General

Malware Config

Signatures

Files

• 85719990f424af2c25758a1df61aeea2e0c3a3b514cb06f1a610369556a19d5d

  .exe windows x86

  9d7ac77a44667ba5186f7bb12dfd9d42

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  CloseHandle

  LoadLibraryW

  GetProcAddress

  CreateFileW

  GetCurrentProcess

  lstrcpyW

  GetLastError

  HeapAlloc

  GetProcessHeap

  HeapFree

  OpenProcess

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GlobalMemoryStatusEx

  GetSystemInfo

  FreeLibrary

  GetModuleFileNameW

  GetCommandLineW

  GetStartupInfoW

  CreateProcessW

  ExitProcess

  WideCharToMultiByte

  CreateFileA

  DeviceIoControl

  QueryPerformanceFrequency

  CreateEventW

  SetEvent

  ResetEvent

  QueryPerformanceCounter

  WaitForSingleObject

  InterlockedExchange

  GetConsoleWindow

  ExpandEnvironmentStringsW

  CopyFileW

  GetFileAttributesW

  CreateEventA

  FormatMessageW

  SetLastError

  VirtualProtect

  IsBadReadPtr

  LoadLibraryA

  GetNativeSystemInfo

  SetErrorMode

  SetUnhandledExceptionFilter

  GetCurrentThreadId

  CreateThread

  CreateMutexW

  GetFileSize

  DeleteFileW

  ReleaseMutex

  SetFilePointer

  RaiseException

  InitializeCriticalSectionAndSpinCount

  GetModuleHandleW

  LocalFree

  ReadFile

  LCMapStringW

  FlushFileBuffers

  SetStdHandle

  WriteConsoleW

  lstrcmpW

  GetTickCount

  Sleep

  lstrcatW

  GetSystemDirectoryW

  GetLocaleInfoW

  GetLocalTime

  GetCurrentProcessId

  MultiByteToWideChar

  lstrlenW

  InterlockedDecrement

  VirtualAlloc

  LeaveCriticalSection

  EnterCriticalSection

  DeleteCriticalSection

  VirtualFree

  WriteFile

  GetSystemTimeAsFileTime

  GetFileType

  SetHandleCount

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  IsValidCodePage

  InitializeCriticalSection

  HeapCreate

  HeapDestroy

  CreateWaitableTimerW

  GetOEMCP

  GetACP

  GetCPInfo

  GetStringTypeW

  TlsFree

  TlsSetValue

  TlsGetValue

  TlsAlloc

  HeapSize

  GetStdHandle

  GetConsoleMode

  GetConsoleCP

  IsProcessorFeaturePresent

  IsDebuggerPresent

  UnhandledExceptionFilter

  TerminateProcess

  RtlUnwind

  HeapSetInformation

  HeapReAlloc

  ExitThread

  EncodePointer

  DecodePointer

  TryEnterCriticalSection

  CancelWaitableTimer

  SetWaitableTimer

  lstrlenA

  UnmapViewOfFile

  SwitchToThread

  CreateFileMappingW

  MapViewOfFileEx

  InterlockedIncrement

  InterlockedCompareExchange

  user32

  GetForegroundWindow

  GetMonitorInfoW

  GetWindowTextW

  MsgWaitForMultipleObjects

  PeekMessageW

  TranslateMessage

  DispatchMessageW

  GetLastInputInfo

  SendMessageW

  FindWindowA

  GetWindowTextA

  GetWindow

  GetClassNameA

  OpenWindowStationW

  SetProcessWindowStation

  IsWindow

  PostThreadMessageA

  GetInputState

  EnumDisplayMonitors

  wsprintfW

  advapi32

  RegSetValueExW

  RegCreateKeyW

  RegDeleteValueW

  RegQueryValueExW

  RegOpenKeyExW

  LookupAccountSidW

  GetTokenInformation

  OpenProcessToken

  FreeSid

  CheckTokenMembership

  AllocateAndInitializeSid

  RegCloseKey

  RegEnumKeyExA

  RegQueryInfoKeyW

  RegOpenKeyExA

  GetCurrentHwProfileW

  shell32

  SHGetFolderPathW

  ole32

  CoUninitialize

  CoCreateInstance

  CoInitialize

  oleaut32

  SysStringLen

  SysFreeString

  SysAllocString

  ws2_32

  WSAAddressToStringW

  WSASetLastError

  WSAStringToAddressW

  shutdown

  send

  setsockopt

  WSAIoctl

  ntohs

  WSAGetLastError

  inet_ntoa

  gethostbyname

  gethostname

  getsockname

  freeaddrinfo

  getaddrinfo

  WSAStartup

  WSAResetEvent

  WSAEventSelect

  WSACleanup

  bind

  connect

  recv

  WSACloseEvent

  WSACreateEvent

  socket

  WSAEnumNetworkEvents

  WSAWaitForMultipleEvents

  closesocket

  htons

  shlwapi

  StrChrW

  StrPBrkW

  PathIsDirectoryA

  netapi32

  NetWkstaGetInfo

  dinput8

  DirectInput8Create

  winmm

  timeGetDevCaps

  timeEndPeriod

  timeBeginPeriod

  timeGetTime

  Sections

  .text

  Size: 165KB - Virtual size: 164KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 44KB - Virtual size: 44KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 20KB - Virtual size: 40KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 512B - Virtual size: 436B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 22KB - Virtual size: 21KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  ���ţu�

  Size: 16KB - Virtual size: 20KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE