General

Malware Config

Signatures

Files

• 3982c767d814e68cb965d6c33acb9ffa7f844a9d5aa9a02b22014ee3875f1a74

  .exe windows x86

  1c2489367a741a394ef5f46c06397c1b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  VirtualAllocEx

  FindClose

  LoadLibraryA

  RemoveDirectoryW

  WaitForMultipleObjects

  lstrcmpiW

  FindNextFileW

  VirtualProtect

  GetFileTime

  ReleaseMutex

  FileTimeToLocalFileTime

  GetVolumeNameForVolumeMountPointW

  DeleteFileW

  GetFileInformationByHandle

  LocalFree

  GetSystemTime

  WriteProcessMemory

  SetFileAttributesW

  CreateThread

  ExpandEnvironmentStringsW

  GetCurrentThreadId

  ExitProcess

  SetEvent

  lstrcmpiA

  WTSGetActiveConsoleSessionId

  CreateEventW

  MapViewOfFile

  WriteFile

  SetThreadPriority

  VirtualProtectEx

  TlsAlloc

  TlsFree

  GetFileAttributesExW

  GetPrivateProfileStringW

  GetPrivateProfileIntW

  GetLocalTime

  ResetEvent

  TlsGetValue

  TlsSetValue

  TerminateProcess

  MoveFileExW

  GetModuleFileNameW

  GetUserDefaultUILanguage

  GetThreadContext

  SetThreadContext

  GetProcessId

  GetNativeSystemInfo

  GetVersionExW

  GetCommandLineW

  SetErrorMode

  GetComputerNameW

  OpenEventW

  DuplicateHandle

  GetCurrentProcessId

  VirtualQueryEx

  SetFileTime

  VirtualAlloc

  GetProcAddress

  SetLastError

  GetLastError

  OpenMutexW

  GetFileSizeEx

  GetTempPathW

  FlushFileBuffers

  MultiByteToWideChar

  IsBadReadPtr

  GetProcessHeap

  CreateFileW

  GetTimeZoneInformation

  ReadFile

  Thread32Next

  GetFileAttributesW

  HeapCreate

  HeapDestroy

  ReadProcessMemory

  Sleep

  LoadLibraryW

  WideCharToMultiByte

  CreateFileMappingW

  Thread32First

  VirtualFree

  GetCurrentThread

  GetModuleHandleW

  CreateDirectoryW

  HeapFree

  SetFilePointerEx

  SystemTimeToFileTime

  HeapAlloc

  CreateProcessW

  FreeLibrary

  SetEndOfFile

  FindFirstFileW

  CreateMutexW

  HeapReAlloc

  GetTempFileNameW

  FileTimeToDosDateTime

  GetEnvironmentVariableW

  CloseHandle

  CreateToolhelp32Snapshot

  Process32NextW

  Process32FirstW

  VirtualFreeEx

  OpenProcess

  CreateRemoteThread

  WaitForSingleObject

  EnterCriticalSection

  GlobalUnlock

  LeaveCriticalSection

  InitializeCriticalSection

  GetTickCount

  UnmapViewOfFile

  GlobalLock

  user32

  OpenInputDesktop

  MenuItemFromPoint

  GetMenu

  RegisterClassExW

  GetMenuItemRect

  TrackPopupMenuEx

  SystemParametersInfoW

  GetClassNameW

  GetMenuState

  DefWindowProcA

  DefMDIChildProcW

  SwitchDesktop

  GetMenuItemCount

  DefDlgProcA

  PostThreadMessageW

  DefMDIChildProcA

  HiliteMenuItem

  DefFrameProcA

  SendMessageW

  CallWindowProcA

  EndMenu

  CallWindowProcW

  DefWindowProcW

  DefFrameProcW

  GetWindowThreadProcessId

  GetMessageW

  GetShellWindow

  CharLowerW

  CreateDesktopW

  SetProcessWindowStation

  GetThreadDesktop

  GetSystemMetrics

  MapVirtualKeyW

  GetUpdateRgn

  CharLowerBuffA

  ExitWindowsEx

  FillRect

  DrawEdge

  IntersectRect

  EqualRect

  PrintWindow

  GetWindowRect

  PostMessageW

  GetParent

  GetWindowInfo

  GetClassLongW

  GetAncestor

  SetWindowPos

  IsWindow

  MapWindowPoints

  IsRectEmpty

  DrawIcon

  GetIconInfo

  EndPaint

  GetWindowDC

  SetCapture

  GetSubMenu

  BeginPaint

  GetMessageA

  RegisterClassW

  GetUpdateRect

  DefDlgProcW

  SetCursorPos

  GetDCEx

  ToUnicode

  GetClipboardData

  PeekMessageA

  GetCursorPos

  ReleaseCapture

  GetMessagePos

  CloseWindowStation

  CreateWindowStationW

  GetProcessWindowStation

  OpenDesktopW

  CloseDesktop

  SetThreadDesktop

  GetUserObjectInformationW

  OpenWindowStationW

  GetTopWindow

  LoadImageW

  MsgWaitForMultipleObjects

  WindowFromPoint

  CharToOemW

  GetDC

  GetWindowLongW

  CharLowerA

  RegisterClassExA

  RegisterWindowMessageW

  GetMenuItemID

  SetKeyboardState

  RegisterClassA

  GetKeyboardState

  TranslateMessage

  DispatchMessageW

  GetWindow

  SendMessageTimeoutW

  SetWindowLongW

  CharUpperW

  ReleaseDC

  PeekMessageW

  GetCapture

  advapi32

  GetLengthSid

  CryptGetHashParam

  OpenProcessToken

  GetSidSubAuthority

  CryptAcquireContextW

  OpenThreadToken

  GetSidSubAuthorityCount

  GetTokenInformation

  RegCreateKeyExW

  CryptReleaseContext

  RegQueryValueExW

  CreateProcessAsUserW

  InitializeSecurityDescriptor

  SetSecurityDescriptorDacl

  SetNamedSecurityInfoW

  LookupPrivilegeValueW

  CryptCreateHash

  ConvertStringSecurityDescriptorToSecurityDescriptorW

  RegOpenKeyExW

  GetSecurityDescriptorSacl

  SetSecurityDescriptorSacl

  CryptDestroyHash

  AdjustTokenPrivileges

  RegCloseKey

  RegSetValueExW

  CryptHashData

  EqualSid

  RegEnumKeyExW

  InitiateSystemShutdownExW

  ConvertSidToStringSidW

  IsWellKnownSid

  shlwapi

  wvnsprintfW

  PathQuoteSpacesW

  PathIsURLW

  PathRenameExtensionW

  StrStrIW

  StrStrIA

  StrCmpNIW

  wvnsprintfA

  StrCmpNIA

  PathMatchSpecW

  PathRemoveBackslashW

  PathUnquoteSpacesW

  PathAddExtensionW

  PathCombineW

  SHDeleteKeyW

  PathSkipRootW

  SHDeleteValueW

  PathAddBackslashW

  PathRemoveFileSpecW

  PathFindFileNameW

  PathIsDirectoryW

  UrlUnescapeA

  shell32

  ShellExecuteW

  SHGetFolderPathW

  CommandLineToArgvW

  secur32

  GetUserNameExW

  ole32

  StringFromGUID2

  CLSIDFromString

  CoUninitialize

  CoCreateInstance

  CoInitializeEx

  gdi32

  RestoreDC

  SaveDC

  DeleteDC

  GdiFlush

  SetViewportOrgEx

  SelectObject

  CreateCompatibleDC

  CreateDIBSection

  GetDeviceCaps

  GetDIBits

  DeleteObject

  SetRectRgn

  CreateCompatibleBitmap

  ws2_32

  WSASetLastError

  freeaddrinfo

  socket

  bind

  recv

  setsockopt

  shutdown

  getsockname

  getpeername

  recvfrom

  sendto

  WSASend

  WSAEventSelect

  WSAIoctl

  connect

  WSAAddressToStringW

  WSAStartup

  getaddrinfo

  select

  closesocket

  send

  listen

  accept

  WSAGetLastError

  crypt32

  PFXExportCertStoreEx

  CertDuplicateCertificateContext

  CertEnumCertificatesInStore

  PFXImportCertStore

  CertCloseStore

  CertOpenSystemStoreW

  CertDeleteCertificateFromStore

  CryptUnprotectData

  wininet

  HttpAddRequestHeadersW

  InternetSetStatusCallbackW

  GetUrlCacheEntryInfoW

  HttpAddRequestHeadersA

  HttpSendRequestW

  InternetReadFileExA

  InternetQueryDataAvailable

  HttpSendRequestExW

  HttpSendRequestExA

  InternetQueryOptionA

  InternetCloseHandle

  InternetOpenA

  HttpSendRequestA

  HttpOpenRequestA

  InternetSetOptionA

  InternetReadFile

  InternetCrackUrlA

  InternetQueryOptionW

  InternetConnectA

  HttpQueryInfoA

  oleaut32

  VariantInit

  SysAllocString

  VariantClear

  SysFreeString

  netapi32

  NetApiBufferFree

  NetUserEnum

  NetUserGetInfo

  Sections

  .text

  Size: 129KB - Virtual size: 129KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 1024B - Virtual size: 8KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 6KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ