General

Malware Config

Signatures

Files

• 06d808c472aaa37b3df04d4d3b18ea90339a3e44cd16d61aa6bf4d3187d7eccc

  .exe windows x86

  21fd7a8e66b864e55bbebfb189880e95

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  ReadConsoleW

  WriteConsoleW

  SetStdHandle

  OutputDebugStringW

  FlushFileBuffers

  GetStringTypeW

  LCMapStringW

  SetFilePointerEx

  GetConsoleMode

  GetConsoleCP

  HeapReAlloc

  LoadLibraryExW

  GetModuleHandleW

  TlsFree

  TlsSetValue

  TlsGetValue

  TlsAlloc

  TerminateProcess

  InitializeCriticalSectionAndSpinCount

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  FreeEnvironmentStringsW

  GlobalMemoryStatus

  GetCurrentProcessId

  QueryPerformanceCounter

  GetModuleFileNameW

  GetProcessHeap

  GetStartupInfoW

  CreateFileW

  GetStdHandle

  DeleteCriticalSection

  GetCPInfo

  GetOEMCP

  GetACP

  IsValidCodePage

  IsDebuggerPresent

  GetCurrentThreadId

  SetLastError

  HeapSize

  WideCharToMultiByte

  GetVersion

  LocalAlloc

  GetCurrentProcess

  GetEnvironmentStringsW

  SetEndOfFile

  SetConsoleTitleW

  GetPriorityClass

  CancelIoEx

  GetCommandLineW

  LoadLibraryA

  CreateEventW

  CreateEventA

  GetTickCount

  GetSystemInfo

  MulDiv

  CloseHandle

  ReadFile

  WriteFile

  Sleep

  WaitForSingleObject

  GlobalAlloc

  GetProcAddress

  FreeLibrary

  FindNextFileA

  FindFirstFileA

  GetFileAttributesExA

  lstrcmpA

  GetVolumeInformationA

  lstrcpyA

  AreFileApisANSI

  GetModuleHandleExW

  ExitProcess

  HeapFree

  HeapAlloc

  LeaveCriticalSection

  EnterCriticalSection

  MultiByteToWideChar

  IsProcessorFeaturePresent

  RaiseException

  RtlUnwind

  DecodePointer

  EncodePointer

  GetOverlappedResult

  GetLastError

  GetFileType

  FreeEnvironmentStringsA

  GetDriveTypeA

  GetModuleHandleA

  GetLogicalDriveStringsA

  lstrcatA

  GetSystemTimeAsFileTime

  user32

  GetProcessWindowStation

  MessageBoxA

  DestroyWindow

  PostQuitMessage

  RegisterClassExW

  GetUserObjectInformationW

  ShowWindow

  DialogBoxParamA

  EndDialog

  LoadAcceleratorsA

  TranslateAcceleratorA

  DefWindowProcA

  DispatchMessageA

  TranslateMessage

  GetMessageA

  CreateWindowExW

  LoadBitmapA

  GetWindow

  GetClassNameA

  GetParent

  GetDesktopWindow

  SetWindowLongA

  OffsetRect

  CopyRect

  GetSysColor

  GetCursorPos

  EndPaint

  GetWindowTextA

  SetWindowTextA

  SetScrollPos

  ScrollWindowEx

  InvalidateRect

  GetClientRect

  BeginPaint

  ReleaseDC

  GetDC

  DrawIcon

  CreatePopupMenu

  DrawMenuBar

  GetSystemMetrics

  EnableWindow

  SendInput

  SetFocus

  SendDlgItemMessageW

  SendDlgItemMessageA

  CheckDlgButton

  GetDlgItemTextA

  SetDlgItemTextA

  GetDlgItem

  DialogBoxIndirectParamA

  SetWindowPos

  MoveWindow

  CallWindowProcA

  wsprintfA

  CreateWindowExA

  SendMessageA

  LoadIconA

  LoadCursorA

  GetWindowRect

  UpdateWindow

  gdi32

  CreateFontIndirectA

  CreateCompatibleDC

  StretchBlt

  SetWindowExtEx

  GetObjectA

  SetAbortProc

  CreateHalftonePalette

  SetTextColor

  BitBlt

  SetMapMode

  SelectObject

  GetTextExtentPoint32A

  GetStockObject

  GetPixel

  GetDeviceCaps

  FillRgn

  DeleteObject

  DeleteDC

  comdlg32

  ChooseFontA

  GetSaveFileNameW

  advapi32

  ReportEventA

  DeregisterEventSource

  OpenProcessToken

  GetTokenInformation

  LsaNtStatusToWinError

  CredEnumerateA

  CryptGenRandom

  CryptGenKey

  CryptReleaseContext

  CryptAcquireContextA

  RegisterEventSourceA

  shell32

  CommandLineToArgvW

  SHCreateShellItem

  SHBrowseForFolderA

  ShellExecuteA

  ole32

  CreateFileMoniker

  BindMoniker

  CoInitializeEx

  CoUninitialize

  odbc32

  ord12

  ord24

  ord39

  ord75

  ord72

  ord19

  ord7

  comctl32

  ImageList_Add

  InitCommonControlsEx

  ImageList_Create

  ord17

  shlwapi

  StrStrA

  StrNCatA

  ws2_32

  WSALookupServiceBeginA

  WSALookupServiceNextA

  WSALookupServiceEnd

  inet_addr

  WSAGetLastError

  WSAStartup

  WSACleanup

  netapi32

  NetShareGetInfo

  iphlpapi

  SendARP

  secur32

  LsaEnumerateLogonSessions

  LsaGetLogonSessionData

  LsaFreeReturnBuffer

  imm32

  ImmGetDefaultIMEWnd

  winhttp

  WinHttpCloseHandle

  WinHttpAddRequestHeaders

  WinHttpCheckPlatform

  Exports

  Exports

  Try

  Sections

  .text

  Size: 125KB - Virtual size: 125KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 165KB - Virtual size: 165KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 26KB - Virtual size: 43KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 360KB - Virtual size: 360KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 19KB - Virtual size: 19KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ