General

Malware Config

Signatures

Files

• 0x000900000001231c-55.dat

  .exe windows x86

  dac8ae7c837e7fe3a3ea62e0b6800155

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  ws2_32

  recvfrom

  setsockopt

  sendto

  send

  recv

  ioctlsocket

  WSAStartup

  bind

  WSACloseEvent

  WSARecv

  WSASend

  WSAGetLastError

  WSAEnumNetworkEvents

  gethostname

  connect

  inet_ntoa

  inet_addr

  htons

  getsockname

  shutdown

  socket

  closesocket

  gethostbyname

  WSAEventSelect

  WSAGetOverlappedResult

  WSAWaitForMultipleEvents

  getpeername

  accept

  WSACreateEvent

  WSASocketA

  listen

  shlwapi

  PathFileExistsW

  StrCmpNW

  PathMatchSpecW

  PathFindFileNameW

  StrChrA

  StrStrIA

  StrCmpNIA

  StrStrW

  urlmon

  URLDownloadToFileW

  wininet

  HttpOpenRequestA

  InternetOpenUrlW

  InternetOpenUrlA

  HttpQueryInfoA

  InternetOpenW

  InternetCloseHandle

  InternetOpenA

  HttpSendRequestA

  InternetConnectA

  InternetCrackUrlA

  InternetReadFile

  HttpAddRequestHeadersA

  ntdll

  memcpy

  _chkstk

  _aulldiv

  RtlUnwind

  memmove

  mbstowcs

  RtlTimeToSecondsSince1980

  NtQuerySystemTime

  NtQueryVirtualMemory

  strstr

  isdigit

  isalpha

  _allshl

  _aullshr

  memset

  msvcrt

  rand

  srand

  _vscprintf

  kernel32

  GetLastError

  CreateProcessW

  GetLocaleInfoA

  DuplicateHandle

  DeleteCriticalSection

  GetThreadPriority

  SetThreadPriority

  GetCurrentThread

  GetCurrentProcess

  InterlockedExchangeAdd

  InterlockedIncrement

  InterlockedExchange

  WaitForSingleObject

  InterlockedDecrement

  GetCurrentProcessId

  HeapSetInformation

  GetSystemInfo

  PostQueuedCompletionStatus

  GetProcessHeaps

  HeapValidate

  HeapCreate

  HeapFree

  HeapAlloc

  HeapReAlloc

  ExpandEnvironmentStringsW

  CreateThread

  DeleteFileA

  CreateMutexA

  MoveFileA

  MoveFileW

  CreateEventA

  GetQueuedCompletionStatus

  CreateIoCompletionPort

  SetEvent

  ExitProcess

  GetVolumeInformationW

  SetFileAttributesW

  lstrcpyW

  DeleteFileW

  GetDiskFreeSpaceExW

  FindNextFileW

  lstrcmpiW

  QueryDosDeviceW

  RemoveDirectoryW

  lstrlenA

  GlobalLock

  GetModuleHandleW

  GetTickCount

  GlobalAlloc

  Sleep

  lstrcpynW

  ExitThread

  MultiByteToWideChar

  lstrlenW

  GlobalUnlock

  GetFileSize

  MapViewOfFile

  UnmapViewOfFile

  WriteFile

  InitializeCriticalSection

  LeaveCriticalSection

  CreateFileW

  FlushFileBuffers

  EnterCriticalSection

  CreateFileMappingW

  CloseHandle

  FindFirstFileW

  GetDriveTypeW

  MoveFileExW

  CreateDirectoryW

  GetLogicalDrives

  CopyFileW

  GetModuleFileNameW

  lstrcmpW

  FindClose

  user32

  TranslateMessage

  RegisterClassExW

  wsprintfW

  GetClipboardData

  EmptyClipboard

  ChangeClipboardChain

  SetWindowLongW

  DefWindowProcA

  RegisterRawInputDevices

  CreateWindowExW

  SendMessageA

  IsClipboardFormatAvailable

  CloseClipboard

  GetMessageA

  wsprintfA

  wvsprintfA

  GetWindowLongW

  DispatchMessageA

  OpenClipboard

  SetClipboardData

  SetClipboardViewer

  advapi32

  RegSetValueExW

  CryptGenRandom

  CryptReleaseContext

  CryptAcquireContextW

  RegQueryValueExW

  RegOpenKeyExA

  RegSetValueExA

  RegCloseKey

  RegOpenKeyExW

  shell32

  ShellExecuteW

  ole32

  CoInitializeEx

  CoCreateInstance

  CoInitialize

  CoUninitialize

  oleaut32

  SysFreeString

  SysAllocString

  Sections

  .text

  Size: 56KB - Virtual size: 55KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 12KB - Virtual size: 11KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 6KB - Virtual size: 11KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE