General

Malware Config

Signatures

Files

• youWhen.db.zip

  .zip

  Password: infected

• youWhen.db

  .dll windows x86

  d2632f6acb821134ed92e8078dc06717

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_GUARD_CF

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  winspool.drv

  GetPrinterDataExW

  DeletePrinterConnectionW

  gdi32

  FloodFill

  GetObjectA

  GetDeviceGammaRamp

  GetWindowOrgEx

  ModifyWorldTransform

  GetPixel

  GetCurrentPositionEx

  GetTextExtentExPointW

  GetBrushOrgEx

  shell32

  FindExecutableW

  ExtractIconW

  user32

  LoadAcceleratorsA

  GetWindowTextA

  DefFrameProcW

  GetUserObjectInformationA

  GetKeyboardLayout

  GetKeyNameTextA

  GetQueueStatus

  LoadBitmapA

  DestroyIcon

  EqualRect

  FindWindowW

  DrawFrameControl

  IsWindowVisible

  msvcrt

  toupper

  _time64

  strcoll

  oleaut32

  LHashValOfNameSysA

  advapi32

  LookupAccountSidW

  GetOldestEventLogRecord

  GetSecurityDescriptorOwner

  EnumServicesStatusW

  RegOpenKeyA

  kernel32

  GetNLSVersion

  OutputDebugStringA

  GetCompressedFileSizeW

  GetTapePosition

  GetLastError

  GetQueuedCompletionStatus

  WaitForSingleObjectEx

  GetSystemDefaultUILanguage

  EnumSystemLocalesA

  GetExitCodeProcess

  lstrcmpA

  GetUserDefaultLCID

  GetPrivateProfileIntA

  VirtualAlloc

  GetLogicalDriveStringsA

  IsValidCodePage

  GetSystemWindowsDirectoryA

  GetDefaultCommConfigA

  LockResource

  DeleteCriticalSection

  GetModuleHandleW

  GetCurrentConsoleFont

  GetModuleFileNameW

  GetBinaryTypeW

  GlobalFree

  GetCommandLineA

  FindNextVolumeMountPointW

  GetCurrentDirectoryA

  Sections

  .text

  Size: 128KB - Virtual size: 127KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 296KB - Virtual size: 292KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 72KB - Virtual size: 81KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 76KB - Virtual size: 72KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 4KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 24KB - Virtual size: 21KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ