0babc6136ad54fd182f4bd41e302eb24d0f2535bd6c75529b155ef1c4eff17b7

Sharing

Copy URL Twitter E-mail

General

Target
0babc6136ad54fd182f4bd41e302eb24d0f2535bd6c75529b155ef1c4eff17b7
Size 3.5MB
Sample260805-qlc4babb55
SHA256 0babc6136ad54fd182f4bd41e302eb24d0f2535bd6c75529b155ef1c4eff17b7
MD5 d194ea4989b261bea09bc0e581a56d91
SHA1 4d53b926908b8a53413be2075be7cac027c1dfde
SHA512 4931f907db7251bd22b04ba682ba3657c574f8be91f88e8493ed870ab398946d17a87924aea47c0996057e314e961a4887cdeb7f736839c9e1882bc86121f154
SSDEEP 49152:x0tD3PQIJMm9RczBJ8S7JUHwey1J0S42ktakPcLkplz3KljDxIJ578kvkKBW5Wks:xyPQI/czoQ1Jx45VGYLnW
TLSH
T1C6F5AF20B1029035F8A311B2CABD6FAF966CDE30175455C3E3C829AF99A46D33E3655F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0babc6136ad54fd182f4bd41e302eb24d0f2535bd6c75529b155ef1c4eff17b7

File Explorer

0babc6136ad54fd182f4bd41e302eb24d0f2535bd6c75529b155ef1c4eff17b7

.exe 3.5MB

0babc6136ad54fd182f4bd41e302eb24d0f2535bd6c75529b155ef1c4eff17b7

IMPHASH 04fa03a2fe0bfacc51374484175a6390
SHA256 0babc6136ad54fd182f4bd41e302eb24d0f2535bd6c75529b155ef1c4eff17b7
MD5 d194ea4989b261bea09bc0e581a56d91
SHA1 4d53b926908b8a53413be2075be7cac027c1dfde
SHA512 4931f907db7251bd22b04ba682ba3657c574f8be91f88e8493ed870ab398946d17a87924aea47c0996057e314e961a4887cdeb7f736839c9e1882bc86121f154
SSDEEP 49152:x0tD3PQIJMm9RczBJ8S7JUHwey1J0S42ktakPcLkplz3KljDxIJ578kvkKBW5Wks:xyPQI/czoQ1Jx45VGYLnW
TLSH
T1C6F5AF20B1029035F8A311B2CABD6FAF966CDE30175455C3E3C829AF99A46D33E3655F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2116006

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

sfml-graphics-2

??1Texture@sf@@QAE@XZ ?loadFromFile@Texture@sf@@QAE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$Rect@H@2@@Z ?getSize@Texture@sf@@QBE?AV?$Vector2@I@2@XZ ?clear@RenderTarget@sf@@QAEXABVColor@2@@Z ?draw@RenderTarget@sf@@QAEXABVDrawable@2@ABVRenderStates@2@@Z ??0Texture@sf@@QAE@XZ ??1Sprite@sf@@UAE@XZ ??0RenderWindow@sf@@QAE@VVideoMode@1@ABVString@1@IABUContextSettings@1@@Z ??1RenderWindow@sf@@UAE@XZ ?Default@RenderStates@sf@@2V12@B ??0Color@sf@@QAE@EEEE@Z ??0Sprite@sf@@QAE@ABVTexture@1@@Z

sfml-window-2

?display@Window@sf@@QAEXXZ ?close@Window@sf@@QAEXXZ ?setPosition@Window@sf@@QAEXABV?$Vector2@H@2@@Z ??0VideoMode@sf@@QAE@III@Z

sfml-system-2

??0String@sf@@QAE@PBDABVlocale@std@@@Z ??1String@sf@@QAE@XZ

kernel32

GetTimeFormatW GetDateFormatW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapAlloc HeapFree GetStdHandle GetFileType ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ResumeThread ExitThread CreateThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount InterlockedPushEntrySList RaiseException RtlUnwind SetLastError TerminateProcess ReadProcessMemory GetCurrentProcessId GetCurrentProcess CompareStringW GetLastError FindNextFileA FindFirstFileA FindClose GetModuleFileNameW WaitNamedPipeW PeekNamedPipe GetStartupInfoW IsDebuggerPresent InitializeSListHead UnhandledExceptionFilter MultiByteToWideChar SetFileAttributesA Module32Next Module32First Process32Next Process32First CreateToolhelp32Snapshot GetSystemInfo OpenProcess SetThreadPriority Sleep CreateEventA WaitForSingleObject SetEvent DeleteCriticalSection LeaveCriticalSection EnterCriticalSection MoveFileA CloseHandle CreateFileW IsProcessorFeaturePresent GetProcessHeap HeapValidate GetCPInfo GetModuleHandleW GetSystemTimeAsFileTime SetEndOfFile WriteConsoleW HeapQueryInformation HeapSize SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW HeapReAlloc SetStdHandle CreateProcessW GetExitCodeProcess GetTimeZoneInformation CreateDirectoryW GetPrivateProfileStringA OpenMutexA lstrlenA GlobalFree GetModuleFileNameA CreateMutexA ReleaseMutex DeleteFileA GetCurrentDirectoryA GetTickCount GetCurrentDirectoryW LoadLibraryA GetProcAddress LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx GetStringTypeW SleepConditionVariableSRW TryAcquireSRWLockExclusive InitializeCriticalSection GetModuleHandleA AcquireSRWLockExclusive ReleaseSRWLockExclusive QueryPerformanceFrequency GetLocalTime GetFileAttributesA CreateDirectoryA LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileAttributesExW FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx WaitForSingleObjectEx QueryPerformanceCounter ReleaseSemaphore GetLocaleInfoA CompareStringA WideCharToMultiByte lstrlenW GlobalLock GlobalUnlock FreeLibrary GetVersionExA GetSystemDirectoryA WriteFile ReadFile GetCurrentThreadId SetUnhandledExceptionFilter GetFileSize CreateFileA CreateFileMappingA UnmapViewOfFile MapViewOfFile OutputDebugStringA GlobalAlloc GetExitCodeThread WakeAllConditionVariable ReadConsoleW SetFilePointerEx

user32

EndPaint FillRect SetRect OffsetRect LoadStringA MessageBoxA GetDesktopWindow GetKeyboardLayout OpenClipboard CloseClipboard GetClipboardData InvalidateRect BeginPaint ReleaseDC GetDC CharNextW PeekMessageA wvsprintfA GetSystemMetrics ChangeDisplaySettingsA ReleaseCapture SetCapture GetCapture ShowWindow ClientToScreen SetCursorPos LoadImageA DestroyCursor SetCursor ShowCursor GetKeyState SystemParametersInfoA LoadIconA FindWindowA ScreenToClient GetCursorPos GetAsyncKeyState SetWindowPos PostQuitMessage GetKeyboardLayoutNameA DispatchMessageA TranslateMessage GetMessageA LoadCursorA AdjustWindowRectEx GetWindowLongA GetMenu RegisterClassA CharPrevExA CharNextExA SetWindowLongA DefWindowProcA UnregisterClassA RegisterClassExA CreateWindowExA IsWindow DestroyWindow MoveWindow SetFocus UpdateWindow GetClientRect

gdi32

GetTextExtentPoint32W SetTextColor TextOutW CreateCompatibleDC DeleteDC SetBkMode CreateDIBSection TextOutA GetCharABCWidthsFloatW CreateFontIndirectA GetStockObject EnumFontFamiliesExA SelectObject GetTextExtentPoint32A SetBkColor StretchBlt PatBlt DeleteObject CreateSolidBrush

ole32

CoInitializeEx OleInitialize OleUninitialize OleSetContainedObject CoUninitialize CoInitialize CoCreateInstance CoGetClassObject

winmm

timeBeginPeriod timeEndPeriod timeGetDevCaps timeGetTime

d3d8

Direct3DCreate8

python27

PyImport_AddModule PyRun_StringFlags Py_Finalize Py_Initialize Py_SetProgramName PyErr_Fetch PyModule_GetDict PyDict_SetItemString _Py_NoneStruct PyNumber_Check PyErr_Print PyErr_BadArgument PyErr_Clear PyString_AsString PyFloat_AsDouble PyLong_AsLongLong PyLong_AsUnsignedLong PyCallable_Check PyObject_GetAttr PyObject_GetAttrString PyString_InternFromString PyImport_ImportModule PyModule_AddStringConstant PyArg_ParseTuple PyList_Append PyList_New PyString_FromString PyExc_RuntimeError PyErr_SetString PyDict_Size PyDict_Next PyLong_FromLongLong PyInt_AsLong Py_IncRef PyDict_GetItemString PyTuple_GetItem PyTuple_Size PyLong_AsLong PyModule_AddIntConstant Py_BuildValue Py_InitModule4 PyObject_CallObject

imm32

ImmGetIMEFileNameA ImmNotifyIME ImmGetOpenStatus ImmSetConversionStatus ImmGetConversionStatus ImmGetCandidateListW ImmSetCompositionStringW ImmGetCompositionStringW ImmAssociateContext ImmReleaseContext ImmGetContext ImmIsIME

libconfig++

??4Setting@libconfig@@QAEAAV01@PBD@Z ??4Setting@libconfig@@QAEAAV01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ??ASetting@libconfig@@QBEAAV01@PBD@Z ??ASetting@libconfig@@QBEAAV01@H@Z ?lookupValue@Setting@libconfig@@QBE_NPBDAA_J@Z ?lookupValue@Setting@libconfig@@QBE_NPBDAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ??4Setting@libconfig@@QAEAAV01@AB_J@Z ?add@Setting@libconfig@@QAEAAV12@W4Type@12@@Z ?getLength@Setting@libconfig@@QBEHXZ ??0Config@libconfig@@QAE@XZ ??1Config@libconfig@@UAE@XZ ?readFile@Config@libconfig@@QAEXPBD@Z ?writeFile@Config@libconfig@@QAEXPBD@Z ?getRoot@Config@libconfig@@QBEAAVSetting@2@XZ ?add@Setting@libconfig@@QAEAAV12@PBDW4Type@12@@Z ?getPath@SettingException@libconfig@@QBEPBDXZ

iphlpapi

GetAdaptersInfo

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

devil

ilLoad ilConvertImage ilCopyPixels ilEnable ilOriginFunc ilGenImages ilDeleteImages ilShutDown ilGetInteger ilInit ilTexImage ilSetPixels ilSave ilBindImage

granny2

_GrannyGetWorldPose4x4@8 _GrannyFreeWorldPose@4 _GrannyMeshIsRigid@4 _GrannyFindBoneByName@12 _GrannyGetMeshBindingToBoneIndices@4 _GrannyFreeMeshBinding@4 _GrannyNewMeshBinding@12 _GrannyFreeModelInstance@4 _GrannyInstantiateModel@4 _GrannyGetWorldPoseComposite4x4Array@4 _GrannyFreeLocalPose@4 _GrannyNewLocalPose@4 _GrannyUpdateModelMatrix@20 _GrannySampleModelAnimationsAccelerated@20 _GrannyFreeCompletedModelControls@4 _GrannyGetWorldPoseComposite4x4@8 _GrannyGetSourceSkeleton@4 _GrannyGetFileInfo@4 _GrannyFreeFile@4 _GrannyFreeFileSection@8 _GrannyReadEntireFileFromMemory@8 _GrannyConvertSingleObject@20 _GrannyFindMatchingMember@16 _GrannyGetMaterialTextureByType@8 _GrannyGetLogMessageOriginString@4 _GrannyGetLogMessageTypeString@4 _GrannySetLogCallback@4 _GrannyGetMeshIndexCount@4 _GrannyGetTotalTypeSize@4 _GrannyFreeControlIfComplete@4 _GrannyFreeControl@4 _GrannyFreeControlOnceUnused@4 _GrannySetModelClock@8 _GrannyGetMeshVertexCount@4 _GrannyNewWorldPose@4 GrannyPNT332VertexType _GrannyDeformVertices@24 _GrannyFreeMeshDeformer@4 _GrannyNewMeshDeformer@16 _GrannyCopyMeshIndices@12 _GrannyGetMeshVertices@4 _GrannyCopyMeshVertices@12 _GrannyGetMeshVertexType@4 _GrannyGetMeshTriangleGroups@4 _GrannyGetMeshTriangleGroupCount@4 _GrannyPlayControlledAnimation@12 _GrannySetControlRawLocalClock@8 _GrannyGetControlRawLocalClock@4 _GrannySetControlEaseOutCurve@28 _GrannySetControlEaseOut@8 _GrannySetControlEaseInCurve@28 _GrannySetControlEaseIn@8 _GrannyControlIsComplete@4 _GrannySetControlSpeed@8 _GrannyGetControlSpeed@4 _GrannySetControlLoopCount@8 _GrannyGetControlLoopCount@4 _GrannyCompleteControlAt@8 _GrannyGetControlLocalDuration@4

mss32

_AIL_3D_sample_volume@4 _AIL_3D_sample_status@4 _AIL_set_3D_sample_loop_count@8 _AIL_set_3D_sample_volume@8 _AIL_set_3D_sample_file@8 _AIL_end_3D_sample@4 _AIL_resume_3D_sample@4 _AIL_stop_3D_sample@4 _AIL_start_3D_sample@4 _AIL_release_3D_sample_handle@4 _AIL_allocate_3D_sample_handle@4 _AIL_sample_volume_pan@12 _AIL_sample_status@4 _AIL_set_sample_loop_count@8 _AIL_set_sample_volume_pan@12 _AIL_end_sample@4 _AIL_resume_sample@4 _AIL_auto_update_3D_position@8 _AIL_start_sample@4 _AIL_set_sample_file@12 _AIL_init_sample@4 _AIL_release_sample_handle@4 _AIL_allocate_sample_handle@4 _AIL_last_error@0 _AIL_stream_status@4 _AIL_set_stream_loop_count@8 _AIL_stream_volume_levels@12 _AIL_set_stream_volume_levels@12 _AIL_pause_stream@8 _AIL_start_stream@4 _AIL_close_stream@4 _AIL_set_redist_directory@4 _AIL_shutdown@0 _AIL_startup@0 _AIL_set_3D_orientation@28 _AIL_set_3D_velocity@20 _AIL_set_3D_position@16 _AIL_close_3D_listener@4 _AIL_open_3D_listener@4 _AIL_close_3D_provider@4 _AIL_open_3D_provider@4 _AIL_enumerate_3D_providers@12 _AIL_close_digital_driver@4 _AIL_open_stream@12 _AIL_open_digital_driver@16 _AIL_file_type@8 _AIL_decompress_ADPCM@12 _AIL_decompress_ASI@24 _AIL_WAV_info@8 _AIL_set_file_callbacks@16 _AIL_file_read@8 _AIL_mem_free_lock@4 _AIL_stop_sample@4

speedtreert

?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z ?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z ?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z ?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z ?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z ?ComputeLodLevel@CSpeedTreeRT@@QAEXXZ ?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ ?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z ?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z ?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z ?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z ?SetLodLevel@CSpeedTreeRT@@QAEXM@Z ?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z ?SetLodLimits@CSpeedTreeRT@@QAEXMM@Z ?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ ?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ ?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ ?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z ?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z ?SetLocalMatrices@CSpeedTreeRT@@QAEXII@Z ?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ ?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ ?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ ?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z ?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z ?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z ?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ ?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z ??3CSpeedTreeRT@@SAXPAX@Z ??2CSpeedTreeRT@@SAPAXI@Z ??1CSpeedTreeRT@@QAE@XZ ??0CSpeedTreeRT@@QAE@XZ ??1STextures@CSpeedTreeRT@@QAE@XZ ??0STextures@CSpeedTreeRT@@QAE@XZ ??1SGeometry@CSpeedTreeRT@@QAE@XZ ??0SGeometry@CSpeedTreeRT@@QAE@XZ ?SetCamera@CSpeedTreeRT@@SAXPBM0@Z ?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z ?SetLightState@CSpeedTreeRT@@SAXI_N@Z ?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z ?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z ?SetTime@CSpeedTreeRT@@SAXM@Z ?GetCurrentError@CSpeedTreeRT@@SAPBDXZ ?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z ?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ ?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z ?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z

dinput8

DirectInput8Create

ws2_32

recv select ioctlsocket connect socket closesocket WSAStartup WSACleanup __WSAFDIsSet htons inet_addr gethostbyname WSAGetLastError send

ddraw

DirectDrawCreate

advapi32

RegSetValueExW RegOpenKeyExW CryptGenRandom CryptReleaseContext RegQueryValueExW RegOpenKeyA RegQueryValueExA RegOpenKeyExA RegCloseKey CryptAcquireContextA RegCreateKeyExW

shell32

SHGetSpecialFolderPathA

oleaut32

SysAllocString VariantInit VariantClear SysFreeString

Name

.text

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

509KB

Virtual Size

509KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

158KB

Virtual Size

647KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data1

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

45KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

128KB

Virtual Size

128KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=55, id=259, version=33140,

count=220, id=261, version=33140,

count=4, id=170, productName=VS2010 build 30319, version=30319,

count=59, id=261, productName=VS2019 v16.6.2 build 28806, version=28806,

count=2, id=262, version=33140,

count=58, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,

count=1, id=48, version=9044,

count=2, id=203, productName=VS2012 UPD3 build 60610, version=60610,

count=2, id=257, productName=VS2015 [14.0] build 23026, version=23026,

count=48, id=265, version=35211,

count=2, id=257, productName=VS2019 v16.7.5 build 29112, version=29112,

count=1, id=253, version=35207,

count=29, id=259, version=35207,

count=20, id=260, version=35207,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=28, version=9178,

count=76, id=29, version=9178,

count=1, id=18, version=8444,

count=8, productName=Unmarked objects (old),

count=4, id=25, version=9210,

count=101, id=261, version=35207,

count=1, id=260, version=35211,

count=42, id=260, version=33140,

count=26, id=257, version=33140,

count=7, id=257, productName=VS2015 UPD3.1 build 24215, version=24215,

count=588, id=1, productName=Unmarked objects,

count=308, id=261, version=35211,

count=1, id=255, version=35211,

count=1, id=151,

count=1, id=258, version=35211,