General

Malware Config

Signatures

Files

• 0c57b50b749dc7961e83ba3cb5e5f3e7f754cdfeb2cb90f6fb3b531a336cabaa.exe

  .dll regsvr32 windows x64

  6cc0be0d01417a15b61c3b6a580e87ed

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  gdi32

  CreatePen

  DeleteObject

  LineTo

  MoveToEx

  Polyline

  SelectObject

  user32

  BeginPaint

  CloseGestureInfoHandle

  CreateWindowExW

  DefWindowProcW

  DestroyWindow

  DispatchMessageW

  EndPaint

  GetGestureInfo

  GetMessageW

  InvalidateRect

  LoadCursorW

  LoadStringW

  PostQuitMessage

  RegisterClassExW

  ScreenToClient

  SetGestureConfig

  ShowWindow

  TranslateAcceleratorW

  TranslateMessage

  UpdateWindow

  kernel32

  CloseHandle

  CompareStringW

  CreateFileW

  DeleteCriticalSection

  EncodePointer

  EnterCriticalSection

  EnumSystemLocalesW

  ExitProcess

  FindClose

  FindFirstFileExW

  FindNextFileW

  FlsAlloc

  FlsFree

  FlsGetValue

  FlsSetValue

  FlushFileBuffers

  FreeEnvironmentStringsW

  FreeLibrary

  GetACP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  GetConsoleMode

  GetConsoleOutputCP

  GetCurrentProcess

  GetCurrentProcessId

  GetCurrentThread

  GetCurrentThreadId

  GetDateFormatW

  GetEnvironmentStringsW

  GetFileSizeEx

  GetFileType

  GetLastError

  GetLocaleInfoW

  GetModuleFileNameW

  GetModuleHandleExW

  GetModuleHandleW

  GetOEMCP

  GetProcAddress

  GetProcessHeap

  GetStartupInfoW

  GetStdHandle

  GetStringTypeW

  GetSystemTimeAsFileTime

  GetTimeFormatW

  GetUserDefaultLCID

  HeapAlloc

  HeapFree

  HeapReAlloc

  HeapSize

  InitializeCriticalSectionAndSpinCount

  InitializeSListHead

  InterlockedFlushSList

  InterlockedPushEntrySList

  IsDebuggerPresent

  IsProcessorFeaturePresent

  IsValidCodePage

  IsValidLocale

  LCMapStringW

  LeaveCriticalSection

  LoadLibraryExW

  MultiByteToWideChar

  OutputDebugStringW

  QueryPerformanceCounter

  RaiseException

  ReadConsoleW

  ReadFile

  RtlCaptureContext

  RtlLookupFunctionEntry

  RtlPcToFileHeader

  RtlUnwind

  RtlUnwindEx

  RtlVirtualUnwind

  SetConsoleCtrlHandler

  SetEnvironmentVariableW

  SetFilePointerEx

  SetLastError

  SetStdHandle

  SetUnhandledExceptionFilter

  TerminateProcess

  TlsAlloc

  TlsFree

  TlsGetValue

  TlsSetValue

  UnhandledExceptionFilter

  VirtualAlloc

  WideCharToMultiByte

  WriteConsoleW

  WriteFile

  Exports

  Exports

  ABeFtrnwmgAedx

  AEjATaIExpQg

  AbfBlUFQKbpevAFdaCpElBdscB

  AhCiOqhwyUiZbbsGncKmyLU

  AppWcUGsNPSALiojxbzmIncLqw

  BuDIuWLYHzeYLi

  BzspXLkN

  CAJbrnGzThPxKInHYeNbeiD

  CAizYoExRRpdPoWVbPYKFDwgiU

  DllRegisterServer

  DsznQIJtSEfpoaC

  DwKmpHIDu

  ECDzEWMCYJeoRkryuQOsYJpmq

  FAcdRHAWz

  FFgOwmblMRuJiEZKeYTYiuzs

  FGcNCKAIdduwyHBYG

  FrsmtxAdhb

  FycDPRFayBivcQtViJFBB

  GGGPAvQKBPbfXZZaHVp

  GKgyyDJNJDeNTLdDtczKsL

  GMWWgDWCipXlIkjHwoUVUkcYR

  GXJpVyiTrLHOne

  HJTFoxcPliQgvLgH

  HLCABIQMByMWBQl

  HSSmJwdyKCypI

  HuenqNYbiVIeAyMGFYkiYBPFpc

  IxremlDMjrvkDxgZfhGQZrk

  IxvOJTyBGbJYNRuYaPxjyAUmf

  JQPbXc

  JcMTbvPHZlumePpXUBhRJWcp

  JnZLIBBbkn

  JohOupoqASpLhYFLsyWn

  JwPmjlqZQXgHaQjgtKwKH

  LsCgTlMZDLwMutNSvzYIEdEhwL

  MPWJOPLDpgeYBymjBqgQIjmNoZ

  MXztYxhtX

  McniJoPJlmcEHlRCsaUz

  MhvpJKCzeAS

  MmBOoLzloNcLojEtz

  MoxtcCOHATssMTmiLf

  MpzzLNccslEpsqsI

  NqTxbmWhjf

  NsnrjJneCojFavepwQt

  OFTAEmNeIKkEpTykdZkNKIzp

  OguNFmV

  PXDdTdN

  PvWkibWuSiAacbZGzrkJUt

  QFGNloHdiwsP

  QOFKcQtiQXM

  QmukeRFviFO

  QupOoHScTGifO

  QyvetqDJywCLrVJLzofDOegxwP

  RmPpiUfGU

  SIkquaNCflVmESatNcndpdTlpe

  SfIHxYaArvTuFNrMVIbyX

  UWpelES

  UkLettFcomFXma

  VLdhIHLdMhyW

  VcULfipZVLXGKZRfrueex

  VqpcWzxeRjlVhQwQzv

  WBpPkPKcWeqGwAzzvNIH

  WEDyKrcivTPPlSwCwT

  WoptoKqfVNqOqwssFKVZfo

  XnGdCqyiMLdhVnMShSkq

  YMyyyHvdBObwWJjXdFk

  YihCWA

  YweLMeZukpQkvnZnYHkhCM

  ZLVzkIypQXUkzx

  ZSoNGzxKLdyqDghj

  ZkiQhRLkrjLkJNX

  ZmqtKkySX

  aPfqQAbMTzuJNp

  aehnZNNrhIsF

  amxdxgjfMZcXaFUifsfcvLXi

  bPfPnNT

  bubLuYEWIvIWsBNJTUOnl

  cTcqyCZyBDJvEFnsvQYDCOLAoT

  cYubuRW

  clFUgmrVuPSljrxXorVz

  dbMiEkrHbNnvlIaysX

  dgAUOlElUrm

  dxEatgtTYroSUkMiQaL

  eCkbiLnmCybWxEn

  efVluiugFvmsD

  exoEcLTZltlKDhXcTPLBLvM

  fAgLiyKNqrsT

  fEeZsQFKbuLaABrhuAbOhNj

  gYiNJrEBUixiSygWCLlsEf

  gpObsYCSb

  gtbMrIHBEjSZnmBWPb

  hCcvyzzlUZCYlRNZCTK

  hPDZNFuvABEgQeoD

  hsEYnjr

  iLEOjsJklFUGkNI

  iLjGFeOafkDi

  jcCPKYwgGqRpySHQKBnfIdayWD

  jjTWNPlegZljgiNVCWFLUDkFH

  kffHAP

  lUlTXKofnHgBxwxJLPdDPpCz

  lYaeKiHDZBLcjXyoPcEOBUc

  lpGoEIn

  mAtENYctTeMWWmtQ

  mEiZkvnenxFVSgbXocseslt

  mSkIHCWnxYjPAvLhkizRM

  nciUfwCE

  nfBvdBN

  ngwzyo

  njQxmJYMOWniVIJCxlqYaGwyco

  pikxaDuNdKkEyUKlBLtRo

  qYcNCgPzHhoixH

  qbLCbNjvgZccfXANyoilYHLz

  rIgvWBvLm

  rMHLHjIymAUoTHNFdsfNPiQH

  riiAnEEXhiFVUIdp

  sCXUQoygEhYAvHSLAtQPOlI

  sNgDDxTXeDBSWJVL

  sjmfaFHjAYLiTOs

  uFvBoQlDuBHPbcggfbqTz

  uKxBgklrkubs

  ueGFocoIB

  ueINzYdzNpuGfNAPnf

  vAVSflnhL

  vJROvhiSqVeOiIsH

  vfDcFWpsvSWqEKgMwpzmloZ

  vzyObHl

  wAavZUBVHJ

  wCHWOvC

  wQlVOK

  wZFewnVovChWmNJWJDqUTvJm

  wkraMphf

  xkQCLrMtQvyCjJhPSdk

  yYodwLnmm

  ysdKIUzdVU

  zFCiVYrpvmmXdRHTSKMcojyZb

  Sections

  .text

  Size: 370KB - Virtual size: 370KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 76KB - Virtual size: 76KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 3KB - Virtual size: 10KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 18KB - Virtual size: 17KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .00cfg

  Size: 512B - Virtual size: 40B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .gehcont

  Size: 512B - Virtual size: 80B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .gxfg

  Size: 40KB - Virtual size: 39KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .retplne

  Size: 512B - Virtual size: 92B

  .voltbl

  Size: 512B - Virtual size: 84B

  _RDATA

  Size: 512B - Virtual size: 244B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 160KB - Virtual size: 160KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ