General

Malware Config

Signatures

Files

• ab8a9df5524a07c4d4a7d3cdf5335e13ff2faee6e96c2412c8e632cdae751fea

  .dll windows x86

  36df56ad47b0b3d1173c2bc36dbc879c

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DEBUG_STRIPPED

  Imports

  advapi32

  RegCloseKey

  RegSetValueExA

  kernel32

  CreateMutexA

  CreateThread

  DeleteCriticalSection

  EnterCriticalSection

  FreeLibrary

  GetLastError

  GetModuleHandleA

  GetProcAddress

  GetVersionExA

  InitializeCriticalSection

  LeaveCriticalSection

  LoadLibraryA

  OutputDebugStringA

  ReleaseMutex

  TlsGetValue

  VirtualProtect

  VirtualQuery

  msvcrt

  __dllonexit

  _errno

  _iob

  _winmajor

  abort

  calloc

  fflush

  free

  fwrite

  malloc

  memcpy

  sprintf

  vfprintf

  Exports

  Exports

  CalcHash

  CalcHashW

  CheckUnblock

  DynamicImports

  GetGlobalKey

  GetKernel32

  GetProcessParent

  Inject@4

  Injecting

  IsPatched

  IsStarted

  Kernel32Base

  KernelGetProcAddressEx

  LoopInject@4

  MapFileToMemory

  PatchDLL

  Peb

  ResolveDynamicImports

  __CloseHandle

  __ConnectNamedPipe

  __CopyFile

  __CreateEvent

  __CreateFile

  __CreateFileMapping

  __CreateMailslot

  __CreateNamedPipe

  __CreateProcess

  __CreateRemoteThread

  __CreateService

  __CreateToolhelp32Snapshot

  __DeleteFile

  __ExitProcess

  __FindResource

  __GetCommandLine

  __GetCurrentProcessId

  __GetFileSize

  __GetFullPathName

  __GetKernelObjectSecurity

  __GetLongPathName

  __GetMailslotInfo

  __GetModuleFileName

  __GetModuleHandle

  __GetProcAddress

  __GetProcessId

  __GetSystemDirectory

  __GetTempFileName

  __GetTempPath

  __GetTickCount

  __GetUserNameW

  __GlobalAlloc

  __GlobalFree

  __LoadLibrary

  __LoadResource

  __LockResource

  __MapViewOfFile

  __MessageBox

  __NtClose

  __NtCreateFile

  __NtCreateSection

  __NtExtendSection

  __NtMapViewOfSection

  __NtOpenDirectoryObject

  __NtOpenFile

  __NtOpenSection

  __NtUnmapViewOfSection

  __ObReferenceObjectByHandle

  __OpenEvent

  __OpenProcess

  __OpenSCManager

  __OpenService

  __OpenThread

  __Process32First

  __Process32Next

  __ReadFile

  __ReadProcessMemory

  __RegOpenKey

  __RegQueryValueEx

  __ResetEvent

  __ResumeThread

  __RtlAdjustPrivilege

  __RtlInitUnicodeString

  __RtlNtStatusToDosError

  __SHGetFolderPath

  __SetEvent

  __SetMailslotInfo

  __SizeofResource

  __Sleep

  __StartService

  __SuspendThread

  __Thread32First

  __Thread32Next

  __UnmapViewOfFile

  __VirtualAlloc

  __VirtualAllocEx

  __VirtualFree

  __VirtualFreeEx

  __WaitForSingleObject

  __WinExec

  __WriteFile

  __WriteProcessMemory

  __ZwCreateDirectoryObject

  __ZwCreateFile

  __ZwCreateSection

  __ZwLoadDriver

  __ZwMakeTemporaryObject

  __ZwQueryInformationProcess

  __ZwUnloadDriver

  ___memset

  ___strlwr

  ___strupr

  ___wcslen

  ___wcsncpy

  __atoi

  __lstrcpyn

  __lstrlen

  __mbstowcs

  __memcmp

  __memcpy

  __memset

  __puts

  __rand

  __srand

  __sscanf

  __strlwr

  __strrchr

  __strstr

  __time

  __wcslen

  __wcsncpy

  __wsprintf

  _strchr

  advapi32

  emul

  hGlobalKey

  kernel32

  m2

  msvcrt

  ntdll

  shell32

  szAutoloadName

  szAutoloadPath

  szDriverPath

  szIsAutoload

  user32

  xwcslwr

  Sections

  .text

  Size: 7KB - Virtual size: 7KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 3KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .eh_fram

  Size: 512B - Virtual size: 4B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .bss

  Size: - Virtual size: 712B

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .edata

  Size: 3KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .idata

  Size: 1024B - Virtual size: 1016B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .CRT

  Size: 512B - Virtual size: 24B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 32B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 1024B - Virtual size: 1020B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ