General

Malware Config

Signatures

Files

• 845f86a5cd28446fc64d66e134a36182d49326686eee64aa6a0131f36d51aaab

  .exe windows x86

  8b789d5cf65d0ae3f648caedfdbc745f

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  OpenProcess

  Process32FirstW

  Process32NextW

  LoadLibraryA

  GetProcAddress

  GetModuleHandleA

  FindResourceA

  SizeofResource

  LoadResource

  LockResource

  InterlockedDecrement

  GetModuleFileNameW

  WideCharToMultiByte

  GetModuleFileNameA

  EnumResourceNamesA

  GetTempPathW

  MultiByteToWideChar

  CopyFileW

  GetTempFileNameW

  MoveFileExW

  FindFirstFileW

  FindNextFileW

  FindClose

  CreateMutexA

  CreateEventA

  WaitForSingleObject

  OpenMutexA

  OpenEventA

  SetEvent

  CreateFileW

  FlushFileBuffers

  GetCurrentProcessId

  CreateToolhelp32Snapshot

  GetLastError

  GetVersionExA

  CloseHandle

  GetCurrentProcess

  CreateFileA

  SetLastError

  LocalFree

  LocalAlloc

  Sleep

  DeviceIoControl

  WriteConsoleW

  SetStdHandle

  HeapReAlloc

  GetStringTypeW

  RtlUnwind

  GetConsoleMode

  GetConsoleCP

  SetFilePointer

  LoadLibraryW

  GetTickCount

  QueryPerformanceCounter

  RaiseException

  GetFileType

  SetHandleCount

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  HeapSize

  LCMapStringW

  GetCurrentThreadId

  TlsFree

  TlsSetValue

  TlsGetValue

  TlsAlloc

  IsValidCodePage

  GetOEMCP

  HeapAlloc

  EncodePointer

  DecodePointer

  HeapFree

  GetSystemTimeAsFileTime

  GetCommandLineA

  HeapSetInformation

  GetStartupInfoW

  GetModuleHandleW

  ExitProcess

  WriteFile

  GetStdHandle

  HeapCreate

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  LeaveCriticalSection

  EnterCriticalSection

  TerminateProcess

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsDebuggerPresent

  IsProcessorFeaturePresent

  GetCPInfo

  InterlockedIncrement

  GetACP

  user32

  ExitWindowsEx

  wsprintfW

  advapi32

  InitializeSecurityDescriptor

  SetEntriesInAclA

  GetUserNameW

  AllocateAndInitializeSid

  AdjustTokenPrivileges

  LookupPrivilegeValueA

  OpenProcessToken

  SetSecurityDescriptorDacl

  shell32

  ShellExecuteExW

  ole32

  CoSetProxyBlanket

  CoInitializeEx

  CoInitializeSecurity

  CoCreateInstance

  CoTaskMemFree

  oleaut32

  VariantClear

  SysAllocString

  SysFreeString

  shlwapi

  PathCombineW

  PathFindFileNameA

  PathRemoveBackslashW

  PathFindFileNameW

  PathFindNextComponentW

  psapi

  GetModuleBaseNameW

  EnumProcessModules

  GetProcessImageFileNameW

  rpcrt4

  UuidFromStringA

  Sections

  .text

  Size: 112KB - Virtual size: 112KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 18KB - Virtual size: 17KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 5KB - Virtual size: 12KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 453KB - Virtual size: 453KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 19KB - Virtual size: 26KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ