13ed8d45c637b8eb36b4a081312e0899123014ba53e698bf78b30b447ebdc327

Sharing

Copy URL Twitter E-mail

General

Target
13ed8d45c637b8eb36b4a081312e0899123014ba53e698bf78b30b447ebdc327
Size 15.6MB
Sample260802-tpvpbasvcw
SHA256 13ed8d45c637b8eb36b4a081312e0899123014ba53e698bf78b30b447ebdc327
MD5 7265d9be90c705e2288cf5ae33ae1560
SHA1 53c040e6ad892ddc23f87466d6f4bc94e1af7d63
SHA512 a0311d2d213adfc8393694e1569846fdc7cc209b849d4332b0f016ab7e575314b1d661c96a79ad7c55c645e5bd533857770b471dace6bd60b9d55dbf844d84d2
SSDEEP 393216:n40j+T6cO7YcULmCzA1EUl5uNZXJI4A5Pp2pNDU64V452PYP2Y9vSW4L:njDcO7YcUCCWrMlfVtvSW
TLSH
T170F6CF21F502D122E5D101B193BEAFE66A3C1B78036854E3A3C469FDED74AD17A36B07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
13ed8d45c637b8eb36b4a081312e0899123014ba53e698bf78b30b447ebdc327

File Explorer

13ed8d45c637b8eb36b4a081312e0899123014ba53e698bf78b30b447ebdc327

.exe 15.6MB

13ed8d45c637b8eb36b4a081312e0899123014ba53e698bf78b30b447ebdc327

IMPHASH 94df47ebeff1e610c62be99561f8e4de
SHA256 13ed8d45c637b8eb36b4a081312e0899123014ba53e698bf78b30b447ebdc327
MD5 7265d9be90c705e2288cf5ae33ae1560
SHA1 53c040e6ad892ddc23f87466d6f4bc94e1af7d63
SHA512 a0311d2d213adfc8393694e1569846fdc7cc209b849d4332b0f016ab7e575314b1d661c96a79ad7c55c645e5bd533857770b471dace6bd60b9d55dbf844d84d2
SSDEEP 393216:n40j+T6cO7YcULmCzA1EUl5uNZXJI4A5Pp2pNDU64V452PYP2Y9vSW4L:njDcO7YcUCCWrMlfVtvSW
TLSH
T170F6CF21F502D122E5D101B193BEAFE66A3C1B78036854E3A3C469FDED74AD17A36B07
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2280726

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetProcAddress FreeLibrary DuplicateHandle CreatePipe TerminateProcess AssignProcessToJobObject WriteFile WaitNamedPipeA SetHandleInformation GetFileSizeEx SetInformationJobObject ReadFile GlobalFree ReleaseMutex CreateMutexA GetPrivateProfileStringA lstrlenA GetCurrentDirectoryA MoveFileA FindClose FindNextFileA FindFirstFileA SetFileAttributesA QueryPerformanceCounter QueryPerformanceFrequency SetEndOfFile HeapQueryInformation HeapSize OutputDebugStringW GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW HeapReAlloc CreateEventA Process32Next FlushFileBuffers OpenProcess Process32First GetSystemInfo ReadProcessMemory SetStdHandle GetTimeZoneInformation CreateProcessW GetFileAttributesExW ReadConsoleW GetConsoleOutputCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapAlloc HeapFree SetFilePointerEx DeleteFileW RemoveDirectoryW GetCurrentProcess FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetFileType GetFileInformationByHandle GetDriveTypeW GetModuleHandleExW FreeLibraryAndExitThread ExitThread TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount LoadLibraryA RaiseException RtlUnwind GetSystemDirectoryW GetProcessAffinityMask SetConsoleTextAttribute GetConsoleScreenBufferInfo WriteConsoleW GetConsoleMode GetStdHandle CancelIoEx MoveFileExW GetFullPathNameW LoadLibraryExW LoadLibraryExA InitializeConditionVariable InitializeSRWLock InitOnceComplete InitOnceBeginInitialize SetLastError GetStartupInfoW IsDebuggerPresent InitializeSListHead IsProcessorFeaturePresent UnhandledExceptionFilter GetCPInfo LCMapStringEx DecodePointer EncodePointer GetModuleHandleW GetSystemTimeAsFileTime InitializeCriticalSectionEx GetStringTypeW WakeAllConditionVariable WakeConditionVariable GetTickCount64 SleepConditionVariableSRW TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive GetExitCodeThread GetCurrentThreadId WaitForSingleObjectEx ReleaseSemaphore GetLocaleInfoA CompareStringA WideCharToMultiByte GlobalLock GlobalUnlock GetVersionExA GetSystemDirectoryA WinExec GetModuleHandleA GetCurrentThread SetUnhandledExceptionFilter CreateFileMappingA UnmapViewOfFile MapViewOfFile OutputDebugStringA GetModuleFileNameW lstrlenW WaitNamedPipeW CreateFileW PeekNamedPipe GlobalAlloc GetTempFileNameA GetExitCodeProcess Module32Next SetEnvironmentVariableA ExitProcess RemoveDirectoryA GetFileSize CreateJobObjectA LocalFree CreateThread CreateFileA QueryFullProcessImageNameA ResumeThread GetEnvironmentVariableA InterlockedPushEntrySList SetFilePointer Module32First GetCurrentProcessId CreateToolhelp32Snapshot GetModuleFileNameA GetTickCount GetCurrentDirectoryW CreateDirectoryA CreateProcessA DeleteCriticalSection CloseHandle DeleteFileA MoveFileExA GetFileAttributesA GetLastError CopyFileA GetTempPathA Sleep MultiByteToWideChar GetCommandLineA WaitForSingleObject InitializeCriticalSection LeaveCriticalSection EnterCriticalSection GetFileAttributesExA CreateDirectoryW

user32

MessageBoxA SetCursorPos InvalidateRect GetDC GetWindowThreadProcessId GetClassNameA EnumWindows LoadStringA FillRect ReleaseDC PeekMessageA ClientToScreen GetClientRect OffsetRect SetRect GetAsyncKeyState PostQuitMessage GetCursorPos ScreenToClient FindWindowA GetSystemMetrics SetWindowPos SystemParametersInfoA GetKeyState LoadImageA GetDesktopWindow CharPrevExA CharNextExA CharNextW GetClipboardData CloseClipboard OpenClipboard GetKeyboardLayout GetKeyboardLayoutNameA DispatchMessageA TranslateMessage GetMessageA LoadCursorA AdjustWindowRectEx GetMenu RegisterClassA SetWindowLongA GetWindowLongA UpdateWindow SetFocus MoveWindow DestroyWindow IsWindow CreateWindowExA RegisterClassExA UnregisterClassA DefWindowProcA DestroyCursor ShowCursor SetCursor LoadIconA SetCapture ReleaseCapture ChangeDisplaySettingsA ShowWindow GetCapture

gdi32

CreateFontIndirectA GetCharABCWidthsFloatW GetTextExtentPoint32W GetStockObject SetBkColor SetTextColor TextOutW CreateCompatibleDC DeleteDC SetBkMode CreateDIBSection TextOutA EnumFontFamiliesExA CreateSolidBrush DeleteObject StretchBlt SelectObject GetTextExtentPoint32A

advapi32

CryptGenRandom RegOpenKeyExA RegCloseKey RegCreateKeyExW RegSetValueExW CryptReleaseContext RegQueryValueExA CryptAcquireContextA

shell32

SHGetSpecialFolderPathA ShellExecuteA

ole32

CoTaskMemFree OleSetContainedObject OleUninitialize OleInitialize CoGetClassObject CoInitializeEx CoUninitialize CoCreateInstance CoInitialize

winmm

timeBeginPeriod timeGetDevCaps timeEndPeriod timeGetTime waveOutClose waveOutReset waveOutOpen waveOutWrite waveOutPrepareHeader waveOutUnprepareHeader

d3d9

Direct3DCreate9

d3dx9_43

D3DXCreateTextureFromFileInMemory D3DXCompileShader D3DXAssembleShader D3DXMatrixMultiplyTranspose D3DXGetFVFVertexSize D3DXCreateSphere D3DXCreateCylinder D3DXCreateMatrixStack D3DXCreateTextureFromFileInMemoryEx D3DXCreateTexture D3DXMatrixOrthoOffCenterRH D3DXMatrixOrthoRH D3DXMatrixPerspectiveFovRH D3DXMatrixScaling D3DXVec3Project D3DXPlaneNormalize D3DXMatrixDeterminant D3DXVec2Normalize D3DXMatrixTranspose D3DXVec4Transform D3DXMatrixRotationAxis D3DXQuaternionRotationYawPitchRoll D3DXVec3TransformNormal D3DXMatrixRotationX D3DXMatrixInverse D3DXMatrixRotationYawPitchRoll D3DXMatrixRotationQuaternion D3DXQuaternionRotationAxis D3DXQuaternionMultiply D3DXMatrixMultiply D3DXMatrixTranslation D3DXVec3TransformCoord D3DXMatrixRotationZ D3DXVec3Normalize D3DXMatrixLookAtRH D3DXVec3Transform

python27

PyImport_ImportModule PyImport_AddModule PyRun_StringFlags Py_Finalize Py_Initialize Py_SetProgramName PyModule_AddIntConstant PyModule_GetDict PyDict_SetItemString _Py_NoneStruct PyNumber_Check PyObject_CallObject PyErr_Print PyErr_BadArgument PyErr_Clear PyString_AsString PyFloat_AsDouble PyCallable_Check PyObject_GetAttr PyObject_GetAttrString PyString_InternFromString PyDict_Next PyDict_Size PyList_GetItem PyList_Size PyArg_ParseTuple PyLong_AsLong PyDict_GetItemString PyTuple_Size PyErr_Fetch Py_BuildValue PyErr_SetString PyExc_RuntimeError PyTuple_GetItem PyInt_AsLong PyList_New PyString_FromString PyList_Append Py_InitModule4

winhttp

WinHttpConnect WinHttpSetTimeouts WinHttpSendRequest WinHttpCloseHandle WinHttpSetOption WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpOpen WinHttpReceiveResponse WinHttpQueryDataAvailable

imm32

ImmGetOpenStatus ImmSetConversionStatus ImmGetConversionStatus ImmGetCandidateListW ImmSetCompositionStringW ImmGetCompositionStringW ImmAssociateContext ImmReleaseContext ImmGetContext ImmIsIME ImmGetIMEFileNameA ImmNotifyIME

secur32

AcquireCredentialsHandleA DecryptMessage EncryptMessage FreeContextBuffer SetContextAttributesA QueryContextAttributesA ApplyControlToken DeleteSecurityContext InitializeSecurityContextA FreeCredentialsHandle AcceptSecurityContext

ncrypt

NCryptCreatePersistedKey NCryptSetProperty NCryptFinalizeKey NCryptImportKey NCryptExportKey NCryptDeleteKey NCryptFreeObject BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptGenRandom NCryptOpenStorageProvider

crypt32

CertCreateSelfSignCertificate CryptStringToBinaryA CryptBinaryToStringA CryptProtectData CryptEncodeObjectEx CertOpenStore CertCloseStore CertFindCertificateInStore CertCreateCertificateContext CryptUnprotectData CertFreeCertificateContext CertSetCertificateContextProperty CryptHashCertificate2 CertStrToNameA

devil

ilBindImage ilLoad ilGetInteger ilDeleteImages ilGenImages

version

VerQueryValueA GetFileVersionInfoA GetFileVersionInfoSizeA

imagehlp

GetTimestampForLoadedLibrary StackWalk EnumerateLoadedModules

granny2

_GrannyGetWorldPoseComposite4x4Array@4 _GrannyFreeLocalPose@4 _GrannyNewLocalPose@4 _GrannyUpdateModelMatrix@20 _GrannySampleModelAnimationsAccelerated@20 _GrannyFreeCompletedModelControls@4 _GrannySetModelClock@8 _GrannyInstantiateModel@4 _GrannyGetFileInfo@4 _GrannyFreeFile@4 _GrannyFreeFileSection@8 _GrannyReadEntireFileFromMemory@8 _GrannyConvertSingleObject@20 _GrannyFindMatchingMember@16 _GrannyGetMaterialTextureByType@8 _GrannySetLogCallback@4 _GrannyFreeModelInstance@4 _GrannyNewMeshBinding@12 _GrannyFreeMeshBinding@4 _GrannyGetMeshBindingToBoneIndices@4 _GrannyFindBoneByName@12 _GrannyNewWorldPose@4 _GrannyFreeWorldPose@4 _GrannyGetWorldPose4x4@8 _GrannyGetWorldPoseComposite4x4@8 _GrannyGetTotalTypeSize@4 _GrannyGetMeshVertexCount@4 _GrannyMeshIsRigid@4 _GrannyGetMeshIndexCount@4 _GrannyFreeControl@4 _GrannyGetMeshTriangleGroupCount@4 _GrannyFreeControlOnceUnused@4 _GrannyCompleteControlAt@8 _GrannyControlIsComplete@4 _GrannyFreeControlIfComplete@4 _GrannyGetControlLoopCount@4 _GrannySetControlLoopCount@8 _GrannyGetControlSpeed@4 _GrannySetControlSpeed@8 _GrannyGetControlLocalDuration@4 _GrannySetControlEaseIn@8 _GrannySetControlEaseInCurve@28 _GrannySetControlEaseOut@8 _GrannySetControlEaseOutCurve@28 _GrannyGetControlRawLocalClock@4 _GrannySetControlRawLocalClock@8 _GrannyPlayControlledAnimation@12 _GrannyGetMeshTriangleGroups@4 _GrannyGetMeshVertexType@4 _GrannyCopyMeshVertices@12 _GrannyGetMeshVertices@4 _GrannyCopyMeshIndices@12 _GrannyNewMeshDeformer@16 _GrannyFreeMeshDeformer@4 _GrannyDeformVertices@24 _GrannyGetSourceSkeleton@4 GrannyPNT332VertexType

mss32

_AIL_set_3D_sample_volume@8 _AIL_set_3D_sample_file@8 _AIL_end_3D_sample@4 _AIL_set_3D_sample_loop_count@8 _AIL_stop_3D_sample@4 _AIL_start_3D_sample@4 _AIL_release_3D_sample_handle@4 _AIL_3D_sample_status@4 _AIL_3D_sample_volume@4 _AIL_auto_update_3D_position@8 _AIL_resume_3D_sample@4 _AIL_mem_free_lock@4 _AIL_file_read@8 _AIL_set_file_callbacks@16 _AIL_WAV_info@8 _AIL_decompress_ASI@24 _AIL_decompress_ADPCM@12 _AIL_file_type@8 _AIL_open_digital_driver@16 _AIL_open_stream@12 _AIL_close_digital_driver@4 _AIL_enumerate_3D_providers@12 _AIL_open_3D_provider@4 _AIL_close_3D_provider@4 _AIL_open_3D_listener@4 _AIL_close_3D_listener@4 _AIL_set_3D_position@16 _AIL_set_3D_velocity@20 _AIL_set_3D_orientation@28 _AIL_startup@0 _AIL_shutdown@0 _AIL_set_redist_directory@4 _AIL_close_stream@4 _AIL_start_stream@4 _AIL_pause_stream@8 _AIL_set_stream_volume_levels@12 _AIL_stream_volume_levels@12 _AIL_set_stream_loop_count@8 _AIL_stream_status@4 _AIL_last_error@0 _AIL_allocate_sample_handle@4 _AIL_release_sample_handle@4 _AIL_init_sample@4 _AIL_set_sample_file@12 _AIL_start_sample@4 _AIL_stop_sample@4 _AIL_resume_sample@4 _AIL_end_sample@4 _AIL_set_sample_volume_pan@12 _AIL_set_sample_loop_count@8 _AIL_sample_status@4 _AIL_sample_volume_pan@12 _AIL_allocate_3D_sample_handle@4

speedtreert

?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z ?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z ?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z ?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ ?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ ?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ ?SetLodLimits@CSpeedTreeRT@@QAEXMM@Z ?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z ?SetLodLevel@CSpeedTreeRT@@QAEXM@Z ?ComputeLodLevel@CSpeedTreeRT@@QAEXXZ ?SetLocalMatrices@CSpeedTreeRT@@QAEXII@Z ?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z ?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z ?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z ?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z ?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ ?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z ?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z ?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ ?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ ?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ ?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z ?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z ?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z ?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z ?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ ?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z ?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z ?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z ?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ ?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z ?GetCurrentError@CSpeedTreeRT@@SAPBDXZ ??3CSpeedTreeRT@@SAXPAX@Z ??2CSpeedTreeRT@@SAPAXI@Z ??1CSpeedTreeRT@@QAE@XZ ??0CSpeedTreeRT@@QAE@XZ ??1STextures@CSpeedTreeRT@@QAE@XZ ??1SGeometry@CSpeedTreeRT@@QAE@XZ ??0SGeometry@CSpeedTreeRT@@QAE@XZ ?SetCamera@CSpeedTreeRT@@SAXPBM0@Z ?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z ?SetLightState@CSpeedTreeRT@@SAXI_N@Z ?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z ?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z ?SetTime@CSpeedTreeRT@@SAXM@Z ??0STextures@CSpeedTreeRT@@QAE@XZ ?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z

dinput8

DirectInput8Create

ws2_32

connect ntohs socket ntohl gethostbyname gethostname getsockopt getnameinfo shutdown getaddrinfo freeaddrinfo getpeername recvfrom sendto recv send getsockname WSAStartup listen WSAGetLastError __WSAFDIsSet WSACleanup accept select bind closesocket inet_addr setsockopt ioctlsocket htons htonl

ddraw

DirectDrawCreate

iphlpapi

GetExtendedTcpTable

oleaut32

VariantInit SysFreeString VariantClear SysAllocString

Name

.text

Size

11.5MB

Virtual Size

11.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.6MB

Virtual Size

3.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

148KB

Virtual Size

23.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

45KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

356KB

Virtual Size

356KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=43, id=224, productName=VS2013 build 21005, version=21005,

count=64, id=259, version=33140,

count=237, id=261, version=33140,

count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=25, version=9210,

count=1, id=29, version=9178,

count=1, id=262, version=33140,

count=1, id=48, version=9044,

count=2, id=203, productName=VS2012 UPD3 build 60610, version=60610,

count=60, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,

count=4, id=28, version=9178,

count=101, productName=Unmarked objects (old),

count=1681, id=260, version=35215,

count=63, id=261, productName=VS2019 v16.8.3 build 29335, version=29335,

count=9, id=253, version=35207,

count=26, id=259, version=35207,

count=18, id=260, version=35207,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=99, id=261, version=35207,

count=2, id=156, version=21202,

count=2, id=123, productName=VS2005 build 50727, version=50727,

count=210, id=261, version=35209,

count=1, id=260, version=35209,

count=66, id=260, version=33140,

count=37, id=257, version=33140,

count=667, id=1, productName=Unmarked objects,

count=102, id=265, version=35209,

count=1, id=255, version=35209,

count=1, id=151,

count=1, id=258, version=35209,