e25bca44a3baad9aba0e2a55d7392cee4ef8cdf992b47fc651e4ec2bc2011a5a

Sharing

Copy URL Twitter E-mail

General

Target
e25bca44a3baad9aba0e2a55d7392cee4ef8cdf992b47fc651e4ec2bc2011a5a
Size 3.9MB
Sample260822-d5hfxsep21
SHA256 e25bca44a3baad9aba0e2a55d7392cee4ef8cdf992b47fc651e4ec2bc2011a5a
MD5 448236857b3f3da4d2afb2f0b5d7c2c6
SHA1 9a2d9b870c0850632f3c0d27389d4accdf9411b7
SHA512 60e8f4e4de41058fe95a21f34b68935282006a6335b801f0ca0de3a28306eef302f42d034839d2206c9e20e26995131f6631853c84bae6b9b5f8d3aa6bc05c10
SSDEEP 49152:qaFrCvh+hGHnMHm2wEkCwS4IbA88El2UKKJC5EJ5YPZ/e0Zbvrmmnk5AvvjGJxJ:qahCZpHnMDtkCwS4H5ElXJC+o
TLSH
T16D169E20B605D072E55511F1587CBFAB81ACAC381B6559C3A3C43E6FB8B02D33B76A5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e25bca44a3baad9aba0e2a55d7392cee4ef8cdf992b47fc651e4ec2bc2011a5a

File Explorer

e25bca44a3baad9aba0e2a55d7392cee4ef8cdf992b47fc651e4ec2bc2011a5a

.exe 3.9MB

e25bca44a3baad9aba0e2a55d7392cee4ef8cdf992b47fc651e4ec2bc2011a5a

IMPHASH e12366a6729c8223574920f1d2fc8564
SHA256 e25bca44a3baad9aba0e2a55d7392cee4ef8cdf992b47fc651e4ec2bc2011a5a
MD5 448236857b3f3da4d2afb2f0b5d7c2c6
SHA1 9a2d9b870c0850632f3c0d27389d4accdf9411b7
SHA512 60e8f4e4de41058fe95a21f34b68935282006a6335b801f0ca0de3a28306eef302f42d034839d2206c9e20e26995131f6631853c84bae6b9b5f8d3aa6bc05c10
SSDEEP 49152:qaFrCvh+hGHnMHm2wEkCwS4IbA88El2UKKJC5EJ5YPZ/e0Zbvrmmnk5AvvjGJxJ:qahCZpHnMDtkCwS4H5ElXJC+o
TLSH
T16D169E20B605D072E55511F1587CBFAB81ACAC381B6559C3A3C43E6FB8B02D33B76A5B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1559174

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

HeapSize CreateDirectoryW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW HeapReAlloc GetTimeZoneInformation CreateProcessW GetExitCodeProcess WaitForSingleObject SetEvent Sleep InitializeCriticalSection GetSystemInfo GetLastError GetTickCount GetFileAttributesExW FlushFileBuffers SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP GetStdHandle FreeLibraryAndExitThread ExitThread GetFileType GetModuleHandleExW LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc RaiseException RtlUnwind WaitNamedPipeW PeekNamedPipe CreateFileW HeapQueryInformation SetLastError IsProcessorFeaturePresent TerminateProcess UnhandledExceptionFilter CreateEventW ResetEvent InitializeCriticalSectionAndSpinCount InitializeSListHead GetCPInfo CompareStringEx GetModuleHandleW GetSystemTimeAsFileTime SleepConditionVariableSRW SleepConditionVariableCS WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable FlsFree FlsSetValue FlsGetValue FlsAlloc LCMapStringEx DecodePointer EncodePointer TryEnterCriticalSection InitializeCriticalSectionEx AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock GetExitCodeThread GetCurrentThreadId WaitForSingleObjectEx GetStringTypeW QueryPerformanceFrequency QueryPerformanceCounter ReleaseSemaphore GetLocaleInfoA CompareStringA lstrlenW GlobalLock GlobalUnlock FreeLibrary GetVersionExA GetSystemDirectoryA WideCharToMultiByte SetEndOfFile WriteConsoleW DeleteCriticalSection EnterCriticalSection GetModuleFileNameW LeaveCriticalSection lstrcmpiA WriteFile ReadFile OutputDebugStringA WinExec SetFileAttributesA FindFirstFileA FindNextFileA FindClose GetLocalTime DeleteFileA CreateProcessA GetFileAttributesA LoadLibraryA GetStartupInfoW GetProcAddress SetProcessWorkingSetSize CreateThread GetCurrentProcessId Process32Next MultiByteToWideChar Process32First ExitProcess IsDebuggerPresent GetCurrentProcess CheckRemoteDebuggerPresent Module32Next Module32First CreateToolhelp32Snapshot HeapFree GetProcessHeap GetModuleHandleA GetCurrentThread SetUnhandledExceptionFilter CreateFileMappingA UnmapViewOfFile MapViewOfFile GetFileSize GetModuleFileNameA CreateDirectoryA HeapAlloc CloseHandle DeviceIoControl InterlockedPushEntrySList CreateFileA

user32

MessageBoxA GetSystemMetrics GetCapture ChangeDisplaySettingsA DefWindowProcA RegisterClassExA CreateWindowExA GetClientRect ShowWindow UpdateWindow SetFocus MoveWindow IsWindow DestroyWindow UnregisterClassA InvalidateRect GetDC ReleaseDC PeekMessageA ClientToScreen SetRect GetAsyncKeyState CharPrevExA CharNextExA CharNextW GetClipboardData CloseClipboard OpenClipboard GetKeyboardLayout GetKeyboardLayoutNameA DispatchMessageA TranslateMessage GetMessageA GetKeyState SetWindowLongA GetWindowLongA AdjustWindowRectEx SetWindowTextA GetMenu RegisterClassA PostQuitMessage GetCursorPos ScreenToClient FindWindowA LoadIconA SetWindowPos SystemParametersInfoA SendMessageA FlashWindowEx ReleaseCapture SetCapture SetCursorPos SetCursor ShowCursor DestroyCursor LoadImageA LoadCursorA

gdi32

GetCharABCWidthsFloatW EnumFontFamiliesExA SelectObject SetBkColor SetTextColor TextOutW CreateCompatibleDC DeleteDC SetBkMode CreateDIBSection TextOutA GetStockObject GetTextExtentPoint32A CreateFontIndirectA GetTextExtentPoint32W DeleteObject

advapi32

RegQueryValueExA RegCreateKeyExW RegQueryValueExW RegCloseKey RegSetValueExW CryptAcquireContextA CryptReleaseContext CryptGenRandom RegOpenKeyExA RegGetValueA RegOpenKeyExW

ole32

CoInitializeEx CoUninitialize CoInitialize CoCreateInstance

winmm

timeEndPeriod timeGetDevCaps timeBeginPeriod timeGetTime

d3d9

Direct3DCreate9

d3dx9_43

D3DXMatrixOrthoOffCenterRH D3DXCreateMatrixStack D3DXVec3Project D3DXMatrixRotationYawPitchRoll D3DXMatrixScaling D3DXMatrixOrthoRH D3DXVec2Normalize D3DXVec4Transform D3DXMatrixRotationAxis D3DXVec3TransformNormal D3DXMatrixRotationX D3DXMatrixInverse D3DXMatrixPerspectiveFovRH D3DXMatrixLookAtRH D3DXVec3Normalize D3DXMatrixRotationZ D3DXVec3TransformCoord D3DXMatrixTranslation D3DXMatrixMultiply D3DXQuaternionMultiply D3DXQuaternionRotationAxis D3DXMatrixRotationQuaternion D3DXCreateSphere D3DXGetFVFVertexSize D3DXGetImageInfoFromFileInMemory D3DXLoadSurfaceFromSurface D3DXCreateTexture D3DXCreateTextureFromFileInMemoryEx D3DXPlaneNormalize D3DXCreateCylinder D3DXQuaternionRotationYawPitchRoll D3DXVec3Transform D3DXMatrixDeterminant D3DXMatrixTranspose

python27

PyImport_ImportModule PyImport_AddModule PyRun_StringFlags Py_Finalize Py_Initialize PyString_InternFromString PyErr_Fetch PyModule_GetDict PyDict_SetItemString _Py_NoneStruct PyNumber_Check PyObject_CallObject PyErr_Print PyErr_BadArgument PyErr_Clear PyString_AsString PyFloat_AsDouble PyLong_AsLongLong PyCallable_Check PyObject_GetAttr Py_BuildValue Py_InitModule4 PyList_New PyList_Append PyModule_AddIntConstant PyErr_SetString PyExc_RuntimeError PyTuple_GetItem PyInt_AsLong PyString_FromString PyTuple_Size PyDict_GetItemString PyLong_AsLong PyLong_FromLongLong PyArg_ParseTuple PyTuple_New PyTuple_SetItem PyInt_FromLong PyUnicodeUCS2_FromString PyObject_GetAttrString PyDict_Size PyDict_Next Py_SetProgramName Py_IncRef

iphlpapi

IcmpSendEcho2 IcmpCreateFile GetPerAdapterInfo GetAdaptersInfo IcmpCloseHandle

libcef

cef_string_multimap_free cef_string_multimap_alloc cef_string_multimap_append cef_string_multimap_value cef_string_multimap_key cef_string_multimap_size cef_string_map_value cef_string_map_key cef_string_map_size cef_string_list_append cef_string_list_value cef_string_list_size cef_browser_host_create_browser cef_command_line_get_global cef_string_map_free cef_string_map_alloc cef_v8context_get_current_context cef_log cef_api_hash cef_string_utf8_to_utf16 cef_string_utf16_clear cef_string_utf8_clear cef_string_utf16_to_utf8 cef_string_utf16_cmp cef_string_map_append cef_run_message_loop cef_shutdown cef_initialize cef_execute_process cef_register_extension cef_string_list_free cef_string_list_alloc cef_string_userfree_utf16_free cef_string_utf16_set

imm32

ImmGetOpenStatus ImmSetConversionStatus ImmGetConversionStatus ImmGetCandidateListW ImmSetCompositionStringW ImmGetCompositionStringW ImmAssociateContext ImmReleaseContext ImmGetContext ImmIsIME ImmGetIMEFileNameA ImmNotifyIME

devil

ilEnable ilBindImage ilGenImages ilInit ilLoad ilGetInteger ilConvertImage ilCopyPixels ilSetPixels ilDeleteImages ilTexImage ilSave ilShutDown ilOriginFunc

version

GetFileVersionInfoSizeA VerQueryValueA GetFileVersionInfoA

imagehlp

GetTimestampForLoadedLibrary StackWalk EnumerateLoadedModules

granny2

_GrannyConvertSingleObject@20 _GrannyReadEntireFileFromMemory@8 _GrannyFreeFileSection@8 _GrannyFreeFile@4 _GrannyGetFileInfo@4 _GrannySetModelClock@8 _GrannyFreeCompletedModelControls@4 _GrannySampleModelAnimationsAccelerated@20 _GrannyUpdateModelMatrix@20 _GrannyNewLocalPose@4 _GrannyFreeLocalPose@4 _GrannyGetWorldPoseComposite4x4Array@4 _GrannyInstantiateModel@4 _GrannyFreeModelInstance@4 _GrannyNewMeshBinding@12 _GrannyFreeMeshBinding@4 _GrannyGetMeshBindingToBoneIndices@4 _GrannyFindBoneByName@12 _GrannyNewWorldPose@4 _GrannyFreeWorldPose@4 _GrannyGetWorldPose4x4@8 _GrannyGetWorldPoseComposite4x4@8 _GrannyGetTotalTypeSize@4 _GrannyGetMeshVertexCount@4 _GrannyMeshIsRigid@4 _GrannyGetMeshIndexCount@4 _GrannyFreeControl@4 _GrannyFreeControlOnceUnused@4 _GrannyCompleteControlAt@8 _GrannyControlIsComplete@4 _GrannyFreeControlIfComplete@4 _GrannyGetControlLoopCount@4 _GrannySetControlLoopCount@8 _GrannyGetControlSpeed@4 _GrannySetControlSpeed@8 _GrannyGetControlLocalDuration@4 _GrannySetControlEaseIn@8 _GrannySetControlEaseInCurve@28 _GrannySetControlEaseOut@8 _GrannyGetMaterialTextureByType@8 _GrannySetControlEaseOutCurve@28 _GrannyGetControlRawLocalClock@4 _GrannySetControlRawLocalClock@8 _GrannyPlayControlledAnimation@12 _GrannyGetMeshTriangleGroupCount@4 _GrannyGetMeshTriangleGroups@4 _GrannyGetMeshVertexType@4 _GrannyCopyMeshVertices@12 _GrannyGetMeshVertices@4 _GrannyCopyMeshIndices@12 _GrannyNewMeshDeformer@16 _GrannyFreeMeshDeformer@4 _GrannyDeformVertices@24 _GrannyGetSourceSkeleton@4 GrannyPNT332VertexType _GrannyFindMatchingMember@16

mss32

_AIL_close_digital_driver@4 _AIL_file_type@8 _AIL_decompress_ADPCM@12 _AIL_decompress_ASI@24 _AIL_WAV_info@8 _AIL_set_file_callbacks@16 _AIL_enumerate_3D_providers@12 _AIL_file_read@8 _AIL_mem_free_lock@4 _AIL_open_3D_provider@4 _AIL_close_3D_provider@4 _AIL_open_3D_listener@4 _AIL_close_3D_listener@4 _AIL_set_3D_position@16 _AIL_set_3D_velocity@20 _AIL_set_3D_orientation@28 _AIL_startup@0 _AIL_shutdown@0 _AIL_set_redist_directory@4 _AIL_close_stream@4 _AIL_start_stream@4 _AIL_pause_stream@8 _AIL_set_stream_volume_levels@12 _AIL_stream_volume_levels@12 _AIL_set_stream_loop_count@8 _AIL_stream_status@4 _AIL_last_error@0 _AIL_allocate_sample_handle@4 _AIL_release_sample_handle@4 _AIL_init_sample@4 _AIL_set_sample_file@12 _AIL_start_sample@4 _AIL_stop_sample@4 _AIL_resume_sample@4 _AIL_end_sample@4 _AIL_set_sample_volume_pan@12 _AIL_set_sample_loop_count@8 _AIL_sample_status@4 _AIL_sample_volume_pan@12 _AIL_allocate_3D_sample_handle@4 _AIL_release_3D_sample_handle@4 _AIL_start_3D_sample@4 _AIL_stop_3D_sample@4 _AIL_resume_3D_sample@4 _AIL_set_3D_sample_file@8 _AIL_set_3D_sample_volume@8 _AIL_set_3D_sample_loop_count@8 _AIL_3D_sample_status@4 _AIL_3D_sample_volume@4 _AIL_auto_update_3D_position@8 _AIL_open_stream@12 _AIL_end_3D_sample@4 _AIL_open_digital_driver@16

speedtreert

?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z ?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z ?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ ?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ ?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ ?SetLodLimits@CSpeedTreeRT@@QAEXMM@Z ?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z ?SetLodLevel@CSpeedTreeRT@@QAEXM@Z ?ComputeLodLevel@CSpeedTreeRT@@QAEXXZ ?SetLocalMatrices@CSpeedTreeRT@@QAEXII@Z ?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z ?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z ?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z ?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z ?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z ?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ ?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ ?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ ?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z ?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z ?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z ?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z ?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ ?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z ?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z ?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z ?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ ?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z ??3CSpeedTreeRT@@SAXPAX@Z ??2CSpeedTreeRT@@SAPAXI@Z ??1CSpeedTreeRT@@QAE@XZ ??0CSpeedTreeRT@@QAE@XZ ??0STextures@CSpeedTreeRT@@QAE@XZ ??1SGeometry@CSpeedTreeRT@@QAE@XZ ??0SGeometry@CSpeedTreeRT@@QAE@XZ ?SetCamera@CSpeedTreeRT@@SAXPBM0@Z ?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z ?SetLightState@CSpeedTreeRT@@SAXI_N@Z ?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z ?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z ?SetTime@CSpeedTreeRT@@SAXM@Z ?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ ?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z ?GetCurrentError@CSpeedTreeRT@@SAPBDXZ ?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z ?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z ??1STextures@CSpeedTreeRT@@QAE@XZ

dinput8

DirectInput8Create

ws2_32

WSAStartup htons socket send WSACleanup WSAGetLastError select recv ioctlsocket connect closesocket __WSAFDIsSet inet_addr inet_ntoa gethostbyname

dwmapi

DwmSetWindowAttribute

shell32

SHGetSpecialFolderPathA

oleaut32

SysFreeString VariantClear

Name

.text

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

484KB

Virtual Size

484KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

100KB

Virtual Size

595KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

761KB

Virtual Size

760KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

141KB

Virtual Size

141KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=43, id=224, productName=VS2013 build 21005, version=21005,

count=48, id=259, version=33140,

count=220, id=261, version=33140,

count=4, id=170, productName=VS2010 build 30319, version=30319,

count=60, id=261, productName=VS2019 v16.1.2 build 27702, version=27702,

count=2, id=25, version=9210,

count=4, id=28, version=9178,

count=1, id=29, version=9178,

count=1, id=262, version=33140,

count=1, id=48, version=9044,

count=2, id=203, productName=VS2012 UPD3 build 60610, version=60610,

count=5, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,

count=60, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,

count=117, id=261, productName=VS2019 v16.4.4 build 28316, version=28316,

count=2, productName=Unmarked objects (old),

count=4, id=253, version=28518,

count=18, id=260, version=30034,

count=26, id=259, version=30034,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=100, id=261, version=30034,

count=2, id=156, version=21202,

count=2, id=123, productName=VS2005 build 50727, version=50727,

count=206, id=261, version=30159,

count=34, id=260, version=33140,

count=33, id=257, version=33140,

count=716, id=1, productName=Unmarked objects,

count=111, id=265, version=30159,

count=1, id=256, version=30159,

count=1, id=255, version=30159,

count=1, id=151,

count=1, id=258, version=30159,