General

Malware Config

Signatures

Files

• Inv_162_Jan-01_Copy.zip

  .zip
• Inv_162_Jan-01_Copy/REF_Scan_01-09.lnk

  .lnk
• Inv_162_Jan-01_Copy/eveeftwedK/blessing.dat

  .dll windows x64

  fc0ee7c77059c08469793286814ec9d0

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  advapi32

  RegCloseKey

  RegOpenKeyExA

  RegQueryInfoKeyW

  RegEnumValueW

  user32

  GetDesktopWindow

  FillRect

  GetDC

  ReleaseDC

  GetWindowDC

  SystemParametersInfoA

  gdi32

  GetFontData

  GetDIBits

  GetDeviceCaps

  DeleteObject

  GetStockObject

  CreateCompatibleDC

  CreateCompatibleBitmap

  EnumFontFamiliesExW

  SetTextColor

  GetTextMetricsA

  GetGlyphOutlineA

  SelectObject

  SetBkColor

  CreateFontIndirectW

  ExtTextOutW

  SetMapMode

  GetFontData

  GetDIBits

  GetDeviceCaps

  DeleteObject

  GetStockObject

  CreateCompatibleDC

  CreateCompatibleBitmap

  EnumFontFamiliesExW

  SetTextColor

  GetTextMetricsA

  GetGlyphOutlineA

  SelectObject

  SetBkColor

  CreateFontIndirectW

  ExtTextOutW

  SetMapMode

  kernel32

  EnterCriticalSection

  DeleteCriticalSection

  RtlCaptureContext

  RtlVirtualUnwind

  GetWindowsDirectoryA

  GetSystemDirectoryA

  LeaveCriticalSection

  RtlLookupFunctionEntry

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  TerminateProcess

  IsProcessorFeaturePresent

  QueryPerformanceCounter

  GetCurrentProcessId

  GetCurrentThreadId

  GetSystemTimeAsFileTime

  DisableThreadLibraryCalls

  InitializeSListHead

  IsDebuggerPresent

  Exports

  Exports

  hava_sun_awt_Win32FontManager_getFontPath

  hava_sun_awt_Win32FontManager_populateFontFileNameMap0

  hava_sun_font_ColorGlyphSurfaceData_initOps

  hava_sun_font_ColorGlyphSurfaceData_setCurrentGlyph

  hava_sun_font_FileFontStrike__1getGlyphImageFromWindows

  hava_sun_font_FileFontStrike_initNative

  hava_sun_font_FreetypeFontScaler_createScalerContextNative

  hava_sun_font_FreetypeFontScaler_disposeNativeScaler

  hava_sun_font_FreetypeFontScaler_getFontMetricsNative

  hava_sun_font_FreetypeFontScaler_getGlyphAdvanceNative

  hava_sun_font_FreetypeFontScaler_getGlyphCodeNative

  hava_sun_font_FreetypeFontScaler_getGlyphImageNative

  hava_sun_font_FreetypeFontScaler_getGlyphMetricsNative

  hava_sun_font_FreetypeFontScaler_getGlyphOutlineBoundsNative

  hava_sun_font_FreetypeFontScaler_getGlyphOutlineNative

  hava_sun_font_FreetypeFontScaler_getGlyphPointNative

  hava_sun_font_FreetypeFontScaler_getGlyphVectorOutlineNative

  hava_sun_font_FreetypeFontScaler_getMissingGlyphCodeNative

  hava_sun_font_FreetypeFontScaler_getNumGlyphsNative

  hava_sun_font_FreetypeFontScaler_getUnitsPerEMNative

  hava_sun_font_FreetypeFontScaler_initIDs

  hava_sun_font_FreetypeFontScaler_initNativeScaler

  hava_sun_font_NullFontScaler_getGlyphImage

  hava_sun_font_NullFontScaler_getNullScalerContext

  hava_sun_font_StrikeCache_freeIntMemory

  hava_sun_font_StrikeCache_freeIntPointer

  hava_sun_font_StrikeCache_freeLongMemory

  hava_sun_font_StrikeCache_freeLongPointer

  hava_sun_font_StrikeCache_getGlyphCacheDescription

  hava_sun_font_SunFontManager_initIDs

  hava_sun_font_SunLayoutEngine_createFace

  hava_sun_font_SunLayoutEngine_disposeFace

  hava_sun_font_SunLayoutEngine_shape

  hava_sun_java2d_loops_DrawGlyphListAA_DrawGlyphListAA

  hava_sun_java2d_loops_DrawGlyphListLCD_DrawGlyphListLCD

  hava_sun_java2d_loops_DrawGlyphList_DrawGlyphList

  hetSunFontIDs

  init

  Sections

  .text

  Size: 486KB - Virtual size: 486KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 249KB - Virtual size: 249KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 3KB - Virtual size: 8KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 21KB - Virtual size: 21KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 16KB - Virtual size: 13KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 320B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Inv_162_Jan-01_Copy/eveeftwedK/oakhidtino.cmd