General

Malware Config

Signatures

Files

• 475f1acbdd1b5402ddb4e204654004f824e5e8d9d46301b9f4b1182baaed7c7f

  .exe windows x86

  e58f011781f91a99e0a9cc8e898255ae

  
  

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  HeapReAlloc

  RtlUnwind

  HeapSize

  MultiByteToWideChar

  GetLocaleInfoA

  LCMapStringA

  LCMapStringW

  GetStringTypeA

  GetStringTypeW

  VirtualProtect

  Sleep

  SetFileAttributesA

  CreateProcessA

  GetModuleFileNameA

  GetOEMCP

  GetACP

  GetCPInfo

  InitializeCriticalSection

  GetCurrentProcessId

  WideCharToMultiByte

  ExitProcess

  LoadLibraryA

  VirtualAlloc

  GetCommandLineA

  HeapFree

  GetVersionExA

  HeapAlloc

  GetProcessHeap

  GetStartupInfoA

  TerminateProcess

  GetCurrentProcess

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsDebuggerPresent

  GetProcAddress

  GetModuleHandleA

  WriteFile

  GetStdHandle

  FreeEnvironmentStringsA

  GetEnvironmentStrings

  FreeEnvironmentStringsW

  GetLastError

  GetEnvironmentStringsW

  SetHandleCount

  GetFileType

  DeleteCriticalSection

  TlsGetValue

  TlsAlloc

  TlsSetValue

  TlsFree

  InterlockedIncrement

  SetLastError

  GetCurrentThreadId

  InterlockedDecrement

  HeapDestroy

  HeapCreate

  VirtualFree

  QueryPerformanceCounter

  GetTickCount

  GetSystemTimeAsFileTime

  LeaveCriticalSection

  EnterCriticalSection

  user32

  GetDlgItemInt

  SetCursor

  InsertMenuItemA

  SetDlgItemInt

  ValidateRect

  PostMessageA

  InvalidateRect

  EmptyClipboard

  BeginPaint

  DestroyMenu

  MapWindowPoints

  GetSystemMetrics

  gdi32

  OffsetViewportOrgEx

  SetViewportExtEx

  ScaleViewportExtEx

  ScaleWindowExtEx

  winspool.drv

  AddPrinterConnectionA

  OpenPrinterA

  DocumentPropertiesA

  GetJobA

  EnumPrintersA

  ClosePrinter

  comctl32

  PropertySheetA

  CreatePropertySheetPageA

  ImageList_SetDragCursorImage

  comdlg32

  ChooseColorA

  GetSaveFileNameA

  GetOpenFileNameA

  advapi32

  CloseServiceHandle

  DeleteService

  CreateServiceA

  LookupPrivilegeValueA

  RegCloseKey

  RegOpenKeyExA

  RegQueryValueExA

  AllocateAndInitializeSid

  FreeSid

  OpenProcessToken

  StartServiceCtrlDispatcherA

  InitializeSecurityDescriptor

  RegEnumKeyA

  RegSetValueExA

  RegisterServiceCtrlHandlerA

  SetServiceStatus

  AdjustTokenPrivileges

  ControlService

  GetTokenInformation

  uxtheme

  GetThemeBackgroundRegion

  CloseThemeData

  GetThemeFont

  gpedit

  CreateGPOLink

  DeleteGPOLink

  ExportRSoPData

  BrowseForGPO

  Sections

  .text

  Size: 216KB - Virtual size: 215KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 16KB - Virtual size: 12KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 4KB - Virtual size: 64KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 132KB - Virtual size: 129KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ