9554d243413964f1ce19884801045c7211f1054fefd024d22ef5bd47ea7cecba

Sharing

Copy URL Twitter E-mail

General

Target

9554d243413964f1ce19884801045c7211f1054fefd024d22ef5bd47ea7cecba
Size

3.2MB
MD5

e758ece91a5495fb4926308a6a7aabe8
SHA1

53357898c5e1b21751927baf07d4b5205c0ca984
SHA256

9554d243413964f1ce19884801045c7211f1054fefd024d22ef5bd47ea7cecba
SHA512

a915a7d0040293436f703b9812fd0f674a557790c854567a07a64ed7715e523e10d4a24190f05a67aec5e558e84fd2fd0564013285e236c9423e26fedcfe4cda
SSDEEP

24576:vYtIKfA9Bi/kcQgcpN24agx3chKiT+Bw1qjhj:vYtIKfA9BGkcQnf01

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9554d243413964f1ce19884801045c7211f1054fefd024d22ef5bd47ea7cecba

Files

9554d243413964f1ce19884801045c7211f1054fefd024d22ef5bd47ea7cecba
.dll windows x86

d3976c6b25198a5a30c85f8a0da9b9cb

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

CsrAllocateCaptureBuffer
CsrAllocateMessagePointer
CsrCaptureMessageBuffer
CsrClientCallServer
CsrClientConnectToServer
CsrFreeCaptureBuffer
CsrGetProcessId
CsrNewThread
DbgBreakPoint
DbgPrint
DbgPrintEx
DbgPrompt
DbgUiConnectToDbg
DbgUiContinue
DbgUiConvertStateChangeStructure
DbgUiDebugActiveProcess
DbgUiGetThreadDebugObject
DbgUiIssueRemoteBreakin
DbgUiStopDebugging
DbgUiWaitStateChange
LdrAccessResource
LdrAddRefDll
LdrDisableThreadCalloutsForDll
LdrEnumerateLoadedModules
LdrFindResourceDirectory_U
LdrFindResource_U
LdrGetDllHandle
LdrGetDllHandleEx
LdrGetProcedureAddress
LdrLoadDll
LdrLockLoaderLock
LdrOpenImageFileOptionsKey
LdrQueryImageFileKeyOption
LdrSetDllManifestProber
LdrShutdownProcess
LdrShutdownThread
LdrUnloadAlternateResourceModule
LdrUnloadDll
LdrUnlockLoaderLock
NlsMbCodePageTag
NlsMbOemCodePageTag
NtAddAtom
NtAllocateUserPhysicalPages
NtAllocateVirtualMemory
NtApphelpCacheControl
NtAssignProcessToJobObject
NtCancelDeviceWakeupRequest
NtCancelIoFile
NtCancelTimer
NtClose
NtCreateDirectoryObject
NtCreateEvent
NtCreateFile
NtCreateIoCompletion
NtCreateJobObject
NtCreateJobSet
NtCreateKey
NtCreateMailslotFile
NtCreateMutant
NtCreateNamedPipeFile
NtCreateProcessEx
NtCreateSection
NtCreateSemaphore
NtCreateThread
NtCreateTimer
NtDelayExecution
NtDeleteAtom
NtDeviceIoControlFile
NtDuplicateObject
NtEnumerateValueKey
NtFindAtom
NtFlushBuffersFile
NtFlushInstructionCache
NtFlushKey
NtFlushVirtualMemory
NtFreeUserPhysicalPages
NtFreeVirtualMemory
NtFsControlFile
NtGetContextThread
NtGetDevicePowerState
NtGetWriteWatch
NtInitiatePowerAction
NtIsProcessInJob
NtIsSystemResumeAutomatic
NtLockFile
NtLockVirtualMemory
NtMapUserPhysicalPages
NtMapUserPhysicalPagesScatter
NtMapViewOfSection
NtNotifyChangeDirectoryFile
NtOpenDirectoryObject
NtOpenEvent
NtOpenFile
NtOpenJobObject
NtOpenKey
NtOpenMutant
NtOpenProcess
NtOpenSection
NtOpenSemaphore
NtOpenSymbolicLinkObject
NtOpenThread
NtOpenThreadToken
NtOpenTimer
NtPowerInformation
NtProtectVirtualMemory
NtPulseEvent
NtQueryAttributesFile
NtQueryDefaultLocale
NtQueryDefaultUILanguage
NtQueryDirectoryFile
NtQueryDirectoryObject
NtQueryEaFile
NtQueryEvent
NtQueryFullAttributesFile
NtQueryInformationAtom
NtQueryInformationFile
NtQueryInformationJobObject
NtQueryInformationProcess
NtQueryInformationThread
NtQueryInstallUILanguage
NtQueryObject
NtQueryPerformanceCounter
NtQuerySection
NtQuerySymbolicLinkObject
NtQuerySystemInformation
NtQueryValueKey
NtQueryVirtualMemory
NtQueryVolumeInformationFile
NtQueueApcThread
NtRaiseHardError
NtReadFile
NtReadFileScatter
NtReadVirtualMemory
NtReleaseMutant
NtReleaseSemaphore
NtRemoveIoCompletion
NtRequestDeviceWakeup
NtRequestWakeupLatency
NtResetEvent
NtResetWriteWatch
NtResumeThread
NtSetContextThread
NtSetEvent
NtSetInformationDebugObject
NtSetInformationFile
NtSetInformationJobObject
NtSetInformationObject
NtSetInformationProcess
NtSetInformationThread
NtSetIoCompletion
NtSetSystemInformation
NtSetSystemTime
NtSetThreadExecutionState
NtSetTimer
NtSetValueKey
NtSetVolumeInformationFile
NtSignalAndWaitForSingleObject
NtSuspendThread
NtTerminateJobObject
NtTerminateProcess
NtTerminateThread
NtUnlockFile
NtUnlockVirtualMemory
NtUnmapViewOfSection
NtWaitForMultipleObjects
NtWaitForSingleObject
NtWriteFile
NtWriteFileGather
NtWriteVirtualMemory
NtYieldExecution
RtlAcquirePebLock
RtlAcquirePrivilege
RtlActivateActivationContext
RtlActivateActivationContextEx
RtlActivateActivationContextUnsafeFast
RtlAddAccessAllowedAce
RtlAddAtomToAtomTable
RtlAddRefActivationContext
RtlAllocateActivationContextStack
RtlAllocateAndInitializeSid
RtlAllocateHandle
RtlAllocateHeap
RtlAnsiCharToUnicodeChar
RtlAnsiStringToUnicodeString
RtlAppendUnicodeStringToString
RtlAppendUnicodeToString
RtlAreBitsSet
RtlAssert
RtlCharToInteger
RtlClearBits
RtlCompactHeap
RtlCompareMemory
RtlComputeImportTableHash
RtlCopyUnicodeString
RtlCreateAcl
RtlCreateActivationContext
RtlCreateAtomTable
RtlCreateEnvironment
RtlCreateHeap
RtlCreateProcessParameters
RtlCreateQueryDebugBuffer
RtlCreateSecurityDescriptor
RtlCreateTagHeap
RtlCreateTimer
RtlCreateTimerQueue
RtlCreateUnicodeString
RtlCreateUnicodeStringFromAsciiz
RtlDeactivateActivationContext
RtlDeactivateActivationContextUnsafeFast
RtlDecodePointer
RtlDecodeSystemPointer
RtlDeleteAtomFromAtomTable
RtlDeleteCriticalSection
RtlDeleteTimer
RtlDeleteTimerQueueEx
RtlDeregisterWaitEx
RtlDestroyEnvironment
RtlDestroyHeap
RtlDestroyProcessParameters
RtlDestroyQueryDebugBuffer
RtlDetermineDosPathNameType_U
RtlDosPathNameToNtPathName_U
RtlDosPathNameToRelativeNtPathName_U
RtlDosSearchPath_Ustr
RtlEncodePointer
RtlEncodeSystemPointer
RtlEnterCriticalSection
RtlEqualUnicodeString
RtlExpandEnvironmentStrings_U
RtlExtendedLargeIntegerDivide
RtlFindActivationContextSectionGuid
RtlFindActivationContextSectionString
RtlFindClearBitsAndSet
RtlFindMessage
RtlFlushSecureMemoryCache
RtlFreeActivationContextStack
RtlFreeAnsiString
RtlFreeHandle
RtlFreeHeap
RtlFreeSid
RtlFreeUnicodeString
RtlGetActiveActivationContext
RtlGetCurrentDirectory_U
RtlGetFullPathName_U
RtlGetFullPathName_UstrEx
RtlGetNativeSystemInformation
RtlGetProcessHeaps
RtlGetThreadErrorMode
RtlGetUserInfoHeap
RtlGetVersion
RtlImageDirectoryEntryToData
RtlImageNtHeader
RtlInitAnsiString
RtlInitAnsiStringEx
RtlInitCodePageTable
RtlInitUnicodeString
RtlInitUnicodeStringEx
RtlInitializeCriticalSection
RtlInitializeCriticalSectionAndSpinCount
RtlInitializeHandleTable
RtlIntegerToChar
RtlIntegerToUnicodeString
RtlIsDosDeviceName_U
RtlIsNameLegalDOS8Dot3
RtlIsTextUnicode
RtlIsValidHandle
RtlLeaveCriticalSection
RtlLengthSid
RtlLockHeap
RtlLookupAtomInAtomTable
RtlMultiByteToUnicodeN
RtlNtStatusToDosError
RtlOemStringToUnicodeString
RtlOemToUnicodeN
RtlOpenCurrentUser
RtlPcToFileHeader
RtlPrefixUnicodeString
RtlQueryAtomInAtomTable
RtlQueryEnvironmentVariable_U
RtlQueryHeapInformation
RtlQueryInformationActivationContext
RtlQueryProcessDebugInformation
RtlQueryRegistryValues
RtlQueryTagHeap
RtlQueueWorkItem
RtlRaiseException
RtlRaiseStatus
RtlReAllocateHeap
RtlRegisterWait
RtlReleaseActivationContext
RtlReleasePebLock
RtlReleasePrivilege
RtlReleaseRelativeName
RtlSetCurrentDirectory_U
RtlSetDaclSecurityDescriptor
RtlSetEnvironmentVariable
RtlSetHeapInformation
RtlSetIoCompletionCallback
RtlSetThreadErrorMode
RtlSetThreadPoolStartFunc
RtlSetTimeZoneInformation
RtlSetUserValueHeap
RtlSizeHeap
RtlTimeFieldsToTime
RtlTimeToTimeFields
RtlUnicodeStringToAnsiString
RtlUnicodeStringToInteger
RtlUnicodeStringToOemString
RtlUnicodeToMultiByteN
RtlUnicodeToMultiByteSize
RtlUnicodeToOemN
RtlUnlockHeap
RtlUnwind
RtlUpcaseUnicodeChar
RtlUpcaseUnicodeString
RtlUpdateTimer
RtlValidateHeap
RtlVerifyVersionInfo
RtlWalkHeap
RtlWow64EnableFsRedirection
RtlWow64EnableFsRedirectionEx
RtlZombifyActivationContext
RtlxAnsiStringToUnicodeSize
RtlxOemStringToUnicodeSize
RtlxUnicodeStringToAnsiSize
RtlxUnicodeStringToOemSize
_snwprintf
_strcmpi
_vsnwprintf
_wcsicmp
_wcsnicmp
_wtoi
isalpha
islower
iswctype
memcmp
memcpy
memmove
memset
qsort
sprintf
strcat
strchr
strcpy
strncmp
strncpy
strpbrk
strrchr
swprintf
tolower
toupper
towlower
towupper
wcscat
wcschr
wcscmp
wcscpy
wcslen
wcsncmp
wcsncpy
wcsrchr
wcsstr
wcstol
wcstoul

Exports

Exports

ActivateActCtx
AddAtomA
AddAtomW
AddConsoleAliasA
AddConsoleAliasW
AddLocalAlternateComputerNameA
AddLocalAlternateComputerNameW
AddRefActCtx
AddVectoredContinueHandler
AddVectoredExceptionHandler
AllocConsole
AllocateUserPhysicalPages
AreFileApisANSI
AssignProcessToJobObject
AttachConsole
BackupRead
BackupSeek
BackupWrite
BaseCheckAppcompatCache
BaseCheckRunApp
BaseCleanupAppcompatCacheSupport
BaseDumpAppcompatCache
BaseFlushAppcompatCache
BaseInitAppcompatCacheSupport
BaseIsAppcompatInfrastructureDisabled
BaseProcessInitPostImport
BaseQueryModuleData
BaseUpdateAppcompatCache
BasepCheckBadapp
BasepCheckWinSaferRestrictions
BasepFreeAppCompatData
Beep
BeginUpdateResourceA
BeginUpdateResourceW
BindIoCompletionCallback
BuildCommDCBA
BuildCommDCBAndTimeoutsA
BuildCommDCBAndTimeoutsW
BuildCommDCBW
CallNamedPipeA
CallNamedPipeW
CancelDeviceWakeupRequest
CancelIo
CancelTimerQueueTimer
CancelWaitableTimer
ChangeTimerQueueTimer
CheckNameLegalDOS8Dot3A
CheckNameLegalDOS8Dot3W
CheckRemoteDebuggerPresent
ClearCommBreak
ClearCommError
CloseConsoleHandle
CloseHandle
CloseProfileUserMapping
CmdBatNotification
CommConfigDialogA
CommConfigDialogW
CompareFileTime
CompareStringA
CompareStringW
ConnectNamedPipe
ConsoleMenuControl
ContinueDebugEvent
ConvertDefaultLocale
ConvertFiberToThread
ConvertThreadToFiber
ConvertThreadToFiberEx
CopyFileA
CopyFileExA
CopyFileExW
CopyFileW
CopyLZFile
CreateActCtxA
CreateActCtxW
CreateConsoleScreenBuffer
CreateDirectoryA
CreateDirectoryExA
CreateDirectoryExW
CreateDirectoryW
CreateEventA
CreateEventW
CreateFiber
CreateFiberEx
CreateFileA
CreateFileMappingA
CreateFileMappingW
CreateFileW
CreateHardLinkA
CreateHardLinkW
CreateIoCompletionPort
CreateJobObjectA
CreateJobObjectW
CreateJobSet
CreateMailslotA
CreateMailslotW
CreateMemoryResourceNotification
CreateMutexA
CreateMutexW
CreateNamedPipeA
CreateNamedPipeW
CreateNlsSecurityDescriptor
CreatePipe
CreateProcessA
CreateProcessInternalA
CreateProcessInternalW
CreateProcessW
CreateRemoteThread
CreateSemaphoreA
CreateSemaphoreW
CreateSocketHandle
CreateTapePartition
CreateThread
CreateTimerQueue
CreateTimerQueueTimer
CreateToolhelp32Snapshot
CreateWaitableTimerA
CreateWaitableTimerW
DeactivateActCtx
DebugActiveProcess
DebugActiveProcessStop
DebugBreak
DebugBreakProcess
DebugSetProcessKillOnExit
DecodePointer
DecodeSystemPointer
DefineDosDeviceA
DefineDosDeviceW
DelayLoadFailureHook
DeleteAtom
DeleteCriticalSection
DeleteFiber
DeleteFileA
DeleteFileW
DeleteTimerQueue
DeleteTimerQueueEx
DeleteTimerQueueTimer
DeleteVolumeMountPointA
DeleteVolumeMountPointW
DeviceIoControl
DisableThreadLibraryCalls
DisconnectNamedPipe
DnsHostnameToComputerNameA
DnsHostnameToComputerNameW
DosDateTimeToFileTime
DosPathToSessionPathA
DosPathToSessionPathW
DuplicateConsoleHandle
DuplicateHandle
EncodePointer
EncodeSystemPointer
EndUpdateResourceA
EndUpdateResourceW
EnterCriticalSection
EnumCalendarInfoA
EnumCalendarInfoExA
EnumCalendarInfoExW
EnumCalendarInfoW
EnumDateFormatsA
EnumDateFormatsExA
EnumDateFormatsExW
EnumDateFormatsW
EnumLanguageGroupLocalesA
EnumLanguageGroupLocalesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceNamesA
EnumResourceNamesW
EnumResourceTypesA
EnumResourceTypesW
EnumSystemCodePagesA
EnumSystemCodePagesW
EnumSystemFirmwareTables
EnumSystemGeoID
EnumSystemLanguageGroupsA
EnumSystemLanguageGroupsW
EnumSystemLocalesA
EnumSystemLocalesW
EnumTimeFormatsA
EnumTimeFormatsW
EnumUILanguagesA
EnumUILanguagesW
EnumerateLocalComputerNamesA
EnumerateLocalComputerNamesW
EraseTape
EscapeCommFunction
ExitProcess
ExitThread
ExitVDM
ExpandEnvironmentStringsA
ExpandEnvironmentStringsW
ExpungeConsoleCommandHistoryA
ExpungeConsoleCommandHistoryW
FatalAppExitA
FatalAppExitW
FatalExit
FileTimeToDosDateTime
FileTimeToLocalFileTime
FileTimeToSystemTime
FillConsoleOutputAttribute
FillConsoleOutputCharacterA
FillConsoleOutputCharacterW
FindActCtxSectionGuid
FindActCtxSectionStringA
FindActCtxSectionStringW
FindAtomA
FindAtomW
FindClose
FindCloseChangeNotification
FindFirstChangeNotificationA
FindFirstChangeNotificationW
FindFirstFileA
FindFirstFileExA
FindFirstFileExW
FindFirstFileW
FindFirstStreamW
FindFirstVolumeA
FindFirstVolumeMountPointA
FindFirstVolumeMountPointW
FindFirstVolumeW
FindNextChangeNotification
FindNextFileA
FindNextFileW
FindNextStreamW
FindNextVolumeA
FindNextVolumeMountPointA
FindNextVolumeMountPointW
FindNextVolumeW
FindResourceA
FindResourceExA
FindResourceExW
FindResourceW
FindVolumeClose
FindVolumeMountPointClose
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushConsoleInputBuffer
FlushFileBuffers
FlushInstructionCache
FlushViewOfFile
FoldStringA
FoldStringW
FormatMessageA
FormatMessageW
FreeConsole
FreeEnvironmentStringsA
FreeEnvironmentStringsW
FreeLibrary
FreeLibraryAndExitThread
FreeResource
FreeUserPhysicalPages
GenerateConsoleCtrlEvent
GetACP
GetAtomNameA
GetAtomNameW
GetBinaryType
GetBinaryTypeA
GetBinaryTypeW
GetCPFileNameFromRegistry
GetCPInfo
GetCPInfoExA
GetCPInfoExW
GetCalendarInfoA
GetCalendarInfoW
GetComPlusPackageInstallStatus
GetCommConfig
GetCommMask
GetCommModemStatus
GetCommProperties
GetCommState
GetCommTimeouts
GetCommandLineA
GetCommandLineW
GetCompressedFileSizeA
GetCompressedFileSizeW
GetComputerNameA
GetComputerNameExA
GetComputerNameExW
GetComputerNameW
GetConsoleAliasA
GetConsoleAliasExesA
GetConsoleAliasExesLengthA
GetConsoleAliasExesLengthW
GetConsoleAliasExesW
GetConsoleAliasW
GetConsoleAliasesA
GetConsoleAliasesLengthA
GetConsoleAliasesLengthW
GetConsoleAliasesW
GetConsoleCP
GetConsoleCharType
GetConsoleCommandHistoryA
GetConsoleCommandHistoryLengthA
GetConsoleCommandHistoryLengthW
GetConsoleCommandHistoryW
GetConsoleCursorInfo
GetConsoleCursorMode
GetConsoleDisplayMode
GetConsoleFontInfo
GetConsoleFontSize
GetConsoleHardwareState
GetConsoleInputExeNameA
GetConsoleInputExeNameW
GetConsoleInputWaitHandle
GetConsoleKeyboardLayoutNameA
GetConsoleKeyboardLayoutNameW
GetConsoleMode
GetConsoleNlsMode
GetConsoleOutputCP
GetConsoleProcessList
GetConsoleScreenBufferInfo
GetConsoleSelectionInfo
GetConsoleTitleA
GetConsoleTitleW
GetConsoleWindow
GetCurrencyFormatA
GetCurrencyFormatW
GetCurrentActCtx
GetCurrentConsoleFont
GetCurrentDirectoryA
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentProcessorNumber
GetCurrentThread
GetCurrentThreadId
GetDateFormatA
GetDateFormatW
GetDefaultCommConfigA
GetDefaultCommConfigW
GetDefaultSortkeySize
GetDevicePowerState
GetDiskFreeSpaceA
GetDiskFreeSpaceExA
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetDllDirectoryA
GetDllDirectoryW
GetDriveTypeA
GetDriveTypeW
GetEnvironmentStrings
GetEnvironmentStringsA
GetEnvironmentStringsW
GetEnvironmentVariableA
GetEnvironmentVariableW
GetExitCodeProcess
GetExitCodeThread
GetExpandedNameA
GetExpandedNameW
GetFileAttributesA
GetFileAttributesExA
GetFileAttributesExW
GetFileAttributesW
GetFileInformationByHandle
GetFileSize
GetFileSizeEx
GetFileTime
GetFileType
GetFirmwareEnvironmentVariableA
GetFirmwareEnvironmentVariableW
GetFullPathNameA
GetFullPathNameW
GetGeoInfoA
GetGeoInfoW
GetHandleContext
GetHandleInformation
GetLargePageMinimum
GetLargestConsoleWindowSize
GetLastError
GetLinguistLangSize
GetLocalTime
GetLocaleInfoA
GetLocaleInfoW
GetLogicalDriveStringsA
GetLogicalDriveStringsW
GetLogicalDrives
GetLogicalProcessorInformation
GetLongPathNameA
GetLongPathNameW
GetMailslotInfo
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExA
GetModuleHandleExW
GetModuleHandleW
GetNLSVersion
GetNLSVersionEx
GetNamedPipeHandleStateA
GetNamedPipeHandleStateW
GetNamedPipeInfo
GetNativeSystemInfo
GetNextVDMCommand
GetNlsSectionName
GetNumaAvailableMemoryNode
GetNumaHighestNodeNumber
GetNumaNodeProcessorMask
GetNumaProcessorNode
GetNumberFormatA
GetNumberFormatW
GetNumberOfConsoleFonts
GetNumberOfConsoleInputEvents
GetNumberOfConsoleMouseButtons
GetOEMCP
GetOverlappedResult
GetPriorityClass
GetPrivateProfileIntA
GetPrivateProfileIntW
GetPrivateProfileSectionA
GetPrivateProfileSectionNamesA
GetPrivateProfileSectionNamesW
GetPrivateProfileSectionW
GetPrivateProfileStringA
GetPrivateProfileStringW
GetPrivateProfileStructA
GetPrivateProfileStructW
GetProcAddress
GetProcessAffinityMask
GetProcessHandleCount
GetProcessHeap
GetProcessHeaps
GetProcessId
GetProcessIdOfThread
GetProcessIoCounters
GetProcessPriorityBoost
GetProcessShutdownParameters
GetProcessTimes
GetProcessVersion
GetProcessWorkingSetSize
GetProcessWorkingSetSizeEx
GetProfileIntA
GetProfileIntW
GetProfileSectionA
GetProfileSectionW
GetProfileStringA
GetProfileStringW
GetQueuedCompletionStatus
GetShortPathNameA
GetShortPathNameW
GetStartupInfoA
GetStartupInfoW
GetStdHandle
GetStringTypeA
GetStringTypeExA
GetStringTypeExW
GetStringTypeW
GetSystemDefaultLCID
GetSystemDefaultLangID
GetSystemDefaultUILanguage
GetSystemDirectoryA
GetSystemDirectoryW
GetSystemFileCacheSize
GetSystemFirmwareTable
GetSystemInfo
GetSystemPowerStatus
GetSystemRegistryQuota
GetSystemTime
GetSystemTimeAdjustment
GetSystemTimeAsFileTime
GetSystemTimes
GetSystemWindowsDirectoryA
GetSystemWindowsDirectoryW
GetSystemWow64DirectoryA
GetSystemWow64DirectoryW
GetTapeParameters
GetTapePosition
GetTapeStatus
GetTempFileNameA
GetTempFileNameW
GetTempPathA
GetTempPathW
GetThreadContext
GetThreadIOPendingFlag
GetThreadId
GetThreadLocale
GetThreadPriority
GetThreadPriorityBoost
GetThreadSelectorEntry
GetThreadTimes
GetTickCount
GetTimeFormatA
GetTimeFormatW
GetTimeZoneInformation
GetUserDefaultLCID
GetUserDefaultLangID
GetUserDefaultUILanguage
GetUserGeoID
GetVDMCurrentDirectories
GetVersion
GetVersionExA
GetVersionExW
GetVolumeInformationA
GetVolumeInformationW
GetVolumeNameForVolumeMountPointA
GetVolumeNameForVolumeMountPointW
GetVolumePathNameA
GetVolumePathNameW
GetVolumePathNamesForVolumeNameA
GetVolumePathNamesForVolumeNameW

Sections

.text
Size: 328KB - Virtual size: 328KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 157KB - Virtual size: 157KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/19
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 15KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rossym
Size: 454KB - Virtual size: 454KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d3976c6b25198a5a30c85f8a0da9b9cb

Headers

File Characteristics

Imports

ntdll

Exports

Exports

Sections

.text Size: 328KB - Virtual size: 328KB

.data Size: 1KB - Virtual size: 1KB

.rdata Size: 157KB - Virtual size: 157KB

/4 Size: 512B - Virtual size: 20B

/19 Size: 512B - Virtual size: 64B

.bss Size: - Virtual size: 15KB

.edata Size: 28KB - Virtual size: 28KB

.idata Size: 12KB - Virtual size: 12KB

.rsrc Size: 2.2MB - Virtual size: 2.2MB

.reloc Size: 12KB - Virtual size: 12KB

.rossym Size: 454KB - Virtual size: 454KB

.text
Size: 328KB - Virtual size: 328KB

.data
Size: 1KB - Virtual size: 1KB

.rdata
Size: 157KB - Virtual size: 157KB

/4
Size: 512B - Virtual size: 20B

/19
Size: 512B - Virtual size: 64B

.bss
Size: - Virtual size: 15KB

.edata
Size: 28KB - Virtual size: 28KB

.idata
Size: 12KB - Virtual size: 12KB

.rsrc
Size: 2.2MB - Virtual size: 2.2MB

.reloc
Size: 12KB - Virtual size: 12KB

.rossym
Size: 454KB - Virtual size: 454KB