General

Malware Config

Signatures

Files

• 4223936b9217a3f798b8f535ce2928a8b6d78078df29c351dd5de285d316dfde

  .exe windows x86

  5002bceb823d3d7321ac4b2e8ee9f66d

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_NO_BIND

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  advapi32

  RegCloseKey

  CryptReleaseContext

  RegQueryValueExW

  RegQueryValueExA

  RegOpenKeyExW

  RegOpenKeyExA

  RegCreateKeyExW

  RegCreateKeyExA

  kernel32

  FindFirstFileW

  FindResourceA

  FindFirstFileA

  GetFileAttributesA

  GetModuleFileNameW

  GetModuleHandleW

  SetFileAttributesA

  SetFileAttributesW

  FindNextFileA

  FindNextFileW

  DeleteFileW

  GetPrivateProfileIntW

  GetTempPathA

  GetTempPathW

  SizeofResource

  LockResource

  LoadResource

  SetLastError

  CopyFileA

  CopyFileW

  RemoveDirectoryA

  RemoveDirectoryW

  CreateMutexW

  CreateFileA

  LoadLibraryA

  LoadLibraryW

  GetPrivateProfileStringA

  GetPrivateProfileStringW

  CreateProcessW

  FindClose

  SetErrorMode

  DeleteCriticalSection

  GetTickCount

  IsBadReadPtr

  InterlockedExchange

  GlobalAddAtomA

  GlobalDeleteAtom

  GetVersionExA

  GetSystemTimeAsFileTime

  GetACP

  GetVersionExW

  QueryPerformanceCounter

  QueryPerformanceFrequency

  InterlockedIncrement

  InterlockedDecrement

  IsDBCSLeadByte

  GetCurrentProcessId

  GetProcessTimes

  GetLocalTime

  FlushFileBuffers

  GetAtomNameA

  lstrcmpA

  RaiseException

  DeleteFileA

  CreateFileW

  CreateEventW

  LocalReAlloc

  WaitForSingleObject

  CloseHandle

  ReleaseMutex

  lstrlenA

  WideCharToMultiByte

  lstrlenW

  ExitProcess

  Sleep

  GetLastError

  GetCommandLineA

  LocalFree

  MultiByteToWideChar

  SetUnhandledExceptionFilter

  LocalAlloc

  GetCommandLineW

  GetCurrentThreadId

  InitializeCriticalSection

  GetModuleHandleA

  UnmapViewOfFile

  GetCurrentProcess

  LeaveCriticalSection

  GetPrivateProfileIntA

  SetEvent

  CreateProcessA

  CreateMutexA

  lstrcpynA

  DuplicateHandle

  CreateFileMappingA

  CreateEventA

  MapViewOfFile

  WriteFile

  GetModuleFileNameA

  EnterCriticalSection

  GetProcAddress

  SetFilePointer

  FreeLibrary

  CreateFileMappingW

  user32

  GetDoubleClickTime

  SetTimer

  KillTimer

  GetSubMenu

  EnableMenuItem

  GetForegroundWindow

  SetForegroundWindow

  GetCursorPos

  LoadMenuA

  SetFocus

  RegisterWindowMessageA

  IsWindow

  GetWindowTextA

  DestroyWindow

  TranslateMessage

  DestroyIcon

  CreateWindowExA

  CreateWindowExW

  DefWindowProcA

  DefWindowProcW

  DispatchMessageA

  FindWindowW

  FindWindowExA

  FindWindowExW

  GetMessageA

  GetMessageW

  MessageBoxW

  GetWindowLongA

  GetWindowLongW

  LoadCursorA

  LoadCursorW

  CreateIconFromResource

  CreateIconFromResourceEx

  LookupIconIdFromDirectoryEx

  LoadImageA

  LoadImageW

  DestroyMenu

  DispatchMessageW

  TrackPopupMenuEx

  LoadStringW

  PostMessageA

  PostMessageW

  PostThreadMessageA

  PostThreadMessageW

  RegisterWindowMessageW

  CharNextA

  SendMessageTimeoutA

  SendMessageTimeoutW

  SetWindowLongA

  SetWindowLongW

  SystemParametersInfoA

  SystemParametersInfoW

  RegisterClassExA

  RegisterClassExW

  GetClassInfoExA

  GetClassInfoExW

  GetSysColor

  ReleaseDC

  GetDC

  GetSystemMetrics

  LoadStringA

  wvsprintfA

  MessageBoxA

  gdi32

  GetDeviceCaps

  GetPaletteEntries

  DeleteObject

  Sections

  .text

  Size: 40KB - Virtual size: 39KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 40KB - Virtual size: 36KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  B%�XA�

  Size: 100KB - Virtual size: 100KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tc

  Size: 248KB - Virtual size: 248KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  W��XAD

  Size: 100KB - Virtual size: 100KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tc

  Size: 248KB - Virtual size: 248KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE