General

Malware Config

Signatures

Files

• a6ed8beb599f2aa594298076a2e8312871a2b12feb8e5d072d51335f21f85d7b

  .exe windows x86

  4320331bcf9a46674ed5540b0553eb3e

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  GetACP

  IsValidCodePage

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GetSystemTimeAsFileTime

  GetCurrentProcessId

  QueryPerformanceCounter

  GetCurrentThreadId

  LoadLibraryExW

  SetFilePointerEx

  ReadFile

  GetConsoleMode

  GetConsoleCP

  WriteFile

  FlushFileBuffers

  CloseHandle

  AreFileApisANSI

  ExitProcess

  EnumSystemLocalesW

  GetOEMCP

  SetStdHandle

  ReadConsoleW

  CreateFileW

  SetEndOfFile

  MultiByteToWideChar

  CreateDirectoryW

  GetWindowsDirectoryA

  LoadLibraryA

  CreateEventW

  lstrlenA

  Sleep

  WaitForSingleObject

  LocalFree

  LocalAlloc

  GlobalFree

  GlobalAlloc

  GetProcAddress

  DeleteCriticalSection

  InitializeCriticalSectionAndSpinCount

  GetLastError

  RaiseException

  GetProcessHeap

  HeapSize

  HeapFree

  GetUserDefaultLCID

  IsValidLocale

  GetLocaleInfoW

  LCMapStringW

  GetModuleHandleW

  GetStartupInfoW

  TlsFree

  TlsSetValue

  TlsGetValue

  TlsAlloc

  TerminateProcess

  GetCurrentProcess

  SetLastError

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  GetCPInfo

  GetCommandLineW

  RtlUnwind

  WriteConsoleW

  GetModuleHandleExW

  GetModuleFileNameW

  GetFileType

  GetStdHandle

  IsProcessorFeaturePresent

  GetStringTypeW

  WideCharToMultiByte

  EncodePointer

  LeaveCriticalSection

  EnterCriticalSection

  OutputDebugStringW

  IsDebuggerPresent

  HeapReAlloc

  HeapAlloc

  DecodePointer

  user32

  CheckMenuRadioItem

  GetParent

  GetWindowLongA

  PtInRect

  UnionRect

  SetRect

  FillRect

  GetCursorPos

  SendMessageA

  GetClientRect

  ScrollWindow

  SetFocus

  DrawIconEx

  GetKeyState

  TrackPopupMenu

  UpdateWindow

  GetDC

  ReleaseDC

  GetDlgItem

  EnumWindowStationsW

  DestroyIcon

  GetScrollInfo

  SetScrollInfo

  LoadStringA

  GetIconInfo

  InvalidateRect

  gdi32

  GetObjectA

  SetTextJustification

  SetBkColor

  SelectObject

  GetDeviceCaps

  DeleteObject

  DeleteDC

  CreateSolidBrush

  CreateCompatibleDC

  CreateCompatibleBitmap

  CombineRgn

  comdlg32

  GetOpenFileNameA

  advapi32

  SetSecurityDescriptorDacl

  InitializeAcl

  AllocateAndInitializeSid

  FreeSid

  SetEntriesInAclW

  RegOpenKeyExW

  GetUserNameW

  LookupAccountNameA

  MakeSelfRelativeSD

  AddAccessAllowedAce

  GetSecurityDescriptorLength

  InitializeSecurityDescriptor

  GetLengthSid

  shell32

  SHGetSpecialFolderLocation

  SHGetSpecialFolderPathA

  SHGetMalloc

  ole32

  MkParseDisplayName

  CreateBindCtx

  CoCreateInstance

  CoUninitialize

  CoInitialize

  oleaut32

  SafeArrayPutElement

  OleTranslateColor

  VariantInit

  SysFreeString

  SysAllocString

  VariantClear

  SafeArrayUnaccessData

  opengl32

  wglMakeCurrent

  wglCreateContext

  wglCopyContext

  ws2_32

  bind

  closesocket

  ioctlsocket

  WSAStartup

  WSAHtonl

  WSAHtons

  WSARecvFrom

  WSASendTo

  WSASocketA

  WSALookupServiceEnd

  WSAGetLastError

  setupapi

  CM_Get_Device_Interface_ListW

  CM_Get_Global_State

  CM_Get_Device_Interface_AliasW

  msacm32

  acmDriverDetailsA

  mpr

  WNetAddConnection2A

  netapi32

  NetApiBufferFree

  NetUserGetInfo

  avifil32

  AVIStreamGetFrameOpen

  rpcrt4

  RpcBindingFree

  UuidToStringA

  UuidCreate

  RpcBindingSetAuthInfoA

  RpcMgmtWaitServerListen

  RpcServerUseProtseqEpA

  RpcStringFreeA

  RpcBindingFromStringBindingA

  RpcStringBindingComposeA

  RpcServerListen

  snmpapi

  SnmpUtilIdsToA

  SnmpUtilOidToA

  ntdsapi

  DsWriteAccountSpnA

  d2d1

  ord1

  dwrite

  DWriteCreateFactory

  Sections

  .text

  Size: 143KB - Virtual size: 143KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 56KB - Virtual size: 55KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 7KB - Virtual size: 18KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 263KB - Virtual size: 263KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ