General

Malware Config

Signatures

Files

• 20f48e19032b23217d4da671173565607b4069912d37f4b143fea97486fba743

  .exe windows x86

  b1673e2183b7269bb499fe5477fd7ffb

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  GetStartupInfoA

  InterlockedDecrement

  lstrcpyA

  lstrlenW

  MultiByteToWideChar

  AreFileApisANSI

  lstrcpynA

  FreeLibrary

  GetLastError

  lstrlenA

  CloseHandle

  CreateMutexA

  SetLastError

  GetFileAttributesA

  LocalFree

  GetProcAddress

  LoadLibraryA

  CancelWaitableTimer

  GetTickCount

  GetProcessHeap

  ActivateActCtx

  GetACP

  OpenWaitableTimerA

  OpenWaitableTimerW

  GlobalFindAtomW

  GetOEMCP

  CancelIo

  GetCurrentProcessId

  GetFullPathNameA

  GetVersion

  GetCurrentThreadId

  GetModuleHandleA

  GetModuleFileNameA

  WideCharToMultiByte

  VirtualProtect

  user32

  CharLowerA

  IsWindowUnicode

  GetDesktopWindow

  IsZoomed

  GetDlgCtrlID

  EnableWindow

  UpdateWindow

  SetRect

  ReleaseCapture

  SetCapture

  SetWindowTextA

  GetForegroundWindow

  GetWindowRect

  EnumChildWindows

  DefWindowProcA

  GrayStringA

  GetParent

  PtInRect

  IsWindow

  FillRect

  GetSystemMetrics

  GetWindowTextA

  GetSystemMenu

  SetForegroundWindow

  wsprintfW

  IsWindowEnabled

  GetTopWindow

  SendMessageA

  TabbedTextOutA

  DrawTextA

  OffsetRect

  gdi32

  SetPixel

  CreateFontIndirectA

  LPtoDP

  CreatePalette

  Polyline

  GetTextColor

  BitBlt

  PtVisible

  PtInRegion

  TextOutA

  DPtoLP

  CreatePolygonRgn

  SetRectRgn

  CombineRgn

  RectVisible

  CreateRectRgn

  GetObjectA

  advapi32

  RegEnumValueA

  CryptDeriveKey

  CryptAcquireContextA

  CryptDecrypt

  RegOpenKeyExA

  RegDeleteValueW

  RegCreateKeyExA

  FreeSid

  IsTextUnicode

  CryptCreateHash

  LsaFreeMemory

  RegCloseKey

  RegSetValueExW

  RegOpenCurrentUser

  LsaOpenPolicy

  RegEnumValueW

  RegDeleteKeyW

  RegOpenKeyExW

  RegCreateKeyExW

  RegEnumKeyW

  RegQueryValueExW

  LsaClose

  CryptDestroyHash

  CryptReleaseContext

  EqualSid

  RegDeleteValueA

  CryptHashData

  CryptDestroyKey

  RegSetValueExA

  RegQueryValueExA

  CryptEncrypt

  RegOpenKeyW

  shell32

  ShellExecuteA

  SHGetMalloc

  SHGetDesktopFolder

  SHGetPathFromIDListA

  ole32

  CoUninitialize

  CoCreateInstance

  StringFromCLSID

  CoInitialize

  CoTaskMemFree

  CLSIDFromProgID

  comctl32

  _TrackMouseEvent

  InitCommonControlsEx

  version

  GetFileVersionInfoA

  VerQueryValueA

  GetFileVersionInfoSizeA

  oledlg

  ord8

  OleUIBusyW

  msvcrt

  _adjust_fdiv

  _CIsin

  _controlfp

  exit

  free

  _vsnprintf

  _strdup

  _initterm

  _mbscmp

  __getmainargs

  _splitpath

  _acmdln

  __dllonexit

  _onexit

  _except_handler3

  __setusermatherr

  __CxxFrameHandler

  _exit

  ??1type_info@@UAE@XZ

  _setmbcp

  _mbsicmp

  _CxxThrowException

  _XcptFilter

  ?terminate@@YAXXZ

  __p__commode

  __p__fmode

  __set_app_type

  Sections

  .text

  Size: 72KB - Virtual size: 71KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .text

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .ydata

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .bss1

  Size: - Virtual size: 4KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 28KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 18KB - Virtual size: 17KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 70KB - Virtual size: 70KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 9KB - Virtual size: 8KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ