General

Malware Config

Signatures

Files

• e0d8ee610cffcc4a30e3d6a3c443ce3e2445fac944a8ecad22deb253abf76ccb

  .exe windows x86

  19fc14d2cc4cfe4ab307b6a88f8756ec

  
  

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  GetVersionExA

  LCMapStringA

  FreeLibrary

  SetEndOfFile

  RemoveDirectoryA

  DeleteFileA

  FindClose

  FindFirstFileA

  FindNextFileA

  FormatMessageA

  GlobalAlloc

  GlobalLock

  GlobalUnlock

  GlobalFree

  GetUserDefaultLCID

  Sleep

  WritePrivateProfileStringA

  GetPrivateProfileStringA

  GetCurrentDirectoryA

  SetFilePointer

  WriteFile

  SetCurrentDirectoryA

  GetCommandLineA

  GetFileSize

  ReadFile

  GetModuleFileNameA

  GetTickCount

  IsBadReadPtr

  HeapFree

  HeapReAlloc

  HeapAlloc

  ExitProcess

  GetProcessHeap

  VirtualProtect

  lstrlenA

  ReadProcessMemory

  LocalFree

  RtlFillMemory

  LocalAlloc

  Module32Next

  GetProcessTimes

  GetCurrentProcess

  CreateThread

  CreateRemoteThread

  OpenProcess

  QueryDosDeviceA

  GetLogicalDriveStringsA

  VirtualFree

  VirtualAlloc

  Module32First

  Process32Next

  Process32First

  CreateToolhelp32Snapshot

  CloseHandle

  DeviceIoControl

  CreateFileA

  GetShortPathNameA

  MultiByteToWideChar

  LoadLibraryA

  lstrcpynA

  GetTimeFormatA

  GetDateFormatA

  GetLocalTime

  SetErrorMode

  WideCharToMultiByte

  GetProcAddress

  GetModuleHandleA

  GetSystemDirectoryA

  GetWindowsDirectoryA

  RtlMoveMemory

  lstrcpyn

  LocalSize

  InterlockedExchange

  GetProcessVersion

  GlobalGetAtomNameA

  InitializeCriticalSection

  DeleteCriticalSection

  EnterCriticalSection

  LeaveCriticalSection

  TerminateThread

  GetLastError

  TerminateProcess

  GetTempPathA

  lstrcpyA

  SetLastError

  lstrcatA

  GetVersion

  lstrlenW

  MulDiv

  GetStartupInfoA

  InterlockedDecrement

  InterlockedIncrement

  RtlUnwind

  RaiseException

  UnhandledExceptionFilter

  FreeEnvironmentStringsA

  FreeEnvironmentStringsW

  GetEnvironmentStrings

  GetEnvironmentStringsW

  SetHandleCount

  GetStdHandle

  GetFileType

  GetCurrentThreadId

  TlsSetValue

  TlsAlloc

  TlsGetValue

  GetEnvironmentVariableA

  HeapDestroy

  HeapCreate

  IsBadWritePtr

  LCMapStringW

  HeapSize

  GetCPInfo

  GetACP

  GetOEMCP

  SetUnhandledExceptionFilter

  GetStringTypeA

  GetStringTypeW

  IsBadCodePtr

  SetStdHandle

  FlushFileBuffers

  lstrcmpiA

  lstrcmpA

  GlobalDeleteAtom

  GlobalHandle

  GlobalReAlloc

  LocalReAlloc

  GlobalFlags

  GlobalFindAtomA

  GlobalAddAtomA

  user32

  TabbedTextOutA

  DrawTextA

  GrayStringA

  UnhookWindowsHookEx

  GetDlgCtrlID

  SetWindowTextA

  GetMenuItemCount

  SetFocus

  GetWindowPlacement

  IsIconic

  GetMessagePos

  GetMessageTime

  DefWindowProcA

  RemovePropA

  GetPropA

  SetPropA

  GetClassLongA

  GetMenuItemID

  GetSubMenu

  GetMenu

  RegisterClassA

  GetClassInfoA

  WinHelpA

  GetCapture

  GetTopWindow

  CopyRect

  GetClientRect

  AdjustWindowRectEx

  MapWindowPoints

  LoadIconA

  LoadCursorA

  GetSysColorBrush

  LoadStringA

  DestroyMenu

  DestroyWindow

  SetWindowRgn

  wsprintfA

  GetSystemMetrics

  EqualRect

  IntersectRect

  CreateWindowExA

  GetWindowTextLengthA

  GetClassInfoExA

  MoveWindow

  BeginPaint

  EndPaint

  InvalidateRect

  TrackMouseEvent

  FillRect

  CallWindowProcA

  GetWindowLongA

  SetTimer

  SetWindowLongA

  ClientToScreen

  GetMenuCheckMarkDimensions

  EnableWindow

  SendMessageTimeoutA

  wvsprintfA

  RegisterWindowMessageA

  PostMessageA

  GetMenuState

  ModifyMenuA

  SetMenuItemBitmaps

  CheckMenuItem

  EnableMenuItem

  GetFocus

  GetNextDlgTabItem

  GetKeyState

  CallNextHookEx

  SetWindowsHookExA

  GetLastActivePopup

  PostQuitMessage

  ScreenToClient

  LoadBitmapA

  GetSysColor

  SetForegroundWindow

  GetForegroundWindow

  IsWindowEnabled

  GetParent

  PtInRect

  GetDlgItem

  SystemParametersInfoA

  GetDC

  ReleaseDC

  SendMessageA

  EnumDisplaySettingsA

  ChangeDisplaySettingsA

  GetWindowRect

  ReleaseCapture

  SetCapture

  RegisterHotKey

  UnregisterHotKey

  GetWindowThreadProcessId

  GetClassNameA

  MessageBoxA

  SetWindowPos

  MessageBeep

  GetDesktopWindow

  GetWindow

  IsWindowVisible

  GetWindowTextA

  PeekMessageA

  GetMessageA

  TranslateMessage

  DispatchMessageA

  GetClipboardData

  OpenClipboard

  EmptyClipboard

  SetClipboardData

  CloseClipboard

  GetCursorPos

  ws2_32

  select

  getpeername

  ntohs

  connect

  htonl

  gethostbyname

  inet_addr

  WSACleanup

  WSAStartup

  listen

  closesocket

  bind

  htons

  socket

  accept

  __WSAFDIsSet

  inet_ntoa

  recv

  recvfrom

  send

  sendto

  gethostname

  getsockname

  iphlpapi

  GetAdaptersInfo

  shlwapi

  PathFileExistsA

  version

  GetFileVersionInfoA

  VerQueryValueA

  GetFileVersionInfoSizeA

  gdi32

  SetMapMode

  SetTextColor

  GetStockObject

  CreateFontA

  CombineRgn

  GetPixel

  CreateRectRgn

  CreateDIBitmap

  TextOutA

  SetBkColor

  ScaleViewportExtEx

  CreatePatternBrush

  StretchBlt

  CreateSolidBrush

  DeleteDC

  BitBlt

  SelectObject

  GetClipBox

  ScaleWindowExtEx

  SetWindowExtEx

  GetObjectA

  RestoreDC

  SaveDC

  CreateBitmap

  TranslateCharsetInfo

  SetViewportExtEx

  OffsetViewportOrgEx

  DeleteObject

  GetDeviceCaps

  SetViewportOrgEx

  Escape

  ExtTextOutA

  RectVisible

  PtVisible

  advapi32

  RegCloseKey

  RegQueryValueExA

  RegOpenKeyA

  shell32

  ShellExecuteA

  SHGetSpecialFolderPathA

  SHCreateDirectoryExA

  DragQueryFileA

  DragAcceptFiles

  DragFinish

  ole32

  CLSIDFromString

  OleRun

  CoUninitialize

  CoInitialize

  CoCreateInstance

  CLSIDFromProgID

  oleaut32

  VarR8FromCy

  VarR8FromBool

  LoadTypeLi

  LHashValOfNameSys

  VariantTimeToSystemTime

  SafeArrayGetElemsize

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayGetUBound

  SafeArrayGetLBound

  SafeArrayGetDim

  VariantClear

  SysAllocString

  VariantCopy

  SafeArrayDestroy

  SafeArrayAllocData

  SafeArrayAllocDescriptor

  VariantInit

  VariantChangeType

  RegisterTypeLi

  SafeArrayCreate

  SysFreeString

  psapi

  GetProcessMemoryInfo

  GetProcessImageFileNameA

  msimg32

  TransparentBlt

  atl

  ord47

  ord42

  icmp

  IcmpSendEcho

  IcmpCreateFile

  IcmpCloseHandle

  winspool.drv

  DocumentPropertiesA

  OpenPrinterA

  ClosePrinter

  comctl32

  ImageList_Add

  ImageList_Create

  ImageList_Destroy

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_DragMove

  ImageList_DragShowNolock

  ImageList_EndDrag

  ord17

  ImageList_BeginDrag

  Sections

  .text

  Size: 808KB - Virtual size: 807KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 28KB - Virtual size: 24KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 80KB - Virtual size: 233KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 36KB - Virtual size: 34KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE