General

Malware Config

Signatures

Files

• 511abcddfa725780593528ef56944433c92089e49bbf75b005fed739ae3b82be

  .exe windows x86

  c8148900e4979475a67b3b8cf27a21a3

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  lstrlenW

  GetVersion

  GetLastError

  GetProcessHeap

  GetTickCount

  GetCommandLineA

  LoadLibraryW

  GetDriveTypeA

  GetFileAttributesA

  GetModuleHandleW

  LoadLibraryA

  GetCommandLineW

  GetStartupInfoA

  GlobalAlloc

  GetFileAttributesW

  GetModuleHandleA

  GetDriveTypeW

  GetCurrentProcessId

  lstrlenA

  GetProcAddress

  CallNamedPipeW

  CloseHandle

  CreateFileA

  CreateFileMappingA

  DebugActiveProcess

  EnterCriticalSection

  ExitProcess

  FindClose

  FindFirstFileA

  FindNextFileA

  _lwrite

  WriteFile

  UnmapViewOfFile

  UnhandledExceptionFilter

  TerminateProcess

  SetUnhandledExceptionFilter

  SetThreadLocale

  SetFileApisToOEM

  SetCurrentDirectoryA

  SetConsoleTextAttribute

  SetConsoleCtrlHandler

  HeapAlloc

  ReadFile

  ReadConsoleOutputCharacterW

  QueryPerformanceCounter

  OpenEventA

  MapViewOfFile

  LocalFree

  LocalAlloc

  LeaveCriticalSection

  IsDBCSLeadByte

  InterlockedDecrement

  InitializeCriticalSection

  GlobalGetAtomNameW

  GetVolumeNameForVolumeMountPointA

  GetUserDefaultLCID

  GetSystemTimeAsFileTime

  GetSystemDirectoryW

  GetStdHandle

  GetProcessAffinityMask

  GetFileSize

  GetCurrentProcess

  GetCurrentDirectoryW

  GetCurrentDirectoryA

  GetConsoleScreenBufferInfo

  GetConsoleOutputCP

  FreeLibrary

  FormatMessageW

  GetCurrentThreadId

  FormatMessageA

  user32

  SendMessageW

  GetSystemMetrics

  IsWindow

  LoadIconW

  GetParent

  DestroyIcon

  GetSysColor

  SendMessageA

  DestroyWindow

  LoadBitmapW

  GetDC

  GetDlgItem

  LoadBitmapA

  EnableMenuItem

  GetMenu

  LoadIconA

  IsWindowVisible

  ShowWindow

  UpdateWindow

  SetWindowLongW

  IsDlgButtonChecked

  ArrangeIconicWindows

  CharToOemA

  PostQuitMessage

  RealGetWindowClassA

  SetCaretBlinkTime

  SetDebugErrorLevel

  wsprintfA

  GetKeyState

  gdi32

  FlattenPath

  SetICMProfileW

  SetDeviceGammaRamp

  SetDIBitsToDevice

  Polygon

  PolyPolygon

  MoveToEx

  MaskBlt

  GetTextMetricsW

  GetTextMetricsA

  GetSystemPaletteUse

  GetStringBitmapW

  GetPolyFillMode

  GetNearestPaletteIndex

  GetNearestColor

  GetDIBColorTable

  GetClipRgn

  GetCharWidth32W

  GdiTransparentBlt

  GdiResetDCEMF

  GdiGetLocalBrush

  GdiEndPageEMF

  GdiDllInitialize

  GdiCreateLocalMetaFilePict

  GdiCreateLocalEnhMetaFile

  GdiConvertEnhMetaFile

  ExtSelectClipRgn

  EngUnlockSurface

  EngStretchBltROP

  EngReleaseSemaphore

  EngMultiByteToWideChar

  EngMultiByteToUnicodeN

  EngCreatePalette

  EngCopyBits

  EngAcquireSemaphore

  CreateScalableFontResourceW

  CreateICW

  CreateFontIndirectExA

  CreateDIBitmap

  CopyMetaFileA

  ColorCorrectPalette

  Arc

  GetEnhMetaFileW

  EndPage

  GetBkMode

  GetEnhMetaFileA

  DeleteObject

  EndDoc

  CreateMetaFileW

  BeginPath

  EndPath

  CreateMetaFileA

  FillPath

  AddFontResourceA

  GetFontLanguageInfo

  CreateHalftonePalette

  GetColorSpace

  SaveDC

  CloseEnhMetaFile

  CreateCompatibleDC

  GdiGetBatchLimit

  GetGraphicsMode

  SelectObject

  CloseFigure

  GetBkColor

  AbortDoc

  CreateSolidBrush

  SetBkMode

  DeleteDC

  SetTextAlign

  GetDCBrushColor

  CancelDC

  GetLayout

  GetDCPenColor

  DeleteEnhMetaFile

  GdiFlush

  SetTextColor

  ExtTextOutW

  DeleteMetaFile

  AbortPath

  CloseMetaFile

  AddFontResourceW

  CreatePatternBrush

  DeleteColorSpace

  advapi32

  CreateServiceW

  RegQueryValueExW

  ChangeServiceConfigW

  CloseServiceHandle

  ControlService

  ConvertSecurityDescriptorToStringSecurityDescriptorW

  ConvertSidToStringSidW

  ConvertStringSecurityDescriptorToSecurityDescriptorW

  ChangeServiceConfig2W

  DeleteService

  EnumDependentServicesW

  EnumServiceGroupW

  EnumServicesStatusExW

  EnumServicesStatusW

  GetServiceDisplayNameW

  GetServiceKeyNameW

  LockServiceDatabase

  NotifyBootConfigStatus

  OpenSCManagerW

  OpenServiceW

  QueryServiceConfig2W

  QueryServiceConfigW

  QueryServiceLockStatusW

  QueryServiceObjectSecurity

  QueryServiceStatus

  QueryServiceStatusEx

  RegCloseKey

  RegOpenKeyExW

  SetServiceObjectSecurity

  StartServiceW

  UnlockServiceDatabase

  shell32

  SHPathPrepareForWriteW

  SHLoadNonloadedIconOverlayIdentifiers

  SHPathPrepareForWriteA

  SHQueryRecycleBinA

  ShellExecuteExA

  ShellExecuteExW

  Shell_NotifyIconA

  DragAcceptFiles

  DragQueryFileAorW

  DragQueryPoint

  DuplicateIcon

  ExtractIconA

  ExtractIconEx

  ExtractIconExW

  ExtractIconW

  FindExecutableA

  SHBrowseForFolderA

  SHChangeNotify

  SHFileOperation

  SHGetDataFromIDListA

  SHGetDesktopFolder

  SHGetFileInfoA

  SHGetFolderPathW

  SHGetInstanceExplorer

  SHGetPathFromIDListA

  SHGetPathFromIDListW

  SHGetSettings

  SHGetSpecialFolderLocation

  SHInvokePrinterCommandA

  WOWShellExecute

  SHInvokePrinterCommandW

  shlwapi

  StrCmpNIA

  StrRChrA

  StrCmpNW

  StrRStrIW

  StrStrIA

  StrChrW

  StrChrA

  winmm

  timeGetTime

  msvcrt

  _XcptFilter

  __getmainargs

  __initenv

  __p__commode

  __p__fmode

  __set_app_type

  __setusermatherr

  __wgetmainargs

  __winitenv

  _adjust_fdiv

  _c_exit

  _cexit

  _controlfp

  _except_handler3

  _exit

  _getche

  _initterm

  _iob

  _isatty

  _itoa

  _setmode

  _splitpath

  _stricmp

  _strlwr

  _strncoll

  _strnicoll

  _strupr

  _ultoa

  _wcsicmp

  _wtol

  clock

  exit

  fclose

  fgets

  fopen

  fprintf

  free

  isalnum

  isalpha

  islower

  isprint

  isspace

  isupper

  isxdigit

  malloc

  memmove

  printf

  setlocale

  sprintf

  strchr

  strcoll

  strcspn

  strncpy

  tolower

  wcscmp

  wcscpy

  wcslen

  wcsncmp

  Sections

  .text

  Size: 297KB - Virtual size: 296KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 12KB - Virtual size: 11KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 6KB - Virtual size: 6KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 72KB - Virtual size: 71KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ