General

Malware Config

Signatures

Files

• 220310-pbzznaegb9_pw_infected.zip.zip

  .zip

  Password: infected

• 220310-pbzznaegb9_pw_infected.zip

  .zip

  Password: infected

• YjreQbD

  .exe windows x86

  a69d6850b513404b914140c23ff33d24

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  comctl32

  ord17

  kernel32

  SetFileAttributesW

  Sleep

  GetExitCodeThread

  CreateThread

  SystemTimeToFileTime

  GetLocalTime

  GetFileAttributesW

  CreateDirectoryW

  lstrlenA

  GetSystemDefaultLCID

  GetSystemDefaultUILanguage

  GetUserDefaultUILanguage

  MultiByteToWideChar

  GetLocaleInfoW

  lstrcmpiW

  GetEnvironmentVariableW

  SetCurrentDirectoryW

  lstrcmpW

  RemoveDirectoryW

  FindClose

  FindNextFileW

  DeleteFileW

  FindFirstFileW

  GetCurrentDirectoryW

  GetTempPathW

  WideCharToMultiByte

  CompareFileTime

  ExpandEnvironmentStringsW

  GetSystemTimeAsFileTime

  LoadLibraryA

  SetEnvironmentVariableW

  WriteFile

  CreateFileW

  GetDriveTypeW

  GetModuleFileNameW

  GetCommandLineW

  GetModuleHandleW

  GetComputerNameW

  CreateEventW

  SetLastError

  ResetEvent

  InitializeCriticalSection

  LockResource

  LoadResource

  FindResourceA

  MulDiv

  GetCurrentThreadId

  GetSystemDirectoryW

  TerminateThread

  ResumeThread

  SuspendThread

  LocalFree

  lstrcpyW

  FormatMessageW

  DeleteCriticalSection

  EnterCriticalSection

  LeaveCriticalSection

  VirtualAlloc

  VirtualFree

  GetFileSize

  SetFilePointer

  ReadFile

  SetFileTime

  SetEndOfFile

  GetFileInformationByHandle

  WaitForMultipleObjects

  GetCurrentProcess

  TerminateProcess

  GetCurrentProcessId

  GetTickCount

  QueryPerformanceCounter

  GetModuleHandleA

  SetUnhandledExceptionFilter

  GetStartupInfoA

  InterlockedCompareExchange

  InterlockedExchange

  GetLastError

  WaitForSingleObject

  CloseHandle

  GetProcAddress

  lstrlenW

  SetEvent

  UnhandledExceptionFilter

  user32

  CallWindowProcW

  DefWindowProcW

  KillTimer

  CallNextHookEx

  PtInRect

  SetWindowsHookExW

  LoadImageW

  LoadIconW

  MessageBeep

  EnableWindow

  GetWindowDC

  GetWindowLongW

  GetSystemMenu

  wvsprintfW

  SetWindowLongW

  GetClientRect

  GetDlgItem

  IsClipboardFormatAvailable

  GetKeyState

  MessageBoxA

  DrawIconEx

  DialogBoxIndirectParamW

  GetWindow

  ClientToScreen

  GetDC

  DrawTextW

  IsWindow

  ReleaseDC

  SendMessageW

  EndDialog

  SetWindowPos

  SystemParametersInfoW

  GetSystemMetrics

  SetFocus

  EnableMenuItem

  UnhookWindowsHookEx

  ShowWindow

  CharUpperW

  ScreenToClient

  GetWindowRect

  GetParent

  wsprintfW

  GetWindowTextW

  GetWindowTextLengthW

  SetWindowTextW

  gdi32

  CreateFontIndirectW

  SelectObject

  GetDeviceCaps

  GetObjectW

  DeleteObject

  shell32

  SHBrowseForFolderW

  SHGetPathFromIDListW

  SHGetMalloc

  ShellExecuteW

  SHGetSpecialFolderPathW

  ShellExecuteExW

  SHGetFileInfoW

  ole32

  CoCreateInstance

  oleaut32

  VariantClear

  SysAllocStringLen

  msvcrt

  wcsncpy

  wcsncmp

  ?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z

  _beginthreadex

  __CxxFrameHandler3

  _CxxThrowException

  malloc

  free

  wcsstr

  _unlock

  __dllonexit

  _lock

  _onexit

  ??1type_info@@UAE@XZ

  __getmainargs

  _cexit

  _exit

  _XcptFilter

  _ismbblead

  exit

  _acmdln

  _initterm

  _amsg_exit

  __setusermatherr

  __p__commode

  __p__fmode

  __set_app_type

  _except_handler4_common

  ?terminate@@YAXXZ

  _controlfp

  strncpy

  memcpy

  memmove

  _wcsnicmp

  _purecall

  memset

  _wtol

  ??2@YAPAXI@Z

  ??3@YAXPAX@Z

  Sections

  .text

  Size: 101KB - Virtual size: 101KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 12KB - Virtual size: 12KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 2KB - Virtual size: 11KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 31KB - Virtual size: 30KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ