General

Malware Config

Signatures

Files

• 1d68a140a1b1fed67187ee9062ff37c77c4bf994e8b75f1660e0a99ecb57e782

  .dll windows x86

  9067c3aa80bafa1ecca4ae1963d6d63e

  
  

  Code Sign

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  VirtualAllocEx

  GetLastError

  SetErrorMode

  GetModuleHandleW

  InitializeCriticalSection

  DeleteCriticalSection

  WriteFile

  FlushFileBuffers

  DeleteFileW

  GetFileSizeEx

  GetFullPathNameW

  OutputDebugStringA

  FileTimeToSystemTime

  MultiByteToWideChar

  GetSystemTimeAsFileTime

  GetCurrentProcessId

  GetCurrentThreadId

  GetFileAttributesW

  FindNextFileW

  ExpandEnvironmentStringsW

  SetFilePointerEx

  GetDiskFreeSpaceExW

  FindClose

  GetWindowsDirectoryW

  FindFirstVolumeW

  QueryDosDeviceW

  FindNextVolumeW

  GetVolumePathNamesForVolumeNameW

  FindVolumeClose

  GlobalMemoryStatusEx

  GetSystemTimes

  QueryPerformanceCounter

  GetEnvironmentStringsW

  GetOEMCP

  IsValidCodePage

  ReadFile

  GetProcAddress

  LocalFree

  GetCurrentProcess

  GetProcessHeap

  HeapAlloc

  HeapFree

  GetLongPathNameW

  LeaveCriticalSection

  EnterCriticalSection

  SetLastError

  HeapSize

  GetFileTime

  CloseHandle

  WaitForSingleObjectEx

  SetEvent

  CreateEventA

  CreateFileW

  OpenProcess

  WideCharToMultiByte

  FreeEnvironmentStringsW

  SetEnvironmentVariableW

  SetStdHandle

  WriteConsoleW

  ReadConsoleW

  FindFirstFileExW

  FormatMessageW

  EncodePointer

  DecodePointer

  RaiseException

  GetStringTypeW

  QueryPerformanceFrequency

  InitializeCriticalSectionAndSpinCount

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  CompareStringW

  LCMapStringW

  GetLocaleInfoW

  GetCPInfo

  FormatMessageA

  GetSystemInfo

  VirtualProtect

  VirtualQuery

  FreeLibrary

  LoadLibraryExA

  InitializeSListHead

  RtlCaptureContext

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  TerminateProcess

  IsProcessorFeaturePresent

  IsDebuggerPresent

  GetStartupInfoW

  InterlockedPushEntrySList

  LoadLibraryExW

  HeapReAlloc

  ExitProcess

  GetModuleHandleExW

  GetModuleFileNameW

  GetStdHandle

  GetCommandLineA

  GetCommandLineW

  GetACP

  GetFileType

  IsValidLocale

  GetUserDefaultLCID

  EnumSystemLocalesW

  GetConsoleCP

  GetConsoleMode

  SetThreadAffinityMask

  ScrollConsoleScreenBufferW

  BuildCommDCBW

  TryEnterCriticalSection

  FillConsoleOutputAttribute

  ReadDirectoryChangesW

  SetConsoleOutputCP

  GetEnvironmentVariableA

  WriteProfileSectionA

  SetHandleCount

  ReleaseSemaphore

  CreateProcessA

  IsSystemResumeAutomatic

  LocalHandle

  SetProcessAffinityMask

  LoadLibraryW

  LoadLibraryA

  LocalAlloc

  GetTickCount

  GetModuleHandleA

  RtlUnwind

  GetStartupInfoA

  InterlockedCompareExchange

  Sleep

  InterlockedExchange

  user32

  CountClipboardFormats

  GetListBoxInfo

  GetCapture

  ShowCaret

  PaintDesktop

  GetDesktopWindow

  IsCharAlphaNumericW

  GetShellWindow

  CreatePopupMenu

  IsCharAlphaW

  GetDoubleClickTime

  IsCharUpperW

  GetForegroundWindow

  CharUpperW

  OemKeyScan

  GetCaretBlinkTime

  GetMenuContextHelpId

  IsCharLowerA

  VkKeyScanW

  IsClipboardFormatAvailable

  LoadIconA

  GetOpenClipboardWindow

  GetLastActivePopup

  GetClassInfoExW

  RegisterClassExW

  GetPropW

  EnumDisplayDevicesW

  IsDlgButtonChecked

  SendMessageTimeoutA

  EnumDesktopsW

  SetWindowTextA

  LookupIconIdFromDirectory

  SetWindowsHookExA

  GetSysColor

  EnumDesktopWindows

  ChangeDisplaySettingsExA

  CreateIconFromResourceEx

  gdi32

  GetStockObject

  GetEnhMetaFileW

  GetEnhMetaFileBits

  BeginPath

  DeleteDC

  GetLayout

  CreateMetaFileW

  EndPage

  CloseEnhMetaFile

  CreateSolidBrush

  SaveDC

  GetStretchBltMode

  GetTextCharset

  GetBoundsRect

  GdiIsMetaPrintDC

  GdiEntry12

  advapi32

  RegOpenKeyA

  CryptReleaseContext

  CryptGenRandom

  CryptAcquireContextW

  RegQueryValueExW

  RegOpenKeyExW

  RegCloseKey

  shell32

  SHPathPrepareForWriteA

  ShellHookProc

  SHGetSpecialFolderPathW

  ExtractIconA

  SHCreateProcessAsUserW

  SHGetSettings

  SHGetSpecialFolderLocation

  SHQueryRecycleBinW

  ExtractAssociatedIconExW

  SHGetSpecialFolderPathA

  ole32

  CoInitializeEx

  CoUninitialize

  shlwapi

  PathFindFileNameW

  StrStrW

  StrRChrW

  Sections

  .text

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .text4

  Size: 512B - Virtual size: 300B

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .text3

  Size: 512B - Virtual size: 300B

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .text2

  Size: 512B - Virtual size: 300B

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 1024B - Virtual size: 573B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 2.0MB - Virtual size: 2.0MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 64KB - Virtual size: 64KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 1024B - Virtual size: 848B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ