General

Malware Config

Signatures

Files

• sys32.exe

  .exe windows x86

  11fc1edb442e257617e8672be635a02f

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  GetLastError

  HeapReAlloc

  CloseHandle

  RaiseException

  CreateThread

  HeapAlloc

  DecodePointer

  GetProcAddress

  SetFilePointerEx

  DeleteCriticalSection

  GetCurrentProcessId

  GetProcessHeap

  GetModuleHandleW

  WideCharToMultiByte

  lstrcmpiW

  CreateIoCompletionPort

  MoveFileW

  GetDriveTypeW

  FlushFileBuffers

  SetLastError

  InitializeSRWLock

  ReleaseSRWLockExclusive

  ReleaseSRWLockShared

  AcquireSRWLockExclusive

  AcquireSRWLockShared

  GetCurrentThreadId

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetSystemDirectoryA

  FreeLibrary

  LoadLibraryA

  FormatMessageA

  Sleep

  VirtualFree

  MultiByteToWideChar

  GetStdHandle

  GetFileType

  GetEnvironmentVariableW

  GetACP

  QueryPerformanceCounter

  GetSystemTimeAsFileTime

  GetConsoleMode

  SetConsoleMode

  ReadConsoleA

  ReadConsoleW

  FindClose

  SetEnvironmentVariableW

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GetCommandLineA

  GetOEMCP

  IsValidCodePage

  FindFirstFileExW

  GetLogicalDriveStringsW

  HeapSize

  OpenProcess

  CreateFileW

  InitializeCriticalSectionEx

  CreateMutexW

  SetEndOfFile

  GetQueuedCompletionStatus

  InitializeConditionVariable

  InitializeCriticalSection

  LeaveCriticalSection

  WaitForMultipleObjects

  WakeAllConditionVariable

  TerminateProcess

  WriteFile

  GetCurrentProcess

  GetTimeZoneInformation

  GetFullPathNameW

  GetCurrentDirectoryW

  SetStdHandle

  EnumSystemLocalesW

  GetUserDefaultLCID

  IsValidLocale

  FindNextFileW

  GetCommandLineW

  EnterCriticalSection

  HeapFree

  GetFileSizeEx

  FindFirstFileW

  CancelIo

  ReadFile

  GetLocaleInfoW

  LCMapStringW

  CompareStringW

  SleepConditionVariableCS

  GetFileAttributesExW

  CreateProcessW

  GetExitCodeProcess

  WaitForSingleObject

  GetConsoleOutputCP

  GetModuleFileNameW

  FileTimeToSystemTime

  SystemTimeToTzSpecificLocalTime

  PeekNamedPipe

  GetFileInformationByHandle

  SetConsoleCtrlHandler

  GetModuleHandleExW

  ExitProcess

  LoadLibraryExW

  RtlUnwind

  InitializeSListHead

  GetStartupInfoW

  IsProcessorFeaturePresent

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  CreateEventW

  InitializeCriticalSectionAndSpinCount

  OutputDebugStringW

  IsDebuggerPresent

  GetNativeSystemInfo

  GetStringTypeW

  EncodePointer

  LCMapStringEx

  GetCPInfo

  WriteConsoleW

  user32

  GetProcessWindowStation

  wsprintfW

  MessageBoxW

  GetUserObjectInformationW

  advapi32

  CryptDestroyHash

  RegisterEventSourceW

  ReportEventW

  CryptAcquireContextW

  CryptReleaseContext

  CryptDestroyKey

  CryptSetHashParam

  CryptGetProvParam

  CryptGetUserKey

  CryptExportKey

  CryptEnumProvidersW

  CryptSignHashW

  DeregisterEventSource

  CryptCreateHash

  CryptDecrypt

  shell32

  CommandLineToArgvW

  ShellExecuteW

  rstrtmgr

  RmEndSession

  RmGetList

  RmRegisterResources

  RmStartSession

  crypt32

  CertOpenStore

  CertCloseStore

  CertEnumCertificatesInStore

  CertFindCertificateInStore

  CertDuplicateCertificateContext

  CertFreeCertificateContext

  CertGetCertificateContextProperty

  netapi32

  NetShareEnum

  NetApiBufferFree

  iphlpapi

  GetIpAddrTable

  ws2_32

  select

  ntohs

  getsockopt

  ioctlsocket

  bind

  WSACleanup

  closesocket

  ntohl

  WSASocketW

  WSAStartup

  socket

  WSAAddressToStringW

  htonl

  htons

  WSAGetLastError

  inet_addr

  inet_ntoa

  gethostbyaddr

  getservbyport

  getservbyname

  WSASetLastError

  recv

  send

  connect

  gethostbyname

  setsockopt

  shutdown

  WSAIoctl

  bcrypt

  BCryptGenRandom

  Sections

  .text

  Size: 1.6MB - Virtual size: 1.6MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 524KB - Virtual size: 524KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 13KB - Virtual size: 38KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 512B - Virtual size: 480B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 82KB - Virtual size: 82KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ