712d5710b47b421d5a51dca039d85e64141d8b9c985faf1d7dba25606740b976

Sharing

Copy URL Twitter E-mail

General

Target

712d5710b47b421d5a51dca039d85e64141d8b9c985faf1d7dba25606740b976
Size

2.9MB
MD5

3f3be08068757f750afae9c4eb5db9ae
SHA1

575cf28fbe5d67ebaaa056639a5de0825842c14b
SHA256

712d5710b47b421d5a51dca039d85e64141d8b9c985faf1d7dba25606740b976
SHA512

31814e7f38482f5c7225e2a140e53d5c7fc39f0fd491884d5c59f432aa19e81d68609d1969bc06612b7745623c8117af0148c895c7414d627f8ea73fd6a4a8b7
SSDEEP

24576:ox/SkM4VBm2SPHFe26g7nCr227Cq8UhPiE:ox6kM4VBmXP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
712d5710b47b421d5a51dca039d85e64141d8b9c985faf1d7dba25606740b976

Files

712d5710b47b421d5a51dca039d85e64141d8b9c985faf1d7dba25606740b976
.dll windows x86

2ac20ea710233153cb8e72b5b3e0b9c1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

CsrAllocateCaptureBuffer
CsrAllocateMessagePointer
CsrCaptureMessageBuffer
CsrClientCallServer
CsrClientConnectToServer
CsrFreeCaptureBuffer
CsrGetProcessId
CsrNewThread
DbgBreakPoint
DbgPrint
DbgPrintEx
DbgPrompt
DbgUiConnectToDbg
DbgUiContinue
DbgUiConvertStateChangeStructure
DbgUiDebugActiveProcess
DbgUiGetThreadDebugObject
DbgUiIssueRemoteBreakin
DbgUiStopDebugging
DbgUiWaitStateChange
LdrAccessResource
LdrAddRefDll
LdrDisableThreadCalloutsForDll
LdrEnumerateLoadedModules
LdrFindResourceDirectory_U
LdrFindResource_U
LdrGetDllHandle
LdrGetDllHandleEx
LdrGetProcedureAddress
LdrLoadDll
LdrLockLoaderLock
LdrOpenImageFileOptionsKey
LdrQueryImageFileKeyOption
LdrSetDllManifestProber
LdrShutdownProcess
LdrShutdownThread
LdrUnloadAlternateResourceModule
LdrUnloadDll
LdrUnlockLoaderLock
NlsMbCodePageTag
NlsMbOemCodePageTag
NtAddAtom
NtAllocateUserPhysicalPages
NtAllocateVirtualMemory
NtApphelpCacheControl
NtAssignProcessToJobObject
NtCancelDeviceWakeupRequest
NtCancelIoFile
NtCancelTimer
NtClose
NtCreateDirectoryObject
NtCreateEvent
NtCreateFile
NtCreateIoCompletion
NtCreateJobObject
NtCreateJobSet
NtCreateKey
NtCreateMailslotFile
NtCreateMutant
NtCreateNamedPipeFile
NtCreateProcessEx
NtCreateSection
NtCreateSemaphore
NtCreateThread
NtCreateTimer
NtDelayExecution
NtDeleteAtom
NtDeviceIoControlFile
NtDuplicateObject
NtEnumerateValueKey
NtFindAtom
NtFlushBuffersFile
NtFlushInstructionCache
NtFlushKey
NtFlushVirtualMemory
NtFreeUserPhysicalPages
NtFreeVirtualMemory
NtFsControlFile
NtGetContextThread
NtGetDevicePowerState
NtGetWriteWatch
NtInitiatePowerAction
NtIsProcessInJob
NtIsSystemResumeAutomatic
NtLockFile
NtLockVirtualMemory
NtMapUserPhysicalPages
NtMapUserPhysicalPagesScatter
NtMapViewOfSection
NtNotifyChangeDirectoryFile
NtOpenDirectoryObject
NtOpenEvent
NtOpenFile
NtOpenJobObject
NtOpenKey
NtOpenMutant
NtOpenProcess
NtOpenSection
NtOpenSemaphore
NtOpenSymbolicLinkObject
NtOpenThread
NtOpenThreadToken
NtOpenTimer
NtPowerInformation
NtProtectVirtualMemory
NtPulseEvent
NtQueryAttributesFile
NtQueryDefaultLocale
NtQueryDefaultUILanguage
NtQueryDirectoryFile
NtQueryDirectoryObject
NtQueryEaFile
NtQueryEvent
NtQueryFullAttributesFile
NtQueryInformationAtom
NtQueryInformationFile
NtQueryInformationJobObject
NtQueryInformationProcess
NtQueryInformationThread
NtQueryInstallUILanguage
NtQueryObject
NtQueryPerformanceCounter
NtQuerySection
NtQuerySymbolicLinkObject
NtQuerySystemInformation
NtQueryValueKey
NtQueryVirtualMemory
NtQueryVolumeInformationFile
NtQueueApcThread
NtRaiseHardError
NtReadFile
NtReadFileScatter
NtReadVirtualMemory
NtReleaseMutant
NtReleaseSemaphore
NtRemoveIoCompletion
NtRequestDeviceWakeup
NtRequestWakeupLatency
NtResetEvent
NtResetWriteWatch
NtResumeThread
NtSetContextThread
NtSetEvent
NtSetInformationDebugObject
NtSetInformationFile
NtSetInformationJobObject
NtSetInformationObject
NtSetInformationProcess
NtSetInformationThread
NtSetIoCompletion
NtSetSystemInformation
NtSetSystemTime
NtSetThreadExecutionState
NtSetTimer
NtSetValueKey
NtSetVolumeInformationFile
NtSignalAndWaitForSingleObject
NtSuspendThread
NtTerminateJobObject
NtTerminateProcess
NtTerminateThread
NtUnlockFile
NtUnlockVirtualMemory
NtUnmapViewOfSection
NtWaitForMultipleObjects
NtWaitForSingleObject
NtWriteFile
NtWriteFileGather
NtWriteVirtualMemory
NtYieldExecution
RtlAcquirePebLock
RtlAcquirePrivilege
RtlActivateActivationContext
RtlActivateActivationContextEx
RtlActivateActivationContextUnsafeFast
RtlAddAccessAllowedAce
RtlAddAtomToAtomTable
RtlAddRefActivationContext
RtlAllocateActivationContextStack
RtlAllocateAndInitializeSid
RtlAllocateHandle
RtlAllocateHeap
RtlAnsiCharToUnicodeChar
RtlAnsiStringToUnicodeString
RtlAppendUnicodeStringToString
RtlAppendUnicodeToString
RtlAreBitsSet
RtlAssert
RtlCharToInteger
RtlClearBits
RtlCompactHeap
RtlCompareMemory
RtlComputeImportTableHash
RtlCopyUnicodeString
RtlCreateAcl
RtlCreateActivationContext
RtlCreateAtomTable
RtlCreateEnvironment
RtlCreateHeap
RtlCreateProcessParameters
RtlCreateQueryDebugBuffer
RtlCreateSecurityDescriptor
RtlCreateTagHeap
RtlCreateTimer
RtlCreateTimerQueue
RtlCreateUnicodeString
RtlCreateUnicodeStringFromAsciiz
RtlDeactivateActivationContext
RtlDeactivateActivationContextUnsafeFast
RtlDecodePointer
RtlDecodeSystemPointer
RtlDeleteAtomFromAtomTable
RtlDeleteCriticalSection
RtlDeleteTimer
RtlDeleteTimerQueueEx
RtlDeregisterWaitEx
RtlDestroyEnvironment
RtlDestroyHeap
RtlDestroyProcessParameters
RtlDestroyQueryDebugBuffer
RtlDetermineDosPathNameType_U
RtlDosPathNameToNtPathName_U
RtlDosPathNameToRelativeNtPathName_U
RtlDosSearchPath_Ustr
RtlEncodePointer
RtlEncodeSystemPointer
RtlEnterCriticalSection
RtlEqualUnicodeString
RtlExpandEnvironmentStrings_U
RtlExtendedLargeIntegerDivide
RtlFindActivationContextSectionGuid
RtlFindActivationContextSectionString
RtlFindClearBitsAndSet
RtlFindMessage
RtlFlushSecureMemoryCache
RtlFreeActivationContextStack
RtlFreeAnsiString
RtlFreeHandle
RtlFreeHeap
RtlFreeSid
RtlFreeUnicodeString
RtlGetActiveActivationContext
RtlGetCurrentDirectory_U
RtlGetDaclSecurityDescriptor
RtlGetFullPathName_U
RtlGetFullPathName_UstrEx
RtlGetNativeSystemInformation
RtlGetProcessHeaps
RtlGetThreadErrorMode
RtlGetUserInfoHeap
RtlGetVersion
RtlImageDirectoryEntryToData
RtlImageNtHeader
RtlInitAnsiString
RtlInitAnsiStringEx
RtlInitCodePageTable
RtlInitUnicodeString
RtlInitUnicodeStringEx
RtlInitializeCriticalSection
RtlInitializeCriticalSectionAndSpinCount
RtlInitializeHandleTable
RtlIntegerToChar
RtlIntegerToUnicodeString
RtlIsDosDeviceName_U
RtlIsNameLegalDOS8Dot3
RtlIsTextUnicode
RtlIsValidHandle
RtlLeaveCriticalSection
RtlLengthSid
RtlLockHeap
RtlLookupAtomInAtomTable
RtlMultiByteToUnicodeN
RtlNtStatusToDosError
RtlOemStringToUnicodeString
RtlOemToUnicodeN
RtlOpenCurrentUser
RtlPcToFileHeader
RtlPrefixUnicodeString
RtlQueryAtomInAtomTable
RtlQueryEnvironmentVariable_U
RtlQueryHeapInformation
RtlQueryInformationActivationContext
RtlQueryProcessDebugInformation
RtlQueryRegistryValues
RtlQueryTagHeap
RtlQueueWorkItem
RtlRaiseException
RtlRaiseStatus
RtlReAllocateHeap
RtlRegisterWait
RtlReleaseActivationContext
RtlReleasePebLock
RtlReleasePrivilege
RtlReleaseRelativeName
RtlSetCurrentDirectory_U
RtlSetDaclSecurityDescriptor
RtlSetEnvironmentVariable
RtlSetHeapInformation
RtlSetIoCompletionCallback
RtlSetThreadErrorMode
RtlSetThreadPoolStartFunc
RtlSetTimeZoneInformation
RtlSetUserValueHeap
RtlSizeHeap
RtlTimeFieldsToTime
RtlTimeToTimeFields
RtlUnicodeStringToAnsiString
RtlUnicodeStringToInteger
RtlUnicodeStringToOemString
RtlUnicodeToMultiByteN
RtlUnicodeToMultiByteSize
RtlUnicodeToOemN
RtlUnlockHeap
RtlUnwind
RtlUpcaseUnicodeChar
RtlUpcaseUnicodeString
RtlUpdateTimer
RtlValidateHeap
RtlVerifyVersionInfo
RtlWalkHeap
RtlWow64EnableFsRedirection
RtlWow64EnableFsRedirectionEx
RtlZombifyActivationContext
RtlxAnsiStringToUnicodeSize
RtlxOemStringToUnicodeSize
RtlxUnicodeStringToAnsiSize
RtlxUnicodeStringToOemSize
_snwprintf
_strcmpi
_vsnwprintf
_wcsicmp
_wcsnicmp
_wtoi
bsearch
isalpha
islower
iswctype
memcmp
memcpy
memmove
memset
qsort
sprintf
strcat
strchr
strcpy
strncmp
strncpy
strpbrk
strrchr
swprintf
tolower
toupper
towlower
towupper
wcscat
wcschr
wcscmp
wcscpy
wcscspn
wcslen
wcsncmp
wcsncpy
wcsrchr
wcsstr
wcstol
wcstoul

Exports

Exports

ActivateActCtx
AddAtomA
AddAtomW
AddConsoleAliasA
AddConsoleAliasW
AddLocalAlternateComputerNameA
AddLocalAlternateComputerNameW
AddRefActCtx
AddVectoredContinueHandler
AddVectoredExceptionHandler
AllocConsole
AllocateUserPhysicalPages
AreFileApisANSI
AssignProcessToJobObject
AttachConsole
BackupRead
BackupSeek
BackupWrite
BaseCheckAppcompatCache
BaseCheckRunApp
BaseCleanupAppcompatCacheSupport
BaseDumpAppcompatCache
BaseFlushAppcompatCache
BaseInitAppcompatCacheSupport
BaseIsAppcompatInfrastructureDisabled
BaseProcessInitPostImport
BaseQueryModuleData
BaseUpdateAppcompatCache
BasepCheckBadapp
BasepCheckWinSaferRestrictions
BasepFreeAppCompatData
Beep
BeginUpdateResourceA
BeginUpdateResourceW
BindIoCompletionCallback
BuildCommDCBA
BuildCommDCBAndTimeoutsA
BuildCommDCBAndTimeoutsW
BuildCommDCBW
CallNamedPipeA
CallNamedPipeW
CancelDeviceWakeupRequest
CancelIo
CancelTimerQueueTimer
CancelWaitableTimer
ChangeTimerQueueTimer
CheckNameLegalDOS8Dot3A
CheckNameLegalDOS8Dot3W
CheckRemoteDebuggerPresent
ClearCommBreak
ClearCommError
CloseConsoleHandle
CloseHandle
CloseProfileUserMapping
CmdBatNotification
CommConfigDialogA
CommConfigDialogW
CompareFileTime
CompareStringA
CompareStringW
ConnectNamedPipe
ConsoleMenuControl
ContinueDebugEvent
ConvertDefaultLocale
ConvertFiberToThread
ConvertThreadToFiber
ConvertThreadToFiberEx
CopyFileA
CopyFileExA
CopyFileExW
CopyFileW
CopyLZFile
CreateActCtxA
CreateActCtxW
CreateConsoleScreenBuffer
CreateDirectoryA
CreateDirectoryExA
CreateDirectoryExW
CreateDirectoryW
CreateEventA
CreateEventW
CreateFiber
CreateFiberEx
CreateFileA
CreateFileMappingA
CreateFileMappingW
CreateFileW
CreateHardLinkA
CreateHardLinkW
CreateIoCompletionPort
CreateJobObjectA
CreateJobObjectW
CreateJobSet
CreateMailslotA
CreateMailslotW
CreateMemoryResourceNotification
CreateMutexA
CreateMutexW
CreateNamedPipeA
CreateNamedPipeW
CreateNlsSecurityDescriptor
CreatePipe
CreateProcessA
CreateProcessInternalA
CreateProcessInternalW
CreateProcessW
CreateRemoteThread
CreateSemaphoreA
CreateSemaphoreW
CreateSocketHandle
CreateTapePartition
CreateThread
CreateTimerQueue
CreateTimerQueueTimer
CreateToolhelp32Snapshot
CreateWaitableTimerA
CreateWaitableTimerW
DeactivateActCtx
DebugActiveProcess
DebugActiveProcessStop
DebugBreak
DebugBreakProcess
DebugSetProcessKillOnExit
DecodePointer
DecodeSystemPointer
DefineDosDeviceA
DefineDosDeviceW
DelayLoadFailureHook
DeleteAtom
DeleteCriticalSection
DeleteFiber
DeleteFileA
DeleteFileW
DeleteTimerQueue
DeleteTimerQueueEx
DeleteTimerQueueTimer
DeleteVolumeMountPointA
DeleteVolumeMountPointW
DeviceIoControl
DisableThreadLibraryCalls
DisconnectNamedPipe
DnsHostnameToComputerNameA
DnsHostnameToComputerNameW
DosDateTimeToFileTime
DosPathToSessionPathA
DosPathToSessionPathW
DuplicateConsoleHandle
DuplicateHandle
EncodePointer
EncodeSystemPointer
EndUpdateResourceA
EndUpdateResourceW
EnterCriticalSection
EnumCalendarInfoA
EnumCalendarInfoExA
EnumCalendarInfoExW
EnumCalendarInfoW
EnumDateFormatsA
EnumDateFormatsExA
EnumDateFormatsExW
EnumDateFormatsW
EnumLanguageGroupLocalesA
EnumLanguageGroupLocalesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceNamesA
EnumResourceNamesW
EnumResourceTypesA
EnumResourceTypesW
EnumSystemCodePagesA
EnumSystemCodePagesW
EnumSystemFirmwareTables
EnumSystemGeoID
EnumSystemLanguageGroupsA
EnumSystemLanguageGroupsW
EnumSystemLocalesA
EnumSystemLocalesW
EnumTimeFormatsA
EnumTimeFormatsW
EnumUILanguagesA
EnumUILanguagesW
EnumerateLocalComputerNamesA
EnumerateLocalComputerNamesW
EraseTape
EscapeCommFunction
ExitProcess
ExitThread
ExitVDM
ExpandEnvironmentStringsA
ExpandEnvironmentStringsW
ExpungeConsoleCommandHistoryA
ExpungeConsoleCommandHistoryW
FatalAppExitA
FatalAppExitW
FatalExit
FileTimeToDosDateTime
FileTimeToLocalFileTime
FileTimeToSystemTime
FillConsoleOutputAttribute
FillConsoleOutputCharacterA
FillConsoleOutputCharacterW
FindActCtxSectionGuid
FindActCtxSectionStringA
FindActCtxSectionStringW
FindAtomA
FindAtomW
FindClose
FindCloseChangeNotification
FindFirstChangeNotificationA
FindFirstChangeNotificationW
FindFirstFileA
FindFirstFileExA
FindFirstFileExW
FindFirstFileW
FindFirstStreamW
FindFirstVolumeA
FindFirstVolumeMountPointA
FindFirstVolumeMountPointW
FindFirstVolumeW
FindNextChangeNotification
FindNextFileA
FindNextFileW
FindNextStreamW
FindNextVolumeA
FindNextVolumeMountPointA
FindNextVolumeMountPointW
FindNextVolumeW
FindResourceA
FindResourceExA
FindResourceExW
FindResourceW
FindVolumeClose
FindVolumeMountPointClose
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushConsoleInputBuffer
FlushFileBuffers
FlushInstructionCache
FlushViewOfFile
FoldStringA
FoldStringW
FormatMessageA
FormatMessageW
FreeConsole
FreeEnvironmentStringsA
FreeEnvironmentStringsW
FreeLibrary
FreeLibraryAndExitThread
FreeResource
FreeUserPhysicalPages
GenerateConsoleCtrlEvent
GetACP
GetAtomNameA
GetAtomNameW
GetBinaryType
GetBinaryTypeA
GetBinaryTypeW
GetCPFileNameFromRegistry
GetCPInfo
GetCPInfoExA
GetCPInfoExW
GetCalendarInfoA
GetCalendarInfoW
GetComPlusPackageInstallStatus
GetCommConfig
GetCommMask
GetCommModemStatus
GetCommProperties
GetCommState
GetCommTimeouts
GetCommandLineA
GetCommandLineW
GetCompressedFileSizeA
GetCompressedFileSizeW
GetComputerNameA
GetComputerNameExA
GetComputerNameExW
GetComputerNameW
GetConsoleAliasA
GetConsoleAliasExesA
GetConsoleAliasExesLengthA
GetConsoleAliasExesLengthW
GetConsoleAliasExesW
GetConsoleAliasW
GetConsoleAliasesA
GetConsoleAliasesLengthA
GetConsoleAliasesLengthW
GetConsoleAliasesW
GetConsoleCP
GetConsoleCharType
GetConsoleCommandHistoryA
GetConsoleCommandHistoryLengthA
GetConsoleCommandHistoryLengthW
GetConsoleCommandHistoryW
GetConsoleCursorInfo
GetConsoleCursorMode
GetConsoleDisplayMode
GetConsoleFontInfo
GetConsoleFontSize
GetConsoleHardwareState
GetConsoleInputExeNameA
GetConsoleInputExeNameW
GetConsoleInputWaitHandle
GetConsoleKeyboardLayoutNameA
GetConsoleKeyboardLayoutNameW
GetConsoleMode
GetConsoleNlsMode
GetConsoleOutputCP
GetConsoleProcessList
GetConsoleScreenBufferInfo
GetConsoleSelectionInfo
GetConsoleTitleA
GetConsoleTitleW
GetConsoleWindow
GetCurrencyFormatA
GetCurrencyFormatW
GetCurrentActCtx
GetCurrentConsoleFont
GetCurrentDirectoryA
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentProcessorNumber
GetCurrentThread
GetCurrentThreadId
GetDateFormatA
GetDateFormatW
GetDefaultCommConfigA
GetDefaultCommConfigW
GetDefaultSortkeySize
GetDevicePowerState
GetDiskFreeSpaceA
GetDiskFreeSpaceExA
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetDllDirectoryA
GetDllDirectoryW
GetDriveTypeA
GetDriveTypeW
GetEnvironmentStrings
GetEnvironmentStringsA
GetEnvironmentStringsW
GetEnvironmentVariableA
GetEnvironmentVariableW
GetExitCodeProcess
GetExitCodeThread
GetExpandedNameA
GetExpandedNameW
GetFileAttributesA
GetFileAttributesExA
GetFileAttributesExW
GetFileAttributesW
GetFileInformationByHandle
GetFileSize
GetFileSizeEx
GetFileTime
GetFileType
GetFirmwareEnvironmentVariableA
GetFirmwareEnvironmentVariableW
GetFullPathNameA
GetFullPathNameW
GetGeoInfoA
GetGeoInfoW
GetHandleContext
GetHandleInformation
GetLargePageMinimum
GetLargestConsoleWindowSize
GetLastError
GetLinguistLangSize
GetLocalTime
GetLocaleInfoA
GetLocaleInfoW
GetLogicalDriveStringsA
GetLogicalDriveStringsW
GetLogicalDrives
GetLogicalProcessorInformation
GetLongPathNameA
GetLongPathNameW
GetMailslotInfo
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExA
GetModuleHandleExW
GetModuleHandleW
GetNLSVersion
GetNLSVersionEx
GetNamedPipeHandleStateA
GetNamedPipeHandleStateW
GetNamedPipeInfo
GetNativeSystemInfo
GetNextVDMCommand
GetNlsSectionName
GetNumaAvailableMemoryNode
GetNumaHighestNodeNumber
GetNumaNodeProcessorMask
GetNumaProcessorNode
GetNumberFormatA
GetNumberFormatW
GetNumberOfConsoleFonts
GetNumberOfConsoleInputEvents
GetNumberOfConsoleMouseButtons
GetOEMCP
GetOverlappedResult
GetPriorityClass
GetPrivateProfileIntA
GetPrivateProfileIntW
GetPrivateProfileSectionA
GetPrivateProfileSectionNamesA
GetPrivateProfileSectionNamesW
GetPrivateProfileSectionW
GetPrivateProfileStringA
GetPrivateProfileStringW
GetPrivateProfileStructA
GetPrivateProfileStructW
GetProcAddress
GetProcessAffinityMask
GetProcessHandleCount
GetProcessHeap
GetProcessHeaps
GetProcessId
GetProcessIdOfThread
GetProcessIoCounters
GetProcessPriorityBoost
GetProcessShutdownParameters
GetProcessTimes
GetProcessVersion
GetProcessWorkingSetSize
GetProcessWorkingSetSizeEx
GetProfileIntA
GetProfileIntW
GetProfileSectionA
GetProfileSectionW
GetProfileStringA
GetProfileStringW
GetQueuedCompletionStatus
GetShortPathNameA
GetShortPathNameW
GetStartupInfoA
GetStartupInfoW
GetStdHandle
GetStringTypeA
GetStringTypeExA
GetStringTypeExW
GetStringTypeW
GetSystemDefaultLCID
GetSystemDefaultLangID
GetSystemDefaultUILanguage
GetSystemDirectoryA
GetSystemDirectoryW
GetSystemFileCacheSize
GetSystemFirmwareTable
GetSystemInfo
GetSystemPowerStatus
GetSystemRegistryQuota
GetSystemTime
GetSystemTimeAdjustment
GetSystemTimeAsFileTime
GetSystemTimes
GetSystemWindowsDirectoryA
GetSystemWindowsDirectoryW
GetSystemWow64DirectoryA
GetSystemWow64DirectoryW
GetTapeParameters
GetTapePosition
GetTapeStatus
GetTempFileNameA
GetTempFileNameW
GetTempPathA
GetTempPathW
GetThreadContext
GetThreadIOPendingFlag
GetThreadId
GetThreadLocale
GetThreadPriority
GetThreadPriorityBoost
GetThreadSelectorEntry
GetThreadTimes
GetTickCount
GetTimeFormatA
GetTimeFormatW
GetTimeZoneInformation
GetUserDefaultLCID
GetUserDefaultLangID
GetUserDefaultUILanguage
GetUserGeoID
GetVDMCurrentDirectories
GetVersion
GetVersionExA
GetVersionExW
GetVolumeInformationA
GetVolumeInformationW
GetVolumeNameForVolumeMountPointA
GetVolumeNameForVolumeMountPointW
GetVolumePathNameA
GetVolumePathNameW
GetVolumePathNamesForVolumeNameA
GetVolumePathNamesForVolumeNameW

Sections

.text
Size: 334KB - Virtual size: 333KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 182KB - Virtual size: 182KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 15KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rossym
Size: 509KB - Virtual size: 508KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2ac20ea710233153cb8e72b5b3e0b9c1

Headers

File Characteristics

Imports

ntdll

Exports

Exports

Sections

.text Size: 334KB - Virtual size: 333KB

.data Size: 1KB - Virtual size: 1KB

.rdata Size: 182KB - Virtual size: 182KB

.bss Size: - Virtual size: 15KB

.edata Size: 28KB - Virtual size: 28KB

.idata Size: 12KB - Virtual size: 12KB

.rsrc Size: 1.8MB - Virtual size: 1.8MB

.reloc Size: 12KB - Virtual size: 12KB

.rossym Size: 509KB - Virtual size: 508KB

.text
Size: 334KB - Virtual size: 333KB

.data
Size: 1KB - Virtual size: 1KB

.rdata
Size: 182KB - Virtual size: 182KB

.bss
Size: - Virtual size: 15KB

.edata
Size: 28KB - Virtual size: 28KB

.idata
Size: 12KB - Virtual size: 12KB

.rsrc
Size: 1.8MB - Virtual size: 1.8MB

.reloc
Size: 12KB - Virtual size: 12KB

.rossym
Size: 509KB - Virtual size: 508KB