General

Malware Config

Signatures

Files

• e848b9957e87c41a2b7b262bbe83c140b7fa466e953e11cae6dffe8c9b973ac1

  .exe windows x86

  571fc26537b740da79ac8f44162a5ed8

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_AGGRESIVE_WS_TRIM

  IMAGE_FILE_32BIT_MACHINE

  Imports

  msvcrt

  wcsrchr

  time

  _except_handler3

  memmove

  wcschr

  _c_exit

  _exit

  _XcptFilter

  _cexit

  _wcsicmp

  exit

  __initenv

  __getmainargs

  __setusermatherr

  _adjust_fdiv

  __p__commode

  __p__fmode

  __set_app_type

  _controlfp

  wcslen

  wcsncmp

  _wtol

  wcscpy

  _itow

  _wcsnicmp

  wcscat

  _initterm

  wcsncpy

  wcscspn

  _ultow

  advapi32

  RegOpenKeyW

  ConvertSidToStringSidW

  LogonUserExW

  LsaStorePrivateData

  LsaLookupNames

  LsaQueryInformationPolicy

  OpenThreadToken

  RegNotifyChangeKeyValue

  InitializeSecurityDescriptor

  StartServiceCtrlDispatcherW

  RegisterServiceCtrlHandlerW

  SetServiceStatus

  SystemFunction029

  SystemFunction005

  CheckTokenMembership

  FreeSid

  AllocateAndInitializeSid

  SetSecurityDescriptorOwner

  GetSecurityDescriptorDacl

  GetLengthSid

  CopySid

  InitializeAcl

  AddAce

  SetSecurityDescriptorDacl

  LsaOpenPolicy

  LsaLookupSids

  LsaFreeMemory

  LsaClose

  ImpersonateLoggedOnUser

  CreateProcessAsUserW

  GetTokenInformation

  RegCloseKey

  RegQueryValueExW

  RegOpenKeyExW

  InitiateSystemShutdownW

  RevertToSelf

  kernel32

  TerminateProcess

  SetProcessShutdownParameters

  lstrcmpiW

  FormatMessageW

  ExitThread

  ReleaseMutex

  DelayLoadFailureHook

  RaiseException

  GetExitCodeThread

  SetErrorMode

  SetUnhandledExceptionFilter

  LoadLibraryA

  QueryPerformanceCounter

  GetCurrentThreadId

  GetCurrentProcess

  UnhandledExceptionFilter

  GetModuleHandleA

  CreateMutexW

  LocalAlloc

  LocalFree

  Sleep

  LeaveCriticalSection

  EnterCriticalSection

  SetLastError

  CloseHandle

  CreateThread

  GetLastError

  CreateProcessW

  ExpandEnvironmentStringsW

  InitializeCriticalSection

  HeapAlloc

  HeapFree

  SetConsoleCtrlHandler

  WaitForSingleObject

  HeapCreate

  FreeLibrary

  GetProcAddress

  GetModuleHandleExW

  InterlockedCompareExchange

  CreateNamedPipeW

  ReadFile

  CancelIo

  GetOverlappedResult

  WaitForMultipleObjects

  ConnectNamedPipe

  TransactNamedPipe

  WriteFile

  GetTickCount

  GetSystemTimeAsFileTime

  GetModuleHandleW

  GetComputerNameW

  CreateEventW

  SetEvent

  ResetEvent

  DeviceIoControl

  CreateFileW

  ResumeThread

  GetCurrentProcessId

  LoadLibraryW

  GetDriveTypeW

  OpenEventW

  GetCurrentThread

  user32

  wsprintfW

  BroadcastSystemMessageW

  MessageBoxW

  LoadStringW

  RegisterServicesProcess

  rpcrt4

  RpcServerRegisterAuthInfoW

  RpcBindingFree

  RpcEpResolveBinding

  RpcBindingFromStringBindingW

  RpcStringBindingComposeW

  NdrClientCall2

  RpcAsyncCompleteCall

  RpcAsyncInitializeHandle

  NdrAsyncServerCall

  NdrAsyncClientCall

  RpcMgmtStopServerListening

  RpcMgmtWaitServerListen

  NdrServerCall2

  I_RpcBindingIsClientLocal

  RpcRevertToSelf

  I_RpcMapWin32Status

  RpcImpersonateClient

  RpcStringBindingParseW

  RpcStringFreeW

  RpcBindingToStringBindingW

  RpcServerRegisterIfEx

  RpcServerUseProtseqEpW

  RpcServerRegisterIf

  RpcServerListen

  RpcServerUnregisterIf

  ntdll

  RtlCreateAcl

  NtCreateKey

  NtQueryValueKey

  NtSetValueKey

  NtDeleteValueKey

  NtEnumerateKey

  NtQuerySecurityObject

  RtlFreeHeap

  NtOpenKey

  NtDeleteKey

  RtlSetControlSecurityDescriptor

  RtlValidSecurityDescriptor

  RtlLengthSecurityDescriptor

  NtPrivilegeObjectAuditAlarm

  NtPrivilegeCheck

  NtOpenThreadToken

  NtAccessCheckAndAuditAlarm

  NtSetInformationThread

  NtAdjustPrivilegesToken

  NtDuplicateToken

  NtOpenProcessToken

  NtQueryInformationToken

  RtlQuerySecurityObject

  RtlAddAccessAllowedAce

  RtlValidRelativeSecurityDescriptor

  RtlMapGenericMask

  RtlCopyUnicodeString

  NtSetInformationFile

  NtQueryInformationFile

  RtlAppendUnicodeStringToString

  RtlAppendUnicodeToString

  NtWaitForSingleObject

  NtQueryDirectoryFile

  NtDeleteFile

  NtSetInformationProcess

  RtlUnhandledExceptionFilter

  NtSetEvent

  RtlGetAce

  RtlQueryInformationAcl

  RtlGetDaclSecurityDescriptor

  RtlAllocateHeap

  RtlCreateSecurityDescriptor

  RtlSetDaclSecurityDescriptor

  RtlConvertSharedToExclusive

  RtlConvertExclusiveToShared

  RtlRegisterWait

  RtlGetNtProductType

  RtlEqualUnicodeString

  RtlLengthSid

  RtlCopySid

  RtlUnicodeStringToAnsiString

  RtlInitAnsiString

  RtlAnsiStringToUnicodeString

  RtlNewSecurityObject

  RtlAddAce

  RtlSetOwnerSecurityDescriptor

  RtlSetGroupSecurityDescriptor

  RtlSetSaclSecurityDescriptor

  RtlSubAuthorityCountSid

  NtOpenDirectoryObject

  NtQueryDirectoryObject

  RtlCompareUnicodeString

  NtLoadDriver

  NtUnloadDriver

  RtlExpandEnvironmentStrings_U

  RtlAdjustPrivilege

  NtFlushKey

  NtOpenFile

  RtlDosPathNameToNtPathName_U

  NtOpenSymbolicLinkObject

  NtQuerySymbolicLinkObject

  RtlFreeUnicodeString

  RtlAreAllAccessesGranted

  NtDeleteObjectAuditAlarm

  NtCloseObjectAuditAlarm

  RtlQueueWorkItem

  RtlCopyLuid

  RtlDeregisterWait

  RtlReleaseResource

  RtlAcquireResourceExclusive

  RtlAcquireResourceShared

  RtlInitializeResource

  RtlDeleteSecurityObject

  RtlLockBootStatusData

  RtlGetSetBootStatusData

  RtlUnlockBootStatusData

  NtInitializeRegistry

  NtQueryKey

  NtClose

  RtlInitUnicodeString

  NtSetSystemEnvironmentValue

  RtlNtStatusToDosError

  NtShutdownSystem

  RtlSetSecurityObject

  RtlMakeSelfRelativeSD

  RtlInitializeSid

  RtlLengthRequiredSid

  RtlSubAuthoritySid

  NtSetSecurityObject

  userenv

  UnloadUserProfile

  CreateEnvironmentBlock

  LoadUserProfileW

  DestroyEnvironmentBlock

  scesrv

  ScesrvInitializeServer

  ScesrvTerminateServer

  umpnpmgr

  RegisterScmCallback

  PNP_SetActiveService

  PNP_GetDeviceRegProp

  PNP_GetDeviceListSize

  PNP_GetDeviceList

  PNP_HwProfFlags

  RegisterServiceNotification

  DeleteServicePlugPlayRegKeys

  ncobjapi

  WmiSetAndCommitObject

  WmiEventSourceConnect

  WmiCreateObjectWithFormat

  Sections

  .text

  Size: 100KB - Virtual size: 99KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ