General

Malware Config

Signatures

Files

• e710a43d937a561ea012d4572d5e9f79eaa4da702646f78b29615acba8203be2

  .exe windows x86

  1070e056ecb0abd3892db6807e735cec

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  msvcr90

  _controlfp_s

  _invoke_watson

  _decode_pointer

  _onexit

  _lock

  __dllonexit

  _unlock

  _strnicmp

  _crt_debugger_hook

  ?_type_info_dtor_internal_method@type_info@@QAEXXZ

  ?terminate@@YAXXZ

  __set_app_type

  _encode_pointer

  __p__fmode

  __p__commode

  _adjust_fdiv

  __setusermatherr

  _configthreadlocale

  _initterm_e

  _initterm

  _acmdln

  exit

  _ismbblead

  _XcptFilter

  _exit

  _cexit

  __getmainargs

  _amsg_exit

  _except_handler4_common

  calloc

  _snprintf

  _beginthreadex

  atol

  mbstowcs

  wcstombs

  _errno

  sprintf

  strncmp

  atoi

  realloc

  strncat

  srand

  rand

  _time64

  strncpy

  ??0exception@std@@QAE@ABV01@@Z

  _invalid_parameter_noinfo

  strrchr

  ??_U@YAPAXI@Z

  free

  ??0exception@std@@QAE@XZ

  ??1exception@std@@UAE@XZ

  malloc

  strchr

  memmove

  ceil

  strstr

  _CxxThrowException

  memcpy

  __CxxFrameHandler3

  memset

  ??3@YAXPAX@Z

  ??2@YAPAXI@Z

  kernel32

  CreateThread

  InitializeCriticalSection

  DeleteCriticalSection

  VirtualFree

  VirtualAlloc

  LeaveCriticalSection

  EnterCriticalSection

  Sleep

  InterlockedExchange

  CancelIo

  GetProcAddress

  LoadLibraryA

  lstrlenA

  WaitForSingleObject

  lstrcatA

  lstrcpyA

  GetWindowsDirectoryA

  FreeLibrary

  MultiByteToWideChar

  WideCharToMultiByte

  lstrcmpA

  GetPrivateProfileStringA

  GetVersionExA

  GetLastError

  CreateDirectoryA

  GetFileAttributesA

  CreateProcessA

  GetDiskFreeSpaceExA

  GetVolumeInformationA

  GetLogicalDriveStringsA

  FindClose

  LocalFree

  FindNextFileA

  LocalReAlloc

  FindFirstFileA

  LocalAlloc

  RemoveDirectoryA

  DeleteFileA

  GetFileSize

  CreateFileA

  WriteFile

  SetFilePointer

  TerminateThread

  ReadFile

  GetModuleFileNameA

  GetCurrentProcess

  ResumeThread

  OpenProcess

  ExitThread

  GetTickCount

  ExitProcess

  GetSystemDirectoryA

  GetLocalTime

  LocalSize

  GlobalFree

  GlobalUnlock

  GlobalLock

  GlobalAlloc

  GlobalSize

  DisconnectNamedPipe

  TerminateProcess

  PeekNamedPipe

  WaitForMultipleObjects

  GetStartupInfoA

  CreatePipe

  GlobalMemoryStatus

  GetSystemInfo

  OpenEventA

  SetErrorMode

  CreateMutexA

  lstrcpyW

  GlobalMemoryStatusEx

  WinExec

  Process32Next

  lstrcmpiA

  Process32First

  CreateToolhelp32Snapshot

  Module32First

  GetModuleHandleA

  GetCurrentThreadId

  InterlockedCompareExchange

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsDebuggerPresent

  QueryPerformanceCounter

  GetCurrentProcessId

  GetSystemTimeAsFileTime

  CloseHandle

  CreateEventA

  CreateRemoteThread

  SetEvent

  MoveFileA

  GetPrivateProfileSectionNamesA

  user32

  OpenClipboard

  SetClipboardData

  CloseClipboard

  SetCursorPos

  GetCursorInfo

  GetThreadDesktop

  DestroyCursor

  LoadCursorA

  GetKeyState

  GetAsyncKeyState

  ReleaseDC

  GetDC

  GetDesktopWindow

  SetRect

  GetCursorPos

  SetProcessWindowStation

  OpenWindowStationA

  GetProcessWindowStation

  GetWindowThreadProcessId

  IsWindowVisible

  EnumWindows

  ExitWindowsEx

  CloseDesktop

  SetThreadDesktop

  OpenInputDesktop

  WindowFromPoint

  GetUserObjectInformationA

  OpenDesktopA

  DispatchMessageA

  PostMessageA

  CloseWindow

  SendMessageA

  IsWindow

  CreateWindowExA

  SetCapture

  TranslateMessage

  GetMessageA

  GetSystemMetrics

  wsprintfA

  CharNextA

  GetWindowTextA

  GetForegroundWindow

  gdi32

  GetDIBits

  SelectObject

  CreateCompatibleDC

  DeleteDC

  BitBlt

  CreateCompatibleBitmap

  DeleteObject

  CreateDIBSection

  advapi32

  OpenEventLogA

  ClearEventLogA

  CloseEventLog

  RegOpenKeyA

  RegQueryValueExA

  RegSetValueExA

  OpenServiceA

  QueryServiceStatus

  ControlService

  DeleteService

  CloseServiceHandle

  RegOpenKeyExA

  RegQueryValueA

  RegCloseKey

  LsaFreeMemory

  LsaOpenPolicy

  LsaRetrievePrivateData

  LsaClose

  LookupAccountNameA

  IsValidSid

  GetTokenInformation

  LookupAccountSidA

  GetUserNameA

  AbortSystemShutdownA

  StartServiceCtrlDispatcherA

  RegisterServiceCtrlHandlerA

  SetServiceStatus

  CreateServiceA

  AdjustTokenPrivileges

  LookupPrivilegeValueA

  OpenProcessToken

  RegEnumValueA

  RegEnumKeyExA

  RegDeleteValueA

  RegDeleteKeyA

  RegCreateKeyExA

  RegQueryInfoKeyA

  QueryServiceConfigA

  UnlockServiceDatabase

  ChangeServiceConfigA

  LockServiceDatabase

  StartServiceA

  EnumServicesStatusA

  ChangeServiceConfig2A

  shell32

  SHGetSpecialFolderPathA

  SHGetFileInfoA

  winmm

  waveInStop

  waveOutPrepareHeader

  waveOutOpen

  waveOutGetNumDevs

  waveInAddBuffer

  waveInReset

  waveInStart

  waveInPrepareHeader

  waveInOpen

  waveInGetNumDevs

  waveOutClose

  waveInUnprepareHeader

  waveInClose

  waveOutReset

  waveOutWrite

  waveOutUnprepareHeader

  ws2_32

  socket

  sendto

  inet_addr

  connect

  WSAIoctl

  select

  recv

  send

  setsockopt

  closesocket

  WSAStartup

  ioctlsocket

  listen

  accept

  getpeername

  __WSAFDIsSet

  recvfrom

  bind

  ntohs

  getsockname

  WSAGetLastError

  WSACleanup

  htonl

  gethostname

  inet_ntoa

  gethostbyname

  WSASocketA

  htons

  msvcp90

  ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

  ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z

  ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z

  wininet

  InternetReadFile

  InternetOpenUrlA

  InternetOpenA

  InternetCloseHandle

  avicap32

  capGetDriverDescriptionA

  capCreateCaptureWindowA

  msvfw32

  ICSeqCompressFrameStart

  ICOpen

  ICSeqCompressFrame

  ICClose

  ICCompressorFree

  ICSeqCompressFrameEnd

  ICSendMessage

  iphlpapi

  GetIfTable

  netapi32

  NetUserDel

  NetApiBufferFree

  NetUserEnum

  NetUserGetLocalGroups

  NetUserGetInfo

  NetUserSetInfo

  NetLocalGroupAddMembers

  NetUserAdd

  psapi

  GetModuleFileNameExA

  EnumProcessModules

  wtsapi32

  WTSQuerySessionInformationW

  WTSEnumerateSessionsA

  WTSLogoffSession

  WTSDisconnectSession

  WTSFreeMemory

  WTSQuerySessionInformationA

  Sections

  BBB

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .text

  Size: 108KB - Virtual size: 107KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  AAA

  Size: 1024B - Virtual size: 947B

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .BUFF

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .6652

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  QQQ

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 22KB - Virtual size: 22KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 8KB - Virtual size: 24KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .115632

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .88963

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE