General

Malware Config

Signatures

Files

• 43c094ba16917ed041a595400d1eb4cc25a403405627d41745afcfab5c3bf0a2

  .exe windows x86

  f093683b353b2a00aa3c07bc9edf850d

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  TlsFree

  GetCommandLineW

  SetErrorMode

  GetComputerNameW

  VirtualFree

  OpenEventW

  DuplicateHandle

  GetCurrentProcessId

  WriteProcessMemory

  GetEnvironmentVariableW

  FileTimeToDosDateTime

  GetTempFileNameW

  HeapReAlloc

  FindFirstFileW

  SetEndOfFile

  CreateProcessW

  HeapAlloc

  SystemTimeToFileTime

  SetFilePointerEx

  HeapFree

  GetProcessHeap

  IsBadReadPtr

  SetFileTime

  VirtualQueryEx

  Thread32First

  WideCharToMultiByte

  ReadProcessMemory

  WTSGetActiveConsoleSessionId

  HeapDestroy

  TlsAlloc

  Thread32Next

  ReadFile

  GetTimeZoneInformation

  MultiByteToWideChar

  GetTempPathW

  GetFileSizeEx

  OpenMutexW

  VirtualAlloc

  VirtualProtectEx

  VirtualAllocEx

  FindClose

  RemoveDirectoryW

  FindNextFileW

  VirtualProtect

  GetFileTime

  FileTimeToLocalFileTime

  GetVolumeNameForVolumeMountPointW

  DeleteFileW

  GetFileInformationByHandle

  GetThreadContext

  SetThreadContext

  GetProcessId

  CreateFileW

  LoadLibraryW

  CreateFileMappingW

  UnmapViewOfFile

  MapViewOfFile

  CreateMutexW

  CreateToolhelp32Snapshot

  Process32NextW

  Process32FirstW

  VirtualFreeEx

  OpenProcess

  CreateDirectoryW

  ExitProcess

  CreateRemoteThread

  TerminateProcess

  TlsSetValue

  TlsGetValue

  WaitForMultipleObjects

  GetPrivateProfileIntW

  FlushFileBuffers

  WriteFile

  GetPrivateProfileStringW

  LocalFree

  GetVersionExW

  GetNativeSystemInfo

  GlobalUnlock

  GlobalLock

  HeapCreate

  SetFileAttributesW

  CreateThread

  GetSystemTime

  GetLocalTime

  lstrcmpiA

  SetThreadPriority

  GetCurrentThread

  ExpandEnvironmentStringsW

  ReleaseMutex

  GetCurrentThreadId

  CloseHandle

  CreateEventW

  ResetEvent

  SetLastError

  GetLastError

  SetEvent

  LoadLibraryA

  FreeLibrary

  EnterCriticalSection

  LeaveCriticalSection

  InitializeCriticalSection

  GetUserDefaultUILanguage

  GetModuleFileNameW

  GetFileAttributesW

  Sleep

  GetTickCount

  WaitForSingleObject

  MoveFileExW

  GetFileAttributesExW

  lstrcmpiW

  GetProcAddress

  GetModuleHandleW

  user32

  OpenDesktopW

  CloseDesktop

  SetThreadDesktop

  GetUserObjectInformationW

  OpenWindowStationW

  CharToOemW

  CharLowerBuffA

  ExitWindowsEx

  GetWindowRect

  PostMessageW

  GetParent

  GetWindowInfo

  GetClassLongW

  GetWindowLongW

  GetAncestor

  SetWindowPos

  SendMessageTimeoutW

  GetProcessWindowStation

  SendMessageW

  MapWindowPoints

  GetWindowThreadProcessId

  IsRectEmpty

  DrawIcon

  GetIconInfo

  EndPaint

  EndMenu

  GetUpdateRgn

  GetMessageW

  RegisterClassExA

  GetWindowDC

  SetCapture

  GetTopWindow

  HiliteMenuItem

  LoadImageW

  MsgWaitForMultipleObjects

  WindowFromPoint

  CharLowerA

  CharUpperW

  SetWindowLongW

  GetWindow

  DispatchMessageW

  RegisterWindowMessageW

  GetMenuItemID

  SetKeyboardState

  GetSubMenu

  MenuItemFromPoint

  GetMenu

  GetMenuItemRect

  TrackPopupMenuEx

  SystemParametersInfoW

  GetClassNameW

  GetMenuState

  GetShellWindow

  FillRect

  CloseWindowStation

  DrawEdge

  GetMenuItemCount

  IsWindow

  IntersectRect

  CreateWindowStationW

  EqualRect

  PrintWindow

  RegisterClassA

  DefFrameProcW

  GetSystemMetrics

  MapVirtualKeyW

  GetKeyboardState

  ToUnicode

  DefDlgProcW

  DefFrameProcA

  OpenInputDesktop

  BeginPaint

  GetUpdateRect

  GetDC

  GetCapture

  TranslateMessage

  RegisterClassExW

  SetCursorPos

  GetClipboardData

  PeekMessageW

  GetDCEx

  PeekMessageA

  ReleaseDC

  DefWindowProcA

  GetCursorPos

  DefMDIChildProcW

  CharLowerW

  CreateDesktopW

  SetProcessWindowStation

  GetThreadDesktop

  GetMessageA

  GetMessagePos

  DefWindowProcW

  CallWindowProcW

  CallWindowProcA

  RegisterClassW

  ReleaseCapture

  DefMDIChildProcA

  DefDlgProcA

  SwitchDesktop

  PostThreadMessageW

  advapi32

  InitiateSystemShutdownExW

  EqualSid

  ConvertSidToStringSidW

  GetLengthSid

  RegOpenKeyExW

  RegEnumKeyExW

  RegCloseKey

  IsWellKnownSid

  CryptGetHashParam

  OpenProcessToken

  GetSidSubAuthority

  CryptAcquireContextW

  OpenThreadToken

  GetSidSubAuthorityCount

  GetTokenInformation

  RegCreateKeyExW

  CryptReleaseContext

  RegQueryValueExW

  CreateProcessAsUserW

  InitializeSecurityDescriptor

  SetSecurityDescriptorDacl

  SetNamedSecurityInfoW

  LookupPrivilegeValueW

  CryptCreateHash

  ConvertStringSecurityDescriptorToSecurityDescriptorW

  GetSecurityDescriptorSacl

  SetSecurityDescriptorSacl

  CryptDestroyHash

  AdjustTokenPrivileges

  RegSetValueExW

  CryptHashData

  shlwapi

  PathQuoteSpacesW

  PathRenameExtensionW

  wvnsprintfA

  StrCmpNIA

  PathMatchSpecW

  PathUnquoteSpacesW

  PathAddExtensionW

  PathCombineW

  SHDeleteKeyW

  PathSkipRootW

  SHDeleteValueW

  PathAddBackslashW

  PathFindFileNameW

  PathIsDirectoryW

  wvnsprintfW

  UrlUnescapeA

  PathRemoveBackslashW

  StrStrIW

  StrStrIA

  StrCmpNIW

  PathIsURLW

  PathRemoveFileSpecW

  shell32

  ShellExecuteW

  SHGetFolderPathW

  CommandLineToArgvW

  secur32

  GetUserNameExW

  ole32

  StringFromGUID2

  CLSIDFromString

  CoUninitialize

  CoCreateInstance

  CoInitializeEx

  gdi32

  GetDeviceCaps

  CreateCompatibleBitmap

  CreateDIBSection

  SetViewportOrgEx

  DeleteDC

  GdiFlush

  SetRectRgn

  CreateCompatibleDC

  SaveDC

  RestoreDC

  GetDIBits

  SelectObject

  DeleteObject

  ws2_32

  recv

  sendto

  getsockname

  select

  getaddrinfo

  recvfrom

  accept

  WSAEventSelect

  WSAGetLastError

  WSAIoctl

  connect

  WSAAddressToStringW

  WSAStartup

  shutdown

  setsockopt

  bind

  socket

  WSASetLastError

  listen

  freeaddrinfo

  getpeername

  WSASend

  closesocket

  send

  crypt32

  PFXExportCertStoreEx

  CertDuplicateCertificateContext

  CertEnumCertificatesInStore

  CertCloseStore

  CertOpenSystemStoreW

  CertDeleteCertificateFromStore

  PFXImportCertStore

  CryptUnprotectData

  wininet

  InternetQueryOptionA

  InternetSetOptionA

  InternetQueryOptionW

  InternetOpenA

  HttpOpenRequestA

  InternetCrackUrlA

  InternetConnectA

  HttpAddRequestHeadersA

  HttpAddRequestHeadersW

  InternetSetStatusCallbackW

  GetUrlCacheEntryInfoW

  InternetCloseHandle

  HttpSendRequestA

  HttpSendRequestW

  InternetReadFile

  InternetReadFileExA

  InternetQueryDataAvailable

  HttpSendRequestExW

  HttpQueryInfoA

  HttpSendRequestExA

  oleaut32

  VariantInit

  SysAllocString

  VariantClear

  SysFreeString

  netapi32

  NetApiBufferFree

  NetUserEnum

  NetUserGetInfo

  Sections

  .text

  Size: 130KB - Virtual size: 129KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 1024B - Virtual size: 8KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 6KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ