General

Malware Config

Signatures

Files

• 3584873a60b0882e46ac70334b589831f2e582ed4f3672fc8bb745aecdd8e9ea

  .exe windows x86

  e29873856a8ad0c0abe94c91ed5d9b8d

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DEBUG_STRIPPED

  Imports

  advapi32

  CryptAcquireContextA

  CryptCreateHash

  CryptDestroyHash

  CryptGetHashParam

  CryptHashData

  CryptReleaseContext

  GetUserNameA

  RegCloseKey

  RegCreateKeyExA

  RegDeleteKeyA

  RegDeleteValueA

  RegEnumKeyExA

  RegOpenKeyExA

  RegQueryValueExA

  RegSetValueExA

  crypt32

  CryptUnprotectData

  gdi32

  BitBlt

  CreateCompatibleBitmap

  CreateCompatibleDC

  DeleteDC

  DeleteObject

  GetDIBits

  SelectObject

  kernel32

  CloseHandle

  CreateDirectoryA

  CreateFileA

  CreateMutexA

  CreatePipe

  CreateProcessA

  CreateToolhelp32Snapshot

  DeleteFileA

  EnterCriticalSection

  ExitProcess

  FileTimeToSystemTime

  FindClose

  FindFirstFileA

  FindNextFileA

  FreeLibrary

  GetCommandLineA

  GetComputerNameA

  GetCurrentProcessId

  GetDriveTypeA

  GetFileAttributesA

  GetFileAttributesExA

  GetLastError

  GetLocalTime

  GetLogicalDriveStringsA

  GetModuleFileNameA

  GetProcAddress

  GetProcessHeap

  GetProcessTimes

  GetStartupInfoA

  GetSystemInfo

  GetTickCount

  GetVersionExA

  HeapAlloc

  HeapFree

  InitializeCriticalSection

  LeaveCriticalSection

  LoadLibraryA

  LocalFree

  MoveFileA

  OpenProcess

  PeekNamedPipe

  Process32First

  Process32Next

  ReadFile

  ReleaseMutex

  ResumeThread

  SetErrorMode

  SetFilePointer

  Sleep

  TerminateProcess

  WriteFile

  msvcrt

  _beginthreadex

  _filelengthi64

  _vscprintf

  _vsnprintf

  fclose

  fflush

  fgetpos

  fgets

  fopen

  fread

  free

  fsetpos

  fwrite

  getenv

  malloc

  realloc

  sprintf

  strlen

  time

  shell32

  SHGetPathFromIDListA

  SHGetSpecialFolderLocation

  ShellExecuteA

  user32

  CreateWindowExA

  DefWindowProcA

  DispatchMessageA

  EnumWindows

  GetDC

  GetDesktopWindow

  GetForegroundWindow

  GetKeyNameTextA

  GetKeyState

  GetKeyboardState

  GetMessageA

  GetSystemMetrics

  GetWindowTextA

  IsWindowVisible

  MapVirtualKeyA

  PostQuitMessage

  RegisterClassExA

  ReleaseDC

  SendMessageA

  SetCursorPos

  SetWindowTextA

  ShowWindow

  ToAscii

  TranslateMessage

  keybd_event

  mouse_event

  winmm

  waveInAddBuffer

  waveInClose

  waveInGetDevCapsA

  waveInGetNumDevs

  waveInOpen

  waveInPrepareHeader

  waveInStart

  waveInStop

  waveInUnprepareHeader

  ws2_32

  WSACleanup

  WSAGetLastError

  WSAIoctl

  WSAStartup

  __WSAFDIsSet

  closesocket

  connect

  gethostbyname

  gethostname

  htons

  ioctlsocket

  ntohs

  recv

  select

  send

  setsockopt

  shutdown

  socket

  Sections

  .text

  Size: 58KB - Virtual size: 57KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .data

  Size: 5KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .bss

  Size: - Virtual size: 14KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 76KB - Virtual size: 80KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE