General

Malware Config

Signatures

Files

• 7593416168.zip

  .zip

  Password: infected

• 876602eb517acecfd824b695225966c78a074f6e002641062d242999f9e5eb80

  .exe windows x86

  8193460fd09f03a7161dfa38bd063ea1

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  SetStdHandle

  WriteConsoleW

  GetConsoleOutputCP

  WriteConsoleA

  InitializeCriticalSectionAndSpinCount

  IsValidLocale

  EnumSystemLocalesA

  GetLocaleInfoA

  GetUserDefaultLCID

  GetStringTypeW

  GetStringTypeA

  GetSystemTimeAsFileTime

  GetCurrentProcessId

  GetTickCount

  QueryPerformanceCounter

  GetEnvironmentStringsW

  LoadLibraryA

  GetEnvironmentStrings

  FreeEnvironmentStringsA

  GetModuleFileNameA

  SetFilePointer

  CreateActCtxA

  HeapSize

  FlushFileBuffers

  GetConsoleMode

  GetConsoleCP

  WriteFile

  ReadFile

  HeapReAlloc

  VirtualFree

  HeapCreate

  GetFileType

  GetStdHandle

  SetHandleCount

  IsValidCodePage

  GetOEMCP

  CompareStringA

  CompareStringW

  SetEnvironmentVariableA

  GetLocaleInfoW

  CreateFileA

  SetEndOfFile

  GetTempPathA

  GetFinalPathNameByHandleA

  GetTempFileNameA

  CloseHandle

  QueryDosDeviceW

  VirtualAlloc

  GetLastError

  FreeEnvironmentStringsW

  EnumSystemLanguageGroupsA

  CreateFileW

  CreateEventA

  WideCharToMultiByte

  GetCommandLineA

  GetACP

  GetCurrentThreadId

  SetLastError

  TlsFree

  TlsSetValue

  TlsAlloc

  TlsGetValue

  GetProcAddress

  GetCompressedFileSizeW

  WaitForSingleObject

  ExitProcess

  GetModuleHandleA

  GetModuleHandleW

  HeapAlloc

  LCMapStringW

  GetProcessHeap

  LCMapStringA

  RaiseException

  RtlUnwind

  GetCPInfo

  GetStartupInfoA

  HeapFree

  IsDebuggerPresent

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  GetCurrentProcess

  TerminateProcess

  LeaveCriticalSection

  EnterCriticalSection

  DeleteCriticalSection

  InitializeCriticalSection

  Sleep

  MultiByteToWideChar

  InterlockedExchange

  InterlockedDecrement

  InterlockedIncrement

  user32

  MapWindowPoints

  GetSystemMetrics

  BeginDeferWindowPos

  DeferWindowPos

  EndMenu

  EndDeferWindowPos

  SetWindowPos

  GetDesktopWindow

  DefWindowProcA

  DialogBoxParamA

  GetDlgItemTextA

  CreatePopupMenu

  DrawFrameControl

  SetDlgItemTextA

  EndDialog

  GetDlgItem

  GetWindowLongA

  InvalidateRect

  GetWindowThreadProcessId

  GetWindow

  GetCursorPos

  GetMessageA

  DrawTextA

  LoadIconA

  CreateMenu

  TranslateMessage

  CreateWindowExA

  ShowWindow

  AppendMenuA

  DispatchMessageA

  UpdateWindow

  LoadCursorA

  RegisterClassA

  EndPaint

  GetWindowRect

  SetActiveWindow

  PostQuitMessage

  IsIconic

  FillRect

  CopyImage

  DrawIcon

  GetClientRect

  SendMessageA

  BeginPaint

  GetMenu

  OffsetRect

  TrackPopupMenuEx

  SetRect

  MessageBoxA

  gdi32

  SetWindowExtEx

  DeleteDC

  ExcludeClipRect

  SetBkMode

  DeleteObject

  SelectObject

  SelectClipRgn

  CreateCompatibleDC

  CreateCompatibleBitmap

  FillRgn

  RealizePalette

  SelectPalette

  GetStockObject

  CreateSolidBrush

  TextOutA

  BitBlt

  comdlg32

  CommDlgExtendedError

  GetSaveFileNameA

  GetOpenFileNameA

  shell32

  Shell_NotifyIconA

  SHGetSpecialFolderLocation

  ole32

  CreateStreamOnHGlobal

  ws2_32

  WSAStartup

  netapi32

  NetWkstaUserGetInfo

  avifil32

  AVIStreamWrite

  crypt32

  CertGetCTLContextProperty

  shlwapi

  ord14

  StrStrIA

  pdh

  PdhCollectQueryData

  gdiplus

  GdipFree

  GdipGetImageHeight

  GdipDrawImageRectRectI

  GdipDeleteGraphics

  GdipLoadImageFromFile

  GdipLoadImageFromFileICM

  GdiplusStartup

  GdipDisposeImage

  GdipCreateFromHDC

  GdipSetInterpolationMode

  GdipCloneImage

  GdipGetImageWidth

  GdipAlloc

  winhttp

  WinHttpSendRequest

  ntdsapi

  DsCrackSpnW

  DsBindWithSpnW

  Sections

  .text

  Size: 203KB - Virtual size: 202KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 43KB - Virtual size: 42KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 34KB - Virtual size: 45KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 216KB - Virtual size: 216KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ