General

Malware Config

Signatures

Files

• f9065d0457649dbb116dea12a9dbf1e0e56a1f83e05a105ff8e5483ab842b7d1

  .exe windows x86

  09d57fc2c048de599d3e6d5df3595268

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  msvcrt

  iswalpha

  iswdigit

  _c_exit

  _exit

  _XcptFilter

  _cexit

  exit

  _acmdln

  __getmainargs

  wprintf

  __setusermatherr

  wcschr

  wcslen

  _vsnwprintf

  ??1exception@@UAE@XZ

  __CxxFrameHandler

  ??3@YAXPAX@Z

  wcstoul

  _ftol

  wcscpy

  ?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z

  _ltow

  wcscat

  _snwprintf

  ?what@exception@@UBEPBDXZ

  _adjust_fdiv

  __p__commode

  __p__fmode

  __set_app_type

  iswspace

  ?terminate@@YAXXZ

  _except_handler3

  ??0exception@@QAE@XZ

  ??0exception@@QAE@ABV0@@Z

  _CxxThrowException

  _initterm

  ??1type_info@@UAE@XZ

  _controlfp

  _wcsicmp

  msvcp60

  ??1bad_alloc@std@@UAE@XZ

  advapi32

  OpenSCManagerW

  ControlService

  RegCloseKey

  CloseServiceHandle

  RegSetValueExW

  RegOpenKeyW

  RegConnectRegistryW

  RegEnumValueW

  RegQueryInfoKeyW

  RegOpenKeyExW

  RegQueryValueExW

  StartServiceCtrlDispatcherW

  SetServiceStatus

  RegisterServiceCtrlHandlerExW

  OpenServiceW

  kernel32

  MultiByteToWideChar

  LoadLibraryW

  GetProcAddress

  FreeLibrary

  GetTimeZoneInformation

  Sleep

  OpenEventW

  GetSystemTimeAsFileTime

  InterlockedIncrement

  GetStdHandle

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  GetLastError

  GetDateFormatW

  LocalAlloc

  GetTimeFormatW

  LocalFree

  WaitForSingleObject

  CreateThread

  GetModuleHandleW

  CreateEventW

  ExpandEnvironmentStringsW

  GetCommandLineW

  GetModuleHandleA

  GetStartupInfoA

  GetFileType

  WriteFile

  WideCharToMultiByte

  WriteConsoleW

  FormatMessageW

  CloseHandle

  SetEvent

  ntdll

  NtQuerySystemTime

  user32

  LoadStringW

  DialogBoxParamW

  EndDialog

  GetDlgItem

  EnableWindow

  SendDlgItemMessageW

  wsprintfW

  CharUpperW

  ws2_32

  connect

  closesocket

  recv

  WSAEventSelect

  WSACleanup

  WSAStartup

  WSALookupServiceBeginW

  WSALookupServiceNextW

  WSAGetLastError

  WSALookupServiceEnd

  socket

  send

  gethostbyaddr

  netapi32

  DsGetDcNameW

  NetServerEnum

  NetApiBufferFree

  w32time

  W32TimeQueryNTPProviderStatus

  W32TimeGetNetlogonServiceBits

  W32TimeSyncNow

  icmp

  IcmpCreateFile

  IcmpSendEcho

  IcmpCloseHandle

  ntdsapi

  DsFreeDomainControllerInfoW

  DsUnBindW

  DsGetDomainControllerInfoW

  DsBindW

  shell32

  CommandLineToArgvW

  Sections

  .text

  Size: 33KB - Virtual size: 32KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 172B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 14KB - Virtual size: 13KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ