General

Malware Config

Signatures

Files

• 7740876126.zip

  .zip

  Password: infected

• 718c0ae260ecee2538564a2a55af22b53f39a24013f008251f443d6dbc8eb06d

  .exe windows x86

  Password: infected

  6873453a03495798ddcdf9b78b6d6fcf

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  winscard

  SCardStatusA

  crypt32

  CertDeleteCRLFromStore

  CertGetValidUsages

  CertFindCTLInStore

  secur32

  CompleteAuthToken

  setupapi

  SetupGetInfInformationW

  user32

  SetWindowPos

  GetMenuContextHelpId

  HideCaret

  GetDlgItemTextW

  SetProcessDefaultLayout

  OemKeyScan

  msvcrt

  _controlfp

  ?terminate@@YAXXZ

  __set_app_type

  __p__fmode

  __p__commode

  __setusermatherr

  _amsg_exit

  _initterm

  exit

  _XcptFilter

  _exit

  _cexit

  __getmainargs

  _except_handler4_common

  wininet

  InternetSetCookieW

  HttpEndRequestA

  InternetSetCookieA

  kernel32

  DeleteCriticalSection

  LoadLibraryA

  GetModuleHandleW

  GetCompressedFileSizeW

  InterlockedExchange

  Sleep

  InterlockedCompareExchange

  SetUnhandledExceptionFilter

  GetModuleHandleA

  QueryPerformanceCounter

  GetTickCount

  GetCurrentThreadId

  UnhandledExceptionFilter

  GetCurrentProcess

  TerminateProcess

  GetSystemTimeAsFileTime

  GetCurrentProcessId

  Sections

  .text

  Size: 24KB - Virtual size: 23KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 4KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 4KB - Virtual size: 19KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .clr0

  Size: 600KB - Virtual size: 596KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 4KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ