General

Malware Config

Signatures

Files

• 31934aef20937c6acc491ec64c061f7ddb47ef7c4cec234bf017c5cdaa7e37c5

  .exe windows x86

  ac68961b2b7914b8dab5d414d24747b9

  
  

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  VirtualAlloc

  LoadLibraryA

  GetProcAddress

  GetModuleHandleA

  MultiByteToWideChar

  lstrlenA

  LocalFree

  WriteConsoleW

  GetStdHandle

  FormatMessageW

  GetLastError

  CloseHandle

  WaitForMultipleObjects

  CreateThread

  lstrcmpW

  lstrcatW

  lstrlenW

  lstrcmpiW

  GetConsoleOutputCP

  QueryPerformanceCounter

  GetTickCount

  GetCurrentThreadId

  GetCurrentProcessId

  GetSystemTimeAsFileTime

  TerminateProcess

  GetCurrentProcess

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  FreeLibrary

  LocalAlloc

  GetFileSize

  CreateFileW

  GetPrivateProfileIntW

  GetLocaleInfoW

  SetFileAttributesW

  GetFileAttributesW

  RemoveDirectoryW

  MoveFileExW

  WaitForSingleObject

  CreateProcessW

  FindClose

  FindNextFileW

  FindFirstFileW

  GetDiskFreeSpaceExW

  WriteFile

  SetFilePointer

  GetVolumeInformationW

  GetPrivateProfileStringW

  SizeofResource

  FindResourceW

  lstrcpyW

  GetSystemInfo

  GetModuleFileNameW

  GetVersionExW

  CopyFileW

  CreateDirectoryW

  VerifyVersionInfoW

  VerSetConditionMask

  _lopen

  _lread

  _lwrite

  _lclose

  _llseek

  SetFileAttributesA

  SetFileTime

  LocalFileTimeToFileTime

  DosDateTimeToFileTime

  CreateFileA

  _lcreat

  WideCharToMultiByte

  GetModuleHandleW

  LoadLibraryW

  EnumUILanguagesW

  CreateMutexW

  GetStartupInfoA

  GetCommandLineW

  GlobalFree

  DeleteFileW

  GetWindowsDirectoryW

  LockResource

  LoadResource

  user32

  ReleaseCapture

  LoadCursorW

  LoadIconA

  gdi32

  GetEnhMetaFileBits

  GetStockObject

  comdlg32

  PrintDlgW

  GetSaveFileNameA

  GetSaveFileNameW

  GetOpenFileNameW

  advapi32

  RegQueryValueExA

  shell32

  ExtractIconEx

  ExtractAssociatedIconExW

  Shell_NotifyIcon

  SHChangeNotify

  ExtractIconA

  ShellExecuteEx

  WOWShellExecute

  DoEnvironmentSubstW

  SHGetFileInfo

  ExtractIconExW

  SHAddToRecentDocs

  SHPathPrepareForWriteW

  ShellExecuteExA

  Shell_NotifyIconW

  ole32

  CoInitialize

  CoCreateInstance

  CoUninitialize

  shlwapi

  StrRStrIA

  StrRChrW

  Sections

  .text

  Size: 283KB - Virtual size: 282KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 512B - Virtual size: 341B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data2

  Size: 20KB - Virtual size: 19KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 24KB - Virtual size: 23KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .data3

  Size: 20KB - Virtual size: 19KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 1024B - Virtual size: 628B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ