General

Malware Config

Signatures

Files

• 27817e88053ac9d3210b40b1f335be92a6875192fbc1324490808cf57c881a2e

  .exe windows x86

  0af8419be362159398343d7b31721726

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_GUARD_CF

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  msvcrt

  __setusermatherr

  __p__fmode

  exit

  iswxdigit

  time

  srand

  _wtol

  fflush

  wcsstr

  iswalpha

  wcstoul

  _errno

  printf

  rand

  fprintf

  _initterm

  wcsncmp

  _pipe

  _cexit

  wcsrchr

  realloc

  towlower

  _ultoa

  _exit

  setlocale

  _wcsupr

  iswdigit

  _lock

  _vsnwprintf

  _unlock

  _wcsicmp

  iswspace

  wcschr

  memmove

  __set_app_type

  fgets

  _pclose

  __dllonexit

  _onexit

  __getmainargs

  _open_osfhandle

  ferror

  _close

  feof

  _wpopen

  _except_handler4_common

  ?terminate@@YAXXZ

  _wcsnicmp

  wcstol

  _controlfp

  _get_osfhandle

  _getch

  memcmp

  _dup

  towupper

  _setmode

  _dup2

  qsort

  wcsspn

  _amsg_exit

  _tell

  __CxxFrameHandler3

  _setjmp3

  ??_V@YAXPAX@Z

  longjmp

  ??3@YAXPAX@Z

  _local_unwind4

  _wcslwr

  free

  calloc

  _XcptFilter

  __p__commode

  ??1type_info@@UAE@XZ

  memcpy

  memcpy_s

  swscanf

  __iob_func

  malloc

  _callnewh

  _purecall

  ??0exception@@QAE@ABQBD@Z

  ??0exception@@QAE@ABQBDH@Z

  ??0exception@@QAE@ABV0@@Z

  ??1exception@@UAE@XZ

  ?what@exception@@UBEPBDXZ

  _CxxThrowException

  memset

  ntdll

  NtOpenProcessToken

  NtQueryInformationToken

  NtClose

  NtOpenThreadToken

  NtFsControlFile

  RtlDosPathNameToNtPathName_U

  RtlFindLeastSignificantBit

  RtlFreeHeap

  RtlReleaseRelativeName

  NtOpenFile

  RtlDosPathNameToRelativeNtPathName_U_WithStatus

  NtSetInformationFile

  NtQueryVolumeInformationFile

  NtSetInformationProcess

  NtQueryInformationProcess

  RtlNtStatusToDosError

  NtCancelSynchronousIoFile

  RtlCreateUnicodeStringFromAsciiz

  RtlFreeUnicodeString

  api-ms-win-core-kernel32-legacy-l1-1-0

  CopyFileW

  api-ms-win-core-libraryloader-l1-2-0

  GetProcAddress

  GetModuleFileNameA

  LoadLibraryExW

  GetModuleFileNameW

  GetModuleHandleExW

  GetModuleHandleW

  api-ms-win-core-synch-l1-1-0

  AcquireSRWLockShared

  TryAcquireSRWLockExclusive

  ReleaseMutex

  WaitForSingleObjectEx

  InitializeCriticalSection

  WaitForSingleObject

  ReleaseSemaphore

  OpenSemaphoreW

  LeaveCriticalSection

  CreateMutexExW

  CreateSemaphoreExW

  ReleaseSRWLockShared

  ReleaseSRWLockExclusive

  EnterCriticalSection

  api-ms-win-core-heap-l1-1-0

  GetProcessHeap

  HeapAlloc

  HeapSize

  HeapSetInformation

  HeapReAlloc

  HeapFree

  api-ms-win-core-errorhandling-l1-1-0

  SetLastError

  UnhandledExceptionFilter

  GetLastError

  SetErrorMode

  SetUnhandledExceptionFilter

  api-ms-win-core-processthreads-l1-1-0

  DeleteProcThreadAttributeList

  UpdateProcThreadAttribute

  CreateProcessAsUserW

  GetStartupInfoW

  CreateProcessW

  InitializeProcThreadAttributeList

  GetCurrentProcessId

  GetCurrentThreadId

  OpenThread

  TerminateProcess

  GetExitCodeProcess

  GetCurrentProcess

  ResumeThread

  api-ms-win-core-localization-l1-2-0

  FormatMessageW

  SetThreadLocale

  GetACP

  GetCPInfo

  GetLocaleInfoW

  GetUserDefaultLCID

  GetThreadLocale

  api-ms-win-core-debug-l1-1-0

  OutputDebugStringW

  IsDebuggerPresent

  DebugBreak

  api-ms-win-core-handle-l1-1-0

  DuplicateHandle

  CloseHandle

  api-ms-win-core-memory-l1-1-0

  VirtualAlloc

  VirtualFree

  VirtualQuery

  ReadProcessMemory

  api-ms-win-core-console-l1-1-0

  ReadConsoleW

  SetConsoleCtrlHandler

  SetConsoleMode

  WriteConsoleW

  GetConsoleMode

  GetConsoleOutputCP

  api-ms-win-core-file-l1-1-0

  CreateFileW

  FlushFileBuffers

  GetFileAttributesExW

  GetDriveTypeW

  FindClose

  FindNextFileW

  CreateDirectoryW

  GetVolumeInformationW

  SetFileAttributesW

  SetEndOfFile

  SetFilePointerEx

  WriteFile

  DeleteFileW

  SetFileTime

  GetVolumePathNameW

  SetFilePointer

  ReadFile

  GetFileAttributesW

  GetFileType

  RemoveDirectoryW

  FindFirstFileExW

  CompareFileTime

  GetFullPathNameW

  GetDiskFreeSpaceExW

  FileTimeToLocalFileTime

  GetFileSize

  FindFirstFileW

  api-ms-win-core-string-l1-1-0

  WideCharToMultiByte

  MultiByteToWideChar

  api-ms-win-core-processenvironment-l1-1-0

  GetCommandLineW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableW

  ExpandEnvironmentStringsW

  SetCurrentDirectoryW

  GetCurrentDirectoryW

  SearchPathW

  GetEnvironmentVariableW

  GetStdHandle

  SetEnvironmentStringsW

  api-ms-win-core-console-l2-1-0

  SetConsoleCursorPosition

  GetConsoleScreenBufferInfo

  ScrollConsoleScreenBufferW

  FillConsoleOutputAttribute

  FillConsoleOutputCharacterW

  FlushConsoleInputBuffer

  SetConsoleTextAttribute

  api-ms-win-security-base-l1-1-0

  RevertToSelf

  GetFileSecurityW

  GetSecurityDescriptorOwner

  api-ms-win-core-sysinfo-l1-1-0

  GetVersion

  GetTickCount

  GetLocalTime

  GetSystemTime

  GetSystemTimeAsFileTime

  SetLocalTime

  GetWindowsDirectoryW

  api-ms-win-core-timezone-l1-1-0

  FileTimeToSystemTime

  SystemTimeToFileTime

  api-ms-win-core-datetime-l1-1-0

  GetDateFormatW

  GetTimeFormatW

  api-ms-win-core-systemtopology-l1-1-0

  GetNumaHighestNodeNumber

  GetNumaNodeProcessorMaskEx

  api-ms-win-core-console-l2-2-0

  SetConsoleTitleW

  GetConsoleTitleW

  api-ms-win-core-processenvironment-l1-2-0

  NeedCurrentDirectoryForExePathW

  api-ms-win-core-registry-l1-1-0

  RegDeleteValueW

  RegQueryValueExW

  RegCloseKey

  RegOpenKeyExW

  RegEnumKeyExW

  RegCreateKeyExW

  RegDeleteKeyExW

  RegSetValueExW

  api-ms-win-core-file-l2-1-0

  MoveFileExW

  CreateSymbolicLinkW

  CreateHardLinkW

  MoveFileWithProgressW

  GetFileInformationByHandleEx

  api-ms-win-core-heap-l2-1-0

  GlobalAlloc

  GlobalFree

  LocalFree

  api-ms-win-core-io-l1-1-0

  DeviceIoControl

  api-ms-win-core-processtopology-l1-1-0

  GetThreadGroupAffinity

  api-ms-win-core-synch-l1-2-0

  Sleep

  api-ms-win-core-profile-l1-1-0

  QueryPerformanceCounter

  api-ms-win-core-string-obsolete-l1-1-0

  lstrcmpiW

  lstrcmpW

  api-ms-win-core-processtopology-obsolete-l1-1-0

  SetProcessAffinityMask

  api-ms-win-core-apiquery-l1-1-0

  ApiSetQueryApiSetPresence

  api-ms-win-core-delayload-l1-1-1

  ResolveDelayLoadedAPI

  api-ms-win-core-delayload-l1-1-0

  DelayLoadFailureHook

  Sections

  .text

  Size: 173KB - Virtual size: 172KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .data

  Size: 512B - Virtual size: 109KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 9KB - Virtual size: 9KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .didat

  Size: 512B - Virtual size: 64B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 33KB - Virtual size: 33KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 9KB - Virtual size: 9KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ