General

Malware Config

Signatures

Files

• c08bb100fafd44f544c5e529f0c65a863e5d980930e663332dcde382461bd5e2

  .exe windows x86

  f8f7b72eb3979e852efbb183dc2eb73c

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  msvcr80

  __CxxUnregisterExceptionObject

  _cexit

  _amsg_exit

  __set_app_type

  _XcptFilter

  __wgetmainargs

  _configthreadlocale

  __p__commode

  __p__fmode

  __FrameUnwindFilter

  _time64

  ??2@YAPAXI@Z

  ??3@YAXPAX@Z

  sprintf

  memmove

  strncmp

  strchr

  atol

  atoi

  _strtoui64

  ??_U@YAPAXI@Z

  _strupr

  strrchr

  _gmtime32_s

  _wcsupr

  wcsncmp

  wcstombs

  strncpy

  strstr

  free

  memset

  _CxxThrowException

  _strnicmp

  __CxxQueryExceptionSize

  __CxxDetectRethrow

  __CxxRegisterExceptionObject

  __CxxExceptionFilter

  malloc

  __CxxFrameHandler3

  ?terminate@@YAXXZ

  ?_type_info_dtor_internal_method@type_info@@QAEXXZ

  memcpy

  _except_handler3

  _crt_debugger_hook

  _except_handler4_common

  _decode_pointer

  _onexit

  _lock

  __dllonexit

  _unlock

  _encode_pointer

  kernel32

  IsDebuggerPresent

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  Sleep

  GetModuleHandleA

  UnmapViewOfFile

  CloseHandle

  InterlockedExchange

  VirtualProtect

  VirtualQuery

  InterlockedIncrement

  InterlockedDecrement

  GetCurrentProcessId

  CreateMutexA

  WaitForSingleObject

  ReleaseMutex

  FindResourceA

  LoadResource

  GetCurrentProcess

  CreateToolhelp32Snapshot

  Module32First

  GetProcAddress

  Module32Next

  EnumResourceNamesA

  VirtualAlloc

  CreateEventA

  ExitProcess

  SetEvent

  GetExitCodeThread

  TerminateThread

  CreateThread

  VirtualFree

  GetModuleFileNameA

  GetSystemTime

  SystemTimeToFileTime

  GetCommandLineW

  LocalFree

  GlobalAlloc

  GetSystemInfo

  GetWindowsDirectoryA

  GetVolumeInformationA

  CreateFileA

  DeviceIoControl

  GetCurrentThread

  CreateFileW

  GlobalFree

  LoadLibraryA

  TlsAlloc

  TlsSetValue

  TlsGetValue

  TlsFree

  FreeLibrary

  MapViewOfFile

  CreateFileMappingA

  lstrcmpA

  LocalAlloc

  GetModuleFileNameW

  GetLastError

  OutputDebugStringA

  TerminateProcess

  LockResource

  QueryPerformanceCounter

  GetTickCount

  GetCurrentThreadId

  GetSystemTimeAsFileTime

  lstrlenW

  MultiByteToWideChar

  lstrlenA

  WideCharToMultiByte

  advapi32

  CryptGenRandom

  OpenThreadToken

  CloseEventLog

  ReadEventLogA

  GetNumberOfEventLogRecords

  OpenEventLogA

  RegCloseKey

  RegEnumValueA

  RegOpenKeyExA

  SetThreadToken

  CryptAcquireContextA

  RevertToSelf

  oleaut32

  GetErrorInfo

  VariantChangeType

  SetErrorInfo

  CreateErrorInfo

  VariantClear

  VariantInit

  SystemTimeToVariantTime

  SysAllocString

  SysFreeString

  msvcm80

  __setusermatherr_m

  ?DoDllLanguageSupportValidation@<CrtImplementationDetails>@@YAXXZ

  ?RegisterModuleUninitializer@<CrtImplementationDetails>@@YAXP$AAVEventHandler@System@@@Z

  ?ThrowModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVString@System@@@Z

  ?ThrowNestedModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVException@System@@0@Z

  ?DoCallBackInDefaultDomain@<CrtImplementationDetails>@@YAXP6GJPAX@Z0@Z

  ?ThrowModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVString@System@@P$AAVException@3@@Z

  mscoree

  GetHashFromFileW

  _CorExeMain

  wintrust

  CryptCATAdminEnumCatalogFromHash

  CryptCATAdminAcquireContext

  WinVerifyTrust

  CryptCATAdminReleaseContext

  CryptCATCatalogInfoFromContext

  CryptCATAdminReleaseCatalogContext

  CryptCATAdminCalcHashFromFileHandle

  crypt32

  CertFindCertificateInStore

  CryptQueryObject

  CryptMsgClose

  CertCloseStore

  CryptMsgGetParam

  CryptDecodeObject

  CertFreeCertificateContext

  CertGetNameStringA

  iphlpapi

  GetAdaptersInfo

  ole32

  CoUninitialize

  CoCreateInstance

  CoInitializeEx

  CoTaskMemAlloc

  CoSetProxyBlanket

  shell32

  CommandLineToArgvW

  setupapi

  SetupDiEnumDeviceInfo

  SetupDiGetClassDevsA

  SetupDiGetDeviceInterfaceDetailA

  SetupDiClassNameFromGuidA

  SetupDiGetDeviceRegistryPropertyA

  SetupDiDestroyDeviceInfoList

  SetupDiEnumDeviceInterfaces

  rpcrt4

  UuidCreate

  Sections

  .text

  Size: 264KB - Virtual size: 261KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 88KB - Virtual size: 87KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 4KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 8KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ