General

Malware Config

Signatures

Files

• a7e8955a8faccdc93348a3ea0bdf1d61b2e30c0dd0fa15cf33cf19946293beeb

  .exe windows x86

  9dba42e03feaa2fe2fdb66c5e897b3ae

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  GetEnvironmentVariableW

  FileTimeToDosDateTime

  GetTempFileNameW

  HeapReAlloc

  FindFirstFileW

  SetEndOfFile

  CreateProcessW

  HeapAlloc

  SystemTimeToFileTime

  SetFilePointerEx

  HeapFree

  CreateDirectoryW

  GetProcessHeap

  IsBadReadPtr

  SetFileTime

  VirtualQueryEx

  WriteFile

  Thread32First

  WideCharToMultiByte

  ReadProcessMemory

  HeapDestroy

  HeapCreate

  Thread32Next

  ReadFile

  GetTimeZoneInformation

  GetFileAttributesExW

  CreateToolhelp32Snapshot

  FlushFileBuffers

  GetTempPathW

  GetFileSizeEx

  OpenMutexW

  GetLastError

  VirtualAlloc

  VirtualProtectEx

  VirtualAllocEx

  FindClose

  RemoveDirectoryW

  FindNextFileW

  VirtualProtect

  GetFileTime

  FileTimeToLocalFileTime

  GetVolumeNameForVolumeMountPointW

  DeleteFileW

  GetFileInformationByHandle

  SetFileAttributesW

  GlobalLock

  GlobalUnlock

  GetThreadContext

  SetThreadContext

  GetProcessId

  WTSGetActiveConsoleSessionId

  GetModuleHandleW

  ReleaseMutex

  Process32NextW

  Process32FirstW

  OpenProcess

  CreateRemoteThread

  WriteProcessMemory

  GetCurrentProcessId

  DuplicateHandle

  OpenEventW

  VirtualFreeEx

  GetCurrentThreadId

  SetLastError

  VirtualFree

  GetComputerNameW

  SetErrorMode

  GetCommandLineW

  ExitProcess

  CreateThread

  GetSystemTime

  GetLocalTime

  LoadLibraryA

  TlsFree

  TlsAlloc

  CreateFileMappingW

  UnmapViewOfFile

  MapViewOfFile

  MultiByteToWideChar

  CreateMutexW

  ExpandEnvironmentStringsW

  GetProcAddress

  GetPrivateProfileIntW

  LoadLibraryW

  GetPrivateProfileStringW

  FreeLibrary

  lstrcmpiA

  LocalFree

  GetVersionExW

  GetNativeSystemInfo

  GetUserDefaultUILanguage

  lstrcmpiW

  GetModuleFileNameW

  GetFileAttributesW

  Sleep

  GetTickCount

  MoveFileExW

  ResetEvent

  SetThreadPriority

  TerminateProcess

  TlsSetValue

  GetCurrentThread

  SetEvent

  TlsGetValue

  EnterCriticalSection

  LeaveCriticalSection

  InitializeCriticalSection

  CloseHandle

  WaitForMultipleObjects

  CreateEventW

  CreateFileW

  WaitForSingleObject

  user32

  EndMenu

  GetShellWindow

  GetSystemMetrics

  RegisterClassExA

  DefDlgProcW

  DefFrameProcA

  OpenInputDesktop

  TranslateMessage

  RegisterClassExW

  GetClipboardData

  DefWindowProcA

  DefMDIChildProcW

  SwitchDesktop

  DefDlgProcA

  DefMDIChildProcA

  RegisterClassW

  CallWindowProcA

  GetUserObjectInformationW

  DefFrameProcW

  RegisterClassA

  GetMessageA

  GetWindowRect

  SetCapture

  GetParent

  GetClassLongW

  ExitWindowsEx

  SetCursorPos

  GetWindowLongW

  GetAncestor

  PeekMessageW

  PeekMessageA

  CreateDesktopW

  SetProcessWindowStation

  DispatchMessageW

  CloseWindowStation

  CreateWindowStationW

  GetProcessWindowStation

  CloseDesktop

  SetThreadDesktop

  OpenWindowStationW

  CharLowerW

  GetKeyboardState

  ToUnicode

  MapVirtualKeyW

  GetTopWindow

  LoadImageW

  MsgWaitForMultipleObjects

  WindowFromPoint

  CharToOemW

  CharLowerA

  CharUpperW

  SetWindowLongW

  DrawIcon

  GetIconInfo

  GetMenuItemCount

  RegisterWindowMessageW

  GetWindow

  CallWindowProcW

  GetThreadDesktop

  HiliteMenuItem

  SetKeyboardState

  GetSubMenu

  IsRectEmpty

  DefWindowProcW

  OpenDesktopW

  MenuItemFromPoint

  GetMenu

  GetMenuItemRect

  SetWindowPos

  GetCursorPos

  SendMessageTimeoutW

  IsWindow

  ReleaseCapture

  MapWindowPoints

  GetMessagePos

  GetWindowThreadProcessId

  CharLowerBuffA

  EndPaint

  GetUpdateRgn

  GetMessageW

  GetWindowDC

  FillRect

  PostMessageW

  GetWindowInfo

  DrawEdge

  BeginPaint

  TrackPopupMenuEx

  SystemParametersInfoW

  GetClassNameW

  GetMenuState

  GetCapture

  SendMessageW

  PrintWindow

  EqualRect

  PostThreadMessageW

  ReleaseDC

  GetDCEx

  IntersectRect

  GetDC

  GetUpdateRect

  GetMenuItemID

  advapi32

  ConvertSidToStringSidW

  RegOpenKeyExW

  RegEnumKeyExW

  RegCloseKey

  InitiateSystemShutdownExW

  IsWellKnownSid

  GetLengthSid

  CryptGetHashParam

  OpenProcessToken

  GetSidSubAuthority

  CryptAcquireContextW

  OpenThreadToken

  GetSidSubAuthorityCount

  GetTokenInformation

  RegCreateKeyExW

  CryptReleaseContext

  RegQueryValueExW

  CreateProcessAsUserW

  InitializeSecurityDescriptor

  SetSecurityDescriptorDacl

  SetNamedSecurityInfoW

  LookupPrivilegeValueW

  CryptCreateHash

  ConvertStringSecurityDescriptorToSecurityDescriptorW

  GetSecurityDescriptorSacl

  SetSecurityDescriptorSacl

  CryptDestroyHash

  AdjustTokenPrivileges

  RegSetValueExW

  CryptHashData

  EqualSid

  shlwapi

  StrStrIW

  PathRenameExtensionW

  StrCmpNIW

  wvnsprintfA

  StrCmpNIA

  PathMatchSpecW

  PathUnquoteSpacesW

  PathAddExtensionW

  PathCombineW

  SHDeleteKeyW

  PathSkipRootW

  SHDeleteValueW

  PathAddBackslashW

  PathFindFileNameW

  PathIsDirectoryW

  wvnsprintfW

  UrlUnescapeA

  PathRemoveBackslashW

  PathIsURLW

  PathQuoteSpacesW

  StrStrIA

  PathRemoveFileSpecW

  shell32

  ShellExecuteW

  SHGetFolderPathW

  CommandLineToArgvW

  secur32

  GetUserNameExW

  ole32

  StringFromGUID2

  CLSIDFromString

  CoUninitialize

  CoCreateInstance

  CoInitializeEx

  gdi32

  GetDeviceCaps

  CreateCompatibleBitmap

  CreateDIBSection

  SetViewportOrgEx

  DeleteDC

  GdiFlush

  DeleteObject

  SelectObject

  SetRectRgn

  CreateCompatibleDC

  GetDIBits

  RestoreDC

  SaveDC

  ws2_32

  WSASend

  getpeername

  WSAGetLastError

  freeaddrinfo

  recv

  sendto

  select

  getaddrinfo

  recvfrom

  WSAIoctl

  connect

  WSAAddressToStringW

  WSAStartup

  shutdown

  setsockopt

  bind

  socket

  WSASetLastError

  listen

  closesocket

  send

  WSAEventSelect

  getsockname

  accept

  crypt32

  CertDuplicateCertificateContext

  CertEnumCertificatesInStore

  CertCloseStore

  CertOpenSystemStoreW

  CertDeleteCertificateFromStore

  PFXImportCertStore

  CryptUnprotectData

  PFXExportCertStoreEx

  wininet

  HttpAddRequestHeadersW

  InternetSetStatusCallbackW

  GetUrlCacheEntryInfoW

  InternetQueryOptionA

  InternetSetOptionA

  InternetQueryOptionW

  InternetOpenA

  HttpAddRequestHeadersA

  HttpOpenRequestA

  InternetCrackUrlA

  InternetConnectA

  HttpSendRequestA

  HttpSendRequestW

  InternetReadFile

  InternetReadFileExA

  InternetQueryDataAvailable

  HttpSendRequestExW

  HttpQueryInfoA

  HttpSendRequestExA

  InternetCloseHandle

  oleaut32

  VariantInit

  SysAllocString

  VariantClear

  SysFreeString

  netapi32

  NetApiBufferFree

  NetUserEnum

  NetUserGetInfo

  Sections

  .text

  Size: 130KB - Virtual size: 129KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 1024B - Virtual size: 8KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 6KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ