General

Malware Config

Signatures

Files

• 4d6aa12717b547f1e5ea64a0ec5ae70e569a5f87d10dee4beb8dee135eb0d24e

  .zip

  Password: infected

• jhdsgvc74.exe

  .exe windows x86

  b933bb8364afc27e16c8073ea70ff235

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_AGGRESIVE_WS_TRIM

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DEBUG_STRIPPED

  Imports

  user32

  PostMessageW

  DispatchMessageA

  GetDlgItemTextW

  LoadStringA

  GetPropW

  GetClassLongW

  IsCharUpperA

  DrawStateA

  IsDialogMessageA

  LoadMenuA

  CreateDesktopA

  LoadIconW

  LoadCursorA

  kernel32

  WaitForSingleObject

  GetCurrentProcess

  GetModuleHandleW

  GetFileAttributesA

  FindNextFileA

  GetTempPathW

  GetModuleFileNameA

  IsBadReadPtr

  GetExpandedNameW

  GetCurrentThread

  LoadLibraryA

  GetProfileSectionA

  GetProcAddress

  GetStringTypeA

  WaitNamedPipeA

  InitializeCriticalSection

  GetConsoleAliasW

  SearchPathW

  GetLogicalDriveStringsA

  odbctrac

  TraceSQLCancel

  TraceSQLError

  authz

  AuthzFreeAuditEvent

  AuthzInitializeContextFromSid

  AuthzFreeResourceManager

  AuthzFreeContext

  modemui

  drvSetDefaultCommConfigA

  CountryRunOnce

  Sections

  .text

  Size: 59KB - Virtual size: 58KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 10KB - Virtual size: 9KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 31KB - Virtual size: 30KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 553KB - Virtual size: 553KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ