General

Malware Config

Signatures

Files

• 3c04368599e361dab09da4e18f822db21c87d7a2531eab7c0e3c6baa5a0f7209

  .exe windows x86

  d623de0f3df7e10c8d2cce515a5d65f1

  
  

  Code Sign

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  GetCurrentProcess

  WriteFile

  LeaveCriticalSection

  SetFilePointer

  InitializeCriticalSectionEx

  CreateMutexA

  UnmapViewOfFile

  HeapSize

  MultiByteToWideChar

  Sleep

  GetFileInformationByHandle

  GetLastError

  CreateFileA

  FileTimeToSystemTime

  LoadLibraryA

  LockResource

  HeapReAlloc

  CloseHandle

  RaiseException

  GetSystemInfo

  FindResourceExW

  LoadResource

  FindResourceW

  HeapAlloc

  GetLocalTime

  HeapDestroy

  GetProcAddress

  CreateFileMappingA

  GetFileSize

  DeleteCriticalSection

  GetProcessHeap

  SystemTimeToFileTime

  FreeLibrary

  WideCharToMultiByte

  MapViewOfFile

  GetTickCount

  EnterCriticalSection

  AreFileApisANSI

  GetFullPathNameW

  GetDiskFreeSpaceW

  LockFile

  InitializeCriticalSection

  GetFullPathNameA

  SetEndOfFile

  UnlockFileEx

  GetTempPathW

  CreateFileW

  GetFileAttributesW

  GetTempPathA

  FormatMessageW

  GetDiskFreeSpaceA

  GetFileAttributesA

  GetFileAttributesExW

  GetVersionExA

  DeleteFileA

  DeleteFileW

  LoadLibraryW

  UnlockFile

  LocalFree

  LockFileEx

  GetCurrentProcessId

  GetSystemTimeAsFileTime

  GetSystemTime

  FormatMessageA

  QueryPerformanceCounter

  FlushFileBuffers

  SetEvent

  GetCurrentDirectoryW

  CreateDirectoryW

  FindClose

  FindFirstFileExW

  FindNextFileW

  HeapFree

  SizeofResource

  IsWow64Process

  ReadFile

  InitializeCriticalSectionAndSpinCount

  OutputDebugStringW

  IsDebuggerPresent

  CopyFileW

  WaitForSingleObjectEx

  CreateEventW

  GetModuleHandleW

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsProcessorFeaturePresent

  GetCurrentThreadId

  InitializeSListHead

  TerminateProcess

  SetLastError

  RemoveDirectoryW

  ResetEvent

  user32

  GetDC

  GetSystemMetrics

  ShowWindow

  ReleaseDC

  GetDesktopWindow

  FindWindowA

  gdi32

  DeleteObject

  GetObjectA

  msvcp140

  ??4?$_Yarn@D@std@@QAEAAV01@PBD@Z

  ?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z

  ?narrow@?$ctype@_W@std@@QBEPB_WPB_W0DPAD@Z

  ??Bid@locale@std@@QAEIXZ

  ?_Getname@_Locinfo@std@@QBEPBDXZ

  ??1_Locinfo@std@@QAE@XZ

  ??0_Locinfo@std@@QAE@HPBD@Z

  ?_Syserror_map@std@@YAPBDH@Z

  ?_Xlength_error@std@@YAXPBD@Z

  ?_Winerror_map@std@@YAHH@Z

  ?_Xout_of_range@std@@YAXPBD@Z

  ?_Winerror_message@std@@YAKKPADK@Z

  ?id@?$ctype@_W@std@@2V0locale@2@A

  ?_Init@locale@std@@CAPAV_Locimp@12@_N@Z

  ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ

  ?_New_Locimp@_Locimp@locale@std@@CAPAV123@_N@Z

  ?_Makeloc@_Locimp@locale@std@@CAPAV123@ABV_Locinfo@3@HPAV123@PBV23@@Z

  ?_Xruntime_error@std@@YAXPBD@Z

  ?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z

  ??0_Lockit@std@@QAE@H@Z

  ??1_Lockit@std@@QAE@XZ

  shlwapi

  PathFindExtensionW

  PathFindExtensionA

  gdiplus

  GdiplusShutdown

  GdiplusStartup

  GdipGetImageEncoders

  GdipCreateBitmapFromHBITMAP

  GdipDisposeImage

  GdipGetImageEncodersSize

  GdipCreateBitmapFromScan0

  GdipSaveImageToFile

  wininet

  HttpOpenRequestA

  HttpEndRequestA

  HttpSendRequestExA

  InternetOpenA

  InternetCloseHandle

  HttpSendRequestA

  InternetConnectA

  InternetReadFile

  InternetWriteFile

  vcruntime140

  __CxxFrameHandler3

  __std_exception_destroy

  memmove

  _CxxThrowException

  __current_exception_context

  memcpy

  __current_exception

  __std_exception_copy

  memcmp

  memset

  memchr

  _except_handler4_common

  _except_handler3

  __std_terminate

  api-ms-win-crt-runtime-l1-1-0

  _configure_narrow_argv

  _initialize_narrow_environment

  _initialize_onexit_table

  _register_onexit_function

  _crt_atexit

  _cexit

  _seh_filter_exe

  terminate

  _invalid_parameter_noinfo_noreturn

  _get_initial_narrow_environment

  _initterm

  _initterm_e

  _exit

  _errno

  __p___argc

  __p___argv

  _c_exit

  _register_thread_local_exe_atexit_callback

  _resetstkoflw

  _invalid_parameter_noinfo

  _set_app_type

  _controlfp_s

  exit

  api-ms-win-crt-time-l1-1-0

  _localtime64_s

  _time64

  _localtime64

  asctime

  clock

  api-ms-win-crt-string-l1-1-0

  wcsspn

  strncmp

  _wcsicmp

  strcpy

  strlen

  wcslen

  isalnum

  wcscspn

  wmemcpy_s

  strcmp

  tolower

  api-ms-win-crt-heap-l1-1-0

  _callnewh

  free

  calloc

  _recalloc

  malloc

  _set_new_mode

  realloc

  api-ms-win-crt-utility-l1-1-0

  labs

  srand

  rand

  api-ms-win-crt-stdio-l1-1-0

  fclose

  fwrite

  _set_fmode

  __stdio_common_vsprintf

  __p__commode

  feof

  fopen

  fread

  api-ms-win-crt-multibyte-l1-1-0

  _mbsicmp

  api-ms-win-crt-environment-l1-1-0

  getenv

  api-ms-win-crt-locale-l1-1-0

  _configthreadlocale

  ___lc_codepage_func

  api-ms-win-crt-math-l1-1-0

  __setusermatherr

  Sections

  .text

  Size: 392KB - Virtual size: 392KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 58KB - Virtual size: 58KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 4KB - Virtual size: 10KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 18KB - Virtual size: 17KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ