General

Malware Config

Signatures

Files

• e025910fa48113e7329a435993656dbd6186db777ac554f9e7469277e17f3f5d

  .exe windows x86

  66268bbf5c50752b3928ac5415016b91

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  user32

  GetClientRect

  comdlg32

  GetSaveFileNameW

  PrintDlgW

  ChooseColorW

  GetOpenFileNameW

  shell32

  SHBrowseForFolderW

  SHGetPathFromIDListW

  DragQueryFileW

  DragQueryPoint

  ShellExecuteW

  SHGetSpecialFolderLocation

  Shell_NotifyIconW

  SHGetMalloc

  DragFinish

  ole32

  CoInitialize

  CoUninitialize

  advapi32

  RegQueryValueExW

  RegSetValueExW

  RegCreateKeyExW

  RegDeleteValueW

  RegDeleteKeyW

  IsTextUnicode

  RegQueryInfoKeyW

  RegEnumKeyExW

  RegCloseKey

  RegOpenKeyExW

  gdi32

  SetBkMode

  DeleteObject

  Rectangle

  CreatePen

  GetStockObject

  SetROP2

  GetROP2

  GetTextExtentPoint32W

  CreateSolidBrush

  SetTextColor

  GetPixel

  CreateFontIndirectW

  GetTextExtentPointW

  GetDeviceCaps

  DPtoLP

  DeleteDC

  StartPage

  SetTextAlign

  SelectObject

  EndPage

  EndDoc

  EnumFontFamiliesExW

  CreateBitmap

  CreatePatternBrush

  SetBrushOrgEx

  PatBlt

  OffsetWindowOrgEx

  SetWindowOrgEx

  SetBkColor

  StartDocW

  GetObjectW

  CreateCompatibleBitmap

  BitBlt

  CreateFontW

  SaveDC

  RestoreDC

  MoveToEx

  LineTo

  CreateHatchBrush

  GetTextMetricsW

  ExtTextOutW

  CreateCompatibleDC

  dbghelp

  SymGetSearchPath

  SymMatchFileName

  SymUnloadModule64

  SymUnDName

  SymGetLineFromName

  comctl32

  ImageList_ReplaceIcon

  _TrackMouseEvent

  ImageList_Create

  ImageList_DragEnter

  ImageList_Draw

  ImageList_Destroy

  ImageList_AddMasked

  ImageList_SetIconSize

  InitCommonControlsEx

  ImageList_EndDrag

  ImageList_BeginDrag

  ImageList_GetImageCount

  ImageList_DragMove

  ImageList_Add

  ImageList_GetImageInfo

  ImageList_DragShowNolock

  shlwapi

  PathFindExtensionW

  PathRemoveExtensionW

  PathFindFileNameW

  PathCompactPathExW

  PathIsDirectoryW

  PathMatchSpecW

  PathRemoveFileSpecW

  PathAppendW

  PathAddExtensionW

  PathIsRelativeW

  PathStripPathW

  PathFileExistsW

  kernel32

  SetEnvironmentVariableA

  CompareStringW

  CompareStringA

  SetFilePointer

  GetStringTypeA

  GetStringTypeW

  GetConsoleCP

  GetConsoleMode

  CloseHandle

  WriteConsoleA

  LCMapStringW

  SetStdHandle

  WriteConsoleW

  CreateFileA

  GetConsoleOutputCP

  MultiByteToWideChar

  LCMapStringA

  GetLocaleInfoA

  HeapSize

  IsValidCodePage

  GetOEMCP

  GetACP

  GetCPInfo

  RtlUnwind

  GetCurrentProcessId

  GetTickCount

  QueryPerformanceCounter

  FindFirstFileW

  WaitNamedPipeA

  ConnectNamedPipe

  RemoveDirectoryW

  SignalObjectAndWait

  ExpandEnvironmentStringsA

  GetLastError

  HeapFree

  GetSystemTimeAsFileTime

  GetTimeZoneInformation

  GetModuleHandleW

  Sleep

  GetProcAddress

  ExitProcess

  GetCommandLineA

  GetStartupInfoA

  HeapCreate

  VirtualFree

  DeleteCriticalSection

  LeaveCriticalSection

  EnterCriticalSection

  HeapAlloc

  VirtualAlloc

  HeapReAlloc

  TerminateProcess

  GetCurrentProcess

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsDebuggerPresent

  WideCharToMultiByte

  TlsGetValue

  TlsAlloc

  TlsSetValue

  TlsFree

  InterlockedIncrement

  SetLastError

  GetCurrentThreadId

  InterlockedDecrement

  WriteFile

  GetStdHandle

  GetModuleFileNameA

  LoadLibraryA

  InitializeCriticalSectionAndSpinCount

  FreeEnvironmentStringsA

  GetEnvironmentStrings

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  SetHandleCount

  GetFileType

  FlushFileBuffers

  Sections

  .text

  Size: 47KB - Virtual size: 47KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 11KB - Virtual size: 11KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 17KB - Virtual size: 24KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 24KB - Virtual size: 24KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ