General

Malware Config

Signatures

Files

• ZB59.img

  .iso .vbs
• SK.js

  .js .vbs
• data.txt
• manacle/flown.temp

  .dll regsvr32 windows x86

  b121f840f8c504d34a3856981e588e27

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DEBUG_STRIPPED

  Imports

  kernel32

  CreateFileA

  FindClose

  FindFirstFileA

  FindNextFileA

  GetFileAttributesA

  GetFileSize

  GetFileType

  ReadFile

  CloseHandle

  GetLastError

  InitializeCriticalSection

  EnterCriticalSection

  LeaveCriticalSection

  CreateThread

  GetCurrentThreadId

  OpenThread

  SuspendThread

  MapViewOfFile

  GetModuleFileNameA

  CreateFileMappingA

  CreateNamedPipeA

  WaitNamedPipeA

  Exports

  Exports

  DllRegisterServer

  Sections

  .text

  Size: 44KB - Virtual size: 44KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 160KB - Virtual size: 160KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 163KB - Virtual size: 163KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 512B - Virtual size: 480B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• manacle/hinged.txt
• manacle/unquestioningly.txt