General

Malware Config

Signatures

Files

• 6ded32aa3d1f387da983270faf43302c34062d2e7acb7dd640bc00a4a075bee9

  .dll windows x86

  216a491d6ed7bfa372ac702a9fa7a941

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  InitializeCriticalSectionAndSpinCount

  GetCurrentThreadId

  RaiseException

  GetVersionExW

  GetTickCount

  GetFileSize

  UnlockFile

  LockFile

  Process32NextW

  Process32FirstW

  CreateToolhelp32Snapshot

  CreateMutexW

  GetCurrentProcessId

  OpenProcess

  GetLongPathNameW

  CreateFileW

  ReadFile

  GetFileSizeEx

  MoveFileExW

  MoveFileW

  FindNextFileW

  FindFirstFileW

  DeleteFileW

  GetFileAttributesW

  SetFileAttributesW

  GetFullPathNameW

  RemoveDirectoryW

  GetWindowsDirectoryW

  GetTempPathW

  lstrlenW

  FindClose

  SetLastError

  WideCharToMultiByte

  MultiByteToWideChar

  FindResourceExW

  FindResourceW

  GetModuleHandleW

  GetModuleFileNameW

  LoadLibraryW

  CreateEventW

  SizeofResource

  LoadResource

  SetFileTime

  GetCurrentDirectoryW

  CreateDirectoryW

  SearchPathW

  SetEndOfFile

  WriteConsoleW

  SetFilePointerEx

  ReadConsoleW

  SetStdHandle

  SetConsoleCtrlHandler

  SetEnvironmentVariableW

  SetEnvironmentVariableA

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GetCommandLineA

  GetCPInfo

  GetOEMCP

  FindFirstChangeNotificationW

  FindCloseChangeNotification

  CompareFileTime

  GetFileInformationByHandle

  SwitchToThread

  GetDriveTypeW

  WritePrivateProfileStringW

  GetCommandLineW

  LoadLibraryExW

  lstrcmpiW

  InterlockedDecrement

  InterlockedIncrement

  DecodePointer

  GlobalFindAtomW

  GlobalAddAtomW

  GetStartupInfoW

  CreateProcessW

  OpenEventW

  Sleep

  WaitForMultipleObjects

  WaitForSingleObject

  SetEvent

  DeleteCriticalSection

  LeaveCriticalSection

  EnterCriticalSection

  InitializeCriticalSection

  GetLastError

  GetCurrentProcess

  GetProcessHeap

  HeapSize

  HeapFree

  HeapReAlloc

  HeapAlloc

  HeapDestroy

  IsValidCodePage

  FindNextFileA

  FindFirstFileExW

  FindFirstFileExA

  GetConsoleMode

  GetConsoleCP

  GetTimeZoneInformation

  EnumSystemLocalesW

  GetUserDefaultLCID

  IsValidLocale

  GetLocaleInfoW

  LCMapStringW

  CompareStringW

  GetTimeFormatW

  GetDateFormatW

  GetStringTypeW

  GetFileType

  GetStdHandle

  GetACP

  GetCurrentThread

  GetModuleFileNameA

  ExitProcess

  GetModuleHandleExW

  FreeLibraryAndExitThread

  ResumeThread

  ExitThread

  CreateThread

  TlsFree

  TlsSetValue

  TlsGetValue

  TlsAlloc

  RtlUnwind

  InterlockedFlushSList

  GetSystemWindowsDirectoryW

  FreeResource

  lstrcmpiA

  lstrcmpA

  GetSystemTimeAsFileTime

  QueryPerformanceCounter

  WaitForSingleObjectEx

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  GlobalFree

  GetProcAddress

  FreeLibrary

  LockResource

  GlobalUnlock

  GlobalLock

  GlobalAlloc

  FlushFileBuffers

  LoadLibraryExA

  VirtualFree

  VirtualAlloc

  IsProcessorFeaturePresent

  FlushInstructionCache

  InterlockedPushEntrySList

  InterlockedPopEntrySList

  InitializeSListHead

  GetVersion

  WriteFile

  EncodePointer

  IsDebuggerPresent

  DeviceIoControl

  GetShortPathNameW

  GetPrivateProfileStringW

  LocalAlloc

  InterlockedCompareExchange

  InterlockedExchange

  GetDiskFreeSpaceExW

  GetSystemDirectoryW

  GetLogicalDriveStringsW

  GetFileAttributesExW

  SetFilePointer

  DeleteFileA

  CreateFileA

  GetTempFileNameA

  GetTempPathA

  CloseHandle

  LocalFree

  GetEnvironmentVariableW

  GetTempFileNameW

  FormatMessageW

  TerminateProcess

  GetExitCodeProcess

  CopyFileW

  OutputDebugStringA

  OutputDebugStringW

  GetLocalTime

  ResetEvent

  GetSystemInfo

  MapViewOfFile

  UnmapViewOfFile

  CreateFileMappingW

  user32

  DefWindowProcW

  GetClassInfoExW

  FindWindowExW

  PostMessageW

  KillTimer

  RegisterClassExW

  GetWindowThreadProcessId

  CallWindowProcW

  SetTimer

  UnregisterClassW

  CreateWindowExW

  IsDialogMessageW

  OffsetRect

  GetActiveWindow

  EndDialog

  DialogBoxParamW

  GetMonitorInfoW

  MonitorFromWindow

  LoadImageW

  GetWindow

  MapWindowPoints

  SetForegroundWindow

  GetSystemMetrics

  MessageBoxW

  wsprintfW

  RegisterWindowMessageW

  SendMessageTimeoutW

  SendNotifyMessageW

  FindWindowW

  UnionRect

  EqualRect

  PtInRect

  SetCursor

  DrawFocusRect

  DestroyCursor

  MoveWindow

  UnregisterClassA

  IsIconic

  PostQuitMessage

  CharNextW

  BringWindowToTop

  PeekMessageW

  DispatchMessageW

  TranslateMessage

  GetMessageW

  GetParent

  FillRect

  ScreenToClient

  GetWindowTextLengthW

  SetWindowTextW

  InvalidateRect

  DrawTextW

  ReleaseCapture

  SetCapture

  GetAsyncKeyState

  GetFocus

  DestroyWindow

  UnhookWinEvent

  SetWinEventHook

  GetWindowTextW

  WaitForInputIdle

  SendMessageW

  GetShellWindow

  SystemParametersInfoW

  LoadCursorW

  SetWindowLongW

  GetWindowLongW

  CopyRect

  GetWindowRect

  GetClientRect

  SetWindowRgn

  EndPaint

  BeginPaint

  ReleaseDC

  GetDC

  IsWindowVisible

  SetWindowPos

  UpdateLayeredWindow

  ShowWindow

  IsWindow

  gdi32

  SetBkMode

  RectVisible

  EnumFontFamiliesW

  GetObjectW

  CreateDIBSection

  SetTextColor

  CreateFontW

  SelectClipRgn

  SaveDC

  RestoreDC

  GetStockObject

  CreateRectRgnIndirect

  SetViewportOrgEx

  SelectObject

  DeleteObject

  DeleteDC

  CreateRectRgn

  CreateCompatibleDC

  CreateCompatibleBitmap

  CombineRgn

  BitBlt

  OffsetViewportOrgEx

  advapi32

  AllocateAndInitializeSid

  RegQueryValueExA

  RegOpenKeyExA

  RegEnumKeyExA

  CryptContextAddRef

  CryptDecrypt

  CryptEncrypt

  CryptImportKey

  CryptGenRandom

  CryptSetKeyParam

  RegSetValueExW

  RegQueryInfoKeyW

  RegEnumKeyExW

  RegDeleteValueW

  RegDeleteKeyW

  RegCreateKeyExW

  RegQueryValueExW

  RegOpenKeyExW

  RegEnumValueW

  RegCloseKey

  DuplicateTokenEx

  LookupPrivilegeValueW

  AdjustTokenPrivileges

  OpenProcessToken

  GetUserNameW

  CryptDestroyKey

  FreeSid

  CheckTokenMembership

  EqualSid

  DeleteAce

  LookupAccountSidW

  LookupAccountNameW

  SetEntriesInAclW

  GetExplicitEntriesFromAclW

  GetNamedSecurityInfoW

  SetNamedSecurityInfoW

  BuildExplicitAccessWithNameW

  GetTrusteeNameW

  ChangeServiceConfigW

  ChangeServiceConfig2W

  CloseServiceHandle

  ControlService

  CreateServiceW

  DeleteService

  LockServiceDatabase

  OpenSCManagerW

  OpenServiceW

  QueryServiceConfigW

  QueryServiceConfig2W

  QueryServiceLockStatusW

  QueryServiceStatus

  StartServiceW

  UnlockServiceDatabase

  CryptAcquireContextW

  CryptReleaseContext

  GetTokenInformation

  shell32

  SHLoadInProc

  CommandLineToArgvW

  SHGetFolderPathW

  SHGetSpecialFolderPathW

  ShellExecuteExW

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHCreateDirectoryExW

  ShellExecuteW

  ord165

  SHChangeNotify

  SHFileOperationW

  ole32

  CoSetProxyBlanket

  CoInitializeEx

  CreateStreamOnHGlobal

  CoCreateGuid

  CoTaskMemFree

  CoTaskMemRealloc

  CoTaskMemAlloc

  CoCreateInstance

  CoUninitialize

  StringFromGUID2

  CoInitializeSecurity

  OleRun

  CoInitialize

  oleaut32

  VariantCopy

  SysFreeString

  VarUI4FromStr

  VariantInit

  GetErrorInfo

  VariantChangeType

  SetErrorInfo

  CreateErrorInfo

  SysStringLen

  VariantClear

  SysAllocStringByteLen

  SysStringByteLen

  SysAllocString

  shlwapi

  SHDeleteValueW

  StrStrIW

  PathIsDirectoryW

  SHSetValueA

  PathIsRootW

  PathIsRelativeW

  PathRemoveFileSpecW

  SHGetValueW

  PathFindFileNameW

  PathFindExtensionW

  PathFileExistsW

  PathCombineW

  PathAppendW

  PathRenameExtensionA

  PathFindFileNameA

  PathIsPrefixW

  wnsprintfW

  SHSetValueW

  StrStrIA

  StrCmpIW

  StrToIntExW

  SHGetValueA

  StrCmpNIW

  StrTrimA

  AssocQueryStringW

  comctl32

  InitCommonControlsEx

  _TrackMouseEvent

  gdiplus

  GdipDrawImageRectRect

  GdipCreateBitmapFromFileICM

  GdipCreateBitmapFromStreamICM

  GdipCreateBitmapFromFile

  GdipCreateBitmapFromStream

  GdiplusStartup

  GdiplusShutdown

  GdipGetImageWidth

  GdipGetImageHeight

  GdipCreateFromHDC

  GdipDeleteGraphics

  GdipDrawImagePointRectI

  GdipDrawImageRectRectI

  GdipDisposeImage

  GdipCloneImage

  GdipSetStringFormatTrimming

  GdipAlloc

  GdipFree

  GdipCloneBrush

  GdipDeleteBrush

  GdipCreateSolidFill

  GdipCreatePen1

  GdipDeletePen

  GdipCreateImageAttributes

  GdipSetStringFormatLineAlign

  GdipSetImageAttributesColorMatrix

  GdipSetTextRenderingHint

  GdipDrawRectangleI

  GdipFillRectangleI

  GdipDisposeImageAttributes

  GdipCreateFontFamilyFromName

  GdipDeleteFontFamily

  GdipCreateFont

  GdipDeleteFont

  GdipDrawString

  GdipMeasureString

  GdipCreateStringFormat

  GdipDeleteStringFormat

  GdipSetStringFormatFlags

  GdipSetStringFormatAlign

  psapi

  EnumProcesses

  GetModuleFileNameExW

  iphlpapi

  GetAdaptersInfo

  wininet

  InternetGetConnectedState

  urlmon

  URLDownloadToFileW

  URLDownloadToCacheFileW

  version

  GetFileVersionInfoSizeW

  GetFileVersionInfoW

  VerQueryValueW

  setupapi

  SetupIterateCabinetW

  secur32

  GetUserNameExW

  crypt32

  CertGetNameStringW

  CryptStringToBinaryA

  CryptStringToBinaryW

  CryptBinaryToStringA

  CryptBinaryToStringW

  wintrust

  WTHelperProvDataFromStateData

  WinVerifyTrust

  Exports

  Exports

  BasicEntry

  Dll_Entry

  Start

  Sections

  .text

  Size: 978KB - Virtual size: 977KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 217KB - Virtual size: 216KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 22KB - Virtual size: 33KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 1.8MB - Virtual size: 1.8MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 50KB - Virtual size: 49KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ