General

Malware Config

Signatures

Files

• 22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0

  .exe windows x86

  9208957cb88350ddbe4e0ccf97008a5d

  
  

  Code Sign

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  user32

  MessageBoxA

  GetForegroundWindow

  AnimateWindow

  PostQuitMessage

  ShutdownBlockReasonCreate

  DefWindowProcA

  MessageBoxW

  wsprintfA

  wsprintfW

  ShutdownBlockReasonDestroy

  RegisterClassExW

  CreateWindowExW

  GetMessageA

  TranslateMessage

  DispatchMessageA

  AdjustWindowRect

  ReleaseDC

  DeferWindowPos

  DestroyWindow

  CloseWindow

  EnumChildWindows

  gdi32

  SetPixel

  GetDeviceCaps

  SelectPalette

  SetPaletteEntries

  DeleteObject

  kernel32

  GetFileSize

  LocalAlloc

  ReadFile

  CloseHandle

  WriteFile

  DeviceIoControl

  OpenMutexW

  CreateMutexW

  lstrlen

  GetModuleHandleA

  LoadLibraryA

  HeapAlloc

  lstrcpy

  lstrcat

  GetProcAddress

  lstrlenW

  CreateDirectoryW

  GetLastError

  lstrcatW

  lstrcpynW

  FindNextFileW

  lstrcmpW

  FindClose

  GetTickCount

  VirtualFree

  ExitThread

  CreateFileA

  CreateFileW

  TlsSetValue

  OutputDebugStringW

  VirtualAlloc

  TlsGetValue

  WaitForSingleObject

  ExitProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  GetWindowsDirectoryA

  GetModuleHandleW

  GetSystemDirectoryW

  CreateProcessW

  GetShortPathNameW

  ExpandEnvironmentStringsW

  Sleep

  GetCurrentProcessId

  VirtualQuery

  VirtualProtect

  IsBadReadPtr

  FreeLibrary

  lstrcmp

  AllocConsole

  GetStdHandle

  WriteConsoleW

  UnmapViewOfFile

  lstrcmpiW

  lstrcpyW

  SetFileAttributesW

  MoveFileExW

  FindFirstFileW

  WaitForMultipleObjects

  GetDriveTypeW

  GetTickCount64

  IsProcessorFeaturePresent

  GetCommandLineW

  GetFileSizeEx

  SetFilePointerEx

  CreateFileMappingW

  MapViewOfFile

  GetCurrentProcess

  LocalFree

  GetUserDefaultUILanguage

  InitializeCriticalSection

  DeleteCriticalSection

  SetLastError

  EnterCriticalSection

  LeaveCriticalSection

  TerminateThread

  GlobalAlloc

  GlobalFree

  Beep

  MoveFileExA

  GetVersionExA

  Process32NextW

  CreateThread

  SetThreadExecutionState

  advapi32

  LsaFreeMemory

  LsaAddAccountRights

  LookupAccountSidW

  InitializeSecurityDescriptor

  LsaClose

  CryptDecrypt

  CryptEncrypt

  CryptImportKey

  GetSidSubAuthority

  GetSidSubAuthorityCount

  AreAllAccessesGranted

  CryptGenRandom

  CryptReleaseContext

  CryptDestroyKey

  CryptExportKey

  CryptGenKey

  CryptAcquireContextW

  LsaQueryTrustedDomainInfo

  LsaCreateTrustedDomainEx

  EqualDomainSid

  EncryptionDisable

  shell32

  ShellExecuteExW

  SHGetFolderPathW

  secur32

  LsaConnectUntrusted

  netapi32

  DsRoleGetPrimaryDomainInformation

  DsRoleFreeMemory

  shlwapi

  StrStrW

  StrToIntA

  mpr

  WNetOpenEnumW

  WNetEnumResourceW

  WNetCloseEnum

  WNetAddConnection2W

  ws2_32

  shutdown

  closesocket

  connect

  ntohs

  inet_addr

  WSAGetLastError

  WSACleanup

  socket

  WSAStartup

  inet_pton

  send

  gethostbyname

  inet_ntoa

  recv

  wininet

  InternetReadFile

  InternetCloseHandle

  HttpQueryInfoA

  HttpSendRequestA

  HttpOpenRequestA

  InternetConnectA

  InternetCrackUrlA

  InternetOpenA

  crypt32

  CryptStringToBinaryA

  CryptBinaryToStringA

  CryptBinaryToStringW

  ole32

  CoInitializeEx

  CoUninitialize

  CoCreateInstance

  oleaut32

  VariantClear

  VariantInit

  Sections

  .text

  Size: 235KB - Virtual size: 234KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 64KB - Virtual size: 63KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 65KB - Virtual size: 64KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE