General

Malware Config

Signatures

Files

• 1690f08195fcac4c0c897b7f8e416b7064344b5e05c0995387315d12194b9054

  .exe windows x86

  929879191b781359908bef05d2a18e83

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  GetPrivateProfileIntW

  LCMapStringW

  GetStringTypeW

  GetLocaleInfoA

  RtlUnwind

  VirtualAlloc

  HeapAlloc

  IsValidCodePage

  GetACP

  FreeEnvironmentStringsW

  EnterCriticalSection

  GetSystemTimeAsFileTime

  VirtualFree

  HeapCreate

  InterlockedIncrement

  TlsGetValue

  GetFileType

  SetHandleCount

  GetCommandLineW

  GetEnvironmentStringsW

  DeleteCriticalSection

  lstrcmpiW

  InitializeCriticalSection

  LeaveCriticalSection

  Sleep

  GetLastError

  CloseHandle

  FindClose

  InterlockedExchange

  WaitForSingleObject

  ReleaseMutex

  UnmapViewOfFile

  MapViewOfFile

  VerifyVersionInfoW

  FileTimeToSystemTime

  FlushFileBuffers

  CreateDirectoryW

  GetProcAddress

  LoadLibraryW

  MultiByteToWideChar

  GetSystemInfo

  lstrcmpiA

  GetModuleHandleW

  FreeLibrary

  QueryPerformanceCounter

  QueryPerformanceFrequency

  GetModuleHandleA

  TryEnterCriticalSection

  LoadLibraryExW

  DeleteFileW

  OutputDebugStringA

  CreateFileMappingW

  CreateMutexW

  TlsFree

  TlsAlloc

  GetExitCodeThread

  OpenThread

  VirtualQuery

  GetShortPathNameW

  CreateFileMappingA

  InterlockedCompareExchange

  CreateFileA

  UnhandledExceptionFilter

  IsDebuggerPresent

  FindNextFileW

  GetFileAttributesExW

  VerSetConditionMask

  SetFilePointer

  GetLocalTime

  GetModuleFileNameW

  GetModuleFileNameA

  GetStdHandle

  ExitProcess

  GetCPInfo

  WriteConsoleW

  GetConsoleOutputCP

  RaiseException

  SetStdHandle

  IsDBCSLeadByteEx

  WideCharToMultiByte

  MoveFileExW

  GetCommandLineA

  HeapDestroy

  WriteFile

  TlsSetValue

  InterlockedDecrement

  GetEnvironmentStrings

  InitializeCriticalSectionAndSpinCount

  LoadLibraryA

  GetOEMCP

  HeapSize

  GetStringTypeA

  LocalFree

  SetLastError

  RemoveDirectoryA

  user32

  wsprintfW

  advapi32

  RegCloseKey

  RegQueryValueExA

  SetSecurityDescriptorDacl

  GetLengthSid

  GetTokenInformation

  OpenProcessToken

  FreeSid

  AllocateAndInitializeSid

  LookupAccountNameW

  InitializeSecurityDescriptor

  AddAccessAllowedAce

  InitializeAcl

  RegQueryValueExW

  ReportEventW

  RegSetValueExW

  OpenSCManagerW

  OpenServiceW

  QueryServiceStatus

  SetSecurityDescriptorOwner

  RegOpenKeyExA

  RegDeleteKeyW

  RegSetKeySecurity

  RegCreateKeyExA

  GetAce

  IsValidSid

  msvcrt

  getenv

  fwrite

  free

  gmtime

  fputc

  fprintf

  puts

  memcmp

  malloc

  pow

  fread

  wcslen

  crypt32

  CertGetPublicKeyLength

  CertCreateCertificateContext

  shlwapi

  PathRemoveFileSpecW

  PathAppendW

  Sections

  .text

  Size: 116KB - Virtual size: 112KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 72KB - Virtual size: 68KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 72KB - Virtual size: 2.2MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 76KB - Virtual size: 75KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ