General

Malware Config

Signatures

Files

• 7c77bb790b156d5789c5127088ff59b0272777e2d2b8a370faeeb6530f84f982

  .exe windows x86

  399e80a2ee0302335d0040b784c6f987

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DEBUG_STRIPPED

  Imports

  crypt32

  CertCompareCertificateName

  CertComparePublicKeyInfo

  CryptDecodeObjectEx

  CertGetPublicKeyLength

  CryptInitOIDFunctionSet

  CertAddCRLLinkToStore

  CertCreateSelfSignCertificate

  CertGetCRLFromStore

  CertCreateContext

  CryptDecodeMessage

  CertStrToNameW

  CryptUnregisterOIDInfo

  CryptMsgCountersign

  CryptCreateKeyIdentifierFromCSP

  CertSetCRLContextProperty

  CryptHashMessage

  CertRemoveStoreFromCollection

  CertDuplicateStore

  CertFindSubjectInSortedCTL

  CryptEncodeObject

  CertSaveStore

  CertEnumPhysicalStore

  CertDeleteCTLFromStore

  CryptVerifyCertificateSignature

  CertIsValidCRLForCertificate

  CryptEnumOIDFunction

  CryptFindLocalizedName

  CryptRegisterDefaultOIDFunction

  CertFindRDNAttr

  CertAddCertificateContextToStore

  CertDuplicateCTLContext

  CryptUninstallDefaultContext

  kernel32

  CreateThread

  VirtualAlloc

  VirtualFree

  FreeConsole

  GetModuleFileNameW

  GetCurrentProcessId

  LoadLibraryA

  GetLastError

  InterlockedExchange

  FreeLibrary

  GetProcAddress

  LocalAlloc

  RaiseException

  ntdll

  NtImpersonateAnonymousToken

  NtWriteVirtualMemory

  NtOpenProcess

  RtlCopyUnicodeString

  NtQueryInformationProcess

  ZwShutdownSystem

  NtQuerySecurityObject

  NtCreateProcess

  NtSuspendThread

  RtlIntegerToUnicodeString

  RtlAppendUnicodeStringToString

  NtCreateSection

  RtlDestroyQueryDebugBuffer

  NtReleaseSemaphore

  ZwProtectVirtualMemory

  RtlCreateProcessParameters

  ZwQueueApcThread

  NtUnmapViewOfSection

  RtlExtendedIntegerMultiply

  RtlTimeFieldsToTime

  RtlLargeIntegerSubtract

  RtlExtendedLargeIntegerDivide

  NtFsControlFile

  RtlNtStatusToDosError

  RtlFreeUnicodeString

  NtImpersonateThread

  NtQueryVolumeInformationFile

  Exports

  Exports

  AllowUninitialize

  ArcOIDTo

  BeginTest

  CommImageDelete

  DebugCompactGuidGamut

  DialogUninstallProvStatusLog

  HttpActiveIdealMasked

  NotifyKeyboardSpec

  PFXIsSwitch

  RegClusterBrushPointer

  RequestDebug

  SHQueryTokenRendering

  SHReleaseGroupButton

  TerminateSelectClickTimeouts

  UninstallObjectBin

  WriteNumberHresultRgn

  Sections

  .text

  Size: 62KB - Virtual size: 61KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 270KB - Virtual size: 270KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .Bc

  Size: 244KB - Virtual size: 244KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .CRT

  Size: 8KB - Virtual size: 8KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 916B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ