General

Malware Config

Signatures

Files

• f158a1e36c936286a10c2a463439b7d8b16271ca16838cc92ff2219541ecc8e8

  .exe windows x86

  7c985ab50cdac809071abb2d062a5bc9

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  CreateFileW

  HeapSize

  LoadLibraryW

  OutputDebugStringW

  LCMapStringEx

  CompareStringEx

  SetEnvironmentVariableA

  GetStringTypeW

  GetFileAttributesExW

  CreateProcessA

  GetExitCodeProcess

  WaitForSingleObject

  WriteConsoleW

  SetFilePointerEx

  SetStdHandle

  HeapReAlloc

  HeapAlloc

  SetEndOfFile

  ReadConsoleInputA

  VirtualProtect

  GetStdHandle

  SetConsoleCursorPosition

  Sleep

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GetTickCount64

  QueryPerformanceCounter

  GetModuleFileNameA

  GetProcessHeap

  LoadLibraryExW

  GetModuleFileNameW

  CloseHandle

  GetTimeZoneInformation

  GetCurrentThreadId

  SetLastError

  GetCPInfo

  GetOEMCP

  GetACP

  IsValidCodePage

  InterlockedIncrement

  ReadConsoleW

  ReadFile

  DeleteFileW

  GetConsoleMode

  GetConsoleCP

  WideCharToMultiByte

  WriteFile

  FlushFileBuffers

  GetLastError

  AreFileApisANSI

  MultiByteToWideChar

  EnterCriticalSection

  LeaveCriticalSection

  GetSystemTimeAsFileTime

  EncodePointer

  DecodePointer

  InterlockedDecrement

  ExitProcess

  GetModuleHandleExW

  GetProcAddress

  GetCommandLineA

  IsDebuggerPresent

  IsProcessorFeaturePresent

  GetFileType

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  InitOnceExecuteOnce

  GetStartupInfoW

  MoveFileExW

  HeapFree

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  FlsAlloc

  FlsGetValue

  FlsSetValue

  FlsFree

  GetCurrentProcess

  TerminateProcess

  GetModuleHandleW

  SetFilePointer

  RtlUnwind

  SetConsoleMode

  ole32

  OleDoAutoConvert

  HBRUSH_UserFree

  HACCEL_UserFree

  HWND_UserFree

  StgCreateDocfile

  rtutils

  TraceDumpExW

  TracePutsExW

  TraceGetConsoleW

  RouterLogEventDataW

  TraceVprintfExW

  RouterAssert

  TraceDumpExA

  TraceVprintfExA

  TraceRegisterExW

  urlmon

  HlinkGoBack

  SetSoftwareUpdateAdvertisementState

  CoInternetQueryInfo

  CoInternetParseUrl

  RegisterFormatEnumerator

  CopyBindInfo

  RegisterMediaTypeClass

  URLOpenStreamA

  ReleaseBindInfo

  HlinkNavigateMoniker

  imm32

  ImmLockIMC

  ImmSimulateHotKey

  ImmGetDefaultIMEWnd

  ImmUnlockIMCC

  ImmDestroyContext

  ImmGetGuideLineW

  ImmEnumRegisterWordA

  ImmGenerateMessage

  ImmDisableIME

  shell32

  SHGetDataFromIDListW

  DragAcceptFiles

  SHBrowseForFolderA

  DragQueryFileW

  wsock32

  getservbyname

  WSAIsBlocking

  ord1118

  ord1113

  ord1112

  setsockopt

  recv

  ord1107

  getpeername

  setupapi

  SetupGetInfInformationW

  SetupDiCreateDevRegKeyW

  SetupGetLineTextW

  SetupDeleteErrorW

  SetupQuerySourceListW

  SetupAdjustDiskSpaceListW

  msacm32

  XRegThunkEntry

  acmFormatEnumW

  acmFilterDetailsW

  acmDriverMessage

  acmFormatTagDetailsW

  acmFilterTagEnumW

  Sections

  .text

  Size: 94KB - Virtual size: 94KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 18KB - Virtual size: 18KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 25KB - Virtual size: 37KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 512B - Virtual size: 16B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 12KB - Virtual size: 11KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ