General

Malware Config

Signatures

Files

• a9fa8e8609872cdcea241e3aab726b02b124c82de4c77ad3c3722d7c6b93b9b5

  .dll windows x86

  ea6b77122533345de1de9cb2013c86f0

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  lstrcmpiA

  GlobalMemoryStatus

  GetVersionExA

  GlobalAlloc

  GlobalFree

  FreeConsole

  VirtualAlloc

  ExitProcess

  FreeLibrary

  CreateFileA

  GetFileSize

  lstrcpyA

  GetModuleFileNameA

  LocalAlloc

  LocalFree

  GetCurrentThreadId

  SetProcessShutdownParameters

  CreateToolhelp32Snapshot

  OpenProcess

  Process32Next

  LoadLibraryA

  GetProcAddress

  lstrlenA

  SetLastError

  Sleep

  MoveFileA

  DeleteFileA

  FindFirstFileA

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  GetLastError

  FindNextFileA

  FindClose

  GetLogicalDriveStringsA

  GetDriveTypeA

  CreatePipe

  GetSystemDirectoryA

  CopyFileA

  ReadFile

  CreateProcessA

  CloseHandle

  CreateThread

  WaitForSingleObject

  WriteFile

  GetTickCount

  GetComputerNameA

  user32

  DispatchMessageA

  TranslateMessage

  PeekMessageA

  CloseDesktop

  GetUserObjectInformationA

  OpenInputDesktop

  SetThreadDesktop

  OpenDesktopA

  SetProcessWindowStation

  CreateWindowExA

  GetThreadDesktop

  GetProcessWindowStation

  CloseWindowStation

  PostMessageA

  SetCursorPos

  keybd_event

  mouse_event

  GetCursorInfo

  DrawIconEx

  GetSystemMetrics

  DefWindowProcA

  OpenWindowStationA

  wsprintfA

  RegisterClassExA

  LoadCursorA

  gdi32

  SelectObject

  GetDIBits

  CreateCompatibleDC

  CreateDCA

  DeleteDC

  CreateCompatibleBitmap

  StretchBlt

  DeleteObject

  advapi32

  ControlService

  OpenSCManagerA

  OpenServiceA

  ChangeServiceConfigA

  StartServiceA

  CloseServiceHandle

  QueryServiceStatus

  GetUserNameA

  GetTokenInformation

  LookupAccountSidA

  DuplicateTokenEx

  SetServiceStatus

  RegisterServiceCtrlHandlerA

  RegDeleteKeyA

  LogonUserA

  RegOpenKeyExA

  RegCloseKey

  RegSetValueExA

  RegCreateKeyA

  RegOpenKeyA

  CreateServiceA

  DeleteService

  OpenProcessToken

  FreeSid

  SetFileSecurityA

  SetSecurityDescriptorDacl

  InitializeSecurityDescriptor

  SetEntriesInAclA

  AllocateAndInitializeSid

  CreateProcessAsUserA

  shell32

  ShellExecuteA

  StrStrIA

  SHGetSpecialFolderPathA

  SHGetFileInfoA

  msvcrt

  strstr

  rand

  ??2@YAPAXI@Z

  strncpy

  _adjust_fdiv

  _initterm

  ??1type_info@@UAE@XZ

  atol

  _local_unwind2

  malloc

  free

  _ftol

  ??3@YAXPAX@Z

  sprintf

  strcspn

  atoi

  _except_handler3

  _CxxThrowException

  __CxxFrameHandler

  srand

  ws2_32

  connect

  closesocket

  shutdown

  setsockopt

  WSACleanup

  send

  recv

  gethostbyname

  inet_addr

  htons

  WSAStartup

  socket

  shlwapi

  SHDeleteKeyA

  wtsapi32

  WTSEnumerateSessionsA

  WTSFreeMemory

  WTSQuerySessionInformationA

  userenv

  DestroyEnvironmentBlock

  CreateEnvironmentBlock

  netapi32

  NetUserDel

  NetLocalGroupAddMembers

  NetUserAdd

  Exports

  Exports

  DiUninstallDevice

  ServiceMain

  UpdateDriverForPlugAndPlayDevicesW

  Sections

  .text

  Size: 15KB - Virtual size: 15KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 5KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 512B - Virtual size: 16B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ