General

Malware Config

Signatures

Files

• 576b9b0e6da2715dc02068b053b4203b9bfda1eb0feca8bddcdfc0827c5db7d1

  .exe windows x86

  8acb34bed3caa60cae3f08f75d53f727

  
  

  Code Sign

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_BYTES_REVERSED_LO

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_BYTES_REVERSED_HI

  Imports

  oleaut32

  SysFreeString

  SysReAllocStringLen

  SysAllocStringLen

  SafeArrayPtrOfIndex

  SafeArrayGetUBound

  SafeArrayGetLBound

  SafeArrayCreate

  VariantChangeType

  VariantCopy

  VariantClear

  VariantInit

  advapi32

  RegQueryValueExA

  RegOpenKeyExA

  RegCloseKey

  RegSetValueExW

  RegSetValueExA

  RegQueryValueExW

  RegQueryValueExA

  RegOpenKeyExW

  RegOpenKeyExA

  RegEnumKeyExA

  RegDeleteValueA

  RegDeleteKeyA

  RegCreateKeyExW

  RegCreateKeyExA

  RegCloseKey

  OpenProcessToken

  LookupPrivilegeValueA

  AdjustTokenPrivileges

  user32

  GetKeyboardType

  DestroyWindow

  LoadStringA

  MessageBoxA

  CharNextA

  TranslateMessage

  PeekMessageA

  MsgWaitForMultipleObjects

  MessageBoxA

  LoadStringA

  GetSystemMetrics

  DispatchMessageA

  CharNextW

  CharLowerBuffW

  CharNextA

  CharLowerBuffA

  CharLowerA

  CharUpperA

  CharToOemA

  kernel32

  GetACP

  Sleep

  VirtualFree

  VirtualAlloc

  GetTickCount

  QueryPerformanceCounter

  GetCurrentThreadId

  InterlockedDecrement

  InterlockedIncrement

  VirtualQuery

  WideCharToMultiByte

  MultiByteToWideChar

  lstrlenA

  lstrcpynA

  LoadLibraryExA

  GetThreadLocale

  GetStartupInfoA

  GetProcAddress

  GetModuleHandleA

  GetModuleFileNameA

  GetLocaleInfoA

  GetCommandLineA

  FreeLibrary

  FindFirstFileA

  FindClose

  ExitProcess

  ExitThread

  CreateThread

  WriteFile

  UnhandledExceptionFilter

  RtlUnwind

  RaiseException

  GetStdHandle

  TlsSetValue

  TlsGetValue

  LocalAlloc

  GetModuleHandleA

  WriteProcessMemory

  WriteFile

  WaitForSingleObject

  VirtualQuery

  VirtualAllocEx

  TerminateThread

  TerminateProcess

  SetLastError

  SetFileTime

  SetFilePointer

  SetFileAttributesW

  SetEvent

  SetEndOfFile

  ResumeThread

  ResetEvent

  ReadFile

  OpenProcess

  MoveFileW

  LoadLibraryA

  LeaveCriticalSection

  InitializeCriticalSection

  GlobalUnlock

  GlobalReAlloc

  GlobalHandle

  GlobalLock

  GlobalFree

  GlobalAlloc

  GetVersionExA

  GetUserDefaultLangID

  GetTickCount

  GetThreadLocale

  GetStdHandle

  GetProcAddress

  GetModuleHandleA

  GetModuleFileNameW

  GetModuleFileNameA

  GetLocaleInfoA

  GetLocalTime

  GetLastError

  GetFullPathNameA

  GetFileAttributesW

  GetFileAttributesA

  GetExitCodeThread

  GetEnvironmentVariableW

  GetEnvironmentVariableA

  GetDriveTypeA

  GetDiskFreeSpaceA

  GetDateFormatA

  GetCurrentThreadId

  GetCurrentProcess

  GetCommandLineW

  GetCPInfo

  InterlockedIncrement

  InterlockedExchange

  InterlockedDecrement

  FreeLibrary

  FormatMessageA

  FindNextFileW

  FindFirstFileW

  FindClose

  FileTimeToLocalFileTime

  FileTimeToDosDateTime

  ExitThread

  ExitProcess

  EnumCalendarInfoA

  EnterCriticalSection

  DuplicateHandle

  DeleteFileW

  DeleteCriticalSection

  CreateThread

  CreateRemoteThread

  CreateProcessW

  CreateProcessA

  CreatePipe

  CreateFileW

  CreateFileA

  CreateEventA

  CreateDirectoryW

  CopyFileW

  CompareStringW

  CompareStringA

  CloseHandle

  Sleep

  mpr

  WNetOpenEnumW

  WNetEnumResourceW

  WNetCloseEnum

  wininet

  InternetReadFile

  InternetOpenUrlA

  InternetOpenA

  InternetConnectA

  InternetCloseHandle

  HttpSendRequestA

  HttpOpenRequestA

  HttpAddRequestHeadersA

  shell32

  ShellExecuteW

  SHGetSpecialFolderLocation

  SHGetPathFromIDListW

  SHGetMalloc

  Sections

  .text

  Size: 184KB - Virtual size: 184KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .itext

  Size: 6KB - Virtual size: 5KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 6KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .bss

  Size: - Virtual size: 1.0MB

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 5KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: - Virtual size: 12B

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 512B - Virtual size: 24B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 10KB - Virtual size: 10KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 512B - Virtual size:

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ