General

Malware Config

Signatures

Files

• 639bd88a73154bd38aa18eaea3e968b76f4431ade64d25936cc7e34509075f94

  .exe windows x86

  c62170d29e98a4f36b2a74ba018472d6

  
  

  Code Sign

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  GetCurrentProcess

  WriteFile

  LeaveCriticalSection

  SetFilePointer

  InitializeCriticalSectionEx

  CreateMutexA

  UnmapViewOfFile

  HeapSize

  MultiByteToWideChar

  Sleep

  GetFileInformationByHandle

  GetLastError

  CreateFileA

  FileTimeToSystemTime

  LoadLibraryA

  LockResource

  HeapReAlloc

  CloseHandle

  RaiseException

  GetSystemInfo

  FindResourceExW

  LoadResource

  FindResourceW

  HeapAlloc

  GetLocalTime

  HeapDestroy

  GetProcAddress

  CreateFileMappingA

  GetFileSize

  DeleteCriticalSection

  GetProcessHeap

  SystemTimeToFileTime

  FreeLibrary

  WideCharToMultiByte

  EnterCriticalSection

  GetTickCount

  IsWow64Process

  AreFileApisANSI

  GetFullPathNameW

  LockFile

  InitializeCriticalSection

  GetFullPathNameA

  SetEndOfFile

  GetTempPathW

  CreateFileW

  GetFileAttributesW

  GetCurrentThreadId

  GetTempPathA

  GetFileAttributesA

  GetVersionExA

  DeleteFileA

  DeleteFileW

  LoadLibraryW

  UnlockFile

  LockFileEx

  GetCurrentProcessId

  GetSystemTimeAsFileTime

  GetSystemTime

  FormatMessageA

  QueryPerformanceCounter

  FlushFileBuffers

  GetCurrentDirectoryW

  CreateDirectoryW

  FindClose

  FindFirstFileExW

  FindNextFileW

  GetFileAttributesExW

  RemoveDirectoryW

  HeapFree

  SizeofResource

  MapViewOfFile

  ReadFile

  SetLastError

  GetModuleHandleW

  CopyFileW

  IsDebuggerPresent

  OutputDebugStringW

  InitializeCriticalSectionAndSpinCount

  SetEvent

  ResetEvent

  WaitForSingleObjectEx

  CreateEventW

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsProcessorFeaturePresent

  InitializeSListHead

  TerminateProcess

  user32

  GetDC

  GetDesktopWindow

  FindWindowA

  GetSystemMetrics

  ShowWindow

  ReleaseDC

  gdi32

  DeleteObject

  GetObjectA

  msvcp140

  ??4?$_Yarn@D@std@@QAEAAV01@PBD@Z

  ?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z

  ?narrow@?$ctype@_W@std@@QBEPB_WPB_W0DPAD@Z

  ??Bid@locale@std@@QAEIXZ

  ?_Getname@_Locinfo@std@@QBEPBDXZ

  ??1_Locinfo@std@@QAE@XZ

  ??0_Locinfo@std@@QAE@HPBD@Z

  ??1_Lockit@std@@QAE@XZ

  ??0_Lockit@std@@QAE@H@Z

  ?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z

  ?_Xruntime_error@std@@YAXPBD@Z

  ?_Syserror_map@std@@YAPBDH@Z

  ?_Xlength_error@std@@YAXPBD@Z

  ?_Winerror_map@std@@YAHH@Z

  ?_Makeloc@_Locimp@locale@std@@CAPAV123@ABV_Locinfo@3@HPAV123@PBV23@@Z

  ?_New_Locimp@_Locimp@locale@std@@CAPAV123@_N@Z

  ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ

  ?_Init@locale@std@@CAPAV_Locimp@12@_N@Z

  ?_Winerror_message@std@@YAKKPADK@Z

  ?id@?$ctype@_W@std@@2V0locale@2@A

  ?_Xout_of_range@std@@YAXPBD@Z

  shlwapi

  PathFindExtensionW

  PathFindExtensionA

  gdiplus

  GdiplusStartup

  GdipCreateBitmapFromHBITMAP

  GdipGetImageEncoders

  GdiplusShutdown

  GdipDisposeImage

  GdipGetImageEncodersSize

  GdipCreateBitmapFromScan0

  GdipSaveImageToFile

  wininet

  HttpEndRequestA

  HttpSendRequestExA

  InternetCloseHandle

  InternetConnectA

  InternetWriteFile

  InternetOpenA

  HttpOpenRequestA

  InternetReadFile

  HttpSendRequestA

  vcruntime140

  _CxxThrowException

  __CxxFrameHandler3

  __std_exception_destroy

  memmove

  __current_exception

  memcpy

  __std_exception_copy

  memcmp

  __current_exception_context

  _except_handler3

  memchr

  _except_handler4_common

  __std_terminate

  memset

  api-ms-win-crt-runtime-l1-1-0

  _configure_narrow_argv

  _initialize_narrow_environment

  _invalid_parameter_noinfo_noreturn

  _register_onexit_function

  _crt_atexit

  _cexit

  _seh_filter_exe

  _errno

  terminate

  _get_initial_narrow_environment

  _initterm

  _initterm_e

  _exit

  _invalid_parameter_noinfo

  __p___argc

  __p___argv

  _c_exit

  _register_thread_local_exe_atexit_callback

  exit

  _resetstkoflw

  _set_app_type

  _controlfp_s

  _initialize_onexit_table

  api-ms-win-crt-time-l1-1-0

  clock

  asctime

  _time64

  _localtime64

  api-ms-win-crt-string-l1-1-0

  wcscspn

  strlen

  isspace

  isalnum

  isdigit

  wcsspn

  strcmp

  wcslen

  tolower

  isxdigit

  _wcsicmp

  wmemcpy_s

  strcpy

  api-ms-win-crt-heap-l1-1-0

  _recalloc

  free

  _set_new_mode

  calloc

  realloc

  _callnewh

  malloc

  api-ms-win-crt-utility-l1-1-0

  srand

  rand

  labs

  api-ms-win-crt-stdio-l1-1-0

  fopen

  __stdio_common_vsprintf

  feof

  fclose

  __p__commode

  _set_fmode

  fread

  fwrite

  api-ms-win-crt-multibyte-l1-1-0

  _mbsicmp

  api-ms-win-crt-environment-l1-1-0

  getenv

  api-ms-win-crt-convert-l1-1-0

  atoi

  api-ms-win-crt-locale-l1-1-0

  _configthreadlocale

  ___lc_codepage_func

  api-ms-win-crt-math-l1-1-0

  __setusermatherr

  Sections

  .text

  Size: 286KB - Virtual size: 286KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 43KB - Virtual size: 43KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 1KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 15KB - Virtual size: 14KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ