General

Malware Config

Signatures

Files

• 4a5ac3c6f8383cc33c795804ba5f7f5553c029bbb4a6d28f1e4d8fb5107902c1

  .exe windows x64

  608bd80057d3a5e8811535ac9a9eb381

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  kernel32

  ReleaseSemaphore

  WaitForSingleObject

  GetTickCount64

  SetEvent

  CreateThread

  CreateSemaphoreA

  CreateEventA

  DeviceIoControl

  SetFileAttributesW

  lstrcmpiW

  TerminateThread

  ResetEvent

  ReadFile

  GetFileSizeEx

  TlsSetValue

  SetEndOfFile

  SetFileInformationByHandle

  SetFilePointerEx

  TlsGetValue

  GetDriveTypeW

  GetCommandLineW

  ExitProcess

  GetCurrentProcess

  lstrlenA

  TlsAlloc

  GetComputerNameA

  TerminateProcess

  OpenProcess

  lstrcmpiA

  GetModuleFileNameW

  GetTempPathW

  CreateProcessW

  GetSystemInfo

  GetComputerNameW

  GlobalMemoryStatus

  DeleteFileW

  CopyFileW

  GetConsoleScreenBufferInfo

  EnterCriticalSection

  GetStdHandle

  LeaveCriticalSection

  InitializeCriticalSection

  WriteConsoleW

  DeleteCriticalSection

  SetConsoleCursorPosition

  AllocConsole

  QueryPerformanceCounter

  QueryPerformanceFrequency

  GetTickCount

  Sleep

  WideCharToMultiByte

  GetCurrentProcessId

  HeapReAlloc

  SetLastError

  CloseHandle

  CreateFileW

  WriteFile

  GetLastError

  FindClose

  FindNextFileW

  HeapFree

  FindFirstFileW

  GetVolumeInformationW

  lstrcpyW

  GetProcessHeap

  HeapAlloc

  lstrcatW

  lstrlenW

  SetErrorMode

  RtlVirtualUnwind

  advapi32

  LookupAccountSidW

  GetTokenInformation

  AdjustTokenPrivileges

  LookupPrivilegeValueA

  OpenProcessToken

  EnumServicesStatusA

  CreateServiceW

  CloseServiceHandle

  OpenSCManagerW

  GetUserNameW

  DeleteService

  ControlService

  StartServiceW

  QueryServiceStatusEx

  OpenServiceA

  CryptDestroyKey

  CryptAcquireContextW

  CryptEncrypt

  CryptImportKey

  CryptReleaseContext

  OpenSCManagerA

  ole32

  CoCreateInstance

  CoInitializeEx

  CoSetProxyBlanket

  CoInitializeSecurity

  msvcrt

  _vsnwprintf

  memset

  feof

  fgetws

  _wfopen

  fclose

  memcpy

  _getch

  mpr

  WNetCancelConnection2W

  WNetOpenEnumW

  WNetCloseEnum

  WNetEnumResourceW

  WNetAddConnection2W

  shell32

  CommandLineToArgvW

  ord680

  shlwapi

  StrCmpNIW

  StrStrIW

  StrCmpIW

  StrChrW

  StrStrIA

  SHRegSetUSValueW

  user32

  wsprintfW

  oleaut32

  SysFreeString

  SysAllocString

  activeds

  ord9

  netapi32

  NetShareEnum

  NetGetJoinInformation

  NetApiBufferFree

  NetGetDCName

  ntdll

  RtlGetVersion

  RtlGetNativeSystemInformation

  ZwQuerySystemInformation

  Sections

  .text

  Size: 26KB - Virtual size: 26KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  bss

  Size: - Virtual size: 136B

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 21KB - Virtual size: 20KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 16KB - Virtual size: 17KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 1024B - Virtual size: 888B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 212B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ