General

Malware Config

Signatures

Files

• 5719460c6ef7567bb9481de8d0fadd3b54bcf9202ad16279975c5fa99d3c93c8

  .exe windows x86

  b57f75e6aff524bc79e3d80c2fa5edae

  
  

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  msvcrt

  __dllonexit

  _setmbcp

  _onexit

  _controlfp

  _except_handler3

  __set_app_type

  __p__fmode

  __p__commode

  _adjust_fdiv

  __setusermatherr

  _initterm

  __getmainargs

  _acmdln

  _dup

  _mbsnextc

  tanh

  _heapmin

  advapi32

  GetServiceKeyNameA

  CreateProcessAsUserA

  SetServiceStatus

  GetSidSubAuthorityCount

  InitializeSid

  LsaQueryInformationPolicy

  ChangeServiceConfigA

  ReadEventLogW

  EnumServicesStatusA

  RegUnLoadKeyW

  RegSetValueW

  LookupPrivilegeValueW

  RegSetValueA

  AddAccessAllowedAce

  SetSecurityDescriptorSacl

  CreateProcessAsUserW

  OpenServiceA

  FreeSid

  GetFileSecurityW

  GetUserNameW

  ReportEventW

  RegQueryValueA

  RegOpenKeyExW

  SetKernelObjectSecurity

  RegisterEventSourceA

  CopySid

  MakeAbsoluteSD

  CloseServiceHandle

  QueryServiceConfigW

  GetSidSubAuthority

  GetSidLengthRequired

  RegOverridePredefKey

  RegDeleteKeyA

  StartServiceCtrlDispatcherA

  AllocateAndInitializeSid

  ChangeServiceConfig2A

  InitiateSystemShutdownA

  LockServiceDatabase

  RegisterServiceCtrlHandlerA

  StartServiceA

  AddAce

  DeleteAce

  ReportEventA

  RegCloseKey

  SetFileSecurityA

  RegCreateKeyW

  OpenEventLogW

  GetKernelObjectSecurity

  SetServiceObjectSecurity

  imagehlp

  BindImage

  user32

  DdeConnectList

  InSendMessage

  mpr

  MultinetGetConnectionPerformanceA

  WNetCancelConnectionA

  WNetDisconnectDialog1A

  WNetConnectionDialog1A

  WNetGetConnectionA

  WNetUseConnectionA

  kernel32

  GetStringTypeA

  EnumDateFormatsW

  GetStartupInfoA

  CreateProcessW

  GetVersion

  ExpandEnvironmentStringsW

  GetModuleHandleA

  mfc42

  ord1043

  ord4424

  ord3738

  ord561

  ord1168

  ord1576

  ord4080

  ord3079

  ord1006

  ord4465

  ord3259

  ord1073

  ord2982

  ord3953

  ord5714

  ord1093

  ord5307

  ord4698

  ord3825

  ord3831

  ord3830

  ord3401

  ord2976

  ord3081

  ord2985

  ord3262

  ord815

  ord6375

  ord4486

  ord2554

  ord1024

  ord5731

  ord3922

  ord1089

  ord1014

  ord2396

  ord3346

  ord1100

  ord5302

  ord2725

  ord1001

  Sections

  .text

  Size: 96KB - Virtual size: 92KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 4KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 8KB - Virtual size: 1.2MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 256KB - Virtual size: 253KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ