General

Malware Config

Signatures

Files

• 5de70ceb083241ffdd828e8aac6a94bb5ffd859f7dd658ededba8eb9dc439e0f

  .exe windows x86

  f9ee72c530e85b767a4ed3391690eadf

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  GetLocaleInfoA

  CreateToolhelp32Snapshot

  OpenMutexA

  Process32NextW

  Process32FirstW

  VirtualProtect

  SetLastError

  VirtualFree

  VirtualAlloc

  LoadLibraryA

  GetNativeSystemInfo

  HeapAlloc

  GetProcAddress

  GetProcessHeap

  FreeLibrary

  IsBadReadPtr

  GetTempPathW

  OpenProcess

  lstrcatW

  GetCurrentProcessId

  GetTempFileNameW

  GetCurrentProcess

  GetSystemDirectoryA

  GlobalAlloc

  GlobalLock

  GetTickCount

  GlobalUnlock

  WriteProcessMemory

  ResumeThread

  GetThreadContext

  ReadProcessMemory

  CreateProcessW

  SetThreadContext

  LocalAlloc

  GlobalFree

  MulDiv

  SizeofResource

  SetFilePointer

  FindResourceA

  LockResource

  LoadResource

  LocalFree

  FormatMessageA

  AllocConsole

  GetModuleFileNameA

  lstrcpynA

  QueryPerformanceFrequency

  CreateMutexA

  EnterCriticalSection

  LeaveCriticalSection

  InitializeCriticalSection

  DeleteCriticalSection

  HeapSize

  WriteConsoleW

  SetStdHandle

  SetEnvironmentVariableW

  SetEnvironmentVariableA

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GetCommandLineW

  GetCommandLineA

  GetOEMCP

  IsValidCodePage

  FindFirstFileExA

  ReadConsoleW

  GetConsoleMode

  GetConsoleCP

  FlushFileBuffers

  GetFileType

  GetTimeZoneInformation

  EnumSystemLocalesW

  GetUserDefaultLCID

  IsValidLocale

  GetTimeFormatW

  GetDateFormatW

  HeapReAlloc

  GetACP

  GetStdHandle

  GetModuleHandleExW

  MoveFileExW

  RtlUnwind

  RaiseException

  LoadLibraryExW

  GetCPInfo

  GetStringTypeW

  GetLocaleInfoW

  LCMapStringW

  CompareStringW

  TlsFree

  TlsSetValue

  CopyFileW

  GetLongPathNameW

  ExpandEnvironmentStringsA

  FindNextFileA

  FindFirstFileA

  GetFileSize

  TerminateThread

  GetLastError

  SetFileAttributesW

  GetModuleHandleA

  CreateDirectoryW

  RemoveDirectoryW

  MoveFileW

  SetFilePointerEx

  GetLogicalDriveStringsA

  DeleteFileW

  DeleteFileA

  GetFileAttributesW

  FindClose

  lstrlenA

  GetDriveTypeA

  FindNextFileW

  GetFileSizeEx

  FindFirstFileW

  ExitProcess

  CreateProcessA

  PeekNamedPipe

  CreatePipe

  TerminateProcess

  ReadFile

  HeapFree

  HeapCreate

  CreateEventA

  GetLocalTime

  CreateThread

  SetEvent

  CreateEventW

  WaitForSingleObject

  Sleep

  GetModuleFileNameW

  CloseHandle

  ExitThread

  CreateFileW

  WriteFile

  QueryPerformanceCounter

  TlsGetValue

  TlsAlloc

  InitializeCriticalSectionAndSpinCount

  MultiByteToWideChar

  DecodePointer

  EncodePointer

  WideCharToMultiByte

  InitializeSListHead

  GetSystemTimeAsFileTime

  GetCurrentThreadId

  IsProcessorFeaturePresent

  GetStartupInfoW

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  IsDebuggerPresent

  GetModuleHandleW

  WaitForSingleObjectEx

  ResetEvent

  SetEndOfFile

  user32

  CallNextHookEx

  GetKeyboardLayoutNameA

  GetKeyState

  GetWindowTextLengthW

  GetWindowThreadProcessId

  SetForegroundWindow

  SetClipboardData

  EnumWindows

  ExitWindowsEx

  TranslateMessage

  DispatchMessageA

  GetMessageA

  GetWindowTextW

  wsprintfW

  GetClipboardData

  UnhookWindowsHookEx

  GetForegroundWindow

  ToUnicodeEx

  GetKeyboardLayout

  SetWindowsHookExA

  CloseClipboard

  OpenClipboard

  GetKeyboardState

  DrawIcon

  GetSystemMetrics

  GetIconInfo

  SystemParametersInfoW

  GetCursorPos

  RegisterClassExA

  AppendMenuA

  mouse_event

  CreateWindowExA

  DefWindowProcA

  TrackPopupMenu

  CreatePopupMenu

  EnumDisplaySettingsW

  SendInput

  CloseWindow

  EmptyClipboard

  ShowWindow

  SetWindowTextW

  MessageBoxW

  IsWindowVisible

  gdi32

  CreateCompatibleBitmap

  SelectObject

  CreateCompatibleDC

  StretchBlt

  GetDIBits

  DeleteDC

  DeleteObject

  CreateDCA

  GetObjectA

  advapi32

  CryptAcquireContextA

  CryptGenRandom

  CryptReleaseContext

  GetUserNameW

  RegEnumKeyExA

  QueryServiceStatus

  CloseServiceHandle

  OpenSCManagerW

  OpenSCManagerA

  ControlService

  StartServiceW

  QueryServiceConfigW

  ChangeServiceConfigW

  OpenServiceW

  EnumServicesStatusW

  AdjustTokenPrivileges

  LookupPrivilegeValueA

  OpenProcessToken

  RegCreateKeyA

  RegCloseKey

  RegQueryInfoKeyW

  RegQueryValueExA

  RegCreateKeyExW

  RegEnumKeyExW

  RegSetValueExW

  RegSetValueExA

  RegOpenKeyExA

  RegOpenKeyExW

  RegCreateKeyW

  RegDeleteValueW

  RegEnumValueW

  RegQueryValueExW

  RegDeleteKeyA

  shell32

  ShellExecuteExA

  Shell_NotifyIconA

  ExtractIconA

  ShellExecuteW

  shlwapi

  StrToIntA

  PathFileExistsW

  PathFileExistsA

  winmm

  waveInPrepareHeader

  waveInStop

  waveInUnprepareHeader

  mciSendStringA

  PlaySoundW

  waveInOpen

  waveInStart

  waveInAddBuffer

  waveInClose

  mciSendStringW

  ws2_32

  WSAGetLastError

  recv

  connect

  socket

  send

  WSAStartup

  closesocket

  inet_ntoa

  gethostbyname

  WSASetLastError

  inet_addr

  gethostbyaddr

  getservbyport

  ntohs

  getservbyname

  htons

  htonl

  urlmon

  URLDownloadToFileW

  URLOpenBlockingStreamW

  gdiplus

  GdiplusStartup

  GdipGetImageEncoders

  GdipCloneImage

  GdipAlloc

  GdipDisposeImage

  GdipFree

  GdipGetImageEncodersSize

  GdipSaveImageToStream

  GdipLoadImageFromStream

  wininet

  InternetOpenUrlW

  InternetCloseHandle

  InternetReadFile

  InternetOpenW

  Sections

  .text

  Size: 334KB - Virtual size: 333KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 92KB - Virtual size: 92KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 3KB - Virtual size: 23KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 9B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .gfids

  Size: 1024B - Virtual size: 560B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 17KB - Virtual size: 17KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 14KB - Virtual size: 14KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ