General

Malware Config

Signatures

Files

• tmp

  .exe windows x64

  8efdacf31710881e56952cb688838c30

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  kernel32

  LocalAlloc

  LoadLibraryW

  TerminateProcess

  GetCurrentProcess

  SetEvent

  OpenEventW

  CreateFileW

  DeleteFileW

  CreateProcessW

  WriteFile

  lstrlenA

  lstrcpyW

  CopyFileW

  SystemTimeToFileTime

  GetLocalTime

  ReleaseMutex

  RemoveDirectoryW

  CreateDirectoryW

  lstrlenW

  VirtualFreeEx

  SetThreadContext

  GetThreadContext

  VirtualProtectEx

  WriteProcessMemory

  VirtualAllocEx

  lstrcpyA

  GetProcAddress

  GetModuleHandleW

  CreateThread

  lstrcmpA

  VirtualFree

  ResetEvent

  ReadFile

  GetFileSize

  Process32NextW

  Process32FirstW

  CreateToolhelp32Snapshot

  GetCurrentProcessId

  OpenProcess

  GetNativeSystemInfo

  GetModuleHandleA

  VirtualProtect

  VirtualAlloc

  LoadLibraryA

  GetTickCount64

  GetComputerNameExW

  GetModuleFileNameW

  GetTickCount

  FlushFileBuffers

  HeapReAlloc

  LCMapStringW

  WriteConsoleW

  SetStdHandle

  HeapSize

  MultiByteToWideChar

  IsValidCodePage

  GetOEMCP

  GetACP

  GetCPInfo

  LeaveCriticalSection

  EnterCriticalSection

  GetConsoleMode

  GetConsoleCP

  SetFilePointer

  GetSystemTimeAsFileTime

  QueryPerformanceCounter

  HeapCreate

  GetVersion

  HeapSetInformation

  DeleteCriticalSection

  GetFileType

  InitializeCriticalSectionAndSpinCount

  SetHandleCount

  GetEnvironmentStringsW

  WideCharToMultiByte

  FreeEnvironmentStringsW

  GetModuleFileNameA

  GetStdHandle

  HeapAlloc

  GetStringTypeW

  HeapFree

  FlsAlloc

  LocalFree

  ExitProcess

  OpenMutexW

  CloseHandle

  CreateMutexW

  GetLastError

  CreateEventW

  GetTempPathW

  lstrcmpiW

  GetCommandLineW

  GetWindowsDirectoryW

  GetSystemDirectoryW

  WaitForSingleObject

  ResumeThread

  Sleep

  GetUserGeoID

  WaitForMultipleObjects

  GetCurrentThreadId

  SetLastError

  FlsFree

  FlsSetValue

  FlsGetValue

  EncodePointer

  RtlCaptureContext

  RtlVirtualUnwind

  IsDebuggerPresent

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  DecodePointer

  GetStartupInfoW

  GetCommandLineA

  RtlPcToFileHeader

  RaiseException

  RtlLookupFunctionEntry

  RtlUnwindEx

  ws2_32

  WSAStartup

  closesocket

  shutdown

  setsockopt

  WSACleanup

  recv

  send

  gethostname

  socket

  WSACreateEvent

  inet_addr

  gethostbyname

  htons

  connect

  WSACloseEvent

  WSAEnumNetworkEvents

  WSAGetLastError

  WSAEventSelect

  WSAWaitForMultipleEvents

  shlwapi

  StrStrIW

  StrCmpNIA

  wnsprintfW

  user32

  MessageBoxW

  wsprintfW

  DestroyWindow

  UnregisterClassW

  wsprintfA

  LoadImageW

  GetCursorPos

  SetForegroundWindow

  CreatePopupMenu

  AppendMenuW

  PostMessageW

  DestroyMenu

  DefWindowProcW

  RegisterClassW

  CreateWindowExW

  GetMessageW

  TranslateMessage

  DispatchMessageW

  TrackPopupMenu

  advapi32

  ConvertStringSecurityDescriptorToSecurityDescriptorW

  GetSecurityDescriptorSacl

  SetNamedSecurityInfoW

  CheckTokenMembership

  FreeSid

  RegSetValueExW

  AllocateAndInitializeSid

  SetEntriesInAclW

  InitializeSecurityDescriptor

  SetSecurityDescriptorDacl

  RegOpenKeyW

  RegDeleteValueW

  RegCloseKey

  RegDeleteKeyExW

  RegDeleteKeyW

  GetUserNameW

  ole32

  CoCreateInstance

  CoInitialize

  CoCreateGuid

  StringFromGUID2

  CoTaskMemFree

  CoInitializeEx

  CoUninitialize

  shell32

  Shell_NotifyIconW

  SHGetKnownFolderPath

  ord680

  SHFileOperationW

  ShellExecuteExW

  ShellExecuteW

  CommandLineToArgvW

  Sections

  .text

  Size: 145KB - Virtual size: 144KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 26KB - Virtual size: 26KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 86KB - Virtual size: 96KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 5KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .tls

  Size: 512B - Virtual size: 2B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 139KB - Virtual size: 138KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ