General

Malware Config

Signatures

Files

• 761F42F03E50EF9B2EB1B1041C81CC6ED24CBC8CE2D6D.exe

  .exe windows x86

  469a28fd506c4e9127d8283ad9556834

  
  

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DEBUG_STRIPPED

  Imports

  user32

  GetUserObjectInformationW

  MessageBoxW

  wsprintfA

  MessageBoxA

  GetProcessWindowStation

  GetDesktopWindow

  gdi32

  DeleteDC

  GetDeviceCaps

  CreateDCA

  BitBlt

  CreateCompatibleBitmap

  GetObjectA

  DeleteObject

  GetBitmapBits

  SelectObject

  CreateCompatibleDC

  kernel32

  SetEvent

  GetSystemDirectoryA

  SetUnhandledExceptionFilter

  ResumeThread

  GlobalAlloc

  GetProcessAffinityMask

  TlsSetValue

  GetTickCount

  SetLastError

  VirtualQuery

  GetModuleHandleExA

  CreateEventA

  IsDBCSLeadByteEx

  DuplicateHandle

  GetVersion

  ExitProcess

  SetThreadPriority

  FindFirstFileA

  ResetEvent

  FindNextFileA

  EnterCriticalSection

  GetTempPathA

  CreateSemaphoreA

  InitializeCriticalSection

  GetCurrentThread

  OpenProcess

  GetTimeZoneInformation

  WaitForSingleObject

  SuspendThread

  GetCurrentProcess

  GlobalHandle

  QueryPerformanceCounter

  SetThreadContext

  GetThreadContext

  QueryPerformanceFrequency

  GetProcAddress

  DeleteCriticalSection

  GetLastError

  TlsAlloc

  LeaveCriticalSection

  lstrcpynA

  Sleep

  WaitForMultipleObjects

  TlsFree

  GetThreadPriority

  VirtualProtect

  GetStdHandle

  ReleaseSemaphore

  GetCurrentThreadId

  GlobalMemoryStatus

  GetModuleHandleA

  LoadLibraryA

  SetProcessAffinityMask

  CloseHandle

  lstrcpyA

  TlsGetValue

  SetThreadAffinityMask

  winmm

  timeGetTime

  ws2_32

  closesocket

  WSASetLastError

  htons

  htonl

  ntohl

  getaddrinfo

  getnameinfo

  recvfrom

  ioctlsocket

  recv

  listen

  connect

  WSAGetLastError

  shutdown

  getpeername

  getsockname

  WSAStartup

  freeaddrinfo

  send

  bind

  __WSAFDIsSet

  inet_addr

  select

  sendto

  ntohs

  gethostname

  setsockopt

  gethostbyname

  socket

  accept

  WSAEnumNetworkEvents

  getsockopt

  WSACleanup

  msvcrt

  localtime

  setvbuf

  _iob

  islower

  fgetc

  fseek

  strftime

  fwprintf

  free

  vfprintf

  _open

  fputc

  ftell

  log10

  _wfopen

  _onexit

  localeconv

  __doserrno

  strtoul

  rand

  isalnum

  qsort

  putc

  wcsstr

  srand

  _filelengthi64

  _lseeki64

  strlen

  strcmp

  rename

  realloc

  abort

  _access

  strncpy

  getc

  strncat

  atof

  sprintf

  _unlock

  time

  _fileno

  fprintf

  memset

  isspace

  atoi

  puts

  _rmdir

  fwrite

  _close

  __mb_cur_max

  strstr

  fread

  _amsg_exit

  printf

  _snwprintf

  _errno

  _read

  fopen

  _beginthreadex

  _lock

  putchar

  _setmode

  gmtime

  strcpy

  _strdup

  strtol

  _endthreadex

  getenv

  __dllonexit

  _getch

  __setusermatherr

  _ftime

  _getpid

  _exit

  strchr

  _putenv

  _write

  _stat

  sscanf

  _strnicmp

  strerror

  tolower

  _get_osfhandle

  isxdigit

  strcspn

  _findclose

  _ftime64

  setlocale

  isprint

  fgets

  calloc

  longjmp

  memcmp

  _stati64

  memmove

  exit

  _wfindnext

  strspn

  strcat

  _mkdir

  fflush

  memchr

  fputs

  fgetpos

  _setjmp3

  bsearch

  mktime

  signal

  isalpha

  ferror

  toupper

  _fdopen

  fsetpos

  _stricmp

  _fstati64

  malloc

  __pioinfo

  ungetc

  isupper

  _initterm

  strrchr

  raise

  strncmp

  fclose

  feof

  _wfindfirst

  wcslen

  _vsnprintf

  wcscpy

  _unlink

  memcpy

  advapi32

  CryptAcquireContextA

  CryptReleaseContext

  CryptGenRandom

  RegisterEventSourceA

  ReportEventA

  crypt32

  CertEnumCertificatesInStore

  CertCloseStore

  CertOpenSystemStoreA

  Sections

  .text

  Size: 70KB - Virtual size: 72KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 219KB - Virtual size: 219KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 35KB - Virtual size: 35KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .bss

  Size: - Virtual size: 20KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 5KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .CRT

  Size: 512B - Virtual size: 52B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 32B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE