General

Malware Config

Signatures

Files

• 56a5c8d85496e9feff7ed147049a18b51c860e39c4bd95fb30588dfaf81fd9de

  .exe windows x86

  98eb9efb7499a3b4651e1d9795785084

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  api-ms-win-security-sddl-l1-1-0

  ConvertSidToStringSidW

  api-ms-win-core-processthreads-l1-1-1

  IsProcessorFeaturePresent

  OpenProcess

  api-ms-win-core-synch-l1-2-0

  Sleep

  api-ms-win-core-psapi-l1-1-0

  K32GetModuleBaseNameW

  api-ms-win-core-handle-l1-1-0

  CloseHandle

  api-ms-win-core-heap-l2-1-0

  LocalFree

  netutils

  NetApiBufferFree

  api-ms-win-core-string-l1-1-0

  CompareStringW

  WideCharToMultiByte

  GetStringTypeW

  MultiByteToWideChar

  CompareStringEx

  api-ms-win-core-localization-l1-2-0

  IsValidCodePage

  GetACP

  GetOEMCP

  LCMapStringW

  GetLocaleInfoW

  IsValidLocale

  LCMapStringEx

  GetLocaleInfoEx

  GetUserDefaultLCID

  EnumSystemLocalesW

  GetCPInfo

  FormatMessageA

  api-ms-win-core-synch-l1-1-0

  LeaveCriticalSection

  EnterCriticalSection

  InitializeCriticalSectionEx

  DeleteCriticalSection

  InitializeCriticalSectionAndSpinCount

  api-ms-win-core-util-l1-1-0

  DecodePointer

  EncodePointer

  kernel32

  K32EnumProcessModules

  netapi32

  NetLocalGroupEnum

  NetUserChangePassword

  NetLocalGroupDelMember

  NetLocalGroupAddMember

  NetUserGetGroups

  NetUserAdd

  NetUserDel

  NetUserEnum

  NetLocalGroupGetMembers

  NetUserGetLocalGroups

  NetUserGetInfo

  api-ms-win-core-errorhandling-l1-1-0

  RaiseException

  UnhandledExceptionFilter

  SetLastError

  SetUnhandledExceptionFilter

  GetLastError

  api-ms-win-core-processthreads-l1-1-0

  ExitProcess

  GetCurrentProcess

  TerminateProcess

  TlsSetValue

  GetCurrentThread

  GetStartupInfoW

  TlsAlloc

  TlsFree

  GetCurrentThreadId

  TlsGetValue

  GetCurrentProcessId

  api-ms-win-core-profile-l1-1-0

  QueryPerformanceCounter

  api-ms-win-core-sysinfo-l1-1-0

  GetSystemTimeAsFileTime

  api-ms-win-core-interlocked-l1-1-0

  InterlockedFlushSList

  InitializeSListHead

  InterlockedPushEntrySList

  api-ms-win-core-debug-l1-1-0

  OutputDebugStringW

  IsDebuggerPresent

  api-ms-win-core-libraryloader-l1-2-0

  GetModuleHandleW

  GetModuleFileNameW

  FreeLibrary

  LoadLibraryExW

  GetProcAddress

  GetModuleHandleExW

  api-ms-win-core-rtlsupport-l1-1-0

  RtlUnwind

  api-ms-win-core-processenvironment-l1-1-0

  GetEnvironmentStringsW

  GetCommandLineW

  GetCommandLineA

  SetStdHandle

  FreeEnvironmentStringsW

  GetStdHandle

  SetEnvironmentVariableW

  api-ms-win-core-file-l1-1-0

  WriteFile

  CreateFileW

  FindNextFileW

  GetFileSizeEx

  SetFilePointerEx

  FindFirstFileExW

  FlushFileBuffers

  ReadFile

  GetFileType

  FindClose

  api-ms-win-core-console-l1-1-0

  ReadConsoleW

  SetConsoleCtrlHandler

  WriteConsoleW

  GetConsoleOutputCP

  GetConsoleMode

  api-ms-win-core-heap-l1-1-0

  HeapSize

  HeapAlloc

  HeapFree

  GetProcessHeap

  HeapReAlloc

  api-ms-win-core-datetime-l1-1-0

  GetTimeFormatW

  GetDateFormatW

  api-ms-win-core-timezone-l1-1-0

  GetTimeZoneInformation

  Sections

  .text

  Size: 491KB - Virtual size: 490KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 88KB - Virtual size: 88KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 115KB - Virtual size: 120KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 19KB - Virtual size: 18KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ