General

Malware Config

Signatures

Files

• 86c5dc1ecd2337273070dd927cef37b2d55760eb9b5518bc5b354c4e1f7e2d00

  .exe windows x86

  e141c8b0776b0def79cd35a781dfde11

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  UnmapViewOfFile

  GetFileSize

  FreeLibrary

  GetPrivateProfileStringA

  lstrcmpA

  LocalReAlloc

  DeleteFileA

  IsBadReadPtr

  GetModuleFileNameA

  lstrcatA

  LocalAlloc

  LocalFree

  SetFilePointer

  GetTempPathA

  GetTempFileNameA

  FindResourceA

  WritePrivateProfileStringA

  WriteFile

  CloseHandle

  CreateFileMappingA

  GetDiskFreeSpaceA

  MulDiv

  FindFirstFileA

  GetPrivateProfileIntA

  SearchPathA

  GetSystemInfo

  GetLocalTime

  GetProfileStringA

  WritePrivateProfileSectionA

  GetFileTime

  GetLastError

  UnhandledExceptionFilter

  lstrcpynA

  QueryPerformanceCounter

  GetFullPathNameA

  ExpandEnvironmentStringsA

  lstrcpyA

  Sleep

  DisableThreadLibraryCalls

  RemoveDirectoryA

  IsDBCSLeadByte

  GetShortPathNameA

  lstrcmpiA

  GetVolumeInformationA

  SetFileAttributesA

  CreateDirectoryA

  GetPrivateProfileSectionA

  CopyFileA

  MoveFileA

  GetSystemDirectoryA

  FindClose

  GetStartupInfoA

  lstrlenW

  GetFileAttributesW

  GetModuleFileNameW

  GetSystemDirectoryW

  SetLastError

  lstrcmpW

  CreateFileW

  SetErrorMode

  CreateEventW

  CreateFileMappingW

  OpenFileMappingW

  GetCurrentThread

  ProcessIdToSessionId

  OpenProcess

  lstrcatW

  GetProcessVersion

  lstrcpyW

  OpenMutexW

  CreateFileA

  lstrlenA

  CompareStringA

  EnumResourceLanguagesA

  GetModuleHandleA

  user32

  GetDesktopWindow

  SetWindowTextA

  ExitWindowsEx

  CharToOemA

  GetSystemMetrics

  CharUpperA

  MsgWaitForMultipleObjects

  GetWindowRect

  GetDC

  ReleaseDC

  SetWindowPos

  LoadStringA

  wsprintfA

  GetDlgItemTextA

  SetTimer

  RegisterClassW

  SetProcessWindowStation

  OpenWindowStationW

  GetProcessWindowStation

  CloseWindowStation

  CloseDesktop

  GetUserObjectInformationW

  OpenInputDesktop

  SetThreadDesktop

  GetWindowThreadProcessId

  KillTimer

  EnumWindows

  SetDlgItemTextA

  DialogBoxParamA

  OemToCharA

  DestroyWindow

  UpdateWindow

  CharNextA

  CreateWindowExW

  advapi32

  SetSecurityDescriptorOwner

  InitializeAcl

  OpenThreadToken

  RegOpenKeyExW

  DuplicateToken

  CheckTokenMembership

  RegOpenCurrentUser

  ImpersonateLoggedOnUser

  RegSetValueExW

  RegQueryValueExW

  RegCloseKey

  RegQueryValueExA

  RegCreateKeyExA

  RegOpenKeyExA

  RegQueryInfoKeyA

  LookupPrivilegeValueA

  RegSetValueExA

  RegEnumValueA

  RegDeleteValueA

  RegDeleteKeyA

  RegFlushKey

  RegLoadKeyA

  RegUnLoadKeyA

  CopySid

  RegEnumKeyA

  FreeSid

  AllocateAndInitializeSid

  EqualSid

  GetTokenInformation

  CloseServiceHandle

  OpenSCManagerA

  DeleteService

  RevertToSelf

  AccessCheck

  AddAccessAllowedAce

  ole32

  CoUninitialize

  CoCreateInstance

  CoInitialize

  OleUninitialize

  version

  GetFileVersionInfoA

  msvcrt

  memmove

  exit

  free

  wcschr

  _chmod

  atol

  swprintf

  malloc

  _chdir

  setupapi

  SetupDiDestroyDeviceInfoList

  SetupDiSetDeviceRegistryPropertyA

  SetupDiCallClassInstaller

  SetupDiClassGuidsFromNameExA

  SetupDiGetClassDescriptionExA

  SetupDiSetClassInstallParamsA

  rpcrt4

  RpcBindingSetAuthInfoExW

  RpcBindingFromStringBindingW

  Sections

  .text

  Size: 144KB - Virtual size: 143KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .idata

  Size: 8KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 24KB - Virtual size: 22KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 52KB - Virtual size: 2.6MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 16KB - Virtual size: 12KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ