General

Malware Config

Signatures

Files

• a02f65b0fece16c54d4ef59d615a6c4a021ae8f8a780da0d349effc989826592

  .exe windows x86

  d67a47f5a24b521d0c3ec768f66fd42f

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  msvcrt

  ??2@YAPAXI@Z

  _vsnprintf

  malloc

  free

  _ftol

  _itow

  ??3@YAXPAX@Z

  _except_handler3

  wcsrchr

  kernel32

  GetSystemTimeAsFileTime

  TerminateProcess

  GetCurrentProcess

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  CreateFileMappingA

  MapViewOfFile

  UnmapViewOfFile

  GetCurrentProcessId

  GetPrivateProfileIntA

  GetTickCount

  GetPrivateProfileStringW

  GetPrivateProfileStringA

  GetFullPathNameW

  GetFullPathNameA

  GetLocaleInfoA

  lstrlenA

  GetPrivateProfileIntW

  GetCurrentThreadId

  lstrcpyA

  HeapReAlloc

  HeapAlloc

  GetProcessHeap

  HeapFree

  FreeLibrary

  GetSystemDirectoryA

  QueryPerformanceCounter

  GetModuleHandleA

  GetCommandLineW

  GetCommandLineA

  MultiByteToWideChar

  ExitProcess

  GetStdHandle

  lstrlenW

  WideCharToMultiByte

  GetLastError

  WriteConsoleW

  WriteFile

  GetFileType

  GetFileSize

  CreateFileW

  CreateEventA

  GetCPInfo

  GetACP

  FindClose

  FindFirstFileA

  GetFileAttributesA

  FindFirstFileW

  GetFileAttributesW

  LocalFree

  FormatMessageA

  LocalAlloc

  FormatMessageW

  GetProcAddress

  LoadLibraryA

  InitializeCriticalSection

  GetModuleFileNameA

  GetModuleFileNameW

  DeleteCriticalSection

  SetEvent

  CloseHandle

  CreateThread

  GetTempPathA

  EnterCriticalSection

  LeaveCriticalSection

  GetVersionExA

  InterlockedIncrement

  InterlockedDecrement

  GetUserDefaultLCID

  FlushFileBuffers

  CreateFileA

  GetTempFileNameA

  oleaut32

  SysFreeString

  SafeArrayCopy

  LoadRegTypeLi

  SafeArrayCreate

  SafeArrayPutElement

  SafeArrayDestroy

  SafeArrayGetUBound

  SafeArrayGetElement

  VariantChangeType

  LoadTypeLi

  VariantInit

  VariantCopy

  VariantClear

  SysAllocStringByteLen

  SysAllocStringLen

  CreateErrorInfo

  SetErrorInfo

  SysAllocString

  SysStringLen

  SafeArrayGetLBound

  ole32

  CreateFileMoniker

  CoCreateInstance

  CoInitializeSecurity

  CreateBindCtx

  CoRegisterMessageFilter

  CLSIDFromString

  CoInitialize

  CoUninitialize

  CoGetClassObject

  MkParseDisplayName

  CLSIDFromProgID

  version

  GetFileVersionInfoSizeW

  GetFileVersionInfoW

  VerQueryValueA

  GetFileVersionInfoA

  GetFileVersionInfoSizeA

  VerQueryValueW

  imm32

  ImmGetDefaultIMEWnd

  advapi32

  RegSetValueExA

  RegQueryValueExW

  RegQueryValueExA

  RegCreateKeyExW

  RegCreateKeyExA

  RegOpenKeyExW

  RegOpenKeyExA

  ImpersonateLoggedOnUser

  IsTextUnicode

  RegisterEventSourceW

  GetUserNameW

  LookupAccountNameW

  ReportEventW

  DeregisterEventSource

  RegCloseKey

  RegSetValueExW

  user32

  LoadStringA

  LoadStringW

  CharNextA

  GetActiveWindow

  GetClassInfoA

  RegisterClassA

  CreateWindowExA

  GetMessageA

  GetWindowLongA

  SetWindowLongA

  SetTimer

  DefWindowProcA

  PostQuitMessage

  KillTimer

  EnumThreadWindows

  IsWindowVisible

  PostMessageA

  SendMessageA

  MsgWaitForMultipleObjects

  PeekMessageA

  TranslateMessage

  DispatchMessageA

  GetParent

  wsprintfW

  wsprintfA

  Sections

  .text

  Size: 56KB - Virtual size: 55KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  Size: 52KB - Virtual size: 48KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 32KB - Virtual size: 31KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ