General

Malware Config

Signatures

Files

• ddf344c0494777f98b3f4d5657e696b047bfd5c32387b5962f59b2ca5474263a

  .zip
• E-ZPass.exe

  .exe windows x86

  72c93e79ef105545d74694c0793bc15d

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP

  IMAGE_FILE_NET_RUN_FROM_SWAP

  IMAGE_FILE_UP_SYSTEM_ONLY

  Imports

  kernel32

  InterlockedDecrement

  GetCurrentThreadId

  InterlockedIncrement

  TlsFree

  TlsSetValue

  TlsGetValue

  TlsAlloc

  DeleteCriticalSection

  GetFileType

  InitializeCriticalSectionAndSpinCount

  SetHandleCount

  GetEnvironmentStringsW

  WideCharToMultiByte

  FreeEnvironmentStringsW

  GetModuleFileNameA

  HeapCreate

  GetModuleFileNameW

  GetStdHandle

  WriteFile

  DecodePointer

  IsDebuggerPresent

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  GetCurrentProcess

  TerminateProcess

  GetStartupInfoW

  HeapSetInformation

  GetCommandLineA

  HeapAlloc

  QueryPerformanceCounter

  GetTickCount

  GetSystemTimeAsFileTime

  LeaveCriticalSection

  EnterCriticalSection

  GetCPInfo

  GetACP

  GetOEMCP

  IsValidCodePage

  HeapFree

  RtlUnwind

  HeapSize

  LCMapStringW

  MultiByteToWideChar

  GetStringTypeW

  HeapReAlloc

  GetCurrentProcessId

  LoadLibraryW

  IsBadReadPtr

  GetProcessHeap

  GetModuleHandleW

  GetModuleHandleA

  ExitProcess

  GetProcAddress

  SetLastError

  GetLastError

  CreateProcessA

  Sleep

  EncodePointer

  IsProcessorFeaturePresent

  user32

  MapVirtualKeyW

  RealChildWindowFromPoint

  MapDialogRect

  SendDlgItemMessageA

  GetMessageTime

  TranslateAcceleratorW

  WinHelpW

  EndDeferWindowPos

  FindWindowA

  DestroyMenu

  GetWindowDC

  IsChild

  UnregisterClassW

  CheckMenuItem

  EnumDisplayMonitors

  RegisterClipboardFormatW

  BeginDeferWindowPos

  GetKeyNameTextW

  FindWindowExW

  AppendMenuA

  ShowOwnedPopups

  IsZoomed

  GetLastActivePopup

  SetMenuItemBitmaps

  CopyImage

  AttachThreadInput

  GetMenuStringW

  FindWindowExA

  FindWindowW

  GetMenuCheckMarkDimensions

  GetClassLongW

  GetForegroundWindow

  SetWindowContextHelpId

  IsDialogMessageW

  IntersectRect

  BringWindowToTop

  GetClassNameW

  SendDlgItemMessageW

  SetLayeredWindowAttributes

  winspool.drv

  EnumPrintersA

  WritePrinter

  EndDocPrinter

  OpenPrinterA

  ClosePrinter

  StartPagePrinter

  StartDocPrinterA

  EndPagePrinter

  wininet

  ResumeSuspendedDownload

  Sections

  .text

  Size: 43KB - Virtual size: 43KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 43KB - Virtual size: 43KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 11KB - Virtual size: 14KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 25KB - Virtual size: 24KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ