General

Malware Config

Signatures

Files

• 99541ab28fc3328e25723607df4b0d9ea0a1af31b58e2da07eff9f15c4e6565c

  .dll windows x86

  d3666d1cde4790b22b44ec35976687fb

  
  

  Code Sign

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  FreeLibrary

  VirtualFree

  Thread32First

  Thread32Next

  SetLastError

  VirtualAlloc

  LoadLibraryA

  OpenThread

  CreateToolhelp32Snapshot

  SuspendThread

  ResumeThread

  PeekNamedPipe

  WaitNamedPipeA

  SetNamedPipeHandleState

  LocalAlloc

  LocalFree

  GetComputerNameA

  Process32First

  TerminateProcess

  Process32Next

  ProcessIdToSessionId

  GetFileAttributesA

  GetLogicalDrives

  SystemTimeToTzSpecificLocalTime

  GetFullPathNameA

  CreateThread

  GetTempPathA

  GetVersionExA

  GetModuleHandleA

  CreateNamedPipeA

  GetProcAddress

  ReadFile

  GetCurrentThread

  ConnectNamedPipe

  GetCurrentProcess

  CloseHandle

  GetFileTime

  GetCurrentDirectoryA

  CreatePipe

  GetCurrentDirectoryW

  GetWindowsDirectoryA

  GetStartupInfoA

  SetCurrentDirectoryA

  FlushFileBuffers

  DisconnectNamedPipe

  GetEnvironmentVariableA

  CreateProcessA

  WriteFile

  SetFileTime

  WaitForSingleObject

  CreateFileA

  GetCurrentProcessId

  Sleep

  SetEndOfFile

  VirtualQuery

  GetModuleFileNameW

  GetProcessHeap

  SetStdHandle

  WriteConsoleW

  GetConsoleOutputCP

  WriteConsoleA

  GetTickCount

  GetStringTypeW

  GetStringTypeA

  LCMapStringW

  LCMapStringA

  GetLocaleInfoA

  HeapSize

  DebugBreak

  RaiseException

  QueryPerformanceCounter

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  GetEnvironmentStrings

  FreeEnvironmentStringsA

  CreateRemoteThread

  FindNextFileA

  FindClose

  FindFirstFileA

  GetLastError

  FileTimeToSystemTime

  SetFilePointer

  GetFileType

  SetHandleCount

  GetConsoleMode

  HeapFree

  HeapAlloc

  GetModuleHandleW

  ExitProcess

  MultiByteToWideChar

  DeleteFileA

  CreateDirectoryA

  RemoveDirectoryA

  GetCurrentThreadId

  GetCommandLineA

  GetSystemTimeAsFileTime

  EnterCriticalSection

  LeaveCriticalSection

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsDebuggerPresent

  HeapCreate

  HeapDestroy

  DeleteCriticalSection

  HeapReAlloc

  GetStdHandle

  GetModuleFileNameA

  TlsGetValue

  TlsAlloc

  TlsSetValue

  TlsFree

  InterlockedIncrement

  InterlockedDecrement

  InitializeCriticalSectionAndSpinCount

  GetCPInfo

  GetACP

  GetOEMCP

  IsValidCodePage

  RtlUnwind

  WideCharToMultiByte

  GetConsoleCP

  advapi32

  CryptGenRandom

  CryptReleaseContext

  CryptAcquireContextA

  LogonUserA

  CheckTokenMembership

  FreeSid

  RevertToSelf

  AllocateAndInitializeSid

  DuplicateTokenEx

  LookupAccountSidA

  GetTokenInformation

  SetSecurityDescriptorDacl

  InitializeSecurityDescriptor

  GetUserNameA

  AdjustTokenPrivileges

  ControlService

  QueryServiceStatusEx

  ImpersonateNamedPipeClient

  ImpersonateLoggedOnUser

  LookupPrivilegeValueA

  OpenThreadToken

  OpenProcessToken

  OpenServiceA

  OpenSCManagerA

  QueryServiceStatus

  CreateProcessWithTokenW

  StartServiceA

  CreateServiceA

  DeleteService

  CreateProcessWithLogonW

  CloseServiceHandle

  CreateProcessAsUserA

  wininet

  InternetConnectA

  InternetQueryDataAvailable

  InternetReadFile

  InternetSetOptionA

  HttpOpenRequestA

  HttpSendRequestA

  InternetOpenA

  InternetCloseHandle

  InternetQueryOptionA

  HttpQueryInfoA

  ws2_32

  ntohs

  connect

  htons

  socket

  accept

  send

  gethostname

  inet_ntoa

  WSAStartup

  gethostbyname

  ntohl

  htonl

  listen

  __WSAFDIsSet

  bind

  recv

  shutdown

  WSAGetLastError

  select

  ioctlsocket

  inet_addr

  closesocket

  WSACleanup

  dnsapi

  DnsFree

  DnsQuery_A

  iphlpapi

  GetIfEntry

  GetIpAddrTable

  secur32

  LsaCallAuthenticationPackage

  LsaConnectUntrusted

  LsaLookupAuthenticationPackage

  Exports

  Exports

  _ReflectiveLoader@4

  Sections

  .text

  Size: 129KB - Virtual size: 129KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 40KB - Virtual size: 39KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 6KB - Virtual size: 61KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 512B - Virtual size: 436B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 8KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ