General

Malware Config

Signatures

Files

• 17f00476ba3b80b94fe3205f017436657200c33bdc14810a4520dd46c98f4deb

  .dll regsvr32 windows x86

  0f1f0419a24eb68846043bdb6617547c

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  msvcrt

  _initterm

  wcscmp

  _except_handler3

  _vsnwprintf

  wcslen

  _wcsicmp

  wcsncpy

  wcsncmp

  wcsstr

  wcsrchr

  wcschr

  _onexit

  __dllonexit

  _adjust_fdiv

  malloc

  wcscpy

  free

  qsort

  _itow

  wcstol

  memmove

  advapi32

  RegQueryInfoKeyW

  OpenSCManagerW

  OpenServiceW

  CloseServiceHandle

  ControlService

  RegCreateKeyExW

  RegSetValueExW

  RegQueryValueExW

  OpenProcessToken

  LookupPrivilegeValueW

  AdjustTokenPrivileges

  PrivilegeCheck

  RegEnumKeyExW

  RegCloseKey

  RegOpenKeyExW

  AllocateAndInitializeSid

  RegEnumValueW

  CheckTokenMembership

  FreeSid

  gdi32

  GetDIBits

  SetTextColor

  SetBkColor

  GetBkMode

  GetTextExtentPoint32W

  GetDeviceCaps

  RealizePalette

  SelectPalette

  CreateHalftonePalette

  StretchBlt

  SetStretchBltMode

  DeleteObject

  DeleteDC

  GetObjectW

  SelectObject

  SetBrushOrgEx

  CreateCompatibleDC

  CreateDIBSection

  SetBkMode

  ExtTextOutW

  gdiplus

  GdipDisposeImage

  GdipCreateBitmapFromFile

  GdipCreateBitmapFromFileICM

  GdipCreateHBITMAPFromBitmap

  GdipFree

  GdipAlloc

  GdipCloneImage

  GdiplusStartup

  GdiplusShutdown

  kernel32

  DelayLoadFailureHook

  UnmapViewOfFile

  CreateFileMappingW

  ReleaseMutex

  MapViewOfFile

  OpenFileMappingW

  CreateMutexW

  GetWindowsDirectoryW

  GetModuleFileNameW

  LocalAlloc

  LocalFree

  LoadLibraryExA

  lstrcpyW

  InterlockedDecrement

  InterlockedIncrement

  CreateThread

  GetLastError

  DeleteCriticalSection

  InitializeCriticalSection

  EnterCriticalSection

  LeaveCriticalSection

  GlobalFree

  GlobalLock

  GlobalAlloc

  GlobalUnlock

  GlobalSize

  GetModuleHandleW

  WideCharToMultiByte

  MoveFileW

  DeleteFileW

  SetFileAttributesW

  GetFileAttributesW

  lstrcpyA

  ReadFile

  GetFileSize

  CreateFileW

  lstrcatW

  GetTempPathW

  GetTempFileNameW

  WaitForSingleObject

  FileTimeToSystemTime

  TlsFree

  TlsAlloc

  TlsGetValue

  CompareStringW

  lstrcmpiW

  LocalFileTimeToFileTime

  SystemTimeToFileTime

  lstrcpynW

  FreeLibrary

  GetProcAddress

  LoadLibraryW

  ExitThread

  SetEvent

  InterlockedExchange

  CreateEventW

  Sleep

  InterlockedExchangeAdd

  GetTimeFormatW

  GetDateFormatW

  GetVersionExW

  GetCurrentProcess

  TlsSetValue

  GetSystemWindowsDirectoryW

  lstrlenW

  WriteFile

  CreateProcessW

  lstrcmpW

  GetLocalTime

  InterlockedCompareExchange

  LoadLibraryA

  QueryPerformanceCounter

  GetTickCount

  GetCurrentThreadId

  GetCurrentProcessId

  GetSystemTimeAsFileTime

  TerminateProcess

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  CloseHandle

  ole32

  CoAllowSetForegroundWindow

  CoUninitialize

  CLSIDFromString

  CoTaskMemAlloc

  PropVariantClear

  FreePropVariantArray

  CoInitialize

  CoMarshalInterThreadInterfaceInStream

  CreateStreamOnHGlobal

  ReleaseStgMedium

  CoCreateInstance

  oleaut32

  SystemTimeToVariantTime

  VariantInit

  SafeArrayCreateVector

  SysStringLen

  SysFreeString

  SysAllocString

  SysAllocStringLen

  VariantClear

  shell32

  ShellExecuteW

  ord80

  ord745

  ord744

  ord237

  SHGetFolderPathW

  ord6

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHGetDesktopFolder

  ord196

  ord73

  ord155

  SHChangeNotify

  SHGetSpecialFolderLocation

  ord16

  ShellExecuteExW

  ord152

  ord18

  SHGetFileInfoW

  ord67

  ord25

  SHGetMalloc

  SHGetFolderLocation

  ord153

  ord701

  ord256

  shlwapi

  AssocQueryStringW

  ord437

  ord199

  ord186

  ord540

  PathRemoveArgsW

  PathFindExtensionW

  StrFormatByteSizeW

  StrRetToBufW

  PathCompactPathExW

  PathAddExtensionW

  PathRemoveExtensionW

  user32

  LoadStringW

  MessageBoxW

  RegisterClipboardFormatW

  ReleaseDC

  GetDC

  DestroyMenu

  GetSubMenu

  LoadMenuW

  LoadStringA

  InsertMenuItemW

  RemoveMenu

  SetMenuDefaultItem

  DestroyIcon

  DrawIconEx

  LoadIconW

  GetDesktopWindow

  wsprintfW

  EnableWindow

  IsWindow

  PostMessageW

  DestroyWindow

  SetWindowLongW

  GetWindowLongW

  SetCursor

  LoadCursorW

  SetWindowTextW

  EndDialog

  GetDlgItem

  WinHelpW

  LoadImageW

  SendMessageW

  CallWindowProcW

  GetParent

  DrawFocusRect

  GetSysColor

  GetWindowTextW

  GetWindowTextLengthW

  CheckDlgButton

  SendDlgItemMessageW

  GetDlgItemTextW

  InvalidateRect

  IsDlgButtonChecked

  SetDlgItemTextW

  DefWindowProcW

  RemovePropW

  GetClassInfoW

  GetPropW

  IsWindowVisible

  ShowWindow

  SetDlgItemInt

  SetPropW

  FindWindowExW

  CheckRadioButton

  MsgWaitForMultipleObjects

  TranslateMessage

  DispatchMessageW

  PeekMessageW

  FillRect

  GetSysColorBrush

  MessageBoxIndirectW

  SetForegroundWindow

  GetLastActivePopup

  CreateDialogParamW

  DialogBoxParamW

  GetSystemMetrics

  wininet

  CreateUrlCacheEntryW

  CommitUrlCacheEntryW

  Exports

  Exports

  AddDeviceWasChosen

  AddDeviceWasChosenA

  AddDeviceWasChosenW

  DllCanUnloadNow

  DllGetClassObject

  DllRegisterServer

  DllUnregisterServer

  DoDeleteAllItems

  GetDeviceFromDeviceId

  GetDeviceIdFromDevice

  GetDeviceUIKey

  GetGeneralUIKey

  IMCreateCameraItemIDL

  IMGetDeviceIdFromIDL

  IMGetFullPathNameFromIDL

  IMGetItemFromIDL

  MakeFullPidlForDevice

  PropertySheetFromDevice

  PropertySheetFromItem

  TakeAPicture

  Sections

  .text

  Size: 127KB - Virtual size: 126KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .data

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 533KB - Virtual size: 533KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 10KB - Virtual size: 9KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ