General

Malware Config

Signatures

Files

• b598cb6ba7c99dcf6040f7073fe313e648db9dd2f6e71cba89790cc45c8c9026

  .zip
• ef62f2b7c05210471d56b8bee8072d2e

  .dll windows x86

  20ea8a16f6d13c8cd72d49cecf55dd95

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  GlobalAlloc

  lstrcmpiA

  GlobalMemoryStatus

  GlobalFree

  GetComputerNameA

  VirtualAlloc

  ExitProcess

  FreeConsole

  CreateFileA

  GetFileSize

  GetModuleFileNameA

  lstrcpyA

  LocalAlloc

  LocalFree

  GetCurrentThreadId

  SetProcessShutdownParameters

  CreateToolhelp32Snapshot

  OpenProcess

  Process32Next

  LoadLibraryA

  GetProcAddress

  lstrlenA

  SetLastError

  Sleep

  MoveFileA

  DeleteFileA

  FindFirstFileA

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  GetLastError

  FindNextFileA

  FindClose

  GetLogicalDriveStringsA

  GetDriveTypeA

  CreatePipe

  GetSystemDirectoryA

  CopyFileA

  CreateProcessA

  ReadFile

  CloseHandle

  CreateThread

  WaitForSingleObject

  WriteFile

  GetTickCount

  GetVersionExA

  user32

  DefWindowProcA

  CreateWindowExA

  DispatchMessageA

  TranslateMessage

  PeekMessageA

  CloseDesktop

  GetUserObjectInformationA

  OpenInputDesktop

  SetThreadDesktop

  OpenDesktopA

  SetProcessWindowStation

  OpenWindowStationA

  GetThreadDesktop

  GetProcessWindowStation

  CloseWindowStation

  PostMessageA

  SetCursorPos

  keybd_event

  mouse_event

  GetCursorInfo

  DrawIconEx

  GetSystemMetrics

  wsprintfA

  RegisterClassExA

  LoadCursorA

  gdi32

  SelectObject

  GetDIBits

  CreateCompatibleDC

  CreateDCA

  DeleteDC

  CreateCompatibleBitmap

  StretchBlt

  DeleteObject

  advapi32

  OpenServiceA

  ChangeServiceConfigA

  StartServiceA

  CloseServiceHandle

  QueryServiceStatus

  GetUserNameA

  GetTokenInformation

  LookupAccountSidA

  DuplicateTokenEx

  SetServiceStatus

  RegisterServiceCtrlHandlerA

  LogonUserA

  CreateProcessAsUserA

  OpenSCManagerA

  ControlService

  RegOpenKeyExA

  RegCloseKey

  RegSetValueExA

  RegCreateKeyA

  RegOpenKeyA

  CreateServiceA

  OpenProcessToken

  FreeSid

  SetFileSecurityA

  SetSecurityDescriptorDacl

  InitializeSecurityDescriptor

  SetEntriesInAclA

  AllocateAndInitializeSid

  shell32

  ShellExecuteA

  StrStrIA

  SHGetSpecialFolderPathA

  SHGetFileInfoA

  msvcrt

  strcspn

  rand

  ??2@YAPAXI@Z

  strncpy

  _adjust_fdiv

  _initterm

  ??1type_info@@UAE@XZ

  atol

  _local_unwind2

  malloc

  free

  _ftol

  ??3@YAXPAX@Z

  strstr

  sprintf

  atoi

  _except_handler3

  _CxxThrowException

  __CxxFrameHandler

  srand

  ws2_32

  htons

  setsockopt

  shutdown

  socket

  WSACleanup

  recv

  send

  gethostbyname

  inet_addr

  connect

  WSAStartup

  closesocket

  wtsapi32

  WTSEnumerateSessionsA

  WTSFreeMemory

  WTSQuerySessionInformationA

  userenv

  DestroyEnvironmentBlock

  CreateEnvironmentBlock

  netapi32

  NetUserDel

  NetLocalGroupAddMembers

  NetUserAdd

  Exports

  Exports

  DiUninstallDevice

  ServiceMain

  UpdateDriverForPlugAndPlayDevicesW

  Sections

  .text

  Size: 15KB - Virtual size: 14KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 1KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 512B - Virtual size: 16B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ