General

Malware Config

Signatures

Files

• 058ce66e9056d1c480dca60cdd9fd26295d79f43c123d190f86df654b58d3780

  .dll windows x86

  cf7865fb5e09e78f534cbc0ca39b974f

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  advapi32

  QueryServiceStatus

  OpenThreadToken

  OpenServiceA

  OpenSCManagerA

  LookupPrivilegeValueW

  GetTokenInformation

  DeleteService

  CreateServiceA

  SetServiceStatus

  SetSecurityDescriptorDacl

  SetEntriesInAclA

  RegisterServiceCtrlHandlerA

  RegSetValueExA

  RegEnumKeyA

  InitializeSecurityDescriptor

  StartServiceCtrlDispatcherA

  OpenProcessToken

  FreeSid

  AllocateAndInitializeSid

  RegQueryValueExA

  RegOpenKeyExA

  RegCloseKey

  kernel32

  GetStringTypeW

  GetStringTypeA

  LCMapStringW

  MultiByteToWideChar

  LCMapStringA

  LoadLibraryA

  InitializeCriticalSectionAndSpinCount

  IsValidCodePage

  GetOEMCP

  GetACP

  GetCPInfo

  GetSystemTimeAsFileTime

  GetCurrentProcessId

  GetLocaleInfoA

  GetCommandLineA

  GetTickCount

  QueryPerformanceCounter

  GetEnvironmentStringsW

  WideCharToMultiByte

  FreeEnvironmentStringsW

  GetEnvironmentStrings

  FreeEnvironmentStringsA

  GetStartupInfoA

  GetFileType

  SetHandleCount

  HeapSize

  InterlockedDecrement

  SetLastError

  FindFirstChangeNotificationA

  GetEnvironmentVariableA

  GetModuleFileNameA

  Sleep

  VirtualProtectEx

  GetVersion

  FileTimeToLocalFileTime

  CreateEventA

  RemoveDirectoryA

  GetCurrentThreadId

  CreateProcessA

  lstrcmpA

  HeapAlloc

  RaiseException

  RtlUnwind

  GetLastError

  HeapFree

  TerminateProcess

  GetCurrentProcess

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsDebuggerPresent

  GetProcAddress

  GetModuleHandleA

  DeleteCriticalSection

  LeaveCriticalSection

  EnterCriticalSection

  VirtualFree

  VirtualAlloc

  HeapReAlloc

  HeapCreate

  HeapDestroy

  GetModuleHandleW

  ExitProcess

  WriteFile

  GetStdHandle

  TlsGetValue

  TlsAlloc

  TlsSetValue

  TlsFree

  InterlockedIncrement

  user32

  GetWindowTextLengthA

  SetForegroundWindow

  RegisterClassExA

  SendDlgItemMessageA

  SendMessageA

  DestroyWindow

  FrameRect

  SystemParametersInfoA

  CheckRadioButton

  ScreenToClient

  GetMenu

  SetMenuItemInfoA

  EnableWindow

  IsWindow

  SetScrollInfo

  DialogBoxIndirectParamA

  GetSysColor

  LoadIconA

  CreateWindowExA

  GetMessagePos

  UpdateWindow

  GetClassNameA

  GetDC

  GetAsyncKeyState

  EnumChildWindows

  GetWindowTextA

  FindWindowA

  SetClipboardData

  ClientToScreen

  gdi32

  AbortDoc

  SetRectRgn

  CombineRgn

  EndDoc

  GetDeviceCaps

  SetBkMode

  MoveToEx

  LineTo

  IntersectClipRect

  SetAbortProc

  shlwapi

  PathIsRootA

  PathCanonicalizeA

  PathStripToRootA

  winspool.drv

  OpenPrinterA

  AddPrinterConnectionA

  GetPrinterDataA

  GetJobA

  DocumentPropertiesA

  ClosePrinter

  comdlg32

  GetOpenFileNameA

  GetSaveFileNameA

  CommDlgExtendedError

  ChooseFontA

  GetFileTitleA

  FindTextA

  comctl32

  ord17

  ImageList_SetOverlayImage

  DestroyPropertySheetPage

  ImageList_Add

  CreateToolbarEx

  ord6

  ImageList_Destroy

  ImageList_LoadImageA

  Exports

  Exports

  Ballbrown

  Sections

  .text

  Size: 496KB - Virtual size: 496KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 64KB - Virtual size: 63KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 4KB - Virtual size: 44KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 8KB - Virtual size: 8KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ