General

Malware Config

Signatures

Files

• 926b31de3b1b605272a70e7e2c21bf746eb8dad96c67beb27c0b43739b6894bf

  .exe windows x86

  4c3982ce530714e5079bdd0302cec4b4

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  winsta

  WinStationOpenServerW

  WinStationNameFromLogonIdW

  LogonIdFromWinStationNameW

  WinStationDisconnect

  user32

  LoadStringW

  ntdll

  _wcslwr

  memmove

  wcscmp

  VerSetConditionMask

  _wcsnicmp

  wcstol

  wcsncpy

  wcscat

  _ultoa

  wcschr

  wcscpy

  wcslen

  iswctype

  wcstoul

  msvcrt

  free

  vfwprintf

  vswprintf

  fwprintf

  _wcsdup

  _exit

  _XcptFilter

  _cexit

  exit

  __initenv

  __getmainargs

  _initterm

  __setusermatherr

  _adjust_fdiv

  __p__commode

  __p__fmode

  __set_app_type

  _controlfp

  _except_handler3

  malloc

  _iob

  fprintf

  setlocale

  _c_exit

  kernel32

  GetLastError

  FreeLibrary

  LoadLibraryW

  SetLastError

  WriteConsoleW

  GetFileType

  GetStdHandle

  MultiByteToWideChar

  GetModuleHandleA

  FindFirstFileW

  FindNextFileW

  GetFileAttributesW

  GetCommandLineW

  LocalAlloc

  LocalFree

  VerifyVersionInfoW

  FormatMessageW

  GetModuleHandleW

  Sections

  .text

  Size: 9KB - Virtual size: 9KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .data

  Size: 1024B - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 71KB - Virtual size: 72KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE