General

Malware Config

Signatures

Files

• a25c032f736a088ad2574afdfbf10662aacbfd0f14d05ae215033fd4eb21687e

  .exe windows x86

  4d4b956ae19d3fcbed5d6407c434822a

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_NO_BIND

  IMAGE_DLLCHARACTERISTICS_GUARD_CF

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP

  IMAGE_FILE_NET_RUN_FROM_SWAP

  IMAGE_FILE_SYSTEM

  Imports

  kernel32

  FlushFileBuffers

  GetStringTypeW

  LCMapStringW

  WriteConsoleW

  HeapSize

  HeapReAlloc

  CloseHandle

  LoadLibraryW

  GetACP

  GetCPInfo

  GetConsoleMode

  GetConsoleCP

  FindResourceExA

  GetSystemTimeAsFileTime

  GetCurrentProcessId

  GetTickCount

  QueryPerformanceCounter

  InterlockedDecrement

  GetCurrentThreadId

  SetLastError

  InterlockedIncrement

  TlsFree

  TlsSetValue

  TlsGetValue

  FileTimeToLocalFileTime

  GetCurrentDirectoryA

  GetModuleHandleA

  GetOEMCP

  GetModuleFileNameA

  LockResource

  CreateFileMappingA

  LoadLibraryA

  GlobalFree

  EnterCriticalSection

  GetProcAddress

  GetLastError

  GetStdHandle

  ReleaseSemaphore

  FileTimeToSystemTime

  MulDiv

  CreateSemaphoreA

  HeapCreate

  SizeofResource

  LeaveCriticalSection

  Sleep

  IsValidCodePage

  GlobalAlloc

  FindResourceA

  GetUserDefaultLangID

  WaitForSingleObject

  LoadResource

  FreeLibrary

  TlsAlloc

  GetEnvironmentStringsW

  WideCharToMultiByte

  FreeEnvironmentStringsW

  DeleteCriticalSection

  SetHandleCount

  MapViewOfFile

  SetFilePointer

  MultiByteToWideChar

  RtlUnwind

  GetModuleFileNameW

  WriteFile

  ExitProcess

  GetModuleHandleW

  IsProcessorFeaturePresent

  HeapFree

  HeapAlloc

  SetStdHandle

  InitializeCriticalSectionAndSpinCount

  GetFileType

  GetCommandLineA

  HeapSetInformation

  GetStartupInfoW

  RaiseException

  TerminateProcess

  GetCurrentProcess

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsDebuggerPresent

  DecodePointer

  EncodePointer

  CreateFileW

  user32

  FindWindowA

  SetDlgItemTextA

  SetWindowTextA

  GetSystemMetrics

  DispatchMessageA

  ShowWindow

  SetWindowPos

  MoveWindow

  UpdateWindow

  EndPaint

  DestroyWindow

  GetWindowRect

  PostQuitMessage

  DrawTextA

  LoadBitmapA

  LoadMenuA

  wsprintfA

  SendMessageA

  BeginPaint

  GetMonitorInfoA

  GetDC

  SetWindowLongA

  OemToCharA

  MessageBoxA

  GetWindowLongA

  CreateWindowExA

  ReleaseDC

  MonitorFromWindow

  GetDlgItem

  EndDialog

  DefWindowProcA

  gdi32

  BitBlt

  Pie

  GetTextExtentPoint32A

  SetTextColor

  DeleteDC

  CreateFontA

  GetDeviceCaps

  DeleteObject

  SelectObject

  CreateCompatibleDC

  CreateCompatibleBitmap

  Rectangle

  SetDCPenColor

  CreatePatternBrush

  CreatePen

  GetTextMetricsA

  GetStockObject

  EnumFontsA

  advapi32

  CloseServiceHandle

  DeleteService

  OpenSCManagerA

  QueryServiceStatus

  OpenServiceA

  shell32

  SHGetFolderPathW

  ole32

  ReleaseStgMedium

  version

  GetFileVersionInfoA

  VerQueryValueA

  GetFileVersionInfoSizeA

  comctl32

  ImageList_Add

  ImageList_Create

  setupapi

  SetupCreateDiskSpaceListA

  dxva2

  GetTimingReport

  Sections

  .text

  Size: 69KB - Virtual size: 69KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 21KB - Virtual size: 20KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 10KB - Virtual size: 17KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .edata

  Size: 51KB - Virtual size: 51KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .udata

  Size: 195KB - Virtual size: 194KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 112KB - Virtual size: 112KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 9KB - Virtual size: 8KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ