General

Malware Config

Signatures

Files

• ea2c169529e782994be5296c81ff4668dba2b77a805bd057b53e5952c65aaf72

  .exe windows x86

  d99e35e9d4559cb6df0e1eb507b928cc

  
  

  Code Sign

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  ntdll

  RtlGetNtVersionNumbers

  strrchr

  wcsncmp

  wcstombs

  _vsnwprintf

  wcsstr

  wcsrchr

  NtQueryInformationProcess

  RtlGetCurrentPeb

  NtYieldExecution

  vsprintf

  mbstowcs

  sprintf

  _stricmp

  _chkstk

  memset

  memcpy

  _allrem

  RtlUnwind

  msvcrt

  ??3@YAXPAX@Z

  free

  ??2@YAPAXI@Z

  malloc

  kernel32

  GetTempPathW

  SwitchToThread

  ExpandEnvironmentStringsW

  CreateThread

  DeleteFileA

  SetFileAttributesW

  ResumeThread

  WriteProcessMemory

  LocalFree

  DeleteFileW

  GetWindowsDirectoryW

  CloseHandle

  GetFullPathNameW

  ExitProcess

  GetCommandLineW

  GetComputerNameA

  CreateFileA

  GetFileSize

  SetPriorityClass

  FindFirstFileW

  SetFilePointer

  GetLocaleInfoA

  MapViewOfFile

  UnmapViewOfFile

  GetDriveTypeW

  FreeLibrary

  HeapAlloc

  SetUnhandledExceptionFilter

  InterlockedIncrement

  MoveFileExW

  InterlockedDecrement

  GetCurrentProcess

  GetLogicalDriveStringsW

  HeapFree

  WaitForSingleObject

  GetSystemDefaultLCID

  OutputDebugStringW

  GetTickCount

  GetProcessHeap

  FormatMessageA

  WriteFile

  InitializeCriticalSection

  GetSystemDirectoryW

  Sleep

  CopyFileW

  LeaveCriticalSection

  HeapCreate

  CreateProcessA

  ReadFile

  CreateFileW

  SetThreadPriority

  FlushFileBuffers

  OutputDebugStringA

  GetFileSizeEx

  GetLastError

  GetProcAddress

  QueueUserAPC

  MoveFileW

  EnterCriticalSection

  VirtualAllocEx

  FindClose

  GetLocalTime

  LoadLibraryA

  CreateFileMappingA

  LocalAlloc

  DeviceIoControl

  WaitForMultipleObjects

  GetModuleFileNameA

  GetModuleHandleA

  FindNextFileW

  GetShortPathNameW

  mpr

  WNetOpenEnumW

  WNetEnumResourceW

  WNetCloseEnum

  ws2_32

  WSAStartup

  connect

  send

  gethostbyname

  closesocket

  socket

  htons

  user32

  MessageBoxA

  wsprintfW

  advapi32

  GetUserNameA

  RegSetValueExW

  RegCloseKey

  GetCurrentHwProfileW

  RegSetValueExA

  RegOpenKeyExA

  RegCreateKeyExA

  RegQueryValueExA

  shell32

  CommandLineToArgvW

  Sections

  .text

  Size: 22KB - Virtual size: 21KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 8KB - Virtual size: 70KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ