General

Malware Config

Signatures

Files

• e29db8d1e444d678a603892b8e8e7651980466d5695e316ac634a7edd9cbb1b5.zip

  .zip

  Password: infected

• e29db8d1e444d678a603892b8e8e7651980466d5695e316ac634a7edd9cbb1b5.exe

  .exe windows x86

  Password: infected

  976b00541f7c89851c403dadf87a23e5

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  LoadLibraryA

  WriteConsoleInputA

  GetWindowsDirectoryW

  FindFirstVolumeMountPointW

  FindFirstChangeNotificationW

  WaitForMultipleObjects

  ReadConsoleInputA

  VerifyVersionInfoW

  GetCPInfoExA

  OpenEventA

  SetLocaleInfoW

  GetProcAddress

  LocalAlloc

  DeleteFileA

  EnumResourceTypesW

  GetLongPathNameW

  LoadLibraryW

  GetBinaryTypeA

  SetLastError

  LocalShrink

  WriteProfileStringW

  GetComputerNameExA

  GetConsoleAliasA

  WriteProfileSectionW

  GetSystemPowerStatus

  GetModuleHandleW

  EnumResourceLanguagesA

  SetDefaultCommConfigA

  EnumDateFormatsW

  SetVolumeMountPointA

  GetStartupInfoA

  CreateJobSet

  WritePrivateProfileStringW

  GetStringTypeW

  GetShortPathNameW

  FindNextFileW

  EnumCalendarInfoA

  AddRefActCtx

  GetLastError

  HeapSize

  WriteConsoleW

  RaiseException

  MultiByteToWideChar

  WideCharToMultiByte

  HeapReAlloc

  HeapFree

  GetCommandLineW

  HeapSetInformation

  GetStartupInfoW

  EncodePointer

  IsProcessorFeaturePresent

  GetCPInfo

  InterlockedIncrement

  InterlockedDecrement

  GetACP

  GetOEMCP

  IsValidCodePage

  TlsAlloc

  TlsGetValue

  TlsSetValue

  DecodePointer

  TlsFree

  GetCurrentThreadId

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsDebuggerPresent

  TerminateProcess

  GetCurrentProcess

  SetFilePointer

  EnterCriticalSection

  LeaveCriticalSection

  CloseHandle

  HeapCreate

  HeapAlloc

  ExitProcess

  WriteFile

  GetStdHandle

  GetModuleFileNameW

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  SetHandleCount

  InitializeCriticalSectionAndSpinCount

  GetFileType

  DeleteCriticalSection

  QueryPerformanceCounter

  GetTickCount

  GetCurrentProcessId

  GetSystemTimeAsFileTime

  LCMapStringW

  Sleep

  SetStdHandle

  GetConsoleCP

  GetConsoleMode

  FlushFileBuffers

  RtlUnwind

  CreateFileW

  user32

  LoadMenuW

  shell32

  CommandLineToArgvW

  Sections

  .text

  Size: 75KB - Virtual size: 75KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 77KB - Virtual size: 1.3MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 42KB - Virtual size: 42KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ