General

Malware Config

Signatures

Files

• e6967a3e28cc938341c5ca21332c84ec700e33ae632cd0c08dc6bbf16b212f28

  .exe windows x86

  686c1f8b8d12c95beafa94d3bf0f0a4d

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  LockResource

  GetModuleFileNameA

  GetModuleHandleA

  CloseHandle

  GetCurrentProcessId

  CreateFileA

  WriteConsoleW

  GetConsoleOutputCP

  WriteConsoleA

  SetStdHandle

  HeapSize

  ReadFile

  GetLocaleInfoA

  GetStringTypeW

  GetStringTypeA

  LCMapStringW

  LCMapStringA

  MultiByteToWideChar

  InitializeCriticalSectionAndSpinCount

  GetConsoleMode

  GetConsoleCP

  SetFilePointer

  GetSystemTimeAsFileTime

  GetTickCount

  QueryPerformanceCounter

  GetEnvironmentStringsW

  CreateFileMappingA

  LoadLibraryA

  GlobalFree

  GetLastError

  FindFirstFileA

  GetStdHandle

  FlushFileBuffers

  DisconnectNamedPipe

  GlobalUnlock

  CreateFileW

  GetModuleFileNameW

  HeapCreate

  SizeofResource

  GlobalAlloc

  FindResourceExA

  EnumResourceTypesA

  WriteFile

  GlobalLock

  WideCharToMultiByte

  FreeEnvironmentStringsW

  GetEnvironmentStrings

  FreeEnvironmentStringsA

  GetCurrentThreadId

  SetLastError

  TlsFree

  TlsSetValue

  TlsAlloc

  TlsGetValue

  IsValidCodePage

  GetOEMCP

  GetACP

  InterlockedIncrement

  GetCPInfo

  GetFileType

  SetHandleCount

  GetProcAddress

  Sleep

  GetModuleHandleW

  HeapReAlloc

  VirtualAlloc

  VirtualFree

  DeleteCriticalSection

  HeapFree

  RtlUnwind

  RaiseException

  GetStartupInfoA

  GetCommandLineA

  IsDebuggerPresent

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  GetCurrentProcess

  TerminateProcess

  InterlockedDecrement

  UpdateResourceA

  HeapAlloc

  LeaveCriticalSection

  EnterCriticalSection

  LoadResource

  VirtualQuery

  FreeResource

  ExitProcess

  user32

  LoadIconA

  AttachThreadInput

  SetForegroundWindow

  MenuItemFromPoint

  FindWindowW

  GetClientRect

  DrawTextA

  GetMenuItemID

  RegisterWindowMessageW

  SendMessageA

  EnumDisplayDevicesA

  EndDeferWindowPos

  BeginPaint

  wsprintfW

  PostQuitMessage

  ScreenToClient

  EndPaint

  GetMenu

  OffsetRect

  GetWindowLongA

  DefWindowProcA

  GetCursorPos

  EnumChildWindows

  GetSysColorBrush

  GetWindowTextA

  LoadCursorA

  FindWindowA

  SendMessageW

  LoadImageA

  MessageBoxA

  UnhookWindowsHookEx

  gdi32

  MoveToEx

  BitBlt

  LineTo

  CreateEnhMetaFileA

  SetTextColor

  DeleteDC

  CreateDCA

  SetPixel

  CreatePalette

  SelectObject

  CreateCompatibleDC

  Rectangle

  SetStretchBltMode

  GetObjectA

  GetStockObject

  CreateSolidBrush

  winspool.drv

  GetPrinterDataA

  EndPagePrinter

  StartDocPrinterA

  StartPagePrinter

  ClosePrinter

  EnumPrintersA

  OpenPrinterA

  EndDocPrinter

  WritePrinter

  shell32

  Shell_NotifyIconA

  ole32

  CreateBindCtx

  MkParseDisplayName

  CreateStreamOnHGlobal

  GetHGlobalFromStream

  CoGetMalloc

  CreateItemMoniker

  CoMarshalInterface

  CoUnmarshalInterface

  CoInitialize

  CoCreateInstance

  GetRunningObjectTable

  oleaut32

  OleCreatePictureIndirect

  ws2_32

  ioctlsocket

  inet_addr

  WSASocketA

  bind

  WSASendTo

  closesocket

  WSAHtons

  WSAHtonl

  winmm

  timeBeginPeriod

  PlaySoundW

  crypt32

  CryptImportPKCS8

  CryptHashToBeSigned

  shlwapi

  UrlGetPartW

  wnsprintfA

  gdiplus

  GdipDeleteBrush

  GdipFree

  GdipSetPathGradientCenterColor

  GdiplusStartup

  GdipFillEllipseI

  GdipCreatePath

  GdipCreateFromHDC

  GdipDeletePath

  GdipAlloc

  GdipGetPathGradientPointCount

  GdipCreatePathGradientFromPath

  GdipAddPathEllipseI

  GdipDeleteGraphics

  GdipSetPathGradientSurroundColorsWithCount

  GdipCloneBrush

  traffic

  TcCloseInterface

  dciman32

  DCISetSrcDestClip

  GetWindowRegionData

  GetDCRegionData

  mscms

  OpenColorProfileA

  Sections

  .text

  Size: 239KB - Virtual size: 239KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 26KB - Virtual size: 26KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 6KB - Virtual size: 13KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 78KB - Virtual size: 78KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 10KB - Virtual size: 9KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ