General

Malware Config

Signatures

Files

• specialsurprise.exe

  .exe windows x86

  a8f9817be32c1d5589680a5066ebff5d

  
  

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  msvcrt

  memset

  wcsncmp

  memmove

  wcsncpy

  wcsstr

  _wcsnicmp

  _wcsicmp

  wcslen

  wcscpy

  wcscmp

  memcpy

  tolower

  wcscat

  malloc

  free

  kernel32

  GetModuleHandleW

  HeapCreate

  GetStdHandle

  HeapDestroy

  ExitProcess

  WriteFile

  LoadLibraryExW

  EnumResourceTypesW

  FreeLibrary

  RemoveDirectoryW

  GetExitCodeProcess

  EnumResourceNamesW

  GetTempFileNameW

  GetCommandLineW

  LoadResource

  SizeofResource

  FreeResource

  FindResourceW

  GetNativeSystemInfo

  GetShortPathNameW

  GetWindowsDirectoryW

  GetSystemDirectoryW

  EnterCriticalSection

  CloseHandle

  LeaveCriticalSection

  InitializeCriticalSection

  WaitForSingleObject

  TerminateThread

  CreateThread

  Sleep

  GetProcAddress

  GetVersionExW

  WideCharToMultiByte

  HeapAlloc

  HeapFree

  LoadLibraryW

  GetCurrentProcessId

  GetCurrentThreadId

  GetModuleFileNameW

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GetCurrentProcess

  TerminateProcess

  SetUnhandledExceptionFilter

  HeapSize

  MultiByteToWideChar

  CreateDirectoryW

  SetFileAttributesW

  DeleteFileW

  GetTempPathW

  GetCurrentDirectoryW

  SetCurrentDirectoryW

  CreateFileW

  SetFilePointer

  TlsFree

  TlsGetValue

  TlsSetValue

  TlsAlloc

  HeapReAlloc

  DeleteCriticalSection

  InterlockedCompareExchange

  InterlockedExchange

  GetLastError

  SetLastError

  UnregisterWait

  GetCurrentThread

  DuplicateHandle

  RegisterWaitForSingleObject

  user32

  CharUpperW

  CharLowerW

  MessageBoxW

  DefWindowProcW

  DestroyWindow

  GetWindowLongW

  GetWindowTextLengthW

  GetWindowTextW

  UnregisterClassW

  LoadIconW

  LoadCursorW

  RegisterClassExW

  IsWindowEnabled

  EnableWindow

  GetSystemMetrics

  CreateWindowExW

  SetWindowLongW

  SendMessageW

  SetFocus

  CreateAcceleratorTableW

  SetForegroundWindow

  BringWindowToTop

  GetMessageW

  TranslateAcceleratorW

  TranslateMessage

  DispatchMessageW

  DestroyAcceleratorTable

  PostMessageW

  GetForegroundWindow

  GetWindowThreadProcessId

  IsWindowVisible

  EnumWindows

  SetWindowPos

  gdi32

  GetStockObject

  comctl32

  InitCommonControlsEx

  shell32

  ShellExecuteExW

  SHGetFolderLocation

  SHGetPathFromIDListW

  winmm

  timeBeginPeriod

  ole32

  CoInitialize

  CoTaskMemFree

  shlwapi

  PathQuoteSpacesW

  PathAddBackslashW

  PathRenameExtensionW

  PathRemoveArgsW

  PathRemoveBackslashW

  Sections

  .code

  Size: 13KB - Virtual size: 12KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .text

  Size: 51KB - Virtual size: 51KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 13KB - Virtual size: 12KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 4KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 9.8MB - Virtual size: 9.8MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ