General

Malware Config

Signatures

Files

• b59dd0ff15b4a58c42cedef618c10789a711a780d287840a33accaf0dafe9517

  .exe windows x86

  bf7521fc5ec800a70c92c79a762d3f5a

  
  

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  InterlockedDecrement

  UnregisterWait

  RegisterWaitForSingleObjectEx

  WideCharToMultiByte

  LeaveCriticalSection

  CreateFileW

  EnterCriticalSection

  InitializeCriticalSection

  OpenEventW

  UnmapViewOfFile

  MapViewOfFileEx

  OpenFileMappingW

  GetSystemInfo

  GetLocalTime

  WaitForSingleObject

  GetCurrentThread

  CompareStringA

  CreateEventA

  GetModuleHandleW

  GetModuleFileNameW

  lstrcpyW

  FormatMessageW

  IsDebuggerPresent

  OutputDebugStringA

  DebugBreak

  lstrcmpW

  LocalFree

  CloseHandle

  GetSystemTimeAsFileTime

  GetStartupInfoA

  GetProfileIntA

  ReplaceFileW

  GetTimeZoneInformation

  GetVersionExA

  GetLocaleInfoW

  CreateFileMappingW

  GetLastError

  advapi32

  OpenThreadToken

  FreeSid

  CheckTokenMembership

  RegisterEventSourceW

  ReportEventW

  DeregisterEventSource

  CryptCreateHash

  CryptHashData

  RegEnumKeyExW

  RegOpenKeyW

  OpenSCManagerW

  OpenServiceW

  QueryServiceConfigW

  QueryServiceStatus

  CloseServiceHandle

  RegQueryValueExW

  RevertToSelf

  SetThreadToken

  LookupAccountSidW

  msvcrt

  system

  fprintf

  setlocale

  fgetc

  fgetpos

  vfprintf

  secur32

  FreeContextBuffer

  Sections

  .text

  Size: 28KB - Virtual size: 24KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 92KB - Virtual size: 473KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 4KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 44KB - Virtual size: 42KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ