Extracted

• 1da2de386faf3618d7b67235e07db6f7.bin

  .zip

  Password: infected

• 4a610d83cdb41c92017a828c6528802cecc1d428f3b1450fd274cae15459f94c.exe

  .exe windows x86

  Password: infected

  0145d2c473bdbcd7b46a054bd6893ec4

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  winmm

  waveInClose

  waveInAddBuffer

  waveInStart

  waveInStop

  waveInPrepareHeader

  waveInUnprepareHeader

  waveInOpen

  webservices

  WsFileTimeToDateTime

  bcrypt

  BCryptOpenAlgorithmProvider

  BCryptSetProperty

  BCryptGenerateSymmetricKey

  BCryptDecrypt

  kernel32

  GetTickCount

  HeapAlloc

  GetProcessHeap

  GetCommandLineA

  GetStartupInfoA

  HeapFree

  VirtualAlloc

  HeapReAlloc

  VirtualQuery

  LocalAlloc

  LocalFree

  SystemTimeToFileTime

  TerminateThread

  CreateThread

  WriteProcessMemory

  GetCurrentProcess

  OpenProcess

  GetWindowsDirectoryA

  VirtualProtectEx

  VirtualAllocEx

  CreateRemoteThread

  GetModuleHandleW

  IsWow64Process

  WriteFile

  WaitForSingleObject

  CreateFileW

  LoadLibraryW

  GetLocalTime

  GetCurrentThreadId

  GetCurrentProcessId

  ReadFile

  FindFirstFileA

  GetBinaryTypeW

  FindNextFileA

  lstrcpyW

  CreateFileA

  GlobalAlloc

  GetCurrentDirectoryW

  SetCurrentDirectoryW

  GetFileSize

  FreeLibrary

  SetDllDirectoryW

  GetFileSizeEx

  WaitForMultipleObjects

  CreatePipe

  PeekNamedPipe

  DuplicateHandle

  SetEvent

  CreateProcessW

  CreateEventA

  GetModuleFileNameW

  LoadResource

  FindResourceW

  GetComputerNameW

  GlobalMemoryStatusEx

  LoadLibraryExW

  FindFirstFileW

  FindNextFileW

  SetFilePointer

  GetLogicalDriveStringsW

  CopyFileW

  GetDriveTypeW

  EnterCriticalSection

  LeaveCriticalSection

  InitializeCriticalSection

  DeleteCriticalSection

  CreateMutexA

  ReleaseMutex

  TerminateProcess

  K32GetModuleFileNameExW

  CreateToolhelp32Snapshot

  Process32NextW

  Process32FirstW

  DeleteFileW

  SizeofResource

  VirtualProtect

  GetSystemDirectoryW

  LockResource

  GetWindowsDirectoryW

  GlobalLock

  GlobalUnlock

  Process32First

  Process32Next

  WideCharToMultiByte

  lstrcpyA

  Sleep

  MultiByteToWideChar

  lstrcatA

  lstrcmpA

  lstrlenA

  ExpandEnvironmentStringsW

  lstrlenW

  lstrcmpW

  CreateProcessA

  WinExec

  ExitProcess

  GetProcAddress

  CloseHandle

  lstrcatW

  LoadLibraryA

  GetLastError

  GetPrivateProfileStringW

  GetModuleHandleA

  GetTempPathW

  VirtualFree

  SetLastError

  GetModuleFileNameA

  CreateDirectoryW

  GetFullPathNameA

  user32

  GetWindowTextW

  GetLastInputInfo

  wsprintfW

  CharLowerW

  PostQuitMessage

  ToUnicode

  TranslateMessage

  RegisterRawInputDevices

  DefWindowProcA

  MapVirtualKeyA

  GetRawInputData

  RegisterClassW

  GetAsyncKeyState

  GetKeyboardState

  CreateWindowExW

  SetClipboardViewer

  DispatchMessageA

  MapVirtualKeyW

  GetMessageA

  GetKeyState

  ReleaseDC

  GetSystemMetrics

  GetForegroundWindow

  OpenClipboard

  CloseClipboard

  GetClipboardData

  GetDC

  advapi32

  RegQueryValueExW

  LookupPrivilegeValueW

  AdjustTokenPrivileges

  AllocateAndInitializeSid

  OpenProcessToken

  FreeSid

  LookupAccountSidW

  GetTokenInformation

  RegQueryInfoKeyA

  RegOpenKeyW

  CloseServiceHandle

  SetSecurityDescriptorDacl

  RegDeleteKeyA

  InitializeSecurityDescriptor

  GetUserNameW

  RegDeleteKeyW

  RegCreateKeyExW

  RegSetValueExA

  RegOpenKeyExW

  RegOpenKeyExA

  RegEnumKeyExW

  RegQueryValueExA

  RegQueryInfoKeyW

  RegCloseKey

  OpenServiceW

  ChangeServiceConfigW

  QueryServiceConfigW

  EnumServicesStatusExW

  StartServiceW

  RegSetValueExW

  RegCreateKeyExA

  OpenSCManagerW

  RegDeleteValueW

  shell32

  SHFileOperationW

  SHGetSpecialFolderPathW

  SHCreateDirectoryExW

  SHGetFolderPathW

  ShellExecuteW

  ord680

  SHGetKnownFolderPath

  urlmon

  URLDownloadToFileW

  gdiplus

  GdiplusStartup

  GdipGetImageEncoders

  GdipSaveImageToFile

  GdipDisposeImage

  GdipCreateBitmapFromHBITMAP

  GdipGetImageEncodersSize

  GdiplusShutdown

  ws2_32

  WSAConnect

  WSAStartup

  shutdown

  closesocket

  WSACleanup

  connect

  InetNtopW

  gethostbyname

  send

  socket

  recv

  htons

  freeaddrinfo

  setsockopt

  getaddrinfo

  inet_addr

  ole32

  CreateStreamOnHGlobal

  CoInitialize

  CoCreateInstance

  CoTaskMemFree

  CoUninitialize

  CoInitializeSecurity

  shlwapi

  AssocQueryStringW

  StrStrW

  PathRemoveFileSpecA

  PathCombineA

  PathFindFileNameW

  PathFindExtensionW

  PathFileExistsW

  StrStrA

  netapi32

  NetUserAdd

  NetApiBufferFree

  NetUserGetInfo

  NetLocalGroupAddMembers

  oleaut32

  VariantInit

  crypt32

  CryptStringToBinaryW

  CryptStringToBinaryA

  CryptUnprotectData

  wininet

  InternetTimeToSystemTimeA

  gdi32

  CreateCompatibleDC

  SelectObject

  CreateCompatibleBitmap

  BitBlt

  DeleteObject

  Sections

  .text

  Size: 100KB - Virtual size: 99KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 21KB - Virtual size: 20KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 1KB - Virtual size: 1.2MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 11KB - Virtual size: 11KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 5KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .bss

  Size: 512B - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ