General

Malware Config

Signatures

Files

• tmp

  .exe windows x86

  c642c0b422c0291be517cbe7f80512c6

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DEBUG_STRIPPED

  Imports

  advapi32

  CryptAcquireContextA

  CryptCreateHash

  CryptDestroyHash

  CryptDestroyKey

  CryptEncrypt

  CryptGenRandom

  CryptGetHashParam

  CryptHashData

  CryptImportKey

  CryptReleaseContext

  crypt32

  CertAddCertificateContextToStore

  CertCloseStore

  CertCreateCertificateChainEngine

  CertEnumCertificatesInStore

  CertFindCertificateInStore

  CertFindExtension

  CertFreeCertificateChain

  CertFreeCertificateChainEngine

  CertFreeCertificateContext

  CertGetCertificateChain

  CertGetNameStringA

  CertOpenStore

  CryptDecodeObjectEx

  CryptQueryObject

  CryptStringToBinaryA

  PFXImportCertStore

  kernel32

  AcquireSRWLockExclusive

  AddVectoredExceptionHandler

  CloseHandle

  CreateEventA

  CreateFileA

  CreateFileW

  CreateHardLinkW

  CreateSemaphoreA

  DeleteCriticalSection

  DeleteFileW

  DuplicateHandle

  EnterCriticalSection

  FindFirstVolumeW

  FindNextVolumeW

  FindVolumeClose

  FormatMessageA

  FormatMessageW

  FreeLibrary

  GetCurrentProcess

  GetCurrentProcessId

  GetCurrentThread

  GetCurrentThreadId

  GetDiskFreeSpaceExW

  GetEnvironmentVariableA

  GetFileAttributesW

  GetFileInformationByHandle

  GetFileSizeEx

  GetFileType

  GetFullPathNameW

  GetHandleInformation

  GetLastError

  GetModuleHandleA

  GetModuleHandleW

  GetProcAddress

  GetProcessAffinityMask

  GetStartupInfoA

  GetStdHandle

  GetSystemDirectoryA

  GetSystemTimeAsFileTime

  GetTempPathW

  GetThreadContext

  GetThreadPriority

  GetTickCount64

  GetTickCount

  GetVolumeInformationW

  InitializeCriticalSection

  InitializeCriticalSectionEx

  IsDBCSLeadByteEx

  IsDebuggerPresent

  LeaveCriticalSection

  LoadLibraryA

  LoadLibraryW

  LocalFree

  MoveFileExA

  MoveFileExW

  MultiByteToWideChar

  OpenProcess

  OutputDebugStringA

  PeekNamedPipe

  QueryPerformanceCounter

  QueryPerformanceFrequency

  RaiseException

  ReadFile

  ReleaseSRWLockExclusive

  ReleaseSemaphore

  RemoveDirectoryW

  RemoveVectoredExceptionHandler

  ResetEvent

  ResumeThread

  SetEndOfFile

  SetEvent

  SetFilePointer

  SetLastError

  SetProcessAffinityMask

  SetThreadContext

  SetThreadPriority

  SetUnhandledExceptionFilter

  Sleep

  SleepEx

  SuspendThread

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TryEnterCriticalSection

  VerSetConditionMask

  VerifyVersionInfoW

  VirtualProtect

  VirtualQuery

  WaitForMultipleObjects

  WaitForSingleObject

  WaitForSingleObjectEx

  WideCharToMultiByte

  msvcrt

  __getmainargs

  __initenv

  __mb_cur_max

  __p__acmdln

  __p__commode

  __p__fmode

  __set_app_type

  __setusermatherr

  _access

  _amsg_exit

  _beginthreadex

  _cexit

  _close

  _close

  _endthreadex

  _errno

  _fdopen

  _findclose

  _fileno

  _fstat64

  _fstati64

  _get_osfhandle

  _getpid

  _initterm

  _iob

  _lseeki64

  _onexit

  _open

  _setjmp3

  _stati64

  _read

  _strdup

  _sys_errlist

  _sys_nerr

  _telli64

  _ultoa

  _unlink

  _wchdir

  _wchmod

  _wfindfirst

  _wfindnext

  _wfopen

  _wfullpath

  _wgetcwd

  _wmkdir

  _wopen

  _write

  _wstat64

  _wutime

  abort

  atoi

  calloc

  exit

  fclose

  feof

  fflush

  fgets

  fopen

  fprintf

  fputc

  fputs

  fread

  free

  fseek

  ftell

  fwrite

  getc

  gmtime

  getenv

  islower

  isspace

  isupper

  iswctype

  isxdigit

  localeconv

  longjmp

  malloc

  mbstowcs

  memchr

  memcmp

  memcpy

  memmove

  memset

  printf

  qsort

  realloc

  setlocale

  setvbuf

  signal

  strchr

  strcmp

  strcoll

  strcpy

  strcspn

  strerror

  strftime

  strlen

  strncmp

  strncpy

  strpbrk

  strrchr

  strspn

  strstr

  strtol

  strtoul

  strxfrm

  time

  tolower

  towlower

  towupper

  ungetc

  vfprintf

  wcscat

  wcscmp

  wcscoll

  wcscpy

  wcsftime

  wcslen

  wcsxfrm

  wcstombs

  ws2_32

  WSACleanup

  WSACloseEvent

  WSACreateEvent

  WSAEnumNetworkEvents

  WSAEventSelect

  WSAGetLastError

  WSAIoctl

  WSAResetEvent

  WSASetEvent

  WSASetLastError

  WSAStartup

  WSAWaitForMultipleEvents

  __WSAFDIsSet

  accept

  bind

  closesocket

  connect

  freeaddrinfo

  getaddrinfo

  gethostname

  getpeername

  getsockname

  getsockopt

  htonl

  htons

  inet_pton

  ioctlsocket

  listen

  ntohs

  recv

  recvfrom

  select

  send

  sendto

  setsockopt

  socket

  Sections

  .text

  Size: 1.3MB - Virtual size: 1.3MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 5KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 126KB - Virtual size: 125KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .eh_fram

  Size: 319KB - Virtual size: 319KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .bss

  Size: - Virtual size: 3KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 8KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .CRT

  Size: 512B - Virtual size: 52B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 8B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 39KB - Virtual size: 38KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ