18012e20262ca505532871b2029b47fab07655780f54e8572e2107dd4e47205a

Sharing

Copy URL Twitter E-mail

General

Target
18012e20262ca505532871b2029b47fab07655780f54e8572e2107dd4e47205a
Size 2.4MB
Sample261014-2sm3mscs8t
SHA256 18012e20262ca505532871b2029b47fab07655780f54e8572e2107dd4e47205a
MD5 677dc9c4244915c4d9d4aa858f6c1daf
SHA1 684569746862ae74b3a79842c2b9394e6076eb85
SHA512 9e1821b1a170cc96bf3dcc1b531e76e053b815d63adcc065b435e59c5fb4e9a58e10f0610de220ec9f7df997eac2b427a968a0b87089dcc90dd4aa69f5db246f
SSDEEP 49152:JqSSymsRUPtNWqO23GHLb8YP7RQ7rP03nEj+UGZubQJ0s7pSJs5eeFx4rse7mc4p:JqSSZWqO23G0YPa0XEj+UGZubQJ0s7pW
TLSH
T1EDC59D10FA02C172E8D312B2D97DBE6F496CAA141B6845D3E3C40E5E5EB06C37B73996
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
18012e20262ca505532871b2029b47fab07655780f54e8572e2107dd4e47205a

File Explorer

18012e20262ca505532871b2029b47fab07655780f54e8572e2107dd4e47205a

.exe 2.4MB

18012e20262ca505532871b2029b47fab07655780f54e8572e2107dd4e47205a

IMPHASH 23daee0b7de8b4f1eebee54b6b3050e0
SHA256 18012e20262ca505532871b2029b47fab07655780f54e8572e2107dd4e47205a
MD5 677dc9c4244915c4d9d4aa858f6c1daf
SHA1 684569746862ae74b3a79842c2b9394e6076eb85
SHA512 9e1821b1a170cc96bf3dcc1b531e76e053b815d63adcc065b435e59c5fb4e9a58e10f0610de220ec9f7df997eac2b427a968a0b87089dcc90dd4aa69f5db246f
SSDEEP 49152:JqSSymsRUPtNWqO23GHLb8YP7RQ7rP03nEj+UGZubQJ0s7pSJs5eeFx4rse7mc4p:JqSSZWqO23G0YPa0XEj+UGZubQJ0s7pW
TLSH
T1EDC59D10FA02C172E8D312B2D97DBE6F496CAA141B6845D3E3C40E5E5EB06C37B73996
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1676555

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FindFirstFileA SetEndOfFile SetEnvironmentVariableA CreateProcessA GetExitCodeProcess OutputDebugStringW WriteConsoleW HeapReAlloc SetStdHandle SetFileAttributesA InitializeCriticalSection LeaveCriticalSection GetTimeZoneInformation FreeEnvironmentStringsW GetEnvironmentStringsW GetFileAttributesExW FlushFileBuffers CreateDirectoryW GetModuleFileNameW GetOEMCP GetACP IsValidCodePage GetStdHandle ReadConsoleW SetFilePointerEx GetConsoleMode GetConsoleCP HeapSize EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetModuleHandleW GetStartupInfoW TlsFree TlsSetValue EnterCriticalSection TlsAlloc TerminateProcess FindNextFileA SetLastError UnhandledExceptionFilter GetFileType AreFileApisANSI GetModuleHandleExW ExitProcess GetCPInfo LoadLibraryExW GetCurrentThreadId RtlUnwind RaiseException GetCommandLineA GetSystemTimeAsFileTime HeapFree HeapAlloc IsDebuggerPresent DecodePointer EncodePointer GetStringTypeW CreateFileW IsProcessorFeaturePresent GetProcessHeap HeapValidate DeleteCriticalSection WaitForSingleObject Sleep GetSystemInfo GetLastError ReadProcessMemory GetCurrentProcess Module32Next CloseHandle Module32First GetCurrentProcessId FindClose MoveFileA GetCurrentDirectoryA lstrlenA GetPrivateProfileStringA DeleteFileA GetModuleFileNameA GlobalFree InitializeCriticalSectionAndSpinCount QueryPerformanceCounter ReleaseSemaphore GetLocaleInfoA CompareStringA WideCharToMultiByte GetVersionExA GetSystemDirectoryA LoadLibraryA lstrlenW GlobalUnlock GlobalLock GetProcAddress FreeLibrary ReadFile WriteFile OutputDebugStringA GetModuleHandleA WinExec GetCurrentThread SetUnhandledExceptionFilter CreateFileA CreateFileMappingA UnmapViewOfFile MapViewOfFile GetFileSize CreateDirectoryA GlobalAlloc CreateToolhelp32Snapshot GetTickCount GetCurrentDirectoryW TlsGetValue MultiByteToWideChar

user32

CharNextExA CharNextW GetClipboardData CloseClipboard OpenClipboard GetKeyboardLayout GetKeyboardLayoutNameA DispatchMessageA TranslateMessage GetMessageA LoadCursorA AdjustWindowRectEx GetMenu RegisterClassA SetWindowLongA GetWindowLongA UpdateWindow CharPrevExA SetCursor ShowCursor DestroyCursor LoadImageA GetKeyState SystemParametersInfoA SetWindowPos LoadIconA FindWindowA ScreenToClient GetCursorPos PostQuitMessage GetAsyncKeyState SetRect OffsetRect GetClientRect ClientToScreen PeekMessageA ReleaseDC FillRect GetDC InvalidateRect CreateWindowExA RegisterClassExA UnregisterClassA DefWindowProcA SetCursorPos SetCapture ReleaseCapture ChangeDisplaySettingsA ShowWindow GetCapture GetSystemMetrics LoadStringA MessageBoxA DestroyWindow MoveWindow IsWindow SetFocus

gdi32

CreateFontIndirectA GetCharABCWidthsFloatW EnumFontFamiliesExA SelectObject SetBkColor SetTextColor TextOutW CreateCompatibleDC DeleteDC SetBkMode CreateDIBSection GetStockObject DeleteObject StretchBlt GetTextExtentPoint32A GetTextExtentPoint32W CreateSolidBrush TextOutA

ole32

CoInitializeEx OleUninitialize OleInitialize CoGetClassObject OleSetContainedObject CoUninitialize CoInitialize CoCreateInstance

winmm

timeGetTime timeEndPeriod timeGetDevCaps timeBeginPeriod

d3d8

Direct3DCreate8

python27

Py_BuildValue PyErr_SetString PyExc_RuntimeError PyTuple_GetItem PyInt_AsLong PyList_New PyString_FromString PyList_Append PyModule_AddIntConstant PyTuple_Size PyDict_GetItemString PyLong_AsLong PyDict_Size PyDict_Next PyString_InternFromString PyObject_GetAttrString PyObject_GetAttr PyCallable_Check PyFloat_AsDouble PyString_AsString PyErr_Clear PyErr_BadArgument PyErr_Print PyObject_CallObject PyNumber_Check _Py_NoneStruct PyDict_SetItemString PyModule_GetDict PyErr_Fetch Py_SetProgramName Py_Initialize Py_Finalize PyRun_StringFlags Py_InitModule4 PyImport_AddModule PyImport_ImportModule

devil

ilConvertImage ilGetInteger ilLoad ilOriginFunc ilEnable ilBindImage ilGenImages ilInit ilSetPixels ilTexImage ilSave ilCopyPixels ilShutDown ilDeleteImages

imm32

ImmGetOpenStatus ImmSetConversionStatus ImmGetConversionStatus ImmGetCandidateListW ImmSetCompositionStringW ImmGetCompositionStringW ImmAssociateContext ImmReleaseContext ImmGetContext ImmIsIME ImmGetIMEFileNameA ImmNotifyIME

version

VerQueryValueA GetFileVersionInfoA GetFileVersionInfoSizeA

imagehlp

StackWalk EnumerateLoadedModules GetTimestampForLoadedLibrary

granny2

_GrannyMeshIsRigid@4 _GrannyGetMeshVertexCount@4 _GrannyGetTotalTypeSize@4 _GrannyGetWorldPoseComposite4x4@8 _GrannyGetWorldPose4x4@8 _GrannyFreeWorldPose@4 _GrannyNewWorldPose@4 _GrannyFindBoneByName@12 _GrannyGetMeshBindingToBoneIndices@4 _GrannyFreeMeshBinding@4 _GrannyNewMeshBinding@12 _GrannyFreeModelInstance@4 _GrannyInstantiateModel@4 _GrannyGetWorldPoseComposite4x4Array@4 _GrannyFreeLocalPose@4 _GrannyNewLocalPose@4 _GrannyUpdateModelMatrix@20 _GrannySampleModelAnimationsAccelerated@20 _GrannyFreeCompletedModelControls@4 _GrannySetModelClock@8 _GrannyGetSourceSkeleton@4 _GrannyGetFileInfo@4 _GrannyFreeFile@4 _GrannyFreeFileSection@8 _GrannyReadEntireFileFromMemory@8 _GrannyConvertSingleObject@20 _GrannyFindMatchingMember@16 _GrannyGetMaterialTextureByType@8 _GrannyGetMeshIndexCount@4 _GrannyFreeControl@4 _GrannyFreeControlOnceUnused@4 _GrannyCompleteControlAt@8 GrannyPNT332VertexType _GrannyDeformVertices@24 _GrannyFreeMeshDeformer@4 _GrannyNewMeshDeformer@16 _GrannyCopyMeshIndices@12 _GrannyGetMeshVertices@4 _GrannyCopyMeshVertices@12 _GrannyGetMeshVertexType@4 _GrannyGetMeshTriangleGroups@4 _GrannyGetMeshTriangleGroupCount@4 _GrannyPlayControlledAnimation@12 _GrannySetControlRawLocalClock@8 _GrannyGetControlRawLocalClock@4 _GrannySetControlEaseOutCurve@28 _GrannySetControlEaseOut@8 _GrannySetControlEaseInCurve@28 _GrannySetControlEaseIn@8 _GrannyGetControlLocalDuration@4 _GrannySetControlSpeed@8 _GrannyGetControlSpeed@4 _GrannySetControlLoopCount@8 _GrannyGetControlLoopCount@4 _GrannyFreeControlIfComplete@4 _GrannyControlIsComplete@4

mss32

_AIL_decompress_ASI@24 _AIL_decompress_ADPCM@12 _AIL_file_type@8 _AIL_open_digital_driver@16 _AIL_open_stream@12 _AIL_close_digital_driver@4 _AIL_enumerate_3D_providers@12 _AIL_open_3D_provider@4 _AIL_close_3D_provider@4 _AIL_open_3D_listener@4 _AIL_close_3D_listener@4 _AIL_set_3D_position@16 _AIL_set_3D_velocity@20 _AIL_set_3D_orientation@28 _AIL_startup@0 _AIL_shutdown@0 _AIL_set_redist_directory@4 _AIL_close_stream@4 _AIL_start_stream@4 _AIL_pause_stream@8 _AIL_set_stream_volume_levels@12 _AIL_stream_volume_levels@12 _AIL_set_stream_loop_count@8 _AIL_stream_status@4 _AIL_WAV_info@8 _AIL_allocate_sample_handle@4 _AIL_release_sample_handle@4 _AIL_init_sample@4 _AIL_set_sample_file@12 _AIL_start_sample@4 _AIL_stop_sample@4 _AIL_resume_sample@4 _AIL_set_sample_volume_pan@12 _AIL_set_sample_loop_count@8 _AIL_sample_status@4 _AIL_sample_volume_pan@12 _AIL_allocate_3D_sample_handle@4 _AIL_release_3D_sample_handle@4 _AIL_start_3D_sample@4 _AIL_stop_3D_sample@4 _AIL_resume_3D_sample@4 _AIL_end_3D_sample@4 _AIL_set_3D_sample_file@8 _AIL_set_3D_sample_volume@8 _AIL_set_3D_sample_loop_count@8 _AIL_3D_sample_status@4 _AIL_3D_sample_volume@4 _AIL_auto_update_3D_position@8 _AIL_set_file_callbacks@16 _AIL_file_read@8 _AIL_last_error@0 _AIL_end_sample@4 _AIL_mem_free_lock@4

speedtreert

?SetLocalMatrices@CSpeedTreeRT@@QAEXII@Z ?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z ?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z ?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z ?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z ?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z ?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ ?ComputeLodLevel@CSpeedTreeRT@@QAEXXZ ?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ ?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ ?GetCurrentError@CSpeedTreeRT@@SAPBDXZ ?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z ?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z ?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z ?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z ?SetLodLevel@CSpeedTreeRT@@QAEXM@Z ?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z ?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z ?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ ?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z ?SetLodLimits@CSpeedTreeRT@@QAEXMM@Z ?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ ?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ ?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z ?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z ?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z ?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ ?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z ?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z ?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z ?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ ?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z ??3CSpeedTreeRT@@SAXPAX@Z ??2CSpeedTreeRT@@SAPAXI@Z ??1CSpeedTreeRT@@QAE@XZ ??0CSpeedTreeRT@@QAE@XZ ??1STextures@CSpeedTreeRT@@QAE@XZ ??0STextures@CSpeedTreeRT@@QAE@XZ ??1SGeometry@CSpeedTreeRT@@QAE@XZ ??0SGeometry@CSpeedTreeRT@@QAE@XZ ?SetCamera@CSpeedTreeRT@@SAXPBM0@Z ?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z ?SetLightState@CSpeedTreeRT@@SAXI_N@Z ?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z ?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z ?SetTime@CSpeedTreeRT@@SAXM@Z ?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ

dinput8

DirectInput8Create

ws2_32

__WSAFDIsSet closesocket connect ioctlsocket recv select send socket WSAGetLastError WSAStartup WSACleanup htons inet_addr gethostbyname

ddraw

DirectDrawCreate

advapi32

RegCloseKey RegOpenKeyExA RegQueryValueExA RegOpenKeyA

shell32

SHGetSpecialFolderPathA

oleaut32

SysAllocString VariantInit VariantClear SysFreeString

generic

count=1, id=48, version=9044,

count=60, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,

count=1, id=199, version=41118,

count=75, id=223, productName=VS2013 build 21005, version=21005,

count=86, id=225, productName=VS2013 build 21005, version=21005,

count=262, id=224, productName=VS2013 build 21005, version=21005,

count=5, id=28, version=9178,

count=76, id=29, version=9178,

count=1, id=18, version=8444,

count=8, productName=Unmarked objects (old),

count=4, id=25, version=9210,

count=207, id=225, productName=VS2013 UPD4 build 31101, version=31101,

count=1, id=224, productName=VS2013 UPD4 build 31101, version=31101,

count=55, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=31, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=492, id=1, productName=Unmarked objects,

count=133, id=229, version=31101,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=1, id=151,

count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,