bazarloader | qBittorrent[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

qBittorrent.zip
Size

57.9MB
MD5

1704b6c1081da2a2fa525680b56285fa
SHA1

b7395c7455ba0f0b776afd7c2a2c32b3450e0f63
SHA256

8ab5c1ec0b309e33dd2928488d6b2f24b95d60f5d2f40d5783cd8c3cfe804213
SHA512

5d04bf503bbbcfa9fe4de40702b4b01bb81dac6797cec6b9ecc3cb37909e96222db8e0ea92c38f2b1315d3cd11402f17d38c01f9c7ec96c1e122568248ff4501
SSDEEP

1572864:jTfrMh+VWugdjt6t+1c4IJazUeiN0K+vJQoFlsDviWXgV3:zMvusjt6tsc4pm0K8RFlNWXgl

Score

10^/10

bazarloader

Malware Config

Signatures

Bazar/Team9 Loader payload 1 IoCs

Processes:

resource	yara_rule
static1/unpack001/qBittorrent/qbittorrent.exe	BazarLoaderVar5

Bazarloader family
bazarloader

Files

qBittorrent.zip
.zip
qBittorrent/qbittorrent.exe
.exe windows x64

7dc3762bf412e12afcfe9e5f5372513a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

powrprof

SetSuspendState

wsock32

WSAGetLastError
htons
htonl
WSACleanup
bind
accept
__WSAFDIsSet
getpeername
ord1141
ord1142
WSAStartup
socket
WSASetLastError
ntohs
setsockopt
inet_ntoa
getsockopt
connect
WSAAsyncSelect
gethostname
closesocket
select
listen
ntohl
getsockname

ws2_32

WSAAccept
WSAHtonl
getaddrinfo
WSANtohl
freeaddrinfo
WSAStringToAddressW
WSAAddressToStringW
WSARecvFrom
WSANtohs
WSASocketW
WSASend
WSAConnect
getnameinfo
WSAIoctl
WSARecv
WSASendTo

iphlpapi

NotifyUnicastIpAddressChange
ConvertInterfaceLuidToGuid
ConvertInterfaceIndexToLuid
ConvertInterfaceNameToLuidW
CancelMibChangeNotify2
GetAdaptersAddresses
ConvertInterfaceLuidToNameW
ConvertInterfaceLuidToIndex

crypt32

CertGetCertificateContextProperty
CertFindCertificateInStore
CertEnumCertificatesInStore
CertFreeCertificateContext
CertOpenSystemStoreA
CertCloseStore
CertOpenStore
CertAddCertificateContextToStore
CertFreeCertificateChain
CertGetCertificateChain
CertOpenSystemStoreW
CertCreateCertificateContext
CertDuplicateCertificateContext

kernel32

FindNextFileW
WriteFile
DeviceIoControl
SetEndOfFile
FindClose
LoadLibraryA
GetOverlappedResult
SetFilePointerEx
CreateEventA
CreateWaitableTimerA
GetACP
CancelIoEx
CancelIo
GetModuleHandleA
GetSystemTimeAsFileTime
GlobalMemoryStatusEx
SystemTimeToFileTime
GetSystemTime
GetModuleHandleExW
DeleteFiber
SwitchToFiber
CreateFiber
GetStdHandle
GetEnvironmentVariableW
GetFileType
RtlVirtualUnwind
QueryPerformanceCounter
ConvertFiberToThread
ConvertThreadToFiber
FreeLibrary
SetConsoleMode
ReadConsoleA
GetConsoleMode
ReadConsoleW
DisconnectNamedPipe
WaitNamedPipeW
CreateNamedPipeW
ConnectNamedPipe
ResetEvent
GlobalFree
SetHandleInformation
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
HeapFree
GetFullPathNameW
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
SetFilePointer
GetFullPathNameA
UnlockFileEx
GetTempPathW
GetFileAttributesW
UnmapViewOfFile
HeapValidate
HeapSize
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
OutputDebugStringW
FlushViewOfFile
CreateFileA
WaitForSingleObjectEx
DeleteFileA
HeapReAlloc
GetSystemInfo
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
LockFileEx
GetFileSize
GetProcessHeap
CreateFileMappingW
MapViewOfFile
GetTickCount
FlushFileBuffers
CompareStringEx
GetNativeSystemInfo
FindFirstFileW
IsProcessorFeaturePresent
TerminateProcess
GetEnvironmentStringsW
FreeEnvironmentStringsW
DuplicateHandle
GetExitCodeProcess
GetProcessId
GetLocalTime
CreateThread
SwitchToThread
GetThreadPriority
ResumeThread
QueryPerformanceFrequency
GetTickCount64
GetUserDefaultLCID
GetCurrencyFormatW
GetDateFormatW
GetTimeFormatW
GetUserPreferredUILanguages
RegisterWaitForSingleObject
UnregisterWaitEx
ReadFileEx
PeekNamedPipe
WriteFileEx
GetModuleFileNameW
GetStartupInfoW
OpenFileMappingW
VirtualQuery
TzSpecificLocalTimeToSystemTime
GetVolumePathNamesForVolumeNameW
GetFileInformationByHandleEx
SetFileTime
SetErrorMode
GetLogicalDrives
GetCurrentDirectoryW
MoveFileW
MoveFileExW
FileTimeToSystemTime
FindFirstFileExW
FindFirstChangeNotificationW
FindCloseChangeNotification
FindNextChangeNotification
GetVolumeNameForVolumeMountPointW
GetDiskFreeSpaceExW
CompareStringW
LCMapStringW
CreateSemaphoreW
ReleaseSemaphore
GetTimeZoneInformation
GetUserGeoID
GetGeoInfoW
VirtualFree
VirtualAlloc
WriteConsoleW
ReadFile
CopyFileW
DeleteFileW
GetFileInformationByHandle
CreateFileW
CreateHardLinkW
RemoveDirectoryW
CreateDirectoryW
GetFileAttributesExW
CreateIoCompletionPort
SleepEx
QueueUserAPC
TerminateThread
SetEvent
CreateEventW
GetQueuedCompletionStatus
InitializeCriticalSectionAndSpinCount
SetLastError
VerifyVersionInfoA
TlsSetValue
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
SetEnvironmentVariableW
GetOEMCP
TryAcquireSRWLockExclusive
GetLocaleInfoEx
SetFileAttributesW
IsValidCodePage
EnumSystemLocalesW
IsValidLocale
SetWaitableTimer
TlsGetValue
PostQueuedCompletionStatus
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
ExitProcess
GetUserDefaultLangID
lstrcmpW
GlobalSize
CreateProcessW
ExpandEnvironmentStringsW
GlobalUnlock
GlobalLock
GlobalAlloc
GetLocaleInfoW
CheckRemoteDebuggerPresent
OpenProcess
WTSGetActiveConsoleSessionId
GetModuleHandleW
GetCurrentThreadId
GetLongPathNameW
GetVolumeInformationW
GetConsoleWindow
LocalAlloc
SetThreadExecutionState
VerifyVersionInfoW
VerSetConditionMask
GetSystemDirectoryW
GetVolumePathNameW
GetDriveTypeW
MultiByteToWideChar
RtlCaptureStackBackTrace
WaitForMultipleObjects
Sleep
OpenMutexW
CreateMutexW
WaitForSingleObject
ReleaseMutex
GetCurrentProcessId
WideCharToMultiByte
FormatMessageW
FormatMessageA
LocalFree
LoadLibraryW
GetProcAddress
TlsFree
TlsAlloc
SetThreadPriority
GetCurrentThread
GetCurrentProcess
GetLastError
CloseHandle
SetStdHandle
GetCommandLineA
SystemTimeToTzSpecificLocalTime
FreeLibraryAndExitThread
RtlPcToFileHeader
RaiseException
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
InitOnceBeginInitialize
InitOnceComplete
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
GetExitCodeThread
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
GetFileSizeEx
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
RtlUnwindEx
RtlUnwind
LoadLibraryExW
SetConsoleCtrlHandler
GetConsoleOutputCP
ExitThread
GetCommandLineW

user32

GetCursor
GetCursorInfo
CreateCursor
LoadCursorW
SetCursorPos
GetClipboardFormatNameW
TrackMouseEvent
RegisterClipboardFormatW
GetMenuItemInfoW
ModifyMenuW
CreatePopupMenu
TrackPopupMenu
SetMenu
GetAsyncKeyState
GetMessageExtraInfo
GetTouchInputInfo
CloseTouchInputHandle
GetWindowTextW
EnumWindows
RealGetWindowClassW
ChangeWindowMessageFilterEx
GetProcessWindowStation
GetUserObjectInformationW
PostThreadMessageW
KillTimer
GetQueueStatus
SetTimer
RegisterClassW
MsgWaitForMultipleObjectsEx
TranslateMessage
DispatchMessageW
UnregisterDeviceNotification
RegisterDeviceNotificationW
EnumDisplayDevicesW
DestroyMenu
DrawMenuBar
InsertMenuW
RemoveMenu
AppendMenuW
CreateMenu
LoadIconW
GetKeyState
MapVirtualKeyW
GetKeyboardState
SetMenuItemInfoW
PeekMessageW
ToUnicode
TrackPopupMenuEx
IsZoomed
ToAscii
MonitorFromWindow
EnumDisplayMonitors
GetMonitorInfoW
HideCaret
SetCaretPos
CreateCaret
GetKeyboardLayout
IsWindowEnabled
DestroyCaret
ShowCaret
FindWindowA
SetClipboardViewer
IsHungAppWindow
ChangeClipboardChain
GetFocus
UnregisterClassW
ChildWindowFromPointEx
RegisterClassExW
WindowFromPoint
GetClassInfoW
GetKeyboardLayoutList
UnregisterPowerSettingNotification
RegisterPowerSettingNotification
GetSysColorBrush
LoadImageW
GetCursorPos
GetWindowLongW
GetWindowThreadProcessId
DefWindowProcW
AdjustWindowRectEx
IsTouchWindow
PostMessageW
MonitorFromPoint
GetWindow
GetWindowRect
GetMenu
DestroyWindow
IsWindowVisible
SetWindowPos
SetWindowLongPtrW
SetWindowRgn
CreateWindowExW
ScreenToClient
SendMessageW
SetWindowTextW
GetWindowLongPtrW
GetWindowPlacement
DestroyCursor
ShowWindow
GetCapture
RegisterTouchWindow
ClientToScreen
IsChild
SetWindowPlacement
AttachThreadInput
GetForegroundWindow
MoveWindow
UnregisterTouchWindow
SetLayeredWindowAttributes
SetFocus
GetUpdateRect
SetParent
SetCapture
SetCursor
FlashWindowEx
SetWindowLongW
GetClientRect
GetParent
ReleaseCapture
SetForegroundWindow
InvalidateRect
GetAncestor
IsIconic
BeginPaint
EndPaint
MessageBeep
IsWindow
GetDoubleClickTime
GetCaretBlinkTime
GetDesktopWindow
UpdateLayeredWindowIndirect
GetSystemMetrics
GetSysColor
EnableMenuItem
GetSystemMenu
SystemParametersInfoW
DrawIconEx
GetIconInfo
CreateIconIndirect
ReleaseDC
GetDC
MessageBoxW
RegisterWindowMessageW
DestroyIcon
AllowSetForegroundWindow
ShutdownBlockReasonDestroy
ShutdownBlockReasonCreate
CharNextExA
UpdateLayeredWindow

gdi32

CreateDIBSection
CreateBitmap
GetDIBits
GetRegionData
DeleteObject
ExtTextOutW
SetTextAlign
SetBkMode
SetTextColor
GetCharABCWidthsW
GetCharABCWidthsI
GetCharABCWidthsFloatW
GetGlyphOutlineW
SetWorldTransform
SetGraphicsMode
GetTextExtentPoint32W
GetOutlineTextMetricsW
GetTextFaceW
GetStockObject
RemoveFontResourceExW
AddFontResourceExW
GetTextMetricsW
RemoveFontMemResourceEx
AddFontMemResourceEx
EnumFontFamiliesExW
GetFontData
CreateFontIndirectW
GdiFlush
GetBitmapBits
CreateCompatibleBitmap
CreateDCW
GetDeviceCaps
SetLayout
OffsetRgn
SelectClipRgn
BitBlt
SelectObject
DeleteDC
CreateCompatibleDC
CreateRectRgn
CombineRgn
GetObjectW

shell32

SHGetKnownFolderPath
Shell_NotifyIconGetRect
Shell_NotifyIconW
SHCreateItemFromIDList
SHGetPathFromIDListW
SHGetKnownFolderIDList
SHBrowseForFolderW
SHGetMalloc
SHGetStockIconInfo
ord727
SHCreateItemFromParsingName
SHGetFileInfoW
ShellExecuteW
SHOpenFolderAndSelectItems
ord190
ord155
SHChangeNotify
CommandLineToArgvW

ole32

DoDragDrop
OleFlushClipboard
CoGetMalloc
CoGetApartmentType
OleIsCurrentClipboard
OleSetClipboard
OleInitialize
OleUninitialize
RevokeDragDrop
CoLockObjectExternal
RegisterDragDrop
CoInitialize
CoTaskMemFree
StringFromGUID2
CoCreateGuid
CoCreateInstance
CoInitializeEx
ReleaseStgMedium
CoUninitialize
OleGetClipboard
CoGetObjectContext

oleaut32

SafeArrayCreateVector
SafeArrayPutElement
SysFreeString
SysAllocString

advapi32

RegOpenKeyExW
RegQueryInfoKeyW
RegEnumKeyExW
RegCloseKey
InitiateSystemShutdownW
RegFlushKey
RegSetValueExW
RegDeleteValueW
RegDeleteKeyW
RegEnumValueW
RegCreateKeyExW
GetEffectiveRightsFromAclW
AccessCheck
MapGenericMask
LookupAccountSidW
GetNamedSecurityInfoW
DuplicateToken
BuildTrusteeWithSidW
CopySid
SystemFunction036
GetSidSubAuthorityCount
GetSidSubAuthority
RegNotifyChangeKeyValue
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
FreeSid
AddAccessAllowedAce
InitializeAcl
GetLengthSid
AllocateAndInitializeSid
GetTokenInformation
InitializeSecurityDescriptor
CryptDestroyKey
CryptGetUserKey
CryptAcquireContextW
CryptEnumProvidersW
CryptDecrypt
CryptExportKey
CryptCreateHash
CryptSetHashParam
CryptDestroyHash
CryptSignHashW
CryptGetProvParam
CryptReleaseContext
DeregisterEventSource
RegisterEventSourceW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
ReportEventW
RegQueryValueExW

mpr

WNetGetUniversalNameW

userenv

GetUserProfileDirectoryW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

netapi32

NetApiBufferFree
NetShareEnum

winmm

timeKillEvent
timeSetEvent
PlaySoundW

imm32

ImmGetVirtualKey
ImmNotifyIME
ImmAssociateContextEx
ImmSetCandidateWindow
ImmGetOpenStatus
ImmAssociateContext
ImmGetCompositionStringW
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
ImmGetDefaultIMEWnd

uxtheme

SetWindowTheme
IsThemeBackgroundPartiallyTransparent
GetCurrentThemeName
IsThemeActive
CloseThemeData
GetThemeBackgroundRegion
IsAppThemed
ord47
GetThemeMargins
GetThemeInt
OpenThemeData
GetThemeColor
GetThemePartSize
GetThemeEnumValue
GetThemeTransitionDuration
GetThemePropertyOrigin
GetThemeBool

dwmapi

DwmIsCompositionEnabled
DwmGetWindowAttribute
DwmEnableBlurBehindWindow
DwmSetWindowAttribute

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW

dbgeng

DebugCreate

bcrypt

BCryptGenRandom

Sections

.text
Size: 15.6MB - Virtual size: 15.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11.0MB - Virtual size: 11.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 594KB - Virtual size: 701KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 589KB - Virtual size: 589KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.qtmetad
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.qtmimed
Size: 315KB - Virtual size: 315KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 149KB - Virtual size: 149KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 104KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
qBittorrent/qbittorrent.pdb
qBittorrent/qt.conf
qBittorrent/translations/qt_gl.qm
qBittorrent/translations/qt_lt.qm
qBittorrent/translations/qt_pt_PT.qm
qBittorrent/translations/qt_sl.qm
qBittorrent/translations/qt_sv.qm
qBittorrent/translations/qtbase_ar.qm
qBittorrent/translations/qtbase_bg.qm
qBittorrent/translations/qtbase_ca.qm
qBittorrent/translations/qtbase_cs.qm
qBittorrent/translations/qtbase_da.qm
qBittorrent/translations/qtbase_de.qm
qBittorrent/translations/qtbase_es.qm
qBittorrent/translations/qtbase_fa.qm
qBittorrent/translations/qtbase_fi.qm
qBittorrent/translations/qtbase_fr.qm
qBittorrent/translations/qtbase_gd.qm
qBittorrent/translations/qtbase_he.qm
qBittorrent/translations/qtbase_hr.qm
qBittorrent/translations/qtbase_hu.qm
qBittorrent/translations/qtbase_it.qm
qBittorrent/translations/qtbase_ja.qm
qBittorrent/translations/qtbase_ko.qm
qBittorrent/translations/qtbase_lv.qm
qBittorrent/translations/qtbase_nl.qm
qBittorrent/translations/qtbase_nn.qm
qBittorrent/translations/qtbase_pl.qm
qBittorrent/translations/qtbase_pt_BR.qm
qBittorrent/translations/qtbase_ru.qm
qBittorrent/translations/qtbase_sk.qm
qBittorrent/translations/qtbase_tr.qm
qBittorrent/translations/qtbase_uk.qm
qBittorrent/translations/qtbase_zh_CN.qm
qBittorrent/translations/qtbase_zh_TW.qm
qBittorrent/uninst.exe
.exe windows x86

61259b55b8912888e90f516ca08dc514

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCreateKeyExW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
SetFileSecurityW
RegOpenKeyExW
RegEnumValueW

shell32

SHGetSpecialFolderLocation
SHFileOperationW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
SHGetFileInfoW

ole32

OleInitialize
OleUninitialize
CoCreateInstance
IIDFromString
CoTaskMemFree

comctl32

ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked

user32

GetClientRect
EndPaint
DrawTextW
IsWindowEnabled
DispatchMessageW
wsprintfA
CharNextA
CharPrevW
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
GetSystemMetrics
FillRect
AppendMenuW
TrackPopupMenu
OpenClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetSysColor
SetWindowPos
GetWindowLongW
PeekMessageW
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
EmptyClipboard
CreatePopupMenu

gdi32

SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectW
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject

kernel32

GetExitCodeProcess
WaitForSingleObject
GetModuleHandleA
GetProcAddress
GetSystemDirectoryW
lstrcatW
Sleep
lstrcpyA
WriteFile
GetTempFileNameW
lstrcmpiA
RemoveDirectoryW
CreateProcessW
CreateDirectoryW
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersionExW
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
CopyFileW
ExitProcess
GetCurrentProcess
GetModuleFileNameW
GetFileSize
CreateFileW
GetTickCount
MulDiv
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
MoveFileExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW

Sections

.text
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 192KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7dc3762bf412e12afcfe9e5f5372513a

Headers

DLL Characteristics

File Characteristics

Imports

powrprof

wsock32

ws2_32

iphlpapi

crypt32

kernel32

user32

gdi32

shell32

ole32

oleaut32

advapi32

mpr

userenv

version

netapi32

winmm

imm32

uxtheme

dwmapi

wtsapi32

dbgeng

bcrypt

Sections

.text Size: 15.6MB - Virtual size: 15.6MB

.rdata Size: 11.0MB - Virtual size: 11.0MB

.data Size: 594KB - Virtual size: 701KB

.pdata Size: 589KB - Virtual size: 589KB

_RDATA Size: 512B - Virtual size: 348B

.qtmetad Size: 1KB - Virtual size: 1KB

.qtmimed Size: 315KB - Virtual size: 315KB

.rsrc Size: 149KB - Virtual size: 149KB

.reloc Size: 104KB - Virtual size: 104KB

61259b55b8912888e90f516ca08dc514

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

Sections

.text Size: 26KB - Virtual size: 25KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 1KB - Virtual size: 128KB

.ndata Size: - Virtual size: 192KB

.rsrc Size: 35KB - Virtual size: 35KB

.text
Size: 15.6MB - Virtual size: 15.6MB

.rdata
Size: 11.0MB - Virtual size: 11.0MB

.data
Size: 594KB - Virtual size: 701KB

.pdata
Size: 589KB - Virtual size: 589KB

_RDATA
Size: 512B - Virtual size: 348B

.qtmetad
Size: 1KB - Virtual size: 1KB

.qtmimed
Size: 315KB - Virtual size: 315KB

.rsrc
Size: 149KB - Virtual size: 149KB

.reloc
Size: 104KB - Virtual size: 104KB

.text
Size: 26KB - Virtual size: 25KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 1KB - Virtual size: 128KB

.ndata
Size: - Virtual size: 192KB

.rsrc
Size: 35KB - Virtual size: 35KB