General

Malware Config

Signatures

Files

• f9cda9e6e65da73434958d2013530f7224c76f930992de1bfb8b99f3d7a7dc3a

  .dll windows x86

  2e0cb872e351474113d3223cee94e947

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  CreateEventA

  SetEvent

  HeapCreate

  HeapDestroy

  InterlockedIncrement

  InterlockedDecrement

  GetCurrentThreadId

  ResetEvent

  SystemTimeToFileTime

  GetCurrentProcess

  MulDiv

  GetCurrentDirectoryA

  GetPrivateProfileIntA

  GetPrivateProfileStringA

  Sleep

  WriteFile

  FreeLibrary

  HeapFree

  ReleaseSemaphore

  TlsAlloc

  GetLocalTime

  TlsSetValue

  DeleteFileA

  MoveFileA

  GetFileSize

  ReadFile

  TlsGetValue

  GetProcessHeap

  HeapAlloc

  SetLastError

  WaitForSingleObject

  EnterCriticalSection

  DeleteCriticalSection

  InitializeCriticalSectionAndSpinCount

  LeaveCriticalSection

  GetSystemTimeAsFileTime

  GetTickCount

  FileTimeToSystemTime

  SystemTimeToTzSpecificLocalTime

  WideCharToMultiByte

  GetLastError

  MultiByteToWideChar

  GetVersionExA

  DeviceIoControl

  CreateFileA

  GetProcAddress

  LoadLibraryA

  lstrlenA

  WaitForMultipleObjects

  CloseHandle

  GlobalAlloc

  GlobalFree

  SetEnvironmentVariableA

  CompareStringW

  CreateFileW

  WriteConsoleW

  CreateSemaphoreA

  FlushFileBuffers

  SetEndOfFile

  SetStdHandle

  GetDriveTypeW

  GetFileAttributesA

  GetStringTypeW

  LoadLibraryW

  HeapReAlloc

  GetConsoleMode

  GetConsoleCP

  SetFilePointer

  GetCurrentProcessId

  QueryPerformanceCounter

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  GetModuleFileNameA

  LCMapStringW

  GetStartupInfoW

  SetHandleCount

  RtlUnwind

  GetCurrentDirectoryW

  GetFileType

  PeekNamedPipe

  EncodePointer

  DecodePointer

  ExitThread

  CreateThread

  FindClose

  FileTimeToLocalFileTime

  GetDriveTypeA

  FindFirstFileExA

  GetCommandLineA

  TerminateProcess

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsDebuggerPresent

  RaiseException

  GetTimeZoneInformation

  HeapSize

  GetModuleHandleW

  ExitProcess

  TlsFree

  GetCPInfo

  GetACP

  GetOEMCP

  IsValidCodePage

  GetStdHandle

  GetModuleFileNameW

  IsProcessorFeaturePresent

  GetFullPathNameA

  GetFileInformationByHandle

  user32

  GetSystemMetrics

  GetDC

  GetWindowDC

  ScreenToClient

  FindWindowExA

  IsWindow

  GetSysColor

  ReleaseDC

  IsRectEmpty

  GetWindowRect

  gdi32

  GetDeviceCaps

  SetWinMetaFileBits

  CreateCompatibleDC

  SelectObject

  DeleteObject

  CreateCompatibleBitmap

  DeleteDC

  SetBkColor

  BitBlt

  GetDIBits

  DeleteEnhMetaFile

  GetEnhMetaFileHeader

  SetEnhMetaFileBits

  PlayEnhMetaFile

  RealizePalette

  SelectPalette

  CreatePalette

  GetEnhMetaFilePaletteEntries

  ExtTextOutA

  advapi32

  LookupPrivilegeValueA

  AdjustTokenPrivileges

  OpenProcessToken

  wininet

  InternetOpenUrlA

  InternetReadFile

  InternetOpenA

  HttpQueryInfoA

  InternetCloseHandle

  iphlpapi

  GetAdaptersInfo

  shlwapi

  PathFileExistsA

  ws2_32

  gethostname

  connect

  WSAStartup

  gethostbyname

  recv

  inet_ntoa

  closesocket

  htons

  WSAGetLastError

  inet_addr

  socket

  ioctlsocket

  WSACreateEvent

  WSAResetEvent

  WSACloseEvent

  send

  WSAEventSelect

  WSAWaitForMultipleEvents

  WSAEnumNetworkEvents

  ntohl

  htonl

  getsockname

  ntohs

  getpeername

  WSACleanup

  Exports

  Exports

  ChangeInfo

  D2Balance

  D2Buf

  D2File

  D2FileAsync

  D2Recharge

  D2Register

  D2Wnd

  D2WndHandle

  Decode

  DecodeBuf

  DecodeBufSync

  DecodeFileSync

  DecodeSync

  DecodeWnd

  DecodeWndHandle

  DecodeWndHandleSync

  DecodeWndSync

  GetOrigError

  GetResult

  Init

  Login

  Login2

  Logoff

  QueryBalance

  ReadInfo

  Recharge

  Register

  ReportResult

  Uninit

  Sections

  .text

  Size: 1.0MB - Virtual size: 1.0MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 278KB - Virtual size: 278KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 28KB - Virtual size: 84KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 36KB - Virtual size: 36KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .rmnet

  Size: 56KB - Virtual size: 60KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE