84b8f62872c9b52abae7adbdb38b2e7e6c3d693a07888ce4be5c5056423cbba3

Sharing

Copy URL Twitter E-mail

General

Target
84b8f62872c9b52abae7adbdb38b2e7e6c3d693a07888ce4be5c5056423cbba3
Size 6.0MB
Sample260925-ml5lsatfrf
SHA256 84b8f62872c9b52abae7adbdb38b2e7e6c3d693a07888ce4be5c5056423cbba3
MD5 53954b1bb6fa2af5faee993d3ab9adfd
SHA1 80af2348d148c48efb0730452440986125171c61
SHA512 ac2fb423c18f907e151a339d95e751b40f5d4d649196f6db68abf0adcab1ce93a7bf64e64c0edbcd1db837853f610c5fa0bf53bb32ee9a11b69e482dbd0d7690
SSDEEP 98304:90msILFH8w4qVvyyEJ+3ZrqukEl1u1FmcJ:CmsILFHaCyyeGrRk20
TLSH
T1AB568D90B3808663D4E6017094F8BA5BAA79F83B17106BC373DC953A1FD42D9DA3A7C5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
84b8f62872c9b52abae7adbdb38b2e7e6c3d693a07888ce4be5c5056423cbba3

File Explorer

84b8f62872c9b52abae7adbdb38b2e7e6c3d693a07888ce4be5c5056423cbba3

.exe 6.0MB

84b8f62872c9b52abae7adbdb38b2e7e6c3d693a07888ce4be5c5056423cbba3

IMPHASH c92f090a56fc921495ef3b03424624b1
SHA256 84b8f62872c9b52abae7adbdb38b2e7e6c3d693a07888ce4be5c5056423cbba3
MD5 53954b1bb6fa2af5faee993d3ab9adfd
SHA1 80af2348d148c48efb0730452440986125171c61
SHA512 ac2fb423c18f907e151a339d95e751b40f5d4d649196f6db68abf0adcab1ce93a7bf64e64c0edbcd1db837853f610c5fa0bf53bb32ee9a11b69e482dbd0d7690
SSDEEP 98304:90msILFH8w4qVvyyEJ+3ZrqukEl1u1FmcJ:CmsILFHaCyyeGrRk20
TLSH
T1AB568D90B3808663D4E6017094F8BA5BAA79F83B17106BC373DC953A1FD42D9DA3A7C5
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1991178

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GlobalFree DeleteFileA FreeLibrary LoadLibraryA VerifyVersionInfoW VerSetConditionMask GetPrivateProfileStringA lstrlenA GetCurrentDirectoryA GetComputerNameA IsProcessorFeaturePresent GetVolumeInformationA GetWindowsDirectoryA ReadFile CreateFileA GetModuleFileNameA LocalFree QueryPerformanceCounter MapViewOfFile CreateFileMappingA FindClose FindNextFileA SetFileAttributesA SetThreadPriority WriteConsoleW SetEndOfFile HeapQueryInformation HeapSize SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW HeapReAlloc SetStdHandle DeleteFileW CreateEventA CreateProcessW GetExitCodeProcess GetFileAttributesExW FlushFileBuffers CreateDirectoryW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc GetExitCodeThread SleepConditionVariableSRW SleepConditionVariableCS WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable TryEnterCriticalSection InitializeSRWLock ReleaseSRWLockExclusive FindFirstFileA AcquireSRWLockExclusive InitializeCriticalSection LeaveCriticalSection EnterCriticalSection DeleteCriticalSection WaitForSingleObject SetEvent Sleep GetSystemInfo GetLastError ReadProcessMemory GetCurrentProcess Module32Next CloseHandle Module32First GetCurrentProcessId HeapAlloc ReadConsoleW HeapFree GetConsoleMode GetConsoleOutputCP FileTimeToSystemTime SystemTimeToTzSpecificLocalTime ExitProcess GetFullPathNameW GetDriveTypeW GetModuleHandleExW FreeLibraryAndExitThread ExitThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InterlockedPushEntrySList RaiseException RtlUnwind VerifyVersionInfoA FormatMessageW WaitForMultipleObjects GetFileType GetStdHandle GetEnvironmentVariableA MoveFileExA SleepEx SetLastError CreateSemaphoreW CreateThread QueryPerformanceFrequency GetFileInformationByHandle GetModuleFileNameW WaitNamedPipeW PeekNamedPipe GetSystemTimeAsFileTime GetCurrentThreadId GetStartupInfoW InitializeSListHead TerminateProcess UnhandledExceptionFilter GetModuleHandleW CreateEventW WaitForSingleObjectEx ResetEvent InitializeCriticalSectionAndSpinCount CreateFileW GetProcessHeap HeapValidate GetCPInfo LCMapStringEx InitializeCriticalSectionEx DecodePointer EncodePointer GetStringTypeW VirtualQuery CheckRemoteDebuggerPresent IsDebuggerPresent SetFilePointerEx GetFileSizeEx ReleaseSemaphore GetLocaleInfoA CompareStringA WideCharToMultiByte lstrlenW GlobalLock GlobalUnlock GetProcAddress GetVersionExA GetSystemDirectoryA WriteFile OutputDebugStringA WinExec GetModuleHandleA GetCurrentThread SetUnhandledExceptionFilter UnmapViewOfFile GetFileSize CreateDirectoryA GetLocalTime GlobalAlloc CreateToolhelp32Snapshot GetTickCount GetCurrentDirectoryW GetTimeZoneInformation MultiByteToWideChar

user32

DispatchMessageA GetKeyboardLayoutNameA GetKeyboardLayout TranslateMessage GetMessageA LoadCursorA AdjustWindowRectEx GetMenu RegisterClassA SetWindowLongA GetWindowLongA UpdateWindow SetFocus MoveWindow DestroyWindow IsWindow CreateWindowExA RegisterClassExA UnregisterClassA DefWindowProcA OpenClipboard CloseClipboard GetClipboardData GetCapture MonitorFromPoint MessageBoxA LoadStringA GetSystemMetrics ShowWindow ChangeDisplaySettingsA ReleaseCapture SetCapture SetCursorPos SetCursor ShowCursor DestroyCursor LoadImageA GetKeyState FlashWindowEx SystemParametersInfoA SetWindowPos LoadIconA FindWindowA ScreenToClient GetCursorPos PostQuitMessage GetAsyncKeyState SetRect OffsetRect GetClientRect ClientToScreen PeekMessageA ReleaseDC FillRect CharNextW GetDC InvalidateRect CharPrevExA CharNextExA GetMonitorInfoA

gdi32

GetTextExtentPoint32A CreateFontIndirectA GetCharABCWidthsFloatW GetDeviceCaps GetTextExtentPoint32W SelectObject SetBkColor SetTextColor TextOutW GetStockObject DeleteDC SetBkMode CreateDIBSection StretchBlt DeleteObject CreateSolidBrush TextOutA CreateCompatibleDC EnumFontFamiliesExA GetPixel

advapi32

RegCloseKey RegOpenKeyExA RegQueryValueExA RegOpenKeyA RegSetValueExW RegCreateKeyExW CryptGenRandom CryptDestroyKey CryptAcquireContextA CryptCreateHash CryptHashData CryptGetHashParam CryptDestroyHash CryptReleaseContext CryptImportKey CryptEncrypt

shell32

ShellExecuteA SHGetSpecialFolderPathA

ole32

CoCreateInstance CoUninitialize CoInitialize CoInitializeEx OleSetContainedObject OleUninitialize OleInitialize CoGetClassObject

winmm

timeEndPeriod timeGetDevCaps timeBeginPeriod timeGetTime

d3d8

Direct3DCreate8

python27

Py_InitModule4 PyErr_SetString PyExc_RuntimeError PyTuple_GetItem PyInt_AsLong PyList_New PyString_FromString PyList_Append PyModule_AddIntConstant PyTuple_Size PyDict_GetItemString PyLong_AsLong PyLong_FromLongLong PyTuple_New PyDict_New PyDict_SetItemString PyTuple_SetItem PyArg_ParseTuple PyDict_Size PyDict_Next PyString_InternFromString PyObject_GetAttrString PyObject_GetAttr PyCallable_Check PyLong_AsLongLong PyFloat_AsDouble PyString_AsString PyErr_Clear PyErr_BadArgument Py_BuildValue PyObject_CallObject PyNumber_Check _Py_NoneStruct PyModule_GetDict PyErr_Fetch Py_SetProgramName Py_Initialize Py_Finalize PyRun_StringFlags PyImport_AddModule PyImport_ImportModule PyImport_FrozenModules PyErr_Print

imm32

ImmGetOpenStatus ImmSetConversionStatus ImmGetConversionStatus ImmGetCandidateListW ImmSetCompositionStringW ImmGetCompositionStringW ImmAssociateContext ImmReleaseContext ImmGetContext ImmIsIME ImmNotifyIME ImmGetIMEFileNameA

devil

ilInit ilSetPixels ilTexImage ilSave ilShutDown ilDeleteImages ilCopyPixels ilConvertImage ilGetInteger ilLoad ilOriginFunc ilBindImage ilGenImages ilEnable

crypt32

CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryA CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CryptQueryObject CertGetNameStringA CertCreateCertificateChainEngine CertFreeCertificateChainEngine CryptProtectData CryptUnprotectData CertGetCertificateChain CertFindExtension CertFreeCertificateChain

wininet

InternetOpenA InternetReadFile InternetOpenUrlA InternetSetOptionA InternetCloseHandle

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

imagehlp

EnumerateLoadedModules GetTimestampForLoadedLibrary StackWalk

granny2

_GrannyGetTotalTypeSize@4 _GrannyGetMeshVertexCount@4 _GrannyMeshIsRigid@4 _GrannyGetMeshIndexCount@4 _GrannyFreeControl@4 _GrannyGetMeshBindingToBoneIndices@4 _GrannySetControlEaseOut@8 GrannyPNT332VertexType _GrannyFreeModelInstance@4 _GrannyDeformVertices@24 _GrannyFreeMeshDeformer@4 _GrannyNewMeshDeformer@16 _GrannyCopyMeshIndices@12 _GrannyNewWorldPose@4 _GrannyGetMeshVertices@4 _GrannyNewMeshBinding@12 _GrannyCopyMeshVertices@12 _GrannyGetMeshVertexType@4 _GrannyGetMeshTriangleGroups@4 _GrannyGetMeshTriangleGroupCount@4 _GrannyPlayControlledAnimation@12 _GrannyGetWorldPoseComposite4x4@8 _GrannySetControlRawLocalClock@8 _GrannyGetWorldPose4x4@8 _GrannyFreeControlOnceUnused@4 _GrannyFreeWorldPose@4 _GrannyGetControlRawLocalClock@4 _GrannySetControlEaseOutCurve@28 _GrannyCompleteControlAt@8 _GrannyControlIsComplete@4 _GrannyFreeControlIfComplete@4 _GrannyGetControlLoopCount@4 _GrannySetControlLoopCount@8 _GrannyGetControlSpeed@4 _GrannyGetMaterialTextureByType@8 _GrannyFindMatchingMember@16 _GrannyConvertSingleObject@20 _GrannyReadEntireFileFromMemory@8 _GrannyFreeFileSection@8 _GrannyFreeFile@4 _GrannyGetFileInfo@4 _GrannyGetSourceSkeleton@4 _GrannySetModelClock@8 _GrannyFreeCompletedModelControls@4 _GrannySampleModelAnimationsAccelerated@20 _GrannyUpdateModelMatrix@20 _GrannyNewLocalPose@4 _GrannyFreeLocalPose@4 _GrannyGetWorldPoseComposite4x4Array@4 _GrannyInstantiateModel@4 _GrannyFindBoneByName@12 _GrannySetControlSpeed@8 _GrannyGetControlLocalDuration@4 _GrannySetControlEaseIn@8 _GrannySetControlEaseInCurve@28 _GrannyFreeMeshBinding@4

mss32

_AIL_set_3D_sample_loop_count@8 _AIL_3D_sample_status@4 _AIL_3D_sample_volume@4 _AIL_set_3D_sample_volume@8 _AIL_set_sample_volume_pan@12 _AIL_mem_free_lock@4 _AIL_file_read@8 _AIL_set_file_callbacks@16 _AIL_WAV_info@8 _AIL_decompress_ASI@24 _AIL_decompress_ADPCM@12 _AIL_file_type@8 _AIL_open_digital_driver@16 _AIL_open_stream@12 _AIL_close_digital_driver@4 _AIL_enumerate_3D_providers@12 _AIL_open_3D_provider@4 _AIL_close_3D_provider@4 _AIL_open_3D_listener@4 _AIL_close_3D_listener@4 _AIL_set_3D_position@16 _AIL_set_3D_velocity@20 _AIL_set_3D_orientation@28 _AIL_startup@0 _AIL_shutdown@0 _AIL_set_redist_directory@4 _AIL_close_stream@4 _AIL_start_stream@4 _AIL_pause_stream@8 _AIL_set_stream_volume_levels@12 _AIL_stream_volume_levels@12 _AIL_set_stream_loop_count@8 _AIL_set_3D_sample_file@8 _AIL_stream_status@4 _AIL_last_error@0 _AIL_allocate_sample_handle@4 _AIL_release_sample_handle@4 _AIL_init_sample@4 _AIL_end_3D_sample@4 _AIL_resume_3D_sample@4 _AIL_stop_3D_sample@4 _AIL_start_3D_sample@4 _AIL_release_3D_sample_handle@4 _AIL_allocate_3D_sample_handle@4 _AIL_sample_volume_pan@12 _AIL_sample_status@4 _AIL_set_sample_file@12 _AIL_start_sample@4 _AIL_stop_sample@4 _AIL_resume_sample@4 _AIL_auto_update_3D_position@8 _AIL_set_sample_loop_count@8 _AIL_end_sample@4

speedtreert

?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ ?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z ?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ ?SetTime@CSpeedTreeRT@@SAXM@Z ?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z ?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z ?SetLightState@CSpeedTreeRT@@SAXI_N@Z ?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z ?SetCamera@CSpeedTreeRT@@SAXPBM0@Z ??0SGeometry@CSpeedTreeRT@@QAE@XZ ??1SGeometry@CSpeedTreeRT@@QAE@XZ ??0STextures@CSpeedTreeRT@@QAE@XZ ??1STextures@CSpeedTreeRT@@QAE@XZ ??0CSpeedTreeRT@@QAE@XZ ??1CSpeedTreeRT@@QAE@XZ ??2CSpeedTreeRT@@SAPAXI@Z ??3CSpeedTreeRT@@SAXPAX@Z ?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z ?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ ?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z ?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z ?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z ?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z ?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z ?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z ?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z ?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z ?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ ?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ ?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ ?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z ?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z ?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z ?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z ?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z ?SetLocalMatrices@CSpeedTreeRT@@QAEXII@Z ?ComputeLodLevel@CSpeedTreeRT@@QAEXXZ ?SetLodLevel@CSpeedTreeRT@@QAEXM@Z ?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z ?SetLodLimits@CSpeedTreeRT@@QAEXMM@Z ?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ ?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ ?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ ?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z ?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z ?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z ?GetCurrentError@CSpeedTreeRT@@SAPBDXZ

dinput8

DirectInput8Create

ws2_32

closesocket connect ioctlsocket recv select send socket WSAGetLastError WSAStartup WSACleanup htonl htons inet_addr ntohl ntohs gethostbyname WSAEnumNetworkEvents gethostname bind getpeername getsockname getsockopt setsockopt WSASetLastError WSAIoctl accept listen getaddrinfo freeaddrinfo WSACloseEvent WSACreateEvent WSAEventSelect recvfrom sendto __WSAFDIsSet

ddraw

DirectDrawCreate

oleaut32

VariantClear SysAllocString VariantInit SysFreeString

wldap32

ord30 ord200 ord301 ord79 ord35 ord143 ord33 ord46 ord211 ord60 ord45 ord50 ord41 ord32 ord22 ord26 ord27 ord217

normaliz

IdnToAscii

Name

.text

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

577KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.9MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data1

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

248KB

Virtual Size

247KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

151KB

Virtual Size

151KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=43, id=224, productName=VS2013 build 21005, version=21005,

count=50, id=259, version=33145,

count=224, id=261, version=33145,

count=4, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=111, id=260, productName=VS2019 v16.4.3 build 28315, version=28315,

count=60, id=261, version=30145,

count=1, id=262, version=33145,

count=1, id=48, version=9044,

count=2, id=203, productName=VS2012 UPD3 build 60610, version=60610,

count=60, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,

count=7, id=253, version=28518,

count=20, id=260, version=30034,

count=29, id=259, version=30034,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=5, id=28, version=9178,

count=76, id=29, version=9178,

count=1, id=18, version=8444,

count=8, productName=Unmarked objects (old),

count=4, id=25, version=9210,

count=98, id=261, version=30034,

count=210, id=261, version=30159,

count=141, id=260, version=30159,

count=40, id=260, version=33145,

count=35, id=257, version=33145,

count=640, id=1, productName=Unmarked objects,

count=108, id=265, version=30159,

count=1, id=255, version=30159,

count=1, id=151,

count=1, id=258, version=30159,