General

Malware Config

Signatures

Files

• 448baf774911e96868a29a8be4201a30cbc900375631ee24f3d723503209f182

  .exe windows x86

  e9359ba603691e15543adbbd9590563d

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_AGGRESIVE_WS_TRIM

  IMAGE_FILE_32BIT_MACHINE

  Imports

  advapi32

  ConvertStringSecurityDescriptorToSecurityDescriptorA

  A_SHAInit

  A_SHAUpdate

  A_SHAFinal

  LsaStorePrivateData

  LsaRetrievePrivateData

  LsaNtStatusToWinError

  CryptGetUserKey

  CryptGetKeyParam

  CryptEncrypt

  CryptSetProvParam

  CryptSignHashW

  CryptDeriveKey

  CryptGetProvParam

  RegOpenCurrentUser

  RegDeleteKeyW

  AddAccessAllowedAceEx

  RegSetKeySecurity

  I_ScSendTSMessage

  MD5Init

  MD5Update

  MD5Final

  SetFileSecurityA

  AllocateLocallyUniqueId

  LsaOpenPolicy

  LsaQueryInformationPolicy

  LsaFreeMemory

  LsaClose

  RegNotifyChangeKeyValue

  QueryServiceConfigW

  SetKernelObjectSecurity

  ConvertStringSecurityDescriptorToSecurityDescriptorW

  RegEnumKeyExW

  GetCurrentHwProfileW

  RegCloseKey

  RegQueryValueExW

  RegOpenKeyW

  FreeSid

  SetSecurityDescriptorDacl

  InitializeSecurityDescriptor

  AddAccessAllowedAce

  InitializeAcl

  GetLengthSid

  AllocateAndInitializeSid

  RegOpenKeyExW

  CreateProcessAsUserW

  DuplicateTokenEx

  CloseServiceHandle

  ControlService

  StartServiceW

  QueryServiceStatus

  OpenServiceW

  OpenSCManagerW

  EqualSid

  GetTokenInformation

  RegSetValueExW

  RegCreateKeyExW

  CryptGenRandom

  CryptDestroyHash

  CryptVerifySignatureW

  CryptSetHashParam

  CryptGetHashParam

  CryptHashData

  CryptCreateHash

  CryptDecrypt

  ReportEventW

  RegisterEventSourceW

  CryptImportKey

  CryptAcquireContextW

  CryptReleaseContext

  CryptDestroyKey

  RegEnumValueW

  RegQueryInfoKeyW

  RegDeleteValueW

  CredFree

  CredDeleteW

  CredEnumerateW

  CopySid

  GetSidLengthRequired

  GetSidSubAuthority

  GetSidSubAuthorityCount

  GetUserNameW

  OpenThreadToken

  EnumServicesStatusW

  ImpersonateLoggedOnUser

  RegQueryValueExA

  CheckTokenMembership

  DeregisterEventSource

  LsaGetUserName

  RevertToSelf

  LookupAccountSidW

  IsValidSid

  SetTokenInformation

  LogonUserW

  LookupAccountNameW

  OpenProcessToken

  SynchronizeWindows31FilesAndWindowsNTRegistry

  QueryWindows31FilesMigration

  AdjustTokenPrivileges

  RegQueryInfoKeyA

  authz

  AuthzInitializeResourceManager

  AuthzAccessCheck

  AuthziFreeAuditEventType

  AuthziInitializeAuditEvent

  AuthziInitializeAuditParams

  AuthziInitializeAuditEventType

  AuthziLogAuditEvent

  AuthzFreeAuditEvent

  AuthzFreeResourceManager

  AuthzFreeHandle

  crypt32

  CryptImportPublicKeyInfo

  CryptVerifyMessageSignature

  CertCreateCertificateContext

  CertSetCertificateContextProperty

  CertVerifyCertificateChainPolicy

  CryptSignMessage

  CertCloseStore

  CertComparePublicKeyInfo

  CryptExportPublicKeyInfo

  CertFindExtension

  CryptDecryptMessage

  CertGetCertificateContextProperty

  CertAddCertificateContextToStore

  CertOpenStore

  CertVerifySubjectCertificateContext

  CertGetIssuerCertificateFromStore

  CertDuplicateCertificateContext

  CertFreeCertificateContext

  CertEnumCertificatesInStore

  CryptImportPublicKeyInfoEx

  gdi32

  RemoveFontResourceW

  AddFontResourceW

  kernel32

  WTSGetActiveConsoleSessionId

  GetTimeFormatW

  GetUserDefaultLCID

  FileTimeToSystemTime

  FileTimeToLocalFileTime

  GetProcAddress

  LoadLibraryW

  GetModuleHandleW

  SystemTimeToFileTime

  GetSystemTime

  SetLastError

  TerminateProcess

  GetCurrentProcess

  CreateTimerQueueTimer

  CreateThread

  lstrcpynW

  GetShortPathNameW

  GetProfileStringW

  FreeLibrary

  ReleaseSemaphore

  CreateSemaphoreW

  GetSystemInfo

  GetComputerNameW

  GetEnvironmentVariableW

  WaitForSingleObjectEx

  LoadResource

  FindResourceW

  SetThreadExecutionState

  DeleteTimerQueueTimer

  ResetEvent

  GetSystemDirectoryW

  TransactNamedPipe

  SetNamedPipeHandleState

  GetTickCount

  CreateFileW

  GlobalGetAtomNameW

  VirtualLock

  VirtualQuery

  GetDriveTypeW

  Beep

  OpenMutexW

  QueueUserWorkItem

  LeaveCriticalSection

  EnterCriticalSection

  DisconnectNamedPipe

  SearchPathW

  lstrcatW

  LocalReAlloc

  ExpandEnvironmentStringsW

  TerminateThread

  ResumeThread

  GetDiskFreeSpaceExW

  GlobalMemoryStatusEx

  DeleteFileW

  WriteProfileStringW

  ReadFile

  FindVolumeClose

  FindNextVolumeW

  FindFirstVolumeW

  FormatMessageW

  SetPriorityClass

  MoveFileExW

  WaitForMultipleObjectsEx

  GetExitCodeProcess

  SleepEx

  InterlockedExchange

  FindClose

  FindFirstFileW

  GetWindowsDirectoryW

  SetTimerQueueTimer

  GetComputerNameA

  GetVersionExW

  VerSetConditionMask

  WriteFile

  WaitNamedPipeW

  WaitForMultipleObjects

  ConnectNamedPipe

  DuplicateHandle

  OpenProcess

  GetOverlappedResult

  GetVersionExA

  lstrcmpW

  SetEnvironmentVariableW

  UnregisterWait

  CreateNamedPipeW

  CreateRemoteThread

  CreateActCtxW

  GetModuleFileNameW

  ExitProcess

  LoadLibraryExW

  SetErrorMode

  SetUnhandledExceptionFilter

  GetPrivateProfileStringW

  LocalSize

  VirtualAlloc

  VirtualQueryEx

  DebugBreak

  CreateFileA

  InitializeCriticalSection

  ProcessIdToSessionId

  SetInformationJobObject

  AssignProcessToJobObject

  TerminateJobObject

  PostQueuedCompletionStatus

  PulseEvent

  GetQueuedCompletionStatus

  CreateIoCompletionPort

  CreateJobObjectW

  ActivateActCtx

  DeactivateActCtx

  InterlockedCompareExchange

  LoadLibraryA

  QueryPerformanceCounter

  GetSystemTimeAsFileTime

  UnhandledExceptionFilter

  GetModuleHandleA

  GetStartupInfoA

  GetCurrentProcessId

  SetThreadPriority

  GetCurrentThreadId

  lstrcmpiW

  GetProfileIntW

  LoadLibraryExA

  lstrcpyW

  lstrlenW

  Sleep

  LocalAlloc

  CreateEventW

  GetExitCodeThread

  SetThreadAffinityMask

  GetProcessAffinityMask

  CreateWaitableTimerW

  CreateMutexW

  OpenEventW

  RegisterWaitForSingleObject

  WaitForSingleObject

  CreateProcessW

  SetWaitableTimer

  ReleaseMutex

  SetEvent

  UnregisterWaitEx

  CloseHandle

  lstrlenA

  lstrcpyA

  MultiByteToWideChar

  GetACP

  WideCharToMultiByte

  HeapAlloc

  GetProcessHeap

  HeapFree

  lstrcpynA

  UnmapViewOfFile

  MapViewOfFile

  CreateFileMappingW

  lstrcmpiA

  GetFileSize

  SetFilePointer

  GlobalAlloc

  GlobalFree

  GetLastError

  LocalFree

  lstrcatA

  lstrcmpA

  GetLogicalDriveStringsA

  GetDriveTypeA

  GetVolumeInformationW

  GlobalMemoryStatus

  CreateMutexA

  FindResourceExW

  LockResource

  SizeofResource

  VerifyVersionInfoW

  GetSystemDirectoryA

  GetCurrentThread

  DelayLoadFailureHook

  BaseInitAppcompatCacheSupport

  OpenProfileUserMapping

  CloseProfileUserMapping

  BaseCleanupAppcompatCacheSupport

  InitializeCriticalSectionAndSpinCount

  VirtualProtect

  CreateEventA

  TlsSetValue

  DeleteCriticalSection

  TlsGetValue

  TlsAlloc

  VirtualFree

  TlsFree

  msvcrt

  _vsnwprintf

  wcslen

  wcsncpy

  wcsstr

  atoi

  wcstok

  memmove

  wcschr

  swprintf

  swscanf

  _local_unwind2

  _wcslwr

  wcscmp

  _snwprintf

  malloc

  _c_exit

  _exit

  _XcptFilter

  _cexit

  exit

  _acmdln

  __getmainargs

  _initterm

  __setusermatherr

  _adjust_fdiv

  __p__commode

  __p__fmode

  ??3@YAXPAX@Z

  ??2@YAPAXI@Z

  __CxxFrameHandler

  _itow

  _snprintf

  _wtol

  _strnicmp

  sscanf

  wcstombs

  sprintf

  strchr

  strncmp

  atof

  _ftol

  isspace

  __set_app_type

  wcscpy

  _controlfp

  wcsncmp

  _wcsupr

  ceil

  wcscat

  _except_handler3

  free

  _wcsicmp

  nddeapi

  ord603

  ord612

  ord613

  ord611

  ntdll

  RtlAllocateHeap

  NtPowerInformation

  NtSetSystemPowerState

  NtRaiseHardError

  RtlDeleteCriticalSection

  NtOpenSymbolicLinkObject

  NtReplyPort

  NtCompleteConnectPort

  NtReplyWaitReceivePort

  NtAcceptConnectPort

  NtCreatePort

  RtlConvertSidToUnicodeString

  RtlFreeUnicodeString

  NtLockProductActivationKeys

  RtlTimeToTimeFields

  NtUnmapViewOfSection

  NtMapViewOfSection

  NtOpenSection

  NtQuerySymbolicLinkObject

  NtQueryVolumeInformationFile

  NtSetSecurityObject

  RtlAdjustPrivilege

  NtOpenFile

  NtFsControlFile

  RtlAllocateAndInitializeSid

  RtlDestroyEnvironment

  RtlFreeHeap

  NtQueryInformationToken

  NtShutdownSystem

  RtlEnterCriticalSection

  RtlLeaveCriticalSection

  RtlInitializeCriticalSection

  RtlCreateEnvironment

  RtlQueryEnvironmentVariable_U

  RtlSetEnvironmentVariable

  RtlInitUnicodeString

  NtOpenKey

  NtQueryValueKey

  RtlSubAuthoritySid

  RtlInitializeSid

  RtlLengthRequiredSid

  NtAllocateLocallyUniqueId

  RtlGetDaclSecurityDescriptor

  RtlCopySid

  RtlLengthSid

  NtSetInformationThread

  NtDuplicateToken

  NtDuplicateObject

  RtlEqualSid

  RtlSetDaclSecurityDescriptor

  NtClose

  RtlOpenCurrentUser

  RtlCreateSecurityDescriptor

  RtlAddAce

  RtlCreateAcl

  RtlNtStatusToDosError

  NtOpenDirectoryObject

  NtQuerySystemInformation

  NtCreateEvent

  NtCreatePagingFile

  RtlDosPathNameToNtPathName_U

  RtlRegisterWait

  NtSetValueKey

  NtCreateKey

  RtlTimeToSecondsSince1980

  NtQuerySystemTime

  NtPrivilegeObjectAuditAlarm

  NtPrivilegeCheck

  NtOpenThreadToken

  NtOpenProcessToken

  RtlUnhandledExceptionFilter

  NtQueryInformationProcess

  DbgBreakPoint

  RtlCheckProcessParameters

  RtlSetThreadIsCritical

  RtlSetProcessIsCritical

  RtlInitString

  NtInitiatePowerAction

  DbgPrint

  NtFilterToken

  NtQueryInformationJobObject

  NtOpenEvent

  RtlGetAce

  RtlQueryInformationAcl

  NtQuerySecurityObject

  RtlCompareUnicodeString

  NtSetInformationProcess

  profmap

  InitializeProfileMappingApi

  RemapAndMoveUserW

  psapi

  EnumProcesses

  EnumProcessModules

  GetModuleBaseNameW

  regapi

  RegDefaultUserConfigQueryW

  RegUserConfigQuery

  rpcrt4

  RpcServerRegisterIfEx

  RpcServerUseProtseqEpW

  RpcImpersonateClient

  I_RpcMapWin32Status

  RpcServerRegisterIf

  RpcGetAuthorizationContextForClient

  RpcFreeAuthorizationContext

  RpcServerListen

  RpcRevertToSelf

  NdrServerCall2

  UuidCreate

  secur32

  GetUserNameExW

  LsaLookupAuthenticationPackage

  LsaRegisterLogonProcess

  LsaCallAuthenticationPackage

  setupapi

  SetupDiDestroyDeviceInfoList

  SetupDiEnumDeviceInfo

  SetupDiGetClassDevsW

  SetupDiGetDeviceRegistryPropertyW

  user32

  SetFocus

  EnumWindows

  CreateWindowStationW

  RegisterLogonProcess

  RecordShutdownReason

  LoadLocalFonts

  UnhookWindowsHook

  SetWindowsHookW

  GetWindowTextW

  CallNextHookEx

  DialogBoxParamW

  GetWindowPlacement

  GetSystemMenu

  DeleteMenu

  SetWindowPlacement

  SetUserObjectInformationW

  GetAsyncKeyState

  PostThreadMessageW

  SetUserObjectSecurity

  CreateDesktopW

  KillTimer

  GetMessageTime

  SetLogonNotifyWindow

  UnlockWindowStation

  SetTimer

  ReplyMessage

  UnregisterHotKey

  RegisterHotKey

  OpenInputDesktop

  GetUserObjectInformationW

  CloseDesktop

  RegisterDeviceNotificationW

  SetThreadDesktop

  CreateWindowExW

  GetMessageW

  TranslateMessage

  RegisterWindowMessageW

  SetCursor

  DefWindowProcW

  FindWindowW

  MessageBoxW

  SendNotifyMessageW

  PostQuitMessage

  MsgWaitForMultipleObjects

  GetWindowRect

  GetSystemMetrics

  PeekMessageW

  DispatchMessageW

  SetProcessWindowStation

  UpdateWindow

  ShowWindow

  SetWindowPos

  PostMessageW

  ExitWindowsEx

  EnumDisplayMonitors

  SystemParametersInfoW

  GetDlgItem

  SendMessageW

  CreateDialogParamW

  DestroyWindow

  GetWindowLongW

  GetDlgItemTextW

  EndDialog

  SetWindowLongW

  LoadStringW

  SetWindowTextW

  SetDlgItemTextW

  wsprintfW

  wsprintfA

  LockWindowStation

  MBToWCSEx

  SetWindowStationUser

  UpdatePerUserSystemParameters

  DialogBoxIndirectParamW

  wvsprintfW

  SetLastErrorEx

  LoadCursorW

  CheckDlgButton

  IsDlgButtonChecked

  RegisterClassW

  CloseWindowStation

  LoadImageW

  GetParent

  GetKeyState

  GetDesktopWindow

  SetForegroundWindow

  SwitchDesktop

  OpenDesktopW

  userenv

  WaitForUserPolicyForegroundProcessing

  GetAllUsersProfileDirectoryW

  ord118

  ord117

  ord131

  ord151

  WaitForMachinePolicyForegroundProcessing

  ord140

  ord150

  ord152

  UnloadUserProfile

  LoadUserProfileW

  GetUserProfileDirectoryW

  RegisterGPNotification

  CreateEnvironmentBlock

  DestroyEnvironmentBlock

  UnregisterGPNotification

  ord130

  version

  GetFileVersionInfoSizeW

  GetFileVersionInfoW

  VerQueryValueW

  winsta

  WinStationRequestSessionsList

  WinStationQueryLogonCredentialsW

  WinStationIsHelpAssistantSession

  WinStationAutoReconnect

  _WinStationWaitForConnect

  WinStationDisconnect

  _WinStationCallback

  WinStationNameFromLogonIdW

  _WinStationFUSCanRemoteUserDisconnect

  WinStationEnumerate_IndexedW

  WinStationGetMachinePolicy

  WinStationQueryInformationW

  WinStationFreeMemory

  WinStationReset

  _WinStationNotifyDisconnectPipe

  WinStationConnectW

  WinStationSetInformationW

  WinStationShutdownSystem

  WinStationCheckLoopBack

  _WinStationNotifyLogon

  _WinStationNotifyLogoff

  wintrust

  CryptCATCatalogInfoFromContext

  CryptCATAdminCalcHashFromFileHandle

  CryptCATAdminAcquireContext

  CryptCATAdminEnumCatalogFromHash

  CryptCATAdminReleaseCatalogContext

  WTHelperProvDataFromStateData

  WinVerifyTrust

  WTHelperGetProvSignerFromChain

  CryptCATAdminReleaseContext

  ws2_32

  WSACleanup

  getaddrinfo

  WSAStartup

  Sections

  .text

  Size: 445KB - Virtual size: 444KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 8KB - Virtual size: 19KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 40KB - Virtual size: 44KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ