General

Malware Config

Signatures

Files

• ACTIVATE____SETUP__4695.exe

  .exe windows x86

  2f49c381e5ec0c6dbf3537665412bd82

  
  

  Code Sign

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  comctl32

  ord17

  kernel32

  SystemTimeToFileTime

  GetLocalTime

  GetFileAttributesW

  CreateDirectoryW

  lstrlenA

  GetSystemDefaultLCID

  GetSystemDefaultUILanguage

  GetUserDefaultUILanguage

  MultiByteToWideChar

  GetLocaleInfoW

  lstrcmpiW

  GetEnvironmentVariableW

  SetCurrentDirectoryW

  lstrcmpW

  RemoveDirectoryW

  FindClose

  FindNextFileW

  DeleteFileW

  FindFirstFileW

  GetCurrentDirectoryW

  GetTempPathW

  WideCharToMultiByte

  CompareFileTime

  ExpandEnvironmentStringsW

  GetSystemTimeAsFileTime

  LoadLibraryA

  SetEnvironmentVariableW

  WriteFile

  CreateFileW

  GetDriveTypeW

  SetProcessWorkingSetSize

  GetCurrentProcess

  GetModuleFileNameW

  GetCommandLineW

  GetModuleHandleW

  LoadLibraryW

  GetComputerNameW

  MulDiv

  CreateThread

  SetEvent

  ResetEvent

  InitializeCriticalSection

  LockResource

  LoadResource

  FindResourceA

  GetCurrentThreadId

  GetSystemDirectoryW

  TerminateThread

  ResumeThread

  SuspendThread

  LocalFree

  lstrcpyW

  FormatMessageW

  DeleteCriticalSection

  EnterCriticalSection

  LeaveCriticalSection

  VirtualAlloc

  VirtualFree

  GetFileSize

  SetFilePointer

  ReadFile

  SetFileTime

  SetEndOfFile

  GetFileInformationByHandle

  WaitForMultipleObjects

  TerminateProcess

  GetCurrentProcessId

  GetTickCount

  QueryPerformanceCounter

  GetModuleHandleA

  SetUnhandledExceptionFilter

  GetStartupInfoA

  InterlockedCompareExchange

  InterlockedExchange

  GetExitCodeThread

  Sleep

  SetFileAttributesW

  SetLastError

  GetLastError

  WaitForSingleObject

  CloseHandle

  GetProcAddress

  lstrlenW

  CreateEventW

  UnhandledExceptionFilter

  user32

  SetWindowsHookExW

  LoadImageW

  LoadIconW

  MessageBeep

  EnableWindow

  IsWindow

  EnableMenuItem

  GetSystemMenu

  wvsprintfW

  GetSystemMetrics

  SetFocus

  UnhookWindowsHookEx

  GetWindowLongW

  PtInRect

  GetClientRect

  GetDlgItem

  GetKeyState

  MessageBoxA

  SetWindowTextW

  CallNextHookEx

  KillTimer

  SetTimer

  DefWindowProcW

  CallWindowProcW

  GetWindowDC

  DrawIconEx

  DialogBoxIndirectParamW

  SendMessageW

  EndDialog

  GetWindow

  ClientToScreen

  SystemParametersInfoW

  DrawTextW

  ReleaseDC

  ShowWindow

  CharUpperW

  ScreenToClient

  GetDC

  GetWindowRect

  GetParent

  wsprintfW

  GetWindowTextW

  GetWindowTextLengthW

  SetWindowLongW

  SetWindowPos

  gdi32

  GetDeviceCaps

  SelectObject

  CreateFontIndirectW

  GetObjectW

  DeleteObject

  advapi32

  FreeSid

  AllocateAndInitializeSid

  CheckTokenMembership

  shell32

  ShellExecuteExW

  SHGetFileInfoW

  SHBrowseForFolderW

  SHGetPathFromIDListW

  SHGetMalloc

  ShellExecuteW

  SHGetSpecialFolderPathW

  ole32

  CoCreateInstance

  oleaut32

  VariantClear

  SysAllocStringLen

  msvcrt

  wcsncpy

  wcsncmp

  ?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z

  wcscmp

  _beginthreadex

  __CxxFrameHandler3

  _CxxThrowException

  malloc

  free

  wcsstr

  _unlock

  __dllonexit

  _lock

  _onexit

  ??1type_info@@UAE@XZ

  __getmainargs

  _cexit

  _exit

  _XcptFilter

  _ismbblead

  exit

  _acmdln

  _initterm

  _amsg_exit

  __setusermatherr

  __p__commode

  __p__fmode

  __set_app_type

  _except_handler4_common

  ?terminate@@YAXXZ

  _controlfp

  strncpy

  memcpy

  memmove

  _wcsnicmp

  _purecall

  memset

  _wtol

  ??3@YAXPAX@Z

  memcmp

  ??2@YAPAXI@Z

  shlwapi

  PathFileExistsW

  Sections

  .text

  Size: 65KB - Virtual size: 65KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 12KB - Virtual size: 11KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 1KB - Virtual size: 10KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 76KB - Virtual size: 75KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ