c66d2dff0dc6a12a64ba4db7a2646edea9238f5de6d9bb094d3b8b3eaee9bc23

Sharing

Copy URL Twitter E-mail

General

Target
c66d2dff0dc6a12a64ba4db7a2646edea9238f5de6d9bb094d3b8b3eaee9bc23
Size 4.8MB
Sample260826-hc4wnstdrd
SHA256 c66d2dff0dc6a12a64ba4db7a2646edea9238f5de6d9bb094d3b8b3eaee9bc23
MD5 1f06ace5e3c8451030c3b5964633588f
SHA1 1e0ad8490c6ab337c2e9ba49c0d4e445ac2b3fe8
SHA512 21460fa928df831f86742eecadcf4a40643d9e2455c92d2feba574c0828b3052b04ce099f962866cb1aac015cb4149883afefac529b37c80dcf638031d3238f8
SSDEEP 98304:j8Kqrs24nd9KM9c5lwIlpuQbgmfOyLwxc4nHo4668q:j1qz4nVc5pl3f2X/r8
TLSH
T1B1368D227601C531D9C510B1DD7EFEAB469C6A280BF549D3B3C42EEE99705C33A32A5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c66d2dff0dc6a12a64ba4db7a2646edea9238f5de6d9bb094d3b8b3eaee9bc23

File Explorer

c66d2dff0dc6a12a64ba4db7a2646edea9238f5de6d9bb094d3b8b3eaee9bc23

.exe 4.8MB

c66d2dff0dc6a12a64ba4db7a2646edea9238f5de6d9bb094d3b8b3eaee9bc23

IMPHASH a575c1ad9b2a92cd66d7df965aa5223e
SHA256 c66d2dff0dc6a12a64ba4db7a2646edea9238f5de6d9bb094d3b8b3eaee9bc23
MD5 1f06ace5e3c8451030c3b5964633588f
SHA1 1e0ad8490c6ab337c2e9ba49c0d4e445ac2b3fe8
SHA512 21460fa928df831f86742eecadcf4a40643d9e2455c92d2feba574c0828b3052b04ce099f962866cb1aac015cb4149883afefac529b37c80dcf638031d3238f8
SSDEEP 98304:j8Kqrs24nd9KM9c5lwIlpuQbgmfOyLwxc4nHo4668q:j1qz4nVc5pl3f2X/r8
TLSH
T1B1368D227601C531D9C510B1DD7EFEAB469C6A280BF549D3B3C42EEE99705C33A32A5B
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2637408

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

DeleteFileA LocalFree GetFileAttributesA CreateDirectoryA GetModuleFileNameA FindNextFileA FindFirstFileA FindClose WriteConsoleW SetEndOfFile HeapQueryInformation HeapSize SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA FindNextFileW FindFirstFileExW GetOEMCP GetACP IsValidCodePage SetStdHandle HeapReAlloc SetFileAttributesA GetSystemInfo Sleep CreateProcessW GetExitCodeProcess GetFileAttributesExW GetTimeZoneInformation FlushFileBuffers CreateDirectoryW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW VirtualProtect HeapAlloc ReadConsoleW GetFileSizeEx GetConsoleMode GetConsoleOutputCP HeapFree GetProcAddress GetFileType ExitProcess TerminateProcess UnhandledExceptionFilter IsDebuggerPresent GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc InterlockedPushEntrySList RtlUnwind RaiseException QueryPerformanceFrequency SetLastError WaitNamedPipeW PeekNamedPipe GetModuleFileNameW GetSystemTimeAsFileTime GetCurrentThreadId GetModuleHandleW GetStartupInfoW InitializeSListHead SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx GetStringTypeW CreateFileW IsProcessorFeaturePresent GetProcessHeap HeapValidate QueryPerformanceCounter ReleaseSemaphore GetLocaleInfoA CompareStringA lstrlenW GlobalLock GlobalUnlock LoadLibraryA GlobalFree lstrlenA GetPrivateProfileStringA MoveFileA TryAcquireSRWLockExclusive GetExitCodeThread WaitForSingleObjectEx GetStdHandle GetSystemTimePreciseAsFileTime FreeLibrary GetVersionExA GetSystemDirectoryA lstrcmpiA WriteFile ReadFile CopyFileA WaitForSingleObject DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection Module32Next Module32First CreateToolhelp32Snapshot ReadProcessMemory GetCurrentProcessId GetCurrentProcess GetLastError CloseHandle WideCharToMultiByte WinExec GetModuleHandleA CreateProcessA GetCurrentThread SetUnhandledExceptionFilter OutputDebugStringA CreateFileMappingA UnmapViewOfFile MapViewOfFile GetFileSize CreateFileA GlobalAlloc MultiByteToWideChar GetTickCount GetCurrentDirectoryW SetFilePointerEx GetCurrentDirectoryA

user32

SetWindowLongA PeekMessageA GetAsyncKeyState GetDC ReleaseDC InvalidateRect ClientToScreen FillRect SetRect OffsetRect PostQuitMessage FlashWindowEx GetPhysicalCursorPos ScreenToClient FindWindowA CharLowerBuffW CharPrevExA CharNextExA CharNextW GetClipboardData CloseClipboard OpenClipboard GetKeyboardLayout GetKeyboardLayoutNameA DispatchMessageA TranslateMessage GetMessageA LoadCursorA SetWindowDisplayAffinity RegisterClassA GetClientRect UpdateWindow SetWindowPos MoveWindow ShowWindow DestroyWindow IsWindow CreateWindowExA RegisterClassExA UnregisterClassA DefWindowProcA GetAncestor GetWindowThreadProcessId SetFocus IsWindowVisible AttachThreadInput GetWindowLongA LoadIconA SystemParametersInfoA GetKeyState ShowCursor SetCursor DestroyCursor MessageBoxA LoadStringA GetSystemMetrics ChangeDisplaySettingsA ReleaseCapture SetCapture GetCapture LoadImageA GetMenu AdjustWindowRectEx SetPhysicalCursorPos IsZoomed

gdi32

TextOutW SetTextColor DeleteDC SetBkMode CreateDIBSection TextOutA SetBkColor SelectObject GetTextExtentPoint32W GetCharABCWidthsFloatW CreateFontIndirectA EnumFontFamiliesExA CreateSolidBrush DeleteObject StretchBlt CreateCompatibleDC GetTextExtentPoint32A GetStockObject

crypt32

CryptProtectData CryptUnprotectData

shell32

ShellExecuteA SHGetSpecialFolderPathA

ole32

CoInitializeEx CoInitialize CoUninitialize CoCreateInstance

winmm

timeGetTime timeGetDevCaps timeBeginPeriod timeEndPeriod

d3d8

Direct3DCreate8

python27

PyEval_EvalCode Py_BuildValue PyModule_AddIntConstant Py_InitModule4 PyString_FromString PyTuple_New PyTuple_SetItem PyLong_FromUnsignedLong Py_IsInitialized _Py_NoneStruct PyString_AsString PyErr_SetString PyExc_RuntimeError _PyThreadState_Current PyInt_FromLong PyInt_AsLong PyString_FromStringAndSize PyTuple_GetItem PyList_New PyList_Append PyDict_New PyModule_AddStringConstant PyLong_AsLong PyTuple_Size PyDict_GetItemString PyObject_GetAttrString PyImport_ImportModule PyList_SetItem PyDict_SetItem PyLong_AsUnsignedLong PyLong_AsLongLong PyList_Size PyList_GetItem PyDict_GetItem PyDict_Next PyArg_ParseTuple PyDict_Size PyBool_FromLong PyModule_AddObject PyString_InternFromString PyErr_Format PyExc_ValueError PyObject_GetAttr PyCallable_Check PyFloat_AsDouble PyErr_Clear PyErr_BadArgument PyErr_Print PyObject_CallObject PyNumber_Check PyModule_GetDict PyErr_Fetch Py_SetProgramName Py_Initialize Py_Finalize PyRun_StringFlags Py_CompileStringFlags Py_FlushLine PyImport_AddModule PyDict_SetItemString PyLong_FromLong

imm32

ImmGetOpenStatus ImmSetConversionStatus ImmGetConversionStatus ImmGetCandidateListW ImmSetCompositionStringW ImmGetCompositionStringW ImmAssociateContext ImmReleaseContext ImmGetContext ImmIsIME ImmGetIMEFileNameA ImmNotifyIME

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

imagehlp

StackWalk GetTimestampForLoadedLibrary EnumerateLoadedModules

devil

ilBindImage ilConvertImage ilCopyPixels ilInit ilTexImage ilSetPixels ilSave ilDeleteImages ilShutDown ilOriginFunc ilLoad ilGetInteger ilGenImages ilEnable

granny2

_GrannyGetWorldPoseBoneCount@4 _GrannyGetWorldPose4x4@8 _GrannyGetWorldPoseComposite4x4@8 _GrannyGetMeshVertexCount@4 _GrannyFreeModelInstance@4 _GrannyInstantiateModel@4 _GrannyFreeMeshBinding@4 _GrannyFreeControl@4 _GrannyFreeControlOnceUnused@4 _GrannyCompleteControlAt@8 _GrannyControlIsComplete@4 _GrannyFreeControlIfComplete@4 _GrannyGetControlLoopCount@4 _GrannyMeshIsRigid@4 _GrannyNewMeshBinding@12 _GrannyGetWorldPoseComposite4x4Array@4 _GrannyFreeLocalPose@4 _GrannyNewLocalPose@4 _GrannyUpdateModelMatrix@20 _GrannySampleModelAnimationsAccelerated@20 _GrannyFreeCompletedModelControls@4 _GrannySetModelClock@8 _GrannyGetSourceSkeleton@4 _GrannyGetFileInfo@4 _GrannyFreeFile@4 _GrannyFreeFileSection@8 _GrannyReadEntireFileFromMemory@8 _GrannyConvertSingleObject@20 _GrannyFindMatchingMember@16 _GrannyGetMaterialTextureByType@8 _GrannySetLogCallback@4 _GrannySetControlLoopCount@8 _GrannyGetControlSpeed@4 _GrannySetControlSpeed@8 _GrannyGetControlLocalDuration@4 _GrannySetControlEaseIn@8 _GrannySetControlEaseInCurve@28 _GrannySetControlEaseOut@8 _GrannySetControlEaseOutCurve@28 _GrannyGetControlRawLocalClock@4 _GrannySetControlRawLocalClock@8 _GrannyPlayControlledAnimation@12 _GrannyGetMeshTriangleGroupCount@4 _GrannyGetMeshTriangleGroups@4 _GrannyGetMeshVertexType@4 _GrannyGetMeshBindingToBoneIndices@4 _GrannyCopyMeshVertices@12 _GrannyFreeWorldPose@4 _GrannyNewWorldPose@4 _GrannyGetMeshVertices@4 _GrannyCopyMeshIndices@12 _GrannyNewMeshDeformer@16 _GrannyFreeMeshDeformer@4 _GrannyDeformVertices@24 GrannyPNT332VertexType _GrannyGetMeshIndexCount@4 _GrannyFindBoneByName@12

mss32

_AIL_close_stream@4 _AIL_set_redist_directory@4 _AIL_shutdown@0 _AIL_startup@0 _AIL_set_3D_orientation@28 _AIL_set_3D_velocity@20 _AIL_pause_stream@8 _AIL_close_3D_listener@4 _AIL_open_3D_listener@4 _AIL_close_3D_provider@4 _AIL_open_3D_provider@4 _AIL_enumerate_3D_providers@12 _AIL_close_digital_driver@4 _AIL_set_stream_volume_levels@12 _AIL_open_stream@12 _AIL_open_digital_driver@16 _AIL_file_type@8 _AIL_stream_volume_levels@12 _AIL_set_stream_loop_count@8 _AIL_stream_status@4 _AIL_last_error@0 _AIL_allocate_sample_handle@4 _AIL_release_sample_handle@4 _AIL_init_sample@4 _AIL_set_sample_file@12 _AIL_start_sample@4 _AIL_stop_sample@4 _AIL_resume_sample@4 _AIL_end_sample@4 _AIL_set_sample_volume_pan@12 _AIL_set_sample_loop_count@8 _AIL_sample_status@4 _AIL_sample_volume_pan@12 _AIL_allocate_3D_sample_handle@4 _AIL_release_3D_sample_handle@4 _AIL_start_3D_sample@4 _AIL_stop_3D_sample@4 _AIL_resume_3D_sample@4 _AIL_end_3D_sample@4 _AIL_set_3D_sample_file@8 _AIL_set_3D_sample_volume@8 _AIL_set_3D_sample_loop_count@8 _AIL_3D_sample_status@4 _AIL_3D_sample_volume@4 _AIL_auto_update_3D_position@8 _AIL_start_stream@4 _AIL_decompress_ADPCM@12 _AIL_decompress_ASI@24 _AIL_WAV_info@8 _AIL_set_file_callbacks@16 _AIL_file_read@8 _AIL_set_3D_position@16 _AIL_mem_free_lock@4

speedtreert

?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z ?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z ?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z ?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ ?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ ?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ ?SetLodLimits@CSpeedTreeRT@@QAEXMM@Z ?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z ?SetLodLevel@CSpeedTreeRT@@QAEXM@Z ?ComputeLodLevel@CSpeedTreeRT@@QAEXXZ ?SetLocalMatrices@CSpeedTreeRT@@QAEXII@Z ?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z ?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z ?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z ?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z ?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z ?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z ?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ ?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ ?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z ?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z ?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z ?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ ?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z ?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z ?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z ?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ ?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ ?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z ??3CSpeedTreeRT@@SAXPAX@Z ??2CSpeedTreeRT@@SAPAXI@Z ??1CSpeedTreeRT@@QAE@XZ ??0CSpeedTreeRT@@QAE@XZ ?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z ?GetCurrentError@CSpeedTreeRT@@SAPBDXZ ?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ ?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z ??1STextures@CSpeedTreeRT@@QAE@XZ ??0STextures@CSpeedTreeRT@@QAE@XZ ??1SGeometry@CSpeedTreeRT@@QAE@XZ ??0SGeometry@CSpeedTreeRT@@QAE@XZ ?SetCamera@CSpeedTreeRT@@SAXPBM0@Z ?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z ?SetLightState@CSpeedTreeRT@@SAXI_N@Z ?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z ?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z ?SetTime@CSpeedTreeRT@@SAXM@Z

dinput8

DirectInput8Create

ws2_32

WSACleanup gethostbyname htons inet_addr __WSAFDIsSet closesocket connect ioctlsocket recv select send socket WSAGetLastError WSAStartup

ddraw

DirectDrawCreate

libcef

cef_string_multimap_free cef_string_multimap_alloc cef_string_multimap_append cef_string_multimap_value cef_string_multimap_key cef_string_multimap_size cef_string_map_append cef_string_map_value cef_string_map_key cef_string_map_size cef_string_list_append cef_string_list_value cef_string_list_size cef_string_map_free cef_string_map_alloc cef_browser_host_create_browser cef_log cef_v8context_get_current_context cef_api_hash cef_string_utf16_to_utf8 cef_string_ascii_to_utf16 cef_string_utf16_cmp cef_string_utf8_clear cef_string_utf8_to_utf16 cef_string_utf16_clear cef_shutdown cef_initialize cef_register_extension cef_string_list_free cef_string_list_alloc cef_string_userfree_utf16_free cef_string_utf16_set

dwmapi

DwmSetWindowAttribute

advapi32

RegSetValueExW CryptAcquireContextA RegGetValueA RegCloseKey CryptReleaseContext CryptGenRandom RegOpenKeyExA RegQueryValueExW RegOpenKeyExW RegCreateKeyExW RegOpenKeyA RegQueryValueExA

oleaut32

VariantClear SysFreeString

Name

.text

Size

3.6MB

Virtual Size

3.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

718KB

Virtual Size

718KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

223KB

Virtual Size

937KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data1

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

50KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

177KB

Virtual Size

177KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=92, id=260, version=35723,

count=49, id=259, version=33145,

count=3, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,

count=1, id=260, productName=VS2019 v16.5.0 build 28610, version=28610,

count=123, id=261, version=36243,

count=60, id=261, version=35719,

count=225, id=261, version=33145,

count=2, id=262, version=33145,

count=1, id=48, version=9044,

count=2, id=203, productName=VS2012 UPD3 build 60610, version=60610,

count=60, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,

count=5, id=261, version=31629,

count=2, id=253, version=35721,

count=29, id=259, version=35721,

count=20, id=260, version=35721,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=100, id=261, version=35721,

count=1, id=28, version=9178,

count=75, id=29, version=9178,

count=1, id=18, version=8444,

count=10, productName=Unmarked objects (old),

count=2, id=25, version=9210,

count=2, id=265, version=36256,

count=38, id=260, version=33145,

count=33, id=257, version=33145,

count=668, id=1, productName=Unmarked objects,

count=1, id=260, version=36256,

count=339, id=261, version=36256,

count=1, id=256, version=36256,

count=1, id=255, version=36256,

count=1, id=151,

count=1, id=258, version=36256,