeThread GetEnvironmentVariableA SetFilePointer CreatePipe TerminateProcess AssignProcessToJobObject WriteFile WaitNamedPipeA SetHandleInformation GetFileSizeEx SetInformationJobObject ReadFile GlobalFree ReleaseMutex CreateMutexA GetPrivateProfileStringA lstrlenA GetCurrentDirectoryA MoveFileA FindClose FindNextFileA SetEndOfFile HeapQueryInformation HeapSize OutputDebugStringW GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW HeapReAlloc FindFirstFileA SetFileAttributesA QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary CreateEventA Process32Next OpenProcess Process32First GetSystemInfo ReadProcessMemory SetStdHandle GetTimeZoneInformation CreateProcessW GetFileAttributesExW ReadConsoleW GetConsoleOutputCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapAlloc HeapFree SetFilePointerEx GetCurrentProcess RemoveDirectoryW CreateDirectoryW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetFileType GetFileInformationByHandle GetDriveTypeW GetModuleHandleExW FreeLibraryAndExitThread ExitThread TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount QueryFullProcessImageNameA RaiseException RtlUnwind GetSystemDirectoryW GetProcessAffinityMask SetConsoleTextAttribute GetConsoleScreenBufferInfo WriteConsoleW GetConsoleMode GetStdHandle CancelIoEx MoveFileExW GetFullPathNameW LoadLibraryExW LoadLibraryExA InitializeConditionVariable InitializeSRWLock InitOnceComplete InitOnceBeginInitialize SetLastError GetStartupInfoW IsDebuggerPresent InitializeSListHead IsProcessorFeaturePresent UnhandledExceptionFilter GetCPInfo LCMapStringEx DecodePointer EncodePointer GetModuleHandleW GetSystemTimeAsFileTime InitializeCriticalSectionEx GetStringTypeW WakeAllConditionVariable WakeConditionVariable GetTickCount64 SleepConditionVariableSRW TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive GetExitCodeThread GetCurrentThreadId WaitForSingleObjectEx ReleaseSemaphore GetLocaleInfoA CompareStringA WideCharToMultiByte GlobalLock GlobalUnlock GetVersionExA GetSystemDirectoryA WinExec GetModuleHandleA GetCurrentThread SetUnhandledExceptionFilter CreateFileMappingA UnmapViewOfFile MapViewOfFile OutputDebugStringA GetModuleFileNameW lstrlenW WaitNamedPipeW CreateFileW PeekNamedPipe GlobalAlloc GetProcAddress DuplicateHandle Module32Next LoadLibraryA GetExitCodeProcess FlushFileBuffers GetTempFileNameA SetEnvironmentVariableA ExitProcess RemoveDirectoryA GetFileSize CreateJobObjectA LocalFree CreateThread InterlockedPushEntrySList CreateFileA Module32First GetCurrentProcessId CreateToolhelp32Snapshot GetModuleFileNameA GetTickCount GetCurrentDirectoryW CreateDirectoryA CreateProcessA DeleteCriticalSection CloseHandle DeleteFileA MoveFileExA GetFileAttributesA GetLastError CopyFileA GetTempPathA Sleep MultiByteToWideChar GetCommandLineA WaitForSingleObject InitializeCriticalSection LeaveCriticalSection EnterCriticalSection GetFileAttributesExA DeleteFileW

user32

MessageBoxA SetCursorPos InvalidateRect GetDC GetWindowThreadProcessId GetClassNameA EnumWindows LoadStringA FillRect ReleaseDC PeekMessageA ClientToScreen GetClientRect OffsetRect SetRect GetAsyncKeyState PostQuitMessage GetCursorPos ScreenToClient FindWindowA GetSystemMetrics SetWindowPos SystemParametersInfoA GetKeyState LoadImageA GetDesktopWindow CharPrevExA CharNextExA CharNextW GetClipboardData CloseClipboard OpenClipboard GetKeyboardLayout GetKeyboardLayoutNameA DispatchMessageA TranslateMessage GetMessageA LoadCursorA AdjustWindowRectEx GetMenu RegisterClassA SetWindowLongA GetWindowLongA UpdateWindow SetFocus MoveWindow DestroyWindow IsWindow CreateWindowExA RegisterClassExA UnregisterClassA DefWindowProcA DestroyCursor ShowCursor SetCursor LoadIconA SetCapture ReleaseCapture ChangeDisplaySettingsA ShowWindow GetCapture

gdi32

CreateFontIndirectA GetCharABCWidthsFloatW GetTextExtentPoint32W SelectObject GetStockObject SetTextColor TextOutW CreateCompatibleDC DeleteDC SetBkMode CreateDIBSection TextOutA EnumFontFamiliesExA CreateSolidBrush DeleteObject StretchBlt SetBkColor GetTextExtentPoint32A

advapi32

CryptHashData RegOpenKeyExA RegCloseKey RegCreateKeyExW RegSetValueExW CryptReleaseContext CryptGetHashParam CryptDestroyHash RegQueryValueExA CryptCreateHash CryptGenRandom CryptAcquireContextA

shell32

SHGetSpecialFolderPathA ShellExecuteA

ole32

CoTaskMemFree OleSetContainedObject OleUninitialize OleInitialize CoGetClassObject CoInitializeEx CoUninitialize CoCreateInstance CoInitialize

winmm

timeBeginPeriod timeGetDevCaps timeEndPeriod timeGetTime waveOutClose waveOutReset waveOutOpen waveOutWrite waveOutPrepareHeader waveOutUnprepareHeader

d3d9

Direct3DCreate9

d3dx9_43

D3DXCreateTextureFromFileInMemory D3DXCompileShader D3DXAssembleShader D3DXMatrixMultiplyTranspose D3DXGetFVFVertexSize D3DXCreateSphere D3DXCreateCylinder D3DXCreateMatrixStack D3DXCreateTextureFromFileInMemoryEx D3DXCreateTexture D3DXMatrixOrthoOffCenterRH D3DXMatrixOrthoRH D3DXMatrixPerspectiveFovRH D3DXMatrixScaling D3DXVec3Project D3DXPlaneNormalize D3DXMatrixDeterminant D3DXVec2Normalize D3DXMatrixTranspose D3DXVec4Transform D3DXMatrixRotationAxis D3DXQuaternionRotationYawPitchRoll D3DXVec3TransformNormal D3DXMatrixRotationX D3DXMatrixInverse D3DXMatrixRotationYawPitchRoll D3DXMatrixRotationQuaternion D3DXQuaternionRotationAxis D3DXQuaternionMultiply D3DXMatrixMultiply D3DXMatrixTranslation D3DXVec3TransformCoord D3DXMatrixRotationZ D3DXVec3Normalize D3DXMatrixLookAtRH D3DXVec3Transform

python27

PyImport_ImportModule PyImport_AddModule PyRun_StringFlags Py_Finalize Py_Initialize Py_SetProgramName PyModule_AddIntConstant PyModule_GetDict PyDict_SetItemString _Py_NoneStruct PyNumber_Check PyObject_CallObject PyErr_Print PyErr_BadArgument PyErr_Clear PyString_AsString PyFloat_AsDouble PyCallable_Check PyObject_GetAttr PyObject_GetAttrString PyString_InternFromString PyDict_Next PyDict_Size PyList_GetItem PyList_Size PyArg_ParseTuple PyLong_AsLong PyDict_GetItemString PyTuple_Size PyErr_Fetch Py_BuildValue PyErr_SetString PyExc_RuntimeError PyTuple_GetItem PyInt_AsLong PyList_New PyString_FromString PyList_Append Py_InitModule4

winhttp

WinHttpConnect WinHttpSetTimeouts WinHttpSendRequest WinHttpCloseHandle WinHttpSetOption WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpOpen WinHttpReceiveResponse WinHttpQueryDataAvailable

imm32

ImmGetOpenStatus ImmSetConversionStatus ImmGetConversionStatus ImmGetCandidateListW ImmSetCompositionStringW ImmGetCompositionStringW ImmAssociateContext ImmReleaseContext ImmGetContext ImmIsIME ImmGetIMEFileNameA ImmNotifyIME

secur32

AcquireCredentialsHandleA DecryptMessage EncryptMessage FreeContextBuffer SetContextAttributesA QueryContextAttributesA ApplyControlToken DeleteSecurityContext InitializeSecurityContextA FreeCredentialsHandle AcceptSecurityContext

ncrypt

NCryptCreatePersistedKey NCryptSetProperty NCryptFinalizeKey NCryptImportKey NCryptExportKey NCryptDeleteKey NCryptFreeObject BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptGenRandom NCryptOpenStorageProvider

crypt32

CryptProtectData CryptEncodeObjectEx CertOpenStore CertCloseStore CertFindCertificateInStore CertCreateCertificateContext CryptStringToBinaryA CertFreeCertificateContext CertSetCertificateContextProperty CryptHashCertificate2 CertStrToNameA CryptUnprotectData CryptBinaryToStringA CertCreateSelfSignCertificate

devil

ilGetInteger ilDeleteImages ilLoad ilGenImages ilBindImage

version

VerQueryValueA GetFileVersionInfoA GetFileVersionInfoSizeA

imagehlp

GetTimestampForLoadedLibrary StackWalk EnumerateLoadedModules

granny2

_GrannyGetWorldPoseComposite4x4Array@4 _GrannyFreeLocalPose@4 _GrannyNewLocalPose@4 _GrannyUpdateModelMatrix@20 _GrannySampleModelAnimationsAccelerated@20 _GrannyFreeCompletedModelControls@4 _GrannySetModelClock@8 _GrannyInstantiateModel@4 _GrannyGetFileInfo@4 _GrannyFreeFile@4 _GrannyFreeFileSection@8 _GrannyReadEntireFileFromMemory@8 _GrannyConvertSingleObject@20 _GrannyFindMatchingMember@16 _GrannyGetMaterialTextureByType@8 _GrannySetLogCallback@4 _GrannyFreeModelInstance@4 _GrannyNewMeshBinding@12 _GrannyFreeMeshBinding@4 _GrannyGetMeshBindingToBoneIndices@4 _GrannyFindBoneByName@12 _GrannyNewWorldPose@4 _GrannyFreeWorldPose@4 _GrannyGetWorldPose4x4@8 _GrannyGetWorldPoseComposite4x4@8 _GrannyGetTotalTypeSize@4 _GrannyGetMeshVertexCount@4 _GrannyMeshIsRigid@4 _GrannyGetMeshIndexCount@4 _GrannyFreeControl@4 _GrannySetControlRawLocalClock@8 _GrannyFreeControlOnceUnused@4 _GrannyCompleteControlAt@8 _GrannyControlIsComplete@4 _GrannyFreeControlIfComplete@4 _GrannyGetControlLoopCount@4 _GrannySetControlLoopCount@8 _GrannyGetControlSpeed@4 _GrannySetControlSpeed@8 _GrannyGetControlLocalDuration@4 _GrannySetControlEaseIn@8 _GrannySetControlEaseInCurve@28 _GrannySetControlEaseOut@8 _GrannySetControlEaseOutCurve@28 _GrannyGetControlRawLocalClock@4 _GrannyPlayControlledAnimation@12 _GrannyGetMeshTriangleGroupCount@4 _GrannyGetMeshTriangleGroups@4 _GrannyGetMeshVertexType@4 _GrannyCopyMeshVertices@12 _GrannyGetMeshVertices@4 _GrannyCopyMeshIndices@12 _GrannyNewMeshDeformer@16 _GrannyFreeMeshDeformer@4 _GrannyDeformVertices@24 _GrannyGetSourceSkeleton@4 GrannyPNT332VertexType

mss32

_AIL_set_3D_sample_volume@8 _AIL_set_3D_sample_file@8 _AIL_end_3D_sample@4 _AIL_set_3D_sample_loop_count@8 _AIL_stop_3D_sample@4 _AIL_start_3D_sample@4 _AIL_release_3D_sample_handle@4 _AIL_3D_sample_status@4 _AIL_3D_sample_volume@4 _AIL_auto_update_3D_position@8 _AIL_resume_3D_sample@4 _AIL_mem_free_lock@4 _AIL_file_read@8 _AIL_set_file_callbacks@16 _AIL_WAV_info@8 _AIL_decompress_ASI@24 _AIL_decompress_ADPCM@12 _AIL_file_type@8 _AIL_open_digital_driver@16 _AIL_open_stream@12 _AIL_close_digital_driver@4 _AIL_enumerate_3D_providers@12 _AIL_open_3D_provider@4 _AIL_close_3D_provider@4 _AIL_open_3D_listener@4 _AIL_close_3D_listener@4 _AIL_set_3D_position@16 _AIL_set_3D_velocity@20 _AIL_set_3D_orientation@28 _AIL_startup@0 _AIL_shutdown@0 _AIL_set_redist_directory@4 _AIL_close_stream@4 _AIL_start_stream@4 _AIL_pause_stream@8 _AIL_set_stream_volume_levels@12 _AIL_stream_volume_levels@12 _AIL_set_stream_loop_count@8 _AIL_stream_status@4 _AIL_last_error@0 _AIL_allocate_sample_handle@4 _AIL_release_sample_handle@4 _AIL_init_sample@4 _AIL_set_sample_file@12 _AIL_start_sample@4 _AIL_stop_sample@4 _AIL_resume_sample@4 _AIL_end_sample@4 _AIL_set_sample_volume_pan@12 _AIL_set_sample_loop_count@8 _AIL_sample_status@4 _AIL_sample_volume_pan@12 _AIL_allocate_3D_sample_handle@4

speedtreert

?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z ?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z ?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z ?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ ?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ ?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ ?SetLodLimits@CSpeedTreeRT@@QAEXMM@Z ?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z ?SetLodLevel@CSpeedTreeRT@@QAEXM@Z ?ComputeLodLevel@CSpeedTreeRT@@QAEXXZ ?SetLocalMatrices@CSpeedTreeRT@@QAEXII@Z ?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z ?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z ?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z ?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z ?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ ?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z ?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z ?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ ?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ ?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ ?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z ?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z ?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z ?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z ?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ ?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z ?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z ?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z ?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ ?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z ?GetCurrentError@CSpeedTreeRT@@SAPBDXZ ??3CSpeedTreeRT@@SAXPAX@Z ??2CSpeedTreeRT@@SAPAXI@Z ??1CSpeedTreeRT@@QAE@XZ ??0CSpeedTreeRT@@QAE@XZ ??1STextures@CSpeedTreeRT@@QAE@XZ ??1SGeometry@CSpeedTreeRT@@QAE@XZ ??0SGeometry@CSpeedTreeRT@@QAE@XZ ?SetCamera@CSpeedTreeRT@@SAXPBM0@Z ?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z ?SetLightState@CSpeedTreeRT@@SAXI_N@Z ?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z ?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z ?SetTime@CSpeedTreeRT@@SAXM@Z ??0STextures@CSpeedTreeRT@@QAE@XZ ?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z

dinput8

DirectInput8Create

ws2_32

connect ntohs socket ntohl gethostbyname gethostname getsockopt getnameinfo shutdown getaddrinfo freeaddrinfo getpeername recvfrom sendto recv send getsockname WSAStartup listen WSAGetLastError __WSAFDIsSet WSACleanup accept select closesocket bind inet_addr setsockopt ioctlsocket htons htonl

ddraw

DirectDrawCreate

iphlpapi

GetExtendedTcpTable

oleaut32

VariantInit SysFreeString VariantClear SysAllocString

Name

.text

Size

11.5MB

Virtual Size

11.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.6MB

Virtual Size

3.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

148KB

Virtual Size

23.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

45KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

356KB

Virtual Size

356KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=43, id=224, productName=VS2013 build 21005, version=21005,

count=64, id=259, version=33140,

count=237, id=261, version=33140,

count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=25, version=9210,

count=1, id=29, version=9178,

count=1, id=262, version=33140,

count=1, id=48, version=9044,

count=2, id=203, productName=VS2012 UPD3 build 60610, version=60610,

count=60, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,

count=4, id=28, version=9178,

count=101, productName=Unmarked objects (old),

count=1681, id=260, version=35215,

count=63, id=261, productName=VS2019 v16.8.3 build 29335, version=29335,

count=9, id=253, version=35207,

count=26, id=259, version=35207,

count=18, id=260, version=35207,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=99, id=261, version=35207,

count=2, id=156, version=21202,

count=2, id=123, productName=VS2005 build 50727, version=50727,

count=210, id=261, version=35209,

count=1, id=260, version=35209,

count=66, id=260, version=33140,

count=37, id=257, version=33140,

count=671, id=1, productName=Unmarked objects,

count=102, id=265, version=35209,

count=1, id=255, version=35209,

count=1, id=151,

count=1, id=258, version=35209,