General

Malware Config

Signatures

Files

• 55c13fa59c8517e58164f51bb3b5cab7a28c88f82ba578df2f73795c9329b7a5

  .exe windows x86

  b90a6995421b6eb79d6bcd36b44f24cf

  
  

  Code Sign

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  GetPrivateProfileSectionNamesW

  EnumResourceNamesW

  UnregisterWait

  GetNumaNodeProcessorMask

  SetCriticalSectionSpinCount

  SearchPathW

  SetInformationJobObject

  lstrcmpA

  FindFirstFileW

  SetThreadContext

  EnumCalendarInfoA

  WriteConsoleInputW

  IsBadStringPtrW

  lstrlenA

  GetConsoleAliasesLengthW

  EnumDateFormatsExW

  CopyFileExW

  TlsGetValue

  SetLocalTime

  UnmapViewOfFile

  MoveFileExA

  CommConfigDialogA

  GetNumberOfConsoleInputEvents

  GetConsoleAliasExesLengthA

  SetErrorMode

  FindResourceW

  FreeLibrary

  DeleteVolumeMountPointA

  SetUnhandledExceptionFilter

  LoadLibraryExW

  SetDllDirectoryW

  InterlockedIncrement

  GetQueuedCompletionStatus

  VerSetConditionMask

  MoveFileExW

  InterlockedDecrement

  WaitNamedPipeA

  SetMailslotInfo

  ZombifyActCtx

  SetConsoleActiveScreenBuffer

  WritePrivateProfileSectionA

  SetDefaultCommConfigW

  SetFirmwareEnvironmentVariableA

  SetEnvironmentVariableW

  GetNamedPipeHandleStateA

  SignalObjectAndWait

  AddConsoleAliasW

  SetVolumeMountPointW

  GetComputerNameW

  SetEvent

  SetThreadExecutionState

  OpenSemaphoreA

  GetFileAttributesExA

  _lclose

  OutputDebugStringW

  GetTickCount

  GetCommConfig

  GetProcessHeap

  IsBadReadPtr

  GetSystemTimeAsFileTime

  GetPrivateProfileStringW

  GetConsoleTitleA

  ReadConsoleW

  CreateRemoteThread

  GetCompressedFileSizeW

  EnumTimeFormatsA

  SetCommTimeouts

  CreateActCtxW

  InitializeCriticalSection

  GetProcessTimes

  TlsSetValue

  AllocateUserPhysicalPages

  OpenProcess

  FindResourceExA

  GetConsoleCP

  GlobalAlloc

  GetPrivateProfileIntA

  LoadLibraryW

  GetConsoleMode

  FatalAppExitW

  GetThreadSelectorEntry

  AssignProcessToJobObject

  GetCalendarInfoA

  ReadFileScatter

  SetSystemTimeAdjustment

  ReadConsoleOutputW

  SetConsoleCP

  InterlockedPopEntrySList

  LeaveCriticalSection

  GetFileAttributesA

  GlobalFlags

  lstrcpynW

  GetNamedPipeInfo

  HeapValidate

  GetVolumePathNamesForVolumeNameW

  CreateSemaphoreA

  SetConsoleCursorPosition

  HeapQueryInformation

  WritePrivateProfileSectionW

  TerminateProcess

  GetAtomNameW

  FileTimeToSystemTime

  GetThreadContext

  lstrcatA

  GetBinaryTypeW

  CompareStringW

  ExitThread

  GetVolumePathNameA

  lstrlenW

  SetConsoleTitleA

  WritePrivateProfileStringW

  GlobalUnlock

  VirtualUnlock

  GetTempPathW

  GetStringTypeExA

  CreateJobObjectA

  GetPrivateProfileIntW

  VerifyVersionInfoW

  InterlockedExchange

  SetCurrentDirectoryA

  GetStdHandle

  FindFirstFileA

  GetLastError

  ChangeTimerQueueTimer

  GetLongPathNameW

  BindIoCompletionCallback

  GetProcAddress

  FindVolumeMountPointClose

  VirtualAlloc

  HeapSize

  BackupWrite

  VerLanguageNameA

  CreateNamedPipeA

  CreateJobSet

  LocalLock

  LockFileEx

  BuildCommDCBW

  DefineDosDeviceA

  GetNumaHighestNodeNumber

  FindClose

  GetPrivateProfileStringA

  LoadLibraryA

  Process32FirstW

  OpenMutexA

  ProcessIdToSessionId

  GetFileType

  MoveFileA

  BuildCommDCBAndTimeoutsW

  CreateHardLinkW

  GetExitCodeThread

  GetNumberFormatW

  SetFileApisToANSI

  QueryDosDeviceW

  SetConsoleWindowInfo

  SetThreadIdealProcessor

  HeapWalk

  GetPrivateProfileStructA

  GetTapeParameters

  GetVolumePathNamesForVolumeNameA

  GetModuleFileNameA

  GetDefaultCommConfigA

  FindNextFileA

  WriteProfileStringA

  EnumDateFormatsA

  WaitCommEvent

  _lread

  GetModuleHandleA

  FindFirstChangeNotificationA

  GetProcessShutdownParameters

  QueueUserWorkItem

  ContinueDebugEvent

  IsDebuggerPresent

  GetProcessAffinityMask

  FreeEnvironmentStringsW

  EnumResourceNamesA

  WriteProfileStringW

  EnumDateFormatsW

  GetConsoleCursorInfo

  FatalAppExitA

  PeekConsoleInputA

  DeleteCriticalSection

  WriteConsoleOutputAttribute

  OutputDebugStringA

  GetCPInfoExA

  DuplicateHandle

  FindFirstVolumeA

  GetVersionExA

  ReadConsoleInputW

  TlsAlloc

  TerminateJobObject

  CloseHandle

  GetVersion

  DeleteTimerQueueTimer

  GlobalAddAtomW

  SetFileValidData

  FindActCtxSectionStringW

  ResetWriteWatch

  UnregisterWaitEx

  ReadConsoleOutputCharacterW

  TlsFree

  GetProfileSectionW

  EnumSystemLocalesW

  lstrcpyW

  CreateFileW

  SetStdHandle

  GetComputerNameA

  GetFullPathNameA

  GetModuleFileNameW

  ExitProcess

  RaiseException

  GetCommandLineW

  HeapSetInformation

  GetStartupInfoW

  QueryPerformanceCounter

  GetCurrentThreadId

  GetCurrentProcessId

  DecodePointer

  GetModuleHandleW

  GetEnvironmentStringsW

  SetHandleCount

  InitializeCriticalSectionAndSpinCount

  EncodePointer

  SetLastError

  HeapCreate

  WriteFile

  GetACP

  GetOEMCP

  GetCPInfo

  IsValidCodePage

  EnterCriticalSection

  GetCurrentProcess

  UnhandledExceptionFilter

  HeapAlloc

  HeapReAlloc

  HeapFree

  RtlUnwind

  WideCharToMultiByte

  LCMapStringW

  MultiByteToWideChar

  GetStringTypeW

  WriteConsoleW

  IsProcessorFeaturePresent

  SetFilePointer

  FlushFileBuffers

  user32

  GetMessageTime

  gdi32

  GetBitmapBits

  advapi32

  InitiateSystemShutdownA

  msimg32

  GradientFill

  Sections

  .text

  Size: 625KB - Virtual size: 624KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 5KB - Virtual size: 38MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 21KB - Virtual size: 20KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 69KB - Virtual size: 69KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ