General

Malware Config

Signatures

Files

• 6104195775758336.zip

  .zip

  Password: infected

• 8a30d72bb314ae7eab1952c7bef22a34147680166cf451c5d5843179fadfa154

  .exe windows x64

  2da62c9dbd8ce41d0a3643feb8cf8be4

  
  

  Code Sign

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  kernel32

  GetProcAddress

  LocalFree

  GetFileSize

  DeleteCriticalSection

  GetProcessHeap

  FreeLibrary

  GetConsoleWindow

  lstrcmpiW

  IsDebuggerPresent

  GetWindowsDirectoryW

  HeapDestroy

  DecodePointer

  HeapAlloc

  LoadLibraryW

  RaiseException

  HeapReAlloc

  DeleteFileW

  LoadLibraryA

  GetLastError

  SetConsoleScreenBufferInfoEx

  GetConsoleMode

  Sleep

  HeapSize

  GetConsoleScreenBufferInfoEx

  InitializeCriticalSectionEx

  LoadLibraryExA

  VirtualAlloc

  SetConsoleMode

  WriteFile

  GetStdHandle

  GetCurrentProcess

  SetConsoleTitleA

  VirtualFree

  SetConsoleTextAttribute

  WriteConsoleW

  SetEnvironmentVariableW

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GetOEMCP

  GetACP

  IsValidCodePage

  FlushFileBuffers

  SetStdHandle

  CreateProcessW

  GetExitCodeProcess

  WaitForSingleObject

  GetTimeZoneInformation

  EnumSystemLocalesW

  GetUserDefaultLCID

  IsValidLocale

  GetLocaleInfoW

  LCMapStringW

  CompareStringW

  GetConsoleOutputCP

  GetCommandLineW

  GetCommandLineA

  GetModuleFileNameW

  SetConsoleCtrlHandler

  FreeLibraryAndExitThread

  ExitThread

  CreateThread

  FileTimeToSystemTime

  SystemTimeToTzSpecificLocalTime

  GetDriveTypeW

  ExitProcess

  VirtualQuery

  VirtualProtect

  GetSystemInfo

  LoadLibraryExW

  RtlPcToFileHeader

  InterlockedPushEntrySList

  RtlUnwindEx

  OutputDebugStringW

  GetCPInfo

  GetStringTypeW

  HeapFree

  ReadFile

  CloseHandle

  CreateFileW

  DeviceIoControl

  SetLastError

  QueryPerformanceCounter

  QueryPerformanceFrequency

  FormatMessageA

  GetTickCount

  EnterCriticalSection

  LeaveCriticalSection

  SleepEx

  GetSystemDirectoryA

  GetModuleHandleA

  VerifyVersionInfoA

  WaitForSingleObjectEx

  ExpandEnvironmentStringsA

  GetFileType

  PeekNamedPipe

  WaitForMultipleObjects

  CreateFileA

  GetFileSizeEx

  GetEnvironmentVariableW

  WideCharToMultiByte

  ReadConsoleA

  ReadConsoleW

  InitializeCriticalSectionAndSpinCount

  GetCurrentThreadId

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetModuleHandleExW

  MultiByteToWideChar

  FormatMessageW

  GetModuleHandleW

  GetCurrentProcessId

  GetSystemTimeAsFileTime

  SwitchToFiber

  DeleteFiber

  CreateFiber

  ConvertFiberToThread

  ConvertThreadToFiber

  FindClose

  FindFirstFileW

  FindNextFileW

  GetSystemTime

  SystemTimeToFileTime

  SetEvent

  ResetEvent

  CreateEventW

  InitializeSListHead

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  TerminateProcess

  IsProcessorFeaturePresent

  GetStartupInfoW

  GetCurrentDirectoryW

  FindFirstFileExW

  GetFileAttributesExW

  GetFileInformationByHandle

  GetFullPathNameW

  SetEndOfFile

  SetFileInformationByHandle

  SetFilePointerEx

  AreFileApisANSI

  GetFileInformationByHandleEx

  EncodePointer

  LCMapStringEx

  FlsAlloc

  FlsGetValue

  FlsSetValue

  FlsFree

  RtlUnwind

  user32

  GetWindowLongA

  SetWindowLongA

  PostThreadMessageA

  MessageBoxA

  MoveWindow

  UnhookWindowsHookEx

  FindWindowA

  GetWindowThreadProcessId

  SetWindowsHookExA

  MessageBoxW

  GetUserObjectInformationW

  GetProcessWindowStation

  GetWindowRect

  GetAsyncKeyState

  advapi32

  ConvertSidToStringSidA

  CryptSignHashW

  CryptDecrypt

  CryptExportKey

  CryptGetUserKey

  CryptGetProvParam

  CryptSetHashParam

  CryptDestroyKey

  CryptAcquireContextW

  ReportEventW

  RegisterEventSourceW

  DeregisterEventSource

  CryptDestroyHash

  CryptHashData

  GetTokenInformation

  GetLengthSid

  CryptAcquireContextA

  CryptReleaseContext

  CryptGetHashParam

  CryptGenRandom

  CryptCreateHash

  CryptEnumProvidersW

  OpenProcessToken

  CopySid

  IsValidSid

  shell32

  ShellExecuteW

  ShellExecuteA

  ws2_32

  ioctlsocket

  listen

  htonl

  socket

  send

  freeaddrinfo

  closesocket

  accept

  WSACleanup

  WSAStartup

  WSAIoctl

  setsockopt

  ntohs

  htons

  getsockopt

  getsockname

  getpeername

  connect

  bind

  WSASetLastError

  select

  __WSAFDIsSet

  ntohl

  recvfrom

  sendto

  inet_pton

  WSAGetLastError

  getaddrinfo

  getnameinfo

  recv

  shutdown

  gethostname

  wldap32

  ord26

  ord22

  ord41

  ord50

  ord32

  ord60

  ord211

  ord46

  ord143

  ord35

  ord27

  ord45

  ord79

  ord301

  ord200

  ord30

  ord33

  crypt32

  CertOpenStore

  CertCloseStore

  CertEnumCertificatesInStore

  CertFindCertificateInStore

  CertFreeCertificateContext

  CryptStringToBinaryA

  CertAddCertificateContextToStore

  CertGetNameStringA

  CryptQueryObject

  CertCreateCertificateChainEngine

  CertFreeCertificateChainEngine

  CertGetCertificateChain

  CertFreeCertificateChain

  CertDuplicateCertificateContext

  CertGetCertificateContextProperty

  userenv

  UnloadUserProfile

  rpcrt4

  UuidCreate

  RpcStringFreeA

  UuidToStringA

  ntdll

  RtlCaptureContext

  RtlImageNtHeader

  VerSetConditionMask

  RtlVirtualUnwind

  RtlLookupFunctionEntry

  urlmon

  URLDownloadToFileA

  bcrypt

  BCryptGenRandom

  Sections

  .text

  Size: 2.4MB - Virtual size: 2.4MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 792KB - Virtual size: 792KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 306KB - Virtual size: 333KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 101KB - Virtual size: 101KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  _RDATA

  Size: 512B - Virtual size: 244B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 198KB - Virtual size: 197KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 31KB - Virtual size: 30KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ