General

Malware Config

Signatures

Files

• 27a9023efb80dcfb56b17dad33c6aa61535ed5a2f91ba7c8a15ffacaa7a00ad0

  .exe windows x86

  ffa5ccbdc5759b95d33c005eeabe810d

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  GetCurrentProcess

  WriteFile

  LeaveCriticalSection

  SetFilePointer

  InitializeCriticalSectionEx

  CreateMutexA

  UnmapViewOfFile

  HeapSize

  MultiByteToWideChar

  Sleep

  GetFileInformationByHandle

  GetLastError

  CreateFileA

  FileTimeToSystemTime

  LoadLibraryA

  LockResource

  HeapReAlloc

  CloseHandle

  RaiseException

  GetSystemInfo

  FindResourceExW

  LoadResource

  FindResourceW

  HeapAlloc

  GetLocalTime

  HeapDestroy

  GetProcAddress

  CreateFileMappingA

  GetFileSize

  DeleteCriticalSection

  GetProcessHeap

  SystemTimeToFileTime

  FreeLibrary

  WideCharToMultiByte

  EnterCriticalSection

  GetTickCount

  IsWow64Process

  AreFileApisANSI

  GetFullPathNameW

  LockFile

  InitializeCriticalSection

  GetFullPathNameA

  SetEndOfFile

  GetTempPathW

  CreateFileW

  GetFileAttributesW

  GetCurrentThreadId

  GetTempPathA

  GetFileAttributesA

  GetVersionExA

  DeleteFileA

  DeleteFileW

  LoadLibraryW

  UnlockFile

  LockFileEx

  GetCurrentProcessId

  GetSystemTimeAsFileTime

  GetSystemTime

  FormatMessageA

  QueryPerformanceCounter

  FlushFileBuffers

  GetCurrentDirectoryW

  CreateDirectoryW

  FindClose

  FindFirstFileExW

  FindNextFileW

  GetFileAttributesExW

  RemoveDirectoryW

  HeapFree

  SizeofResource

  MapViewOfFile

  ReadFile

  SetLastError

  GetModuleHandleW

  CopyFileW

  LocalFree

  IsDebuggerPresent

  OutputDebugStringW

  InitializeCriticalSectionAndSpinCount

  SetEvent

  ResetEvent

  WaitForSingleObjectEx

  CreateEventW

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsProcessorFeaturePresent

  InitializeSListHead

  TerminateProcess

  user32

  GetDC

  GetDesktopWindow

  FindWindowA

  GetSystemMetrics

  ShowWindow

  ReleaseDC

  gdi32

  DeleteObject

  GetObjectA

  msvcp140

  ??4?$_Yarn@D@std@@QAEAAV01@PBD@Z

  ?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z

  ?narrow@?$ctype@_W@std@@QBEPB_WPB_W0DPAD@Z

  ??Bid@locale@std@@QAEIXZ

  ?_Getname@_Locinfo@std@@QBEPBDXZ

  ??1_Locinfo@std@@QAE@XZ

  ??0_Locinfo@std@@QAE@HPBD@Z

  ??1_Lockit@std@@QAE@XZ

  ??0_Lockit@std@@QAE@H@Z

  ?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z

  ?_Xruntime_error@std@@YAXPBD@Z

  ?_Syserror_map@std@@YAPBDH@Z

  ?_Xlength_error@std@@YAXPBD@Z

  ?_Winerror_map@std@@YAHH@Z

  ?_Makeloc@_Locimp@locale@std@@CAPAV123@ABV_Locinfo@3@HPAV123@PBV23@@Z

  ?_New_Locimp@_Locimp@locale@std@@CAPAV123@_N@Z

  ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ

  ?_Init@locale@std@@CAPAV_Locimp@12@_N@Z

  ?id@?$ctype@_W@std@@2V0locale@2@A

  ?_Xout_of_range@std@@YAXPBD@Z

  shlwapi

  PathFindExtensionW

  PathFindExtensionA

  gdiplus

  GdiplusShutdown

  GdipGetImageEncoders

  GdiplusStartup

  GdipCreateBitmapFromHBITMAP

  GdipDisposeImage

  GdipGetImageEncodersSize

  GdipCreateBitmapFromScan0

  GdipSaveImageToFile

  wininet

  HttpEndRequestA

  HttpSendRequestExA

  HttpSendRequestA

  InternetWriteFile

  InternetConnectA

  InternetOpenA

  HttpOpenRequestA

  InternetReadFile

  InternetCloseHandle

  vcruntime140

  __current_exception_context

  _CxxThrowException

  __CxxFrameHandler3

  __std_exception_destroy

  _except_handler4_common

  memmove

  memcpy

  __std_exception_copy

  __current_exception

  _except_handler3

  memchr

  __std_terminate

  memset

  memcmp

  api-ms-win-crt-runtime-l1-1-0

  _invalid_parameter_noinfo_noreturn

  terminate

  _configure_narrow_argv

  _initialize_narrow_environment

  _initialize_onexit_table

  _register_onexit_function

  _crt_atexit

  _cexit

  _seh_filter_exe

  _set_app_type

  _invalid_parameter_noinfo

  _get_initial_narrow_environment

  _initterm

  _initterm_e

  _exit

  exit

  __p___argc

  __p___argv

  _c_exit

  _register_thread_local_exe_atexit_callback

  _resetstkoflw

  _controlfp_s

  _errno

  api-ms-win-crt-time-l1-1-0

  asctime

  clock

  _time64

  _localtime64

  api-ms-win-crt-string-l1-1-0

  isxdigit

  strlen

  isspace

  isalnum

  wcslen

  wcsspn

  strcmp

  isdigit

  tolower

  wcscspn

  _wcsicmp

  strcpy

  wmemcpy_s

  api-ms-win-crt-heap-l1-1-0

  free

  malloc

  realloc

  _callnewh

  _recalloc

  calloc

  _set_new_mode

  api-ms-win-crt-utility-l1-1-0

  labs

  rand

  srand

  api-ms-win-crt-stdio-l1-1-0

  __stdio_common_vsprintf

  fopen

  _set_fmode

  __p__commode

  fclose

  feof

  fwrite

  fread

  api-ms-win-crt-multibyte-l1-1-0

  _mbsicmp

  api-ms-win-crt-environment-l1-1-0

  getenv

  api-ms-win-crt-convert-l1-1-0

  atoi

  api-ms-win-crt-locale-l1-1-0

  _configthreadlocale

  ___lc_codepage_func

  api-ms-win-crt-math-l1-1-0

  __setusermatherr

  Sections

  .text

  Size: 288KB - Virtual size: 287KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 44KB - Virtual size: 43KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 1KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 15KB - Virtual size: 14KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ