General

Malware Config

Signatures

Files

• 2b007be0db86373bb33b396b53556fc90b8d972f1dc7e43fe10857bcfe591930

  .iso
• INVOICE.EXE

  .exe windows x86

  300d3b6e0225afa84f16cb9efc1a80da

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  msvcr90

  _controlfp_s

  _invoke_watson

  _except_handler4_common

  _decode_pointer

  _onexit

  _lock

  __dllonexit

  _unlock

  ?_type_info_dtor_internal_method@type_info@@QAEXXZ

  ?terminate@@YAXXZ

  __set_app_type

  ?what@exception@std@@UBEPBDXZ

  _encode_pointer

  __p__fmode

  __p__commode

  _adjust_fdiv

  __setusermatherr

  _configthreadlocale

  _initterm_e

  _initterm

  _wcmdln

  exit

  _XcptFilter

  _exit

  _cexit

  __wgetmainargs

  _amsg_exit

  ??3@YAXPAX@Z

  _crt_debugger_hook

  ceil

  ??1exception@std@@UAE@XZ

  ??_V@YAXPAX@Z

  ??0exception@std@@QAE@ABV01@@Z

  fclose

  fwrite

  fread

  scanf

  vsprintf

  sprintf

  __FrameUnwindFilter

  abort

  ??2@YAPAXI@Z

  _encoded_null

  kernel32

  GetCurrentProcess

  Sleep

  InterlockedCompareExchange

  GetStartupInfoW

  SetUnhandledExceptionFilter

  QueryPerformanceCounter

  GetTickCount

  GetCurrentThreadId

  GetFileSizeEx

  GetProcessId

  VirtualAlloc

  GetModuleHandleW

  TerminateThread

  ExitThread

  IsDebuggerPresent

  UnhandledExceptionFilter

  TerminateProcess

  GetSystemTimeAsFileTime

  GetCurrentProcessId

  InterlockedExchange

  msvcp90

  ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z

  ??0?$allocator@_W@std@@QAE@ABV01@@Z

  ?_Decref@facet@locale@std@@QAEPAV123@XZ

  ?_Lockit_dtor@_Lockit@std@@SAXH@Z

  ?_Lockit_ctor@_Lockit@std@@SAXH@Z

  ?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ

  ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

  msvcm90

  ?RegisterModuleUninitializer@<CrtImplementationDetails>@@YAXP$AAVEventHandler@System@@@Z

  ?DoDllLanguageSupportValidation@<CrtImplementationDetails>@@YAXXZ

  ?ThrowModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVString@System@@P$AAVException@3@@Z

  ?ThrowModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVString@System@@@Z

  ?ThrowNestedModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVException@System@@0@Z

  ?DoCallBackInDefaultDomain@<CrtImplementationDetails>@@YAXP6GJPAX@Z0@Z

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 57KB - Virtual size: 56KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 171KB - Virtual size: 230KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .ricibec

  Size: 512B - Virtual size: 10B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 27KB - Virtual size: 27KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ