6a84c4f387ccd0d89362e6fe2af8a36448f789885fda3b31179aa31ddf619ef5

Sharing

Copy URL Twitter E-mail

General

Target
6a84c4f387ccd0d89362e6fe2af8a36448f789885fda3b31179aa31ddf619ef5
Size 7.7MB
Sample261001-prwbeasy6p
SHA256 6a84c4f387ccd0d89362e6fe2af8a36448f789885fda3b31179aa31ddf619ef5
MD5 dcd7095bafff6b6ef051a36331411e64
SHA1 6b47c1b2b6b76ac2872c86f4ea03f7894a586a83
SHA512 9d0229be675251535ba297c3e44f3eb36fd07347b1fa16897b24877dcb36b27553f45320a30c14819a30281495fefff4de381858c10268166839fc70f9f9f4ad
SSDEEP 98304:gH1hG43SaZgizjXxTR6KYsg+jufEXZUXU:gVhG4Caj3lgGuEq
TLSH
T16A864D30D602802AF9F604B2EEFEDDDE551CBA200F9854D3A3C45EDDDA99AC1793215B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6a84c4f387ccd0d89362e6fe2af8a36448f789885fda3b31179aa31ddf619ef5

File Explorer

6a84c4f387ccd0d89362e6fe2af8a36448f789885fda3b31179aa31ddf619ef5

.exe 7.7MB

6a84c4f387ccd0d89362e6fe2af8a36448f789885fda3b31179aa31ddf619ef5

IMPHASH 40fd4b903994130da1ee5e0ac1392cf9
SHA256 6a84c4f387ccd0d89362e6fe2af8a36448f789885fda3b31179aa31ddf619ef5
MD5 dcd7095bafff6b6ef051a36331411e64
SHA1 6b47c1b2b6b76ac2872c86f4ea03f7894a586a83
SHA512 9d0229be675251535ba297c3e44f3eb36fd07347b1fa16897b24877dcb36b27553f45320a30c14819a30281495fefff4de381858c10268166839fc70f9f9f4ad
SSDEEP 98304:gH1hG43SaZgizjXxTR6KYsg+jufEXZUXU:gVhG4Caj3lgGuEq
TLSH
T16A864D30D602802AF9F604B2EEFEDDDE551CBA200F9854D3A3C45EDDDA99AC1793215B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4089584

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

MoveFileA GetPrivateProfileStringA lstrlenA GlobalFree GetModuleFileNameA CreateMutexA SetEndOfFile SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW SetStdHandle DeleteFileW SetFileAttributesW GetCurrentDirectoryW GetTimeZoneInformation CreateProcessW GetExitCodeProcess HeapQueryInformation HeapSize HeapReAlloc GetFileAttributesExW FlushFileBuffers CreateDirectoryW ReadConsoleW GetConsoleMode GetConsoleOutputCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect FlsFree FlsGetValue FlsAlloc OutputDebugStringW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime ReleaseMutex ExitProcess FreeLibraryAndExitThread ExitThread CreateThread GetFullPathNameW GetDriveTypeW HeapValidate WriteConsoleW GetModuleHandleExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount LoadLibraryExW GetModuleFileNameW InterlockedPushEntrySList RtlUnwind GetFileSizeEx VerifyVersionInfoA VerSetConditionMask FormatMessageW WaitForMultipleObjects PeekNamedPipe GetFileType GetStdHandle GetEnvironmentVariableA DeleteFileA GetCurrentDirectoryA FindNextFileA FindFirstFileA FindClose MultiByteToWideChar SetFileAttributesA Sleep Module32Next Module32First CreateToolhelp32Snapshot ReadProcessMemory GetCurrentProcessId GetCurrentProcess GetLastError FlsSetValue TryAcquireSRWLockExclusive WaitForSingleObjectEx MoveFileExA GetTickCount SleepEx GetThreadTimes GetCurrentThread QueryPerformanceFrequency SetLastError SetFilePointerEx CreateFileW GetComputerNameA GetSystemTimeAsFileTime VirtualQuery GetProcessHeap HeapFree HeapAlloc GetModuleHandleW GetStartupInfoW RaiseException IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSListHead GetCurrentThreadId GetCPInfo LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx GetStringTypeW QueryPerformanceCounter CopyFileA DebugBreak IsDebuggerPresent DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection CreateSemaphoreA SetThreadPriority WaitForSingleObject ReleaseSemaphore GetLocaleInfoA CompareStringA lstrlenW GlobalLock GlobalUnlock LoadLibraryA GetProcAddress FreeLibrary GetVersionExA GetSystemDirectoryA GetModuleHandleA WideCharToMultiByte WriteFile SetFilePointer ReadFile CreateFileMappingA UnmapViewOfFile MapViewOfFile GetSystemInfo GetFileSize CreateFileA GetTempFileNameA GetTempPathA RemoveDirectoryA CreateDirectoryA AllocConsole GlobalAlloc CloseHandle GetFileInformationByHandle OutputDebugStringA

user32

GetSystemMetrics ChangeDisplaySettingsA ReleaseCapture SetCapture MessageBoxA GetCapture ShowWindow ClientToScreen LoadImageA DestroyCursor SetCursor ShowCursor GetKeyState SystemParametersInfoA LoadIconA FindWindowA ScreenToClient GetCursorPos GetAsyncKeyState SetWindowPos PostQuitMessage SetCursorPos DefWindowProcA UnregisterClassA RegisterClassExA CreateWindowExA IsWindow DestroyWindow MoveWindow SetFocus UpdateWindow GetClientRect GetWindowLongA SetWindowLongA RegisterClassA GetMenu InvalidateRect SetWindowTextA GetWindowRect AdjustWindowRectEx SetRect LoadCursorA GetMessageA TranslateMessage DispatchMessageA PeekMessageA GetDC ReleaseDC GetKeyboardLayoutNameA GetKeyboardLayout OpenClipboard LoadImageW LoadIconW CreateWindowExW RegisterClassExW UnregisterClassW DefWindowProcW SendMessageW CharPrevExA CharNextExA CharNextW GetClipboardData CloseClipboard LoadStringA

ole32

OleSetContainedObject OleUninitialize OleInitialize CoGetClassObject CoInitializeEx CoCreateInstance CoUninitialize

winmm

timeGetTime timeBeginPeriod timeEndPeriod timeGetDevCaps

d3d9

Direct3DCreate9

d3dx9_43

D3DXMatrixRotationAxis D3DXVec3TransformNormal D3DXMatrixRotationX D3DXMatrixInverse D3DXVec3Normalize D3DXMatrixRotationYawPitchRoll D3DXQuaternionMultiply D3DXQuaternionRotationAxis D3DXLoadSurfaceFromSurface D3DXCreateTexture D3DXVec4Transform D3DXMatrixLookAtRH D3DXVec3Project D3DXVec3Unproject D3DXMatrixScaling D3DXMatrixPerspectiveFovRH D3DXMatrixOrthoRH D3DXGetImageInfoFromFileInMemory D3DXCreateSphere D3DXMatrixRotationQuaternion D3DXCreateCylinder D3DXVec2Normalize D3DXCreateTextureFromFileInMemoryEx D3DXMatrixTranspose D3DXVec3Transform D3DXQuaternionRotationYawPitchRoll D3DXPlaneNormalize D3DXMatrixRotationY D3DXMatrixOrthoOffCenterRH D3DXCreateMatrixStack D3DXMatrixDeterminant D3DXMatrixTranslation D3DXMatrixMultiply D3DXMatrixRotationZ D3DXVec3TransformCoord D3DXGetFVFVertexSize

python27

PyExc_RuntimeError _PyThreadState_Current PyInt_AsLong PyString_FromString PyTuple_GetItem PyList_New PyList_Append PyModule_AddIntConstant Py_InitModule4 PyLong_AsLong PyTuple_Size PyDict_GetItemString PyLong_FromLongLong PyArg_ParseTuple PyTuple_New PyTuple_SetItem PyDict_Next PyDict_Size PyString_InternFromString PyObject_GetAttrString PyFrame_GetLineNumber PyErr_SetString PyString_AsString PyObject_GetAttr PyCallable_Check PyLong_AsLongLong PyFloat_AsDouble PyErr_Clear PyErr_BadArgument PyErr_Print Py_BuildValue PyNumber_Check _Py_NoneStruct PyDict_SetItemString PyModule_GetDict PyErr_Fetch Py_SetProgramName Py_Initialize Py_Finalize PyRun_StringFlags PyEval_SetTrace PyImport_GetMagicNumber PyImport_AddModule PyImport_ImportModule PyObject_AsCharBuffer PyCode_Addr2Line PyEval_EvalCode Py_OptimizeFlag PyCode_Type PyUnicodeUCS2_DecodeUTF8 PyInt_FromLong _PyLong_FromByteArray PyFloat_FromDouble PyComplex_FromCComplex PyString_FromStringAndSize PyList_SetItem PyDict_New PyDict_SetItem PyErr_Occurred PyErr_NoMemory PyEval_GetRestricted PyCode_New PyMarshal_ReadObjectFromString _PyLong_New _Py_EllipsisObject PyExc_StopIteration PyExc_EOFError PyExc_ValueError PyObject_CallObject Py_FlushLine

devil

ilInit ilTexImage ilSetPixels ilSave ilShutDown ilOriginFunc ilLoad ilGetInteger ilGenImages ilEnable ilDeleteImages ilCopyPixels ilConvertImage ilBindImage

imm32

ImmGetOpenStatus ImmSetConversionStatus ImmGetConversionStatus ImmGetCandidateListW ImmSetCompositionStringW ImmGetCompositionStringW ImmAssociateContext ImmNotifyIME ImmReleaseContext ImmGetContext ImmIsIME ImmGetIMEFileNameA

version

VerQueryValueA GetFileVersionInfoA GetFileVersionInfoSizeA

granny2

GrannyPNT332VertexType _GrannyDeformVertices@24 _GrannyFreeMeshDeformer@4 _GrannySetLogCallback@4 _GrannyGetMaterialTextureByType@8 _GrannyFindMatchingMember@16 _GrannyConvertSingleObject@20 _GrannyReadEntireFileFromMemory@8 _GrannyFreeFileSection@8 _GrannyFreeFile@4 _GrannyNewMeshDeformer@16 _GrannyGetSourceSkeleton@4 _GrannySetModelClock@8 _GrannyFreeCompletedModelControls@4 _GrannySampleModelAnimationsAccelerated@20 _GrannyUpdateModelMatrix@20 _GrannyNewLocalPose@4 _GrannyFreeLocalPose@4 _GrannyGetWorldPoseComposite4x4Array@4 _GrannyInstantiateModel@4 _GrannyFreeModelInstance@4 _GrannyNewMeshBinding@12 _GrannyFreeMeshBinding@4 _GrannyGetMeshBindingToBoneIndices@4 _GrannyCopyMeshIndices@12 _GrannyPlayControlledAnimation@12 _GrannyFindBoneByName@12 _GrannyNewWorldPose@4 _GrannyFreeWorldPose@4 _GrannyGetWorldPose4x4@8 _GrannyGetWorldPoseComposite4x4@8 _GrannyGetTotalTypeSize@4 _GrannyGetMeshVertexCount@4 _GrannyMeshIsRigid@4 _GrannyGetMeshIndexCount@4 _GrannyFreeControl@4 _GrannyFreeControlOnceUnused@4 _GrannyCompleteControlAt@8 _GrannyControlIsComplete@4 _GrannyFreeControlIfComplete@4 _GrannyGetControlLoopCount@4 _GrannySetControlLoopCount@8 _GrannyGetControlSpeed@4 _GrannySetControlSpeed@8 _GrannyGetControlLocalDuration@4 _GrannySetControlEaseIn@8 _GrannySetControlEaseInCurve@28 _GrannySetControlEaseOut@8 _GrannySetControlEaseOutCurve@28 _GrannyGetControlRawLocalClock@4 _GrannySetControlRawLocalClock@8 _GrannyGetFileInfo@4 _GrannyGetMeshTriangleGroupCount@4 _GrannyGetMeshTriangleGroups@4 _GrannyGetMeshVertexType@4 _GrannyCopyMeshVertices@12 _GrannyGetMeshVertices@4

mss32

_AIL_init_sample@4 _AIL_release_sample_handle@4 _AIL_allocate_sample_handle@4 _AIL_set_sample_file@12 _AIL_last_error@0 _AIL_mem_free_lock@4 _AIL_file_read@8 _AIL_set_file_callbacks@16 _AIL_WAV_info@8 _AIL_decompress_ASI@24 _AIL_decompress_ADPCM@12 _AIL_file_type@8 _AIL_open_digital_driver@16 _AIL_open_stream@12 _AIL_close_digital_driver@4 _AIL_enumerate_3D_providers@12 _AIL_open_3D_provider@4 _AIL_close_3D_provider@4 _AIL_open_3D_listener@4 _AIL_close_3D_listener@4 _AIL_set_3D_position@16 _AIL_set_3D_velocity@20 _AIL_set_3D_orientation@28 _AIL_start_sample@4 _AIL_stop_sample@4 _AIL_resume_sample@4 _AIL_end_sample@4 _AIL_set_sample_volume_pan@12 _AIL_set_sample_loop_count@8 _AIL_sample_status@4 _AIL_sample_volume_pan@12 _AIL_startup@0 _AIL_allocate_3D_sample_handle@4 _AIL_release_3D_sample_handle@4 _AIL_start_3D_sample@4 _AIL_stop_3D_sample@4 _AIL_resume_3D_sample@4 _AIL_end_3D_sample@4 _AIL_set_3D_sample_file@8 _AIL_set_3D_sample_volume@8 _AIL_set_3D_sample_loop_count@8 _AIL_3D_sample_status@4 _AIL_3D_sample_volume@4 _AIL_update_3D_position@8 _AIL_shutdown@0 _AIL_stream_status@4 _AIL_set_stream_loop_count@8 _AIL_stream_volume_levels@12 _AIL_set_stream_volume_levels@12 _AIL_pause_stream@8 _AIL_start_stream@4 _AIL_close_stream@4 _AIL_set_redist_directory@4 _AIL_auto_update_3D_position@8

speedtreert

?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ ?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z ?GetCurrentError@CSpeedTreeRT@@SAPBDXZ ?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z ?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ ?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z ?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z ?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ ?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ ?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z ?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z ?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z ?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z ?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z ?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z ?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ ?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ ?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ ?GetLeafLightingAdjustment@CSpeedTreeRT@@QBEMXZ ?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z ?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z ?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z ?SetTime@CSpeedTreeRT@@SAXM@Z ?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z ?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z ?SetLightState@CSpeedTreeRT@@SAXI_N@Z ?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z ?SetCamera@CSpeedTreeRT@@SAXPBM0@Z ??0SGeometry@CSpeedTreeRT@@QAE@XZ ??1SGeometry@CSpeedTreeRT@@QAE@XZ ??0STextures@CSpeedTreeRT@@QAE@XZ ??1STextures@CSpeedTreeRT@@QAE@XZ ??0CSpeedTreeRT@@QAE@XZ ??1CSpeedTreeRT@@QAE@XZ ??2CSpeedTreeRT@@SAPAXI@Z ??3CSpeedTreeRT@@SAXPAX@Z ?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z ?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ ?DeleteTransientData@CSpeedTreeRT@@QAEXXZ ?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z ?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z ?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z ?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ ?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z ?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z

dinput8

DirectInput8Create

ws2_32

__WSAFDIsSet closesocket connect ioctlsocket bind getpeername getsockname getsockopt recv WSAIoctl accept listen getaddrinfo freeaddrinfo WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect recvfrom sendto select send gethostbyname gethostname setsockopt ntohs socket WSAGetLastError WSAStartup WSACleanup htonl htons inet_addr ntohl WSASetLastError

gdi32

GetStockObject EnumFontFamiliesExA CreateFontIndirectA DeleteObject GetCharABCWidthsFloatW GetTextExtentPoint32W SelectObject SetBkColor SetTextColor TextOutW CreateCompatibleDC DeleteDC SetBkMode TextOutA GetTextExtentPoint32A SetDIBitsToDevice CreateDIBSection

advapi32

CryptHashData CryptDestroyHash CryptDestroyKey CryptImportKey CryptEncrypt RegOpenKeyExA RegQueryValueExA CryptAcquireContextA CryptReleaseContext CryptGenRandom CryptGetHashParam CryptCreateHash RegCloseKey

shell32

SHGetSpecialFolderPathA

oleaut32

SafeArrayDestroy SysFreeString SafeArrayCreate VariantInit SysAllocString VariantClear SafeArrayAccessData

crypt32

CertAddCertificateContextToStore PFXImportCertStore CertGetNameStringA CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertFindExtension CryptStringToBinaryA CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CryptDecodeObjectEx

wldap32

ord143 ord301 ord200 ord30 ord79 ord35 ord33 ord32 ord27 ord26 ord22 ord46 ord41 ord50 ord45 ord60 ord217 ord211

normaliz

IdnToUnicode IdnToAscii

Name

.text

Size

6.5MB

Virtual Size

6.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

992KB

Virtual Size

991KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

206KB

Virtual Size

496KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.msvcjmc

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

47KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

generic

count=43, id=264, version=35229,

count=51, id=259, version=33145,

count=233, id=261, version=33145,

count=4, id=260, version=33520,

count=111, id=260, productName=VS2019 v16.4.3 build 28315, version=28315,

count=63, id=261, version=33520,

count=1, id=171, productName=VS2010 build 30319, version=30319,

count=1, id=262, version=33145,

count=1, id=48, version=9044,

count=2, id=203, productName=VS2012 UPD3 build 60610, version=60610,

count=60, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,

count=7, id=253, version=35207,

count=23, id=259, version=35207,

count=18, id=260, version=35207,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=103, id=261, version=35207,

count=2, id=156, version=21202,

count=2, id=123, productName=VS2005 build 50727, version=50727,

count=3, id=260, version=35229,

count=38, id=260, version=33145,

count=31, id=257, version=33145,

count=620, id=1, productName=Unmarked objects,

count=297, id=261, version=35229,

count=1, id=256, version=35229,

count=1, id=255, version=35229,

count=1, id=151,

count=1, id=258, version=35229,