General

Malware Config

Signatures

Files

• 880638c92fa2c08cb06e39cb26c8f0800a31261d7f9ca87b1b0d56e01d0e5299

  .exe windows x86

  efee9af40fbd27be01ec5d9d6eade1c5

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  lstrlenW

  TerminateProcess

  GetModuleFileNameW

  GetTempPathW

  WaitForSingleObject

  GetVersionExW

  OpenProcess

  CreateToolhelp32Snapshot

  Process32NextW

  OutputDebugStringW

  Process32FirstW

  GetLocalTime

  GetFileTime

  GetModuleHandleW

  GetTempFileNameW

  GetSystemTime

  GetExitCodeProcess

  GetVersion

  MultiByteToWideChar

  CopyFileW

  WriteConsoleW

  SetStdHandle

  GetProcessHeap

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GetCommandLineW

  SystemTimeToTzSpecificLocalTime

  CreateProcessW

  DeleteCriticalSection

  DecodePointer

  RaiseException

  CloseHandle

  FileTimeToSystemTime

  GetLastError

  Sleep

  CreateFileW

  InitializeCriticalSectionAndSpinCount

  GetProcAddress

  InterlockedDecrement

  GetCommandLineA

  GetOEMCP

  IsValidCodePage

  HeapSize

  ReadConsoleW

  EnumSystemLocalesW

  GetUserDefaultLCID

  IsValidLocale

  ReadFile

  HeapReAlloc

  GetConsoleMode

  GetConsoleCP

  FlushFileBuffers

  GetFileType

  HeapAlloc

  HeapFree

  GetACP

  WriteFile

  GetStdHandle

  GetModuleHandleExW

  ExitProcess

  FindClose

  FindFirstFileExW

  FindNextFileW

  GetFileAttributesExW

  SetEndOfFile

  SetFilePointerEx

  WideCharToMultiByte

  FormatMessageW

  GetStringTypeW

  EnterCriticalSection

  LeaveCriticalSection

  SetLastError

  SwitchToThread

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetSystemTimeAsFileTime

  EncodePointer

  GetCPInfo

  LCMapStringW

  GetLocaleInfoW

  IsDebuggerPresent

  LocalFree

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  IsProcessorFeaturePresent

  GetStartupInfoW

  QueryPerformanceCounter

  GetCurrentProcessId

  GetCurrentThreadId

  InitializeSListHead

  RtlUnwind

  FreeLibrary

  LoadLibraryExW

  user32

  wvsprintfW

  EnumChildWindows

  SendMessageW

  EnumWindows

  GetDlgCtrlID

  GetWindowThreadProcessId

  advapi32

  GetUserNameW

  RegCloseKey

  RegQueryInfoKeyW

  RegCreateKeyExW

  RegSetValueExW

  RegOpenKeyExW

  RegCreateKeyW

  RegDeleteValueW

  RegOpenKeyW

  RegEnumValueW

  RegQueryValueExW

  shell32

  SHGetFolderPathW

  ole32

  CoCreateInstance

  CoSetProxyBlanket

  CoUninitialize

  CoInitialize

  oleaut32

  SysAllocStringLen

  GetErrorInfo

  VariantInit

  VariantClear

  SysAllocString

  SysFreeString

  wininet

  HttpSendRequestW

  HttpOpenRequestW

  InternetCloseHandle

  InternetOpenW

  InternetReadFile

  InternetConnectW

  urlmon

  URLDownloadToFileW

  rpcrt4

  UuidCreate

  UuidToStringW

  Sections

  .text

  Size: 215KB - Virtual size: 215KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 93KB - Virtual size: 92KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 4KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 512B - Virtual size: 488B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 12KB - Virtual size: 11KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ