General

Malware Config

Signatures

Files

• Document_OF62.iso

  .iso
• Document.lnk

  .lnk
• belts/anyhow.tmp

  .dll windows x64

  3e72d88070d6a7fcfeed86660b802e13

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  user32

  LoadBitmapA

  GetMenuItemCount

  GetMessageTime

  shlwapi

  ord151

  StrRetToBSTR

  StrRetToBufA

  StrCmpNA

  StrRetToStrA

  Exports

  Exports

  BZzobHOgNzoY

  Jbadsjasfks

  ZLZecyQcuKUzjfFQ

  Sections

  .text

  Size: 24KB - Virtual size: 23KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 66KB - Virtual size: 65KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 512B - Virtual size: 480B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• belts/coleman.cmd

  .cmd .vbs
• belts/disparager.txt
• belts/forties.txt
• belts/sinus.cmd

  .cmd .vbs