General

Malware Config

Signatures

Files

• 8209336365.zip

  .zip

  Password: infected

• 1dba5f321b3b289692f794c663ba008a9424f2a845f4b453e00ce0ea52450845

  .dll regsvr32 windows x86

  Password: infected

  2f1cb7eb3d252fbf82afd26f16d7b0e6

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  Sleep

  FormatMessageW

  SetSystemPowerState

  EnterCriticalSection

  VirtualProtectEx

  FindClose

  CreateEventW

  FindNextFileW

  TlsAlloc

  FileTimeToLocalFileTime

  GetVersion

  CloseHandle

  WriteConsoleW

  SetFilePointerEx

  SetStdHandle

  SetEnvironmentVariableA

  GetConsoleMode

  GetConsoleCP

  FlushFileBuffers

  GetSystemDirectoryW

  LCMapStringW

  CompareStringW

  GetStringTypeW

  HeapReAlloc

  LoadLibraryExW

  GetModuleFileNameW

  WriteFile

  LeaveCriticalSection

  TlsFree

  TlsSetValue

  InitializeCriticalSection

  GetSystemTimeAsFileTime

  GetModuleHandleW

  GetCPInfo

  FindFirstChangeNotificationW

  OutputDebugStringW

  FindFirstFileW

  TlsGetValue

  TerminateProcess

  GetCurrentProcess

  InitializeCriticalSectionAndSpinCount

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GetCurrentProcessId

  QueryPerformanceCounter

  GetModuleFileNameA

  GetStartupInfoW

  DeleteCriticalSection

  GetFileType

  GetStdHandle

  GetProcessHeap

  HeapAlloc

  GetTimeZoneInformation

  HeapFree

  CreateFileW

  SetLastError

  GetOEMCP

  GetACP

  EncodePointer

  DecodePointer

  GetCommandLineA

  GetCurrentThreadId

  RaiseException

  RtlUnwind

  IsDebuggerPresent

  IsProcessorFeaturePresent

  GetLastError

  ExitProcess

  GetModuleHandleExW

  GetProcAddress

  MultiByteToWideChar

  WideCharToMultiByte

  HeapSize

  IsValidCodePage

  user32

  LoadImageW

  EnumChildWindows

  GetClassNameW

  GetWindowTextW

  AppendMenuW

  CheckMenuRadioItem

  GetAsyncKeyState

  LoadIconW

  IsDialogMessageW

  TranslateMessage

  GetDC

  CreateMenu

  FindWindowW

  DrawIcon

  DispatchMessageW

  GetMessagePos

  GetPropW

  DrawFrameControl

  UnregisterHotKey

  UpdateWindow

  BeginDeferWindowPos

  DeferWindowPos

  GetActiveWindow

  TrackPopupMenu

  RegisterWindowMessageW

  FillRect

  IsWindowEnabled

  PostMessageW

  ShowWindow

  gdi32

  PtVisible

  CreateFontW

  CreateRectRgn

  GetPixel

  GetStockObject

  SelectClipRgn

  ole32

  OleSetContainedObject

  OleInitialize

  CoSuspendClassObjects

  OleUninitialize

  StgCreateDocfile

  CoInitialize

  OleCreate

  CoUninitialize

  wininet

  InternetOpenW

  InternetSetOptionExW

  InternetQueryDataAvailable

  InternetOpenUrlW

  InternetReadFile

  InternetConnectW

  InternetWriteFile

  HttpSendRequestW

  InternetSetStatusCallbackW

  HttpQueryInfoW

  InternetSetFilePointer

  InternetCanonicalizeUrlW

  InternetCloseHandle

  HttpOpenRequestW

  Exports

  Exports

  DllRegisterServer

  Sections

  .text

  Size: 240KB - Virtual size: 240KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 43KB - Virtual size: 43KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 5KB - Virtual size: 5.0MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 67KB - Virtual size: 66KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 7KB - Virtual size: 6KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ