General

Malware Config

Signatures

Files

• 569d4b67cc2329c25f27d01f38a492d018deafce02e115c6c66d4d9a178595d7

  .exe windows x86

  f56c4549ae74e4451d3f98c631a12ed9

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  SetLastError

  GetModuleHandleW

  WaitForSingleObject

  SetThreadPriority

  GetModuleFileNameA

  GetSystemDirectoryA

  GetWindowsDirectoryA

  GetTempPathA

  FindFirstFileA

  FindNextFileA

  FindClose

  CreateFileMappingA

  MapViewOfFile

  UnmapViewOfFile

  GetSystemInfo

  CreateEventA

  CreateThread

  TerminateThread

  WriteFile

  FreeLibrary

  GetLocaleInfoA

  GetStartupInfoA

  GetThreadLocale

  InterlockedDecrement

  LocalFree

  LeaveCriticalSection

  GetFileAttributesA

  CloseHandle

  ReadFile

  GetFileSize

  CreateFileA

  GetLastError

  OutputDebugStringA

  CopyFileW

  DeviceIoControl

  CreateFileMappingW

  CreateFileW

  DeleteCriticalSection

  InitializeCriticalSectionAndSpinCount

  SetFilePointer

  GetEnvironmentStringsW

  GetVersion

  LCMapStringW

  InterlockedIncrement

  GetStringTypeW

  GetStringTypeA

  MultiByteToWideChar

  RtlUnwind

  HeapReAlloc

  VirtualAlloc

  GetOEMCP

  EnterCriticalSection

  InitializeCriticalSection

  HeapFree

  VirtualFree

  HeapCreate

  HeapDestroy

  GetVersionExA

  GetEnvironmentVariableA

  GetModuleHandleA

  GetEnvironmentStrings

  WideCharToMultiByte

  FreeEnvironmentStringsW

  FreeEnvironmentStringsA

  GetFileType

  GetStdHandle

  SetHandleCount

  TlsGetValue

  TlsFree

  TlsAlloc

  TlsSetValue

  ExitProcess

  GetCommandLineA

  InterlockedCompareExchange

  InterlockedExchange

  Sleep

  DisableThreadLibraryCalls

  QueryPerformanceCounter

  UnhandledExceptionFilter

  IsDebuggerPresent

  GetACP

  HeapSize

  HeapAlloc

  GetConsoleCP

  FlushFileBuffers

  LCMapStringA

  LocalAlloc

  SetStdHandle

  user32

  LoadCursorA

  DestroyWindow

  LoadIconA

  UnregisterClassA

  DefWindowProcA

  KillTimer

  SetTimer

  RegisterClassExA

  GetKeyboardType

  advapi32

  OpenServiceA

  RegOpenKeyA

  CloseServiceHandle

  QueryServiceStatus

  OpenSCManagerA

  RegQueryValueExA

  RegQueryValueA

  shell32

  SHGetMalloc

  SHGetSpecialFolderLocation

  SHGetPathFromIDListA

  oleaut32

  SysReAllocStringLen

  SysAllocStringLen

  SysFreeString

  msvcrt

  atol

  malloc

  strncmp

  iswdigit

  wcsncmp

  qsort

  bsearch

  strstr

  time

  wcsrchr

  free

  puts

  fclose

  fputs

  fopen

  wcschr

  strchr

  exit

  memset

  memmove

  mbtowc

  isleadbyte

  ferror

  wctomb

  Sections

  .text

  Size: 105KB - Virtual size: 104KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 39KB - Virtual size: 38KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 87KB - Virtual size: 2.2MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 25KB - Virtual size: 24KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ