6e42b9d583a7c54465c7b18e8ad771f9244debb8164823ad627d5a6464a7fcd1

Sharing

Copy URL Twitter E-mail

General

Target
6e42b9d583a7c54465c7b18e8ad771f9244debb8164823ad627d5a6464a7fcd1
Size 3.2MB
Sample261002-3kft2axzft
SHA256 6e42b9d583a7c54465c7b18e8ad771f9244debb8164823ad627d5a6464a7fcd1
MD5 0e71ec4e4d2c0661537b5114f1f91b8c
SHA1 b90b6f070ef6da861c9709c6b5fc1e0cb73b3b14
SHA512 0859d62b61cae96df943d69991ec6f79492e3f628120f9dee9d7bb83a24deb0b3b14af5e4949494f2b1d117631c16eed4054dbf90b57397fbd9f20c866ce14d6
SSDEEP 49152:gZ2rA94fDdo+YMDn0PJ3W/eTn24GF1vDoSYxhKH9oJ5pewhP08X0qaWJdby:W4popMD0PJ524GFKSOIb
TLSH
T1B2F5BF31B105C0B1D88211F1997CBFBF856CA9381B75A9C3A3C41D6ED9B05C23F76A9A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6e42b9d583a7c54465c7b18e8ad771f9244debb8164823ad627d5a6464a7fcd1

File Explorer

6e42b9d583a7c54465c7b18e8ad771f9244debb8164823ad627d5a6464a7fcd1

.exe 3.2MB

6e42b9d583a7c54465c7b18e8ad771f9244debb8164823ad627d5a6464a7fcd1

IMPHASH a7c028fa489e1a631275b5633c8bbe07
SHA256 6e42b9d583a7c54465c7b18e8ad771f9244debb8164823ad627d5a6464a7fcd1
MD5 0e71ec4e4d2c0661537b5114f1f91b8c
SHA1 b90b6f070ef6da861c9709c6b5fc1e0cb73b3b14
SHA512 0859d62b61cae96df943d69991ec6f79492e3f628120f9dee9d7bb83a24deb0b3b14af5e4949494f2b1d117631c16eed4054dbf90b57397fbd9f20c866ce14d6
SSDEEP 49152:gZ2rA94fDdo+YMDn0PJ3W/eTn24GF1vDoSYxhKH9oJ5pewhP08X0qaWJdby:W4popMD0PJ524GFKSOIb
TLSH
T1B2F5BF31B105C0B1D88211F1997CBFBF856CA9381B75A9C3A3C41D6ED9B05C23F76A9A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1505414

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GlobalFree GetModuleFileNameA GetCommandLineA GetPrivateProfileIntA WritePrivateProfileStringA CreateMutexA DeleteFileA GetPrivateProfileStringA lstrlenA GetCurrentDirectoryA MoveFileA SetThreadPriority CreateThread GetCurrentThreadId GetTickCount Process32Next Process32First GetConsoleWindow ExitProcess GetProcAddress FreeLibrary LoadLibraryA GetModuleHandleW Module32NextW Module32FirstW GetSystemDirectoryW WriteConsoleW SetEndOfFile HeapQueryInformation HeapSize GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW HeapReAlloc SetStdHandle DeleteFileW GetCurrentDirectoryW GetTimeZoneInformation CreateProcessW GetExitCodeProcess GetFileAttributesExW FlushFileBuffers CreateDirectoryW EnumSystemLocalesW GetModuleFileNameW IsValidLocale GetLocaleInfoW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapAlloc ReadConsoleW HeapFree GetConsoleMode GetConsoleOutputCP FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetFileInformationByHandle GetModuleHandleExW FreeLibraryAndExitThread ExitThread GetFullPathNameW GetDriveTypeW LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RaiseException InterlockedPushEntrySList RtlUnwind GetFileSizeEx VerifyVersionInfoA VerSetConditionMask FormatMessageW WaitForMultipleObjects PeekNamedPipe GetFileType GetStdHandle GetEnvironmentVariableA WaitForSingleObjectEx MoveFileExA SleepEx QueryPerformanceFrequency SetLastError SetFilePointerEx WideCharToMultiByte GetLocalTime GetFileAttributesW FindClose FindNextFileA FindFirstFileA MultiByteToWideChar SetFileAttributesA Sleep GetLastError ReadProcessMemory GetCurrentProcess Module32Next CloseHandle Module32First LCMapStringW TryAcquireSRWLockExclusive CreateFileW GetSystemTimeAsFileTime GetStartupInfoW IsDebuggerPresent InitializeSListHead IsProcessorFeaturePresent TerminateProcess UnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetCPInfo LCMapStringEx InitializeCriticalSectionEx DecodePointer EncodePointer GetStringTypeW QueryPerformanceCounter DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection WaitForSingleObject ReleaseSemaphore GetLocaleInfoA CompareStringA lstrlenW GlobalLock GlobalUnlock GetVersionExA GetSystemDirectoryA WriteFile ReadFile OutputDebugStringA WinExec GetModuleHandleA GetCurrentThread SetUnhandledExceptionFilter CreateFileMappingA UnmapViewOfFile MapViewOfFile GetSystemInfo GetFileSize CreateFileA CreateDirectoryA GlobalAlloc GetCurrentProcessId GetUserDefaultLCID CreateToolhelp32Snapshot

user32

LoadStringA EnumWindows GetClassNameA GetWindowTextA GetWindowTextLengthA IsWindowVisible MessageBoxA PostThreadMessageA GetSystemMetrics FlashWindowEx GetForegroundWindow GetCapture ShowWindow CreateWindowExA ChangeDisplaySettingsA DestroyWindow MoveWindow SetFocus UpdateWindow GetClientRect GetWindowLongA PostMessageA GetMessageA TranslateMessage DispatchMessageA PeekMessageA GetDC ReleaseDC RegisterClassA GetMenu InvalidateRect AdjustWindowRectEx ReleaseCapture SetCapture SetCursorPos ClientToScreen SetCursor ShowCursor DestroyCursor LoadImageA GetKeyState SystemParametersInfoA SetWindowLongA RegisterClassExA UnregisterClassA DefWindowProcA GetKeyboardLayout OpenClipboard CloseClipboard GetClipboardData CharNextW CharNextExA CharPrevExA MonitorFromPoint GetMonitorInfoA SetWindowPos LoadIconA FindWindowA ScreenToClient GetCursorPos GetAsyncKeyState PostQuitMessage SetRect LoadCursorA IsWindow GetKeyboardLayoutNameA

ole32

OleInitialize CoGetClassObject CoCreateInstance OleUninitialize OleSetContainedObject CoInitializeEx CoUninitialize

winmm

timeGetDevCaps timeBeginPeriod timeGetTime timeEndPeriod

d3d9

Direct3DCreate9

d3dx9_43

D3DXVec3Normalize D3DXCreateCylinder D3DXCreateSphere D3DXGetImageInfoFromFileInMemory D3DXCreateTexture D3DXCreateTextureFromFileInMemoryEx D3DXGetFVFVertexSize D3DXPlaneNormalize D3DXQuaternionRotationYawPitchRoll D3DXVec3Transform D3DXMatrixTranspose D3DXMatrixOrthoOffCenterRH D3DXMatrixOrthoRH D3DXMatrixPerspectiveFovRH D3DXMatrixRotationZ D3DXVec3TransformCoord D3DXMatrixTranslation D3DXMatrixMultiply D3DXQuaternionMultiply D3DXQuaternionRotationAxis D3DXMatrixRotationQuaternion D3DXMatrixRotationYawPitchRoll D3DXMatrixInverse D3DXMatrixRotationX D3DXVec3TransformNormal D3DXMatrixRotationAxis D3DXVec4Transform D3DXVec2Normalize D3DXMatrixDeterminant D3DXMatrixLookAtRH D3DXVec3Project D3DXMatrixScaling D3DXCreateMatrixStack

python27

PyImport_ImportModule PyImport_AddModule PyRun_StringFlags Py_Finalize Py_SetProgramName PyErr_Fetch PyModule_GetDict PyDict_SetItemString _Py_NoneStruct PyNumber_Check PyObject_CallObject PyErr_Print PyErr_BadArgument PyErr_Clear PyFloat_AsDouble PyLong_AsLongLong PyCallable_Check PyObject_GetAttr PyObject_GetAttrString PyString_InternFromString PyDict_Next PyDict_Size PyInt_FromLong PyTuple_SetItem PyTuple_New PyArg_ParseTuple PyList_SetItem PyLong_AsLong PyDict_GetItemString PyTuple_Size PyModule_AddIntConstant Py_InitModule4 PyList_Append PyString_FromString PyList_New PyInt_AsLong PyTuple_GetItem PyExc_RuntimeError PyErr_SetString PyFrame_GetLineNumber PyString_AsString _PyThreadState_Current Py_BuildValue Py_Initialize

devil

ilInit ilSetPixels ilTexImage ilSave ilShutDown ilDeleteImages ilCopyPixels ilConvertImage ilGetInteger ilLoad ilOriginFunc ilEnable ilBindImage ilGenImages

imm32

ImmGetOpenStatus ImmSetConversionStatus ImmGetConversionStatus ImmGetCandidateListW ImmSetCompositionStringW ImmGetCompositionStringW ImmAssociateContext ImmReleaseContext ImmGetContext ImmIsIME ImmGetIMEFileNameA ImmNotifyIME

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

imagehlp

GetTimestampForLoadedLibrary EnumerateLoadedModules StackWalk

granny2

_GrannyFreeFileSection@8 _GrannyFreeFile@4 _GrannyGetFileInfo@4 _GrannyGetSourceSkeleton@4 _GrannySetModelClock@8 _GrannyFreeCompletedModelControls@4 _GrannySampleModelAnimationsAccelerated@20 _GrannyUpdateModelMatrix@20 _GrannySetControlEaseOut@8 _GrannyFreeLocalPose@4 _GrannyGetWorldPoseComposite4x4Array@4 _GrannyInstantiateModel@4 _GrannyFreeModelInstance@4 _GrannyNewMeshBinding@12 _GrannyFreeMeshBinding@4 _GrannyGetMeshBindingToBoneIndices@4 _GrannyFindBoneByName@12 _GrannyNewLocalPose@4 _GrannyReadEntireFileFromMemory@8 _GrannyConvertSingleObject@20 _GrannyFindMatchingMember@16 _GrannyGetMaterialTextureByType@8 _GrannySetLogCallback@4 _GrannyGetControlRawLocalClock@4 _GrannySetControlRawLocalClock@8 _GrannyPlayControlledAnimation@12 _GrannyGetMeshTriangleGroupCount@4 _GrannyCopyMeshVertices@12 _GrannyGetMeshVertexType@4 _GrannyFreeMeshDeformer@4 _GrannyNewWorldPose@4 _GrannyGetMeshVertices@4 _GrannyCopyMeshIndices@12 _GrannyNewMeshDeformer@16 _GrannyFreeWorldPose@4 _GrannyGetWorldPose4x4@8 _GrannyGetWorldPoseComposite4x4@8 _GrannyGetTotalTypeSize@4 _GrannyGetMeshVertexCount@4 _GrannyMeshIsRigid@4 _GrannyGetMeshIndexCount@4 _GrannySetControlEaseOutCurve@28 _GrannyFreeControlOnceUnused@4 _GrannyCompleteControlAt@8 _GrannyControlIsComplete@4 _GrannyFreeControlIfComplete@4 _GrannyGetControlLoopCount@4 _GrannySetControlLoopCount@8 _GrannyGetControlSpeed@4 _GrannySetControlSpeed@8 _GrannyGetControlLocalDuration@4 _GrannySetControlEaseIn@8 _GrannySetControlEaseInCurve@28 _GrannyGetMeshTriangleGroups@4 GrannyPNT332VertexType _GrannyDeformVertices@24 _GrannyFreeControl@4

mss32

_AIL_file_type@8 _AIL_open_digital_driver@16 _AIL_open_stream@12 _AIL_close_digital_driver@4 _AIL_enumerate_3D_providers@12 _AIL_open_3D_provider@4 _AIL_close_3D_provider@4 _AIL_open_3D_listener@4 _AIL_close_3D_listener@4 _AIL_set_3D_position@16 _AIL_set_3D_velocity@20 _AIL_set_3D_orientation@28 _AIL_startup@0 _AIL_shutdown@0 _AIL_set_redist_directory@4 _AIL_close_stream@4 _AIL_start_stream@4 _AIL_pause_stream@8 _AIL_set_stream_volume_levels@12 _AIL_stream_volume_levels@12 _AIL_set_stream_loop_count@8 _AIL_stream_status@4 _AIL_last_error@0 _AIL_decompress_ASI@24 _AIL_release_sample_handle@4 _AIL_init_sample@4 _AIL_set_sample_file@12 _AIL_start_sample@4 _AIL_stop_sample@4 _AIL_resume_sample@4 _AIL_end_sample@4 _AIL_set_sample_volume_pan@12 _AIL_set_sample_loop_count@8 _AIL_sample_status@4 _AIL_sample_volume_pan@12 _AIL_allocate_3D_sample_handle@4 _AIL_release_3D_sample_handle@4 _AIL_start_3D_sample@4 _AIL_stop_3D_sample@4 _AIL_resume_3D_sample@4 _AIL_end_3D_sample@4 _AIL_set_3D_sample_file@8 _AIL_set_3D_sample_volume@8 _AIL_set_3D_sample_loop_count@8 _AIL_3D_sample_status@4 _AIL_3D_sample_volume@4 _AIL_auto_update_3D_position@8 _AIL_decompress_ADPCM@12 _AIL_WAV_info@8 _AIL_set_file_callbacks@16 _AIL_allocate_sample_handle@4 _AIL_mem_free_lock@4 _AIL_file_read@8

speedtreert

?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z ?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z ?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z ?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ ?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ ?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ ?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z ?GetCurrentError@CSpeedTreeRT@@SAPBDXZ ?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z ?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ ?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z ?SetLodLevel@CSpeedTreeRT@@QAEXM@Z ?ComputeLodLevel@CSpeedTreeRT@@QAEXXZ ?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z ?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z ?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z ?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z ?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z ?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ ?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ ?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ ?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z ?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z ?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z ?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z ?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ ?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z ?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z ?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z ?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ ?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z ??3CSpeedTreeRT@@SAXPAX@Z ??2CSpeedTreeRT@@SAPAXI@Z ??1CSpeedTreeRT@@QAE@XZ ??0CSpeedTreeRT@@QAE@XZ ??1STextures@CSpeedTreeRT@@QAE@XZ ??0STextures@CSpeedTreeRT@@QAE@XZ ??1SGeometry@CSpeedTreeRT@@QAE@XZ ??0SGeometry@CSpeedTreeRT@@QAE@XZ ?SetCamera@CSpeedTreeRT@@SAXPBM0@Z ?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z ?SetLightState@CSpeedTreeRT@@SAXI_N@Z ?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z ?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z ?SetTime@CSpeedTreeRT@@SAXM@Z

dinput8

DirectInput8Create

ws2_32

WSAStartup WSACleanup htonl WSAGetLastError inet_addr ntohl ntohs gethostbyname setsockopt gethostname socket send select recv sendto recvfrom WSAEventSelect WSAEnumNetworkEvents ioctlsocket connect closesocket __WSAFDIsSet WSACreateEvent WSACloseEvent freeaddrinfo getaddrinfo listen accept WSAIoctl WSASetLastError getsockopt getsockname getpeername bind htons

gdi32

EnumFontFamiliesExA GetTextExtentPoint32A CreateFontIndirectA DeleteObject GetCharABCWidthsFloatW GetTextExtentPoint32W SelectObject SetBkColor SetTextColor TextOutW CreateCompatibleDC DeleteDC SetBkMode GetPixel GetDeviceCaps GetStockObject CreateDIBSection TextOutA

advapi32

RegCloseKey CryptAcquireContextA CryptReleaseContext RegOpenKeyExA CryptGenRandom CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash CryptDestroyKey CryptImportKey CryptEncrypt RegQueryValueExA

shell32

SHGetSpecialFolderPathA

oleaut32

VariantClear SysAllocString SysFreeString VariantInit

crypt32

CertCloseStore CertOpenStore CertFreeCertificateContext CertFindCertificateInStore CryptStringToBinaryA PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringA CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChain CertGetCertificateChain CertEnumCertificatesInStore CertFreeCertificateChainEngine

wldap32

ord22 ord41 ord50 ord45 ord26 ord211 ord46 ord217 ord143 ord27 ord32 ord33 ord35 ord79 ord30 ord200 ord301 ord60

normaliz

IdnToAscii

Name

.text

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

488KB

Virtual Size

487KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

143KB

Virtual Size

401KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

201KB

Virtual Size

200KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

123KB

Virtual Size

123KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=49, id=259, version=33145,

count=223, id=261, version=33145,

count=4, id=260, version=33520,

count=111, id=260, productName=VS2019 v16.4.3 build 28315, version=28315,

count=63, id=261, version=33520,

count=1, id=171, productName=VS2010 build 30319, version=30319,

count=1, id=262, version=33145,

count=1, id=48, version=9044,

count=2, id=203, productName=VS2012 UPD3 build 60610, version=60610,

count=60, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,

count=7, id=253, version=35207,

count=25, id=259, version=35207,

count=18, id=260, version=35207,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=95, id=261, version=35207,

count=2, id=156, version=21202,

count=2, id=123, productName=VS2005 build 50727, version=50727,

count=203, id=261, version=35222,

count=1, id=260, version=35222,

count=38, id=260, version=33145,

count=33, id=257, version=33145,

count=645, id=1, productName=Unmarked objects,

count=144, id=265, version=35222,

count=1, id=256, version=35222,

count=1, id=255, version=35222,

count=1, id=151,

count=1, id=258, version=35222,