General

Malware Config

Signatures

Files

• 890eacb1a49d606586eb585ee0738f55ac76fb3a175016ad627532425ee19dc8

  .dll regsvr32 windows x86

  074dc58de55fa696ca96fcd56e872079

  
  

  Code Sign

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  advapi32

  AdjustTokenPrivileges

  SetSecurityDescriptorDacl

  GetAce

  RegQueryValueExW

  CreateProcessAsUserW

  InitializeAcl

  GetTokenInformation

  OpenProcessToken

  AddAccessAllowedAce

  AddAce

  InitializeSecurityDescriptor

  EqualSid

  RegOpenKeyExW

  RevertToSelf

  CopySid

  AllocateAndInitializeSid

  GetSecurityDescriptorDacl

  RegCloseKey

  LookupPrivilegeValueW

  GetAclInformation

  GetLengthSid

  ImpersonateLoggedOnUser

  DuplicateTokenEx

  FreeSid

  comctl32

  _TrackMouseEvent

  gdi32

  RoundRect

  SelectObject

  StretchBlt

  CreatePen

  GetObjectW

  CreateSolidBrush

  GetDeviceCaps

  PatBlt

  GetPixel

  CreatePatternBrush

  CreatePalette

  RealizePalette

  GetLayout

  SetPixel

  GetDIBColorTable

  CreateFontIndirectW

  CreateCompatibleDC

  CreateCompatibleBitmap

  DeleteObject

  GetTextExtentPoint32W

  BitBlt

  CreateHalftonePalette

  kernel32

  SetLastError

  GetProcAddress

  Sleep

  LeaveCriticalSection

  GetCurrentProcess

  RaiseException

  CreateThread

  GetLastError

  GetTickCount

  SetEvent

  GetCurrentProcessId

  CloseHandle

  HeapAlloc

  HeapSize

  HeapDestroy

  OpenProcess

  LocalFree

  GetExitCodeProcess

  DeleteCriticalSection

  GetSystemDirectoryW

  GetCommandLineW

  GlobalFree

  VerifyVersionInfoW

  GetVersionExW

  GetProcessHeap

  ProcessIdToSessionId

  OutputDebugStringW

  SizeofResource

  HeapReAlloc

  InterlockedIncrement

  FindResourceW

  GlobalUnlock

  LoadLibraryExW

  FreeLibrary

  CreateEventW

  GetCurrentThreadId

  GlobalLock

  VirtualProtectEx

  HeapFree

  InterlockedDecrement

  LoadLibraryA

  InitializeCriticalSectionAndSpinCount

  GetFileAttributesExW

  GetFileAttributesW

  OpenThread

  InterlockedCompareExchange

  LockResource

  QueryPerformanceCounter

  GetModuleFileNameW

  IsDebuggerPresent

  EnterCriticalSection

  FindResourceExW

  SetProcessShutdownParameters

  GlobalAlloc

  IsProcessorFeaturePresent

  GetModuleHandleW

  WaitForSingleObject

  InitializeCriticalSection

  LoadLibraryW

  MulDiv

  VerSetConditionMask

  LoadResource

  WaitForMultipleObjects

  GetModuleHandleA

  ole32

  StringFromGUID2

  CreateStreamOnHGlobal

  shell32

  CommandLineToArgvW

  user32

  SetForegroundWindow

  SetTimer

  DrawIconEx

  GetClassNameW

  GetSysColor

  EnableMenuItem

  KillTimer

  GetProcessWindowStation

  GetUserObjectInformationW

  SetUserObjectSecurity

  OpenDesktopW

  GetWindowRect

  CopyRect

  IsWindow

  DrawStateW

  CloseWindowStation

  SystemParametersInfoW

  InflateRect

  SetCursor

  GetClientRect

  UpdateWindow

  GetWindowLongW

  DrawFocusRect

  GetDC

  GetSystemMetrics

  LoadImageW

  OpenWindowStationW

  SendInput

  EqualRect

  GetWindow

  GetWindowDC

  ExitWindowsEx

  GetSystemMenu

  FillRect

  GetParent

  DestroyIcon

  OpenInputDesktop

  GetUserObjectSecurity

  EnableWindow

  GetKeyState

  TrackMouseEvent

  GetIconInfo

  SendMessageW

  ScreenToClient

  ReleaseDC

  InvalidateRect

  OffsetRect

  GetFocus

  LoadStringW

  SetRect

  SetProcessWindowStation

  LoadCursorW

  LoadIconW

  CloseDesktop

  wtsapi32

  WTSOpenServerW

  WTSCloseServer

  WTSFreeMemory

  WTSWaitSystemEvent

  WTSEnumerateSessionsW

  WTSQuerySessionInformationW

  Exports

  Exports

  APEwWAH

  XUcwjgK

  LthH

  DllGetClassObject

  DllRegisterServer

  cFUrsP

  NNdMrcPBkR

  OVqlNVYmHLr

  DllUnregisterServer

  QIdKkDX

  DllCanUnloadNow

  sIcu

  oCmRfXLCWfq

  KOtSMPQ

  vWKAS

  ILtrUjn

  JjNNDN

  viBSRvp

  Sections

  .text

  Size: 25KB - Virtual size: 25KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 213KB - Virtual size: 235KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ