General

Malware Config

Signatures

Files

• 78366B123438B7CD2F167E49623104B76A0E27334CE3F.dll

  .dll windows x86

  d742aa65c4880f85ae43feebb0781b67

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  CreateRemoteThread

  FreeLibrary

  GetVersion

  CopyFileA

  MoveFileExA

  GetLocalTime

  HeapFree

  GetProcessHeap

  MapViewOfFile

  CreateFileMappingA

  HeapAlloc

  UnmapViewOfFile

  GlobalFree

  GlobalUnlock

  GlobalLock

  GlobalAlloc

  GlobalSize

  GetCurrentProcess

  CreatePipe

  PeekNamedPipe

  WaitForMultipleObjects

  GetPrivateProfileStringA

  ReleaseMutex

  CreateMutexA

  OpenEventA

  SetErrorMode

  SetUnhandledExceptionFilter

  DisableThreadLibraryCalls

  FreeConsole

  GetModuleHandleA

  ExitProcess

  lstrcmpiA

  GetCurrentThreadId

  WritePrivateProfileStringA

  GetTempPathA

  GetSystemDirectoryA

  GetTickCount

  SetLastError

  OutputDebugStringA

  GetModuleFileNameA

  CreateToolhelp32Snapshot

  Process32First

  OpenProcess

  Process32Next

  GlobalMemoryStatus

  GetVersionExA

  MoveFileA

  RemoveDirectoryA

  FindNextFileA

  FindClose

  GetLogicalDriveStringsA

  GetVolumeInformationA

  GetDiskFreeSpaceExA

  GetDriveTypeA

  lstrcatA

  CreateProcessA

  DeleteFileA

  LoadLibraryA

  GetProcAddress

  WriteFile

  lstrlenA

  lstrcpyA

  GetFileAttributesA

  CreateDirectoryA

  GetLastError

  FindFirstFileA

  SetFilePointer

  ReadFile

  LocalFree

  CreateFileA

  GetFileSize

  Sleep

  CancelIo

  InterlockedExchange

  ResetEvent

  LocalAlloc

  LocalSize

  LocalReAlloc

  InterlockedDecrement

  WideCharToMultiByte

  InterlockedIncrement

  VirtualAlloc

  EnterCriticalSection

  LeaveCriticalSection

  VirtualFree

  DeleteCriticalSection

  InitializeCriticalSection

  CreateThread

  ResumeThread

  SetEvent

  WaitForSingleObject

  TerminateThread

  CloseHandle

  GetStartupInfoA

  CreateEventA

  user32

  UnhookWindowsHookEx

  LoadCursorA

  DestroyCursor

  BlockInput

  SystemParametersInfoA

  SendMessageA

  keybd_event

  MapVirtualKeyA

  SetCapture

  WindowFromPoint

  SetCursorPos

  GetActiveWindow

  CloseClipboard

  SetClipboardData

  SetWindowsHookExA

  OpenClipboard

  GetClipboardData

  GetSystemMetrics

  SetRect

  GetDC

  GetDesktopWindow

  ReleaseDC

  GetCursorInfo

  GetCursorPos

  SetProcessWindowStation

  OpenWindowStationA

  GetProcessWindowStation

  GetWindowTextA

  GetThreadDesktop

  OpenDesktopA

  CallNextHookEx

  EmptyClipboard

  GetKeyNameTextA

  GetClientRect

  DispatchMessageA

  TranslateMessage

  GetMessageA

  CreateWindowExA

  CharNextA

  mouse_event

  wsprintfA

  GetUserObjectInformationA

  OpenInputDesktop

  SetThreadDesktop

  CloseDesktop

  ShowWindow

  PostMessageA

  EnumWindows

  GetWindowThreadProcessId

  IsWindowVisible

  ExitWindowsEx

  FindWindowA

  gdi32

  CreateDIBSection

  CreateCompatibleDC

  DeleteObject

  DeleteDC

  BitBlt

  GetDIBits

  SelectObject

  CreateCompatibleBitmap

  advapi32

  InitializeSecurityDescriptor

  SetServiceStatus

  RegisterServiceCtrlHandlerA

  StartServiceA

  LockServiceDatabase

  ChangeServiceConfigA

  RegQueryValueA

  RegOpenKeyExA

  RegCreateKeyA

  RegQueryValueExA

  RegOpenKeyA

  CloseEventLog

  ClearEventLogA

  AdjustTokenPrivileges

  LookupPrivilegeValueA

  OpenProcessToken

  FreeSid

  SetSecurityDescriptorDacl

  AddAccessAllowedAce

  InitializeAcl

  GetLengthSid

  AllocateAndInitializeSid

  RegEnumValueA

  RegEnumKeyExA

  RegDeleteValueA

  RegDeleteKeyA

  RegCreateKeyExA

  RegCloseKey

  RegQueryInfoKeyA

  RegSetValueExA

  CloseServiceHandle

  EnumServicesStatusA

  OpenSCManagerA

  QueryServiceConfigA

  OpenServiceA

  DeleteService

  ControlService

  QueryServiceStatus

  UnlockServiceDatabase

  shell32

  SHGetFileInfoA

  ShellExecuteA

  ole32

  CoTaskMemFree

  CoUninitialize

  CoInitialize

  CoCreateInstance

  oleaut32

  SysFreeString

  msvcrt

  _strlwr

  strchr

  _strrev

  _adjust_fdiv

  _initterm

  ??1type_info@@UAE@XZ

  _onexit

  __dllonexit

  calloc

  _beginthreadex

  atoi

  realloc

  _strnicmp

  strncat

  sprintf

  rename

  isdigit

  strtoul

  strncmp

  strncpy

  strrchr

  _except_handler3

  malloc

  free

  _CxxThrowException

  wcstombs

  strstr

  _ftol

  ceil

  memmove

  __CxxFrameHandler

  ??2@YAPAXI@Z

  ??3@YAXPAX@Z

  winmm

  waveOutReset

  waveOutClose

  waveInUnprepareHeader

  waveInReset

  waveInStop

  waveInClose

  waveOutUnprepareHeader

  waveInAddBuffer

  waveOutWrite

  waveInStart

  waveInOpen

  waveInPrepareHeader

  waveInGetNumDevs

  waveOutGetNumDevs

  waveOutOpen

  waveOutPrepareHeader

  ws2_32

  WSAStartup

  WSACleanup

  WSAIoctl

  setsockopt

  connect

  htons

  gethostbyname

  socket

  select

  getsockname

  gethostname

  send

  closesocket

  recv

  msvcp60

  ?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ

  ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

  ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB

  ?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z

  ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB

  ?_Xran@std@@YAXXZ

  ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z

  ?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z

  ?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z

  ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z

  psapi

  GetModuleFileNameExA

  EnumProcessModules

  imm32

  ImmReleaseContext

  ImmGetContext

  ImmGetCompositionStringA

  wininet

  InternetReadFile

  msvfw32

  ICOpen

  ICSeqCompressFrame

  ICCompressorFree

  ICSeqCompressFrameEnd

  ICSendMessage

  ICClose

  ICGetInfo

  ICInfo

  ICSeqCompressFrameStart

  Exports

  Exports

  ServiceMain

  UninstallServer

  Sections

  .text

  Size: 88KB - Virtual size: 88KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 16KB - Virtual size: 15KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 8KB - Virtual size: 9KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 6KB - Virtual size: 6KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ