General

Malware Config

Signatures

Files

• 1ac73d515c89d782e889ea9ba68f0b0eb3a80fb15247ecc81841613d8a057e7a

  .exe windows x86

  2a1c59f2822a4b9e0435e5c824306502

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_NO_BIND

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  advapi32

  GetTokenInformation

  RegQueryValueExA

  RegOpenKeyExA

  RegSetValueExA

  RegCreateKeyExA

  RegDeleteKeyA

  RegDeleteValueA

  RegQueryInfoKeyA

  FreeSid

  EqualSid

  RegCloseKey

  OpenProcessToken

  AllocateAndInitializeSid

  AdjustTokenPrivileges

  LookupPrivilegeValueA

  kernel32

  GetCommandLineA

  lstrcpyA

  GetModuleHandleA

  CloseHandle

  ExitProcess

  GetCurrentProcessId

  CopyFileA

  SetFileAttributesA

  lstrlenA

  DeleteFileA

  GetTempFileNameA

  GetTempPathA

  GetFileAttributesA

  GetLastError

  CreateMutexA

  GetModuleFileNameA

  OpenProcess

  lstrcpynA

  ReleaseMutex

  WritePrivateProfileStringA

  MultiByteToWideChar

  GetPrivateProfileStringA

  FreeLibrary

  WideCharToMultiByte

  GetProcAddress

  LoadLibraryA

  lstrcatA

  lstrcmpiA

  lstrcmpA

  RemoveDirectoryA

  IsDBCSLeadByte

  GetWindowsDirectoryA

  GetSystemDirectoryA

  FindClose

  FindFirstFileA

  FindNextFileA

  GetVersionExA

  LocalFree

  LocalAlloc

  GetCurrentProcess

  GetExitCodeProcess

  CreateProcessA

  user32

  DispatchMessageA

  FindWindowA

  MessageBoxA

  wsprintfA

  EnumChildWindows

  PostMessageA

  GetWindowThreadProcessId

  DestroyWindow

  CreateDialogParamA

  TranslateMessage

  LoadStringA

  MsgWaitForMultipleObjects

  ExitWindowsEx

  CharPrevA

  CharUpperA

  CharNextA

  PeekMessageA

  ole32

  CoInitialize

  CLSIDFromString

  CoUninitialize

  CoCreateInstance

  oleaut32

  SysFreeString

  Sections

  .text

  Size: 16KB - Virtual size: 15KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 4KB - Virtual size: 288B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 8KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  !55�u�

  Size: 20KB - Virtual size: 20KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE