General

Malware Config

Signatures

Files

• 449fabab501c8630cbbe159a0f2cab8cfa73a75b0807a1e49097590346d74fe2

  .exe windows x86

  d09f77ee6f02f5fcefbc59b7a8e0b147

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  LoadLibraryExW

  CreateProcessW

  GetCurrentThreadId

  RemoveDirectoryW

  SetFileAttributesW

  GetDiskFreeSpaceW

  WaitForSingleObject

  CreateFileW

  WriteConsoleW

  FlushFileBuffers

  SetFilePointerEx

  GetConsoleMode

  GetConsoleCP

  HeapSize

  SetStdHandle

  SetEnvironmentVariableA

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GetCommandLineW

  GetCommandLineA

  GetOEMCP

  IsValidCodePage

  FindNextFileW

  FindFirstFileExW

  FindClose

  CloseHandle

  GetFileType

  GetProcessHeap

  EnumSystemLocalesW

  EnterCriticalSection

  LeaveCriticalSection

  DeleteCriticalSection

  MultiByteToWideChar

  GetCPInfo

  WideCharToMultiByte

  EncodePointer

  DecodePointer

  SetLastError

  InitializeCriticalSectionAndSpinCount

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetSystemTimeAsFileTime

  GetModuleHandleW

  CompareStringW

  LCMapStringW

  GetLocaleInfoW

  GetStringTypeW

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  TerminateProcess

  IsProcessorFeaturePresent

  QueryPerformanceCounter

  GetCurrentProcessId

  InitializeSListHead

  IsDebuggerPresent

  GetStartupInfoW

  RaiseException

  RtlUnwind

  GetLastError

  GetModuleFileNameW

  FreeLibrary

  QueryPerformanceFrequency

  HeapAlloc

  HeapFree

  HeapReAlloc

  GetStdHandle

  WriteFile

  ExitProcess

  GetModuleHandleExW

  GetACP

  GetTimeZoneInformation

  IsValidLocale

  GetUserDefaultLCID

  GetProcAddress

  user32

  LoadIconW

  WindowFromPoint

  SetCapture

  CloseClipboard

  EndDialog

  GetMessageW

  ole32

  CoUninitialize

  CoSuspendClassObjects

  CoTaskMemAlloc

  CoTaskMemFree

  StgCreateDocfile

  OleCreate

  CoInitialize

  ws2_32

  send

  select

  recv

  ntohl

  socket

  inet_ntoa

  inet_addr

  ioctlsocket

  WSAStartup

  WSACleanup

  WSAConnect

  WSACreateEvent

  WSAGetOverlappedResult

  WSASocketW

  listen

  advapi32

  SystemFunction036

  Sections

  .text

  Size: 583KB - Virtual size: 583KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 100KB - Virtual size: 100KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 56KB - Virtual size: 118KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .gfids

  Size: 512B - Virtual size: 412B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 696KB - Virtual size: 696KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 10KB - Virtual size: 9KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ