44aeb0d62298c8610c035ecf83bf340bd1ecbfd081dbbd37e7b3da1d9175e7d7

Sharing

Copy URL Twitter E-mail

General

Target

44aeb0d62298c8610c035ecf83bf340bd1ecbfd081dbbd37e7b3da1d9175e7d7
Size

3.4MB
MD5

49c28e1343bd2558987555723bc45f29
SHA1

0a13ba0454532d7e97eeea838d174a0349e00b34
SHA256

44aeb0d62298c8610c035ecf83bf340bd1ecbfd081dbbd37e7b3da1d9175e7d7
SHA512

3dfc8e1d52e2828a4fe2f9c3c6e9ce3a01a8117b06b28299ab0b9b04ae9c49c2aab6a34f63bc92bd804c32fe10caab3d09108d65390d0f0922ffb43e9b354e85
SSDEEP

24576:bWKR0dEzsrdvtOLX4iBKxooV+riGqYBv8pebqE8O1:BLzsrdvtOLX4Fgv80bM+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
44aeb0d62298c8610c035ecf83bf340bd1ecbfd081dbbd37e7b3da1d9175e7d7

Files

44aeb0d62298c8610c035ecf83bf340bd1ecbfd081dbbd37e7b3da1d9175e7d7
.dll windows:4 windows x86

1cb8b68770af551c169bee20790a354c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernelbase

ActivateActCtx
AddDllDirectory
AddRefActCtx
AllocConsole
AllocateUserPhysicalPages
AllocateUserPhysicalPagesNuma
AreFileApisANSI
AttachConsole
BaseFlushAppcompatCache
BaseGetNamedObjectDirectory
Beep
CallNamedPipeW
CallbackMayRunLong
CancelIo
CancelIoEx
CancelSynchronousIo
CancelWaitableTimer
ChangeTimerQueueTimer
CheckRemoteDebuggerPresent
ClearCommBreak
ClearCommError
CloseHandle
ClosePseudoConsole
CompareFileTime
CompareStringA
CompareStringEx
CompareStringOrdinal
CompareStringW
ConnectNamedPipe
ContinueDebugEvent
ConvertDefaultLocale
ConvertFiberToThread
ConvertThreadToFiber
ConvertThreadToFiberEx
CopyContext
CopyFileExW
CopyFileW
CreateActCtxW
CreateConsoleScreenBuffer
CreateDirectoryA
CreateDirectoryExW
CreateDirectoryW
CreateEventA
CreateEventExA
CreateEventExW
CreateEventW
CreateFiber
CreateFiberEx
CreateFile2
CreateFileA
CreateFileMappingNumaW
CreateFileMappingW
CreateFileW
CreateHardLinkA
CreateHardLinkW
CreateIoCompletionPort
CreateMemoryResourceNotification
CreateMutexA
CreateMutexExA
CreateMutexExW
CreateMutexW
CreateNamedPipeW
CreatePipe
CreateProcessA
CreateProcessAsUserA
CreateProcessAsUserW
CreateProcessInternalA
CreateProcessInternalW
CreateProcessW
CreatePseudoConsole
CreateRemoteThread
CreateRemoteThreadEx
CreateSemaphoreExW
CreateSemaphoreW
CreateSymbolicLinkW
CreateThread
CreateThreadpool
CreateThreadpoolCleanupGroup
CreateThreadpoolIo
CreateThreadpoolTimer
CreateThreadpoolWait
CreateThreadpoolWork
CreateTimerQueue
CreateTimerQueueTimer
CreateWaitableTimerExW
CreateWaitableTimerW
DeactivateActCtx
DebugActiveProcess
DebugActiveProcessStop
DebugBreak
DefineDosDeviceW
DelayLoadFailureHook
DeleteFiber
DeleteFileA
DeleteFileW
DeleteProcThreadAttributeList
DeleteTimerQueueEx
DeleteTimerQueueTimer
DeleteVolumeMountPointW
DisableThreadLibraryCalls
DisconnectNamedPipe
DnsHostnameToComputerNameExW
DuplicateHandle
EnterCriticalSection
EnumCalendarInfoExEx
EnumCalendarInfoExW
EnumCalendarInfoW
EnumDateFormatsExEx
EnumDateFormatsExW
EnumDateFormatsW
EnumLanguageGroupLocalesW
EnumResourceLanguagesExA
EnumResourceLanguagesExW
EnumResourceNamesExA
EnumResourceNamesExW
EnumResourceNamesW
EnumResourceTypesExA
EnumResourceTypesExW
EnumSystemCodePagesW
EnumSystemFirmwareTables
EnumSystemGeoID
EnumSystemLanguageGroupsW
EnumSystemLocalesA
EnumSystemLocalesEx
EnumSystemLocalesW
EnumTimeFormatsEx
EnumTimeFormatsW
EnumUILanguagesW
EscapeCommFunction
ExitThread
ExpandEnvironmentStringsA
ExpandEnvironmentStringsW
FatalAppExitA
FatalAppExitW
FileTimeToLocalFileTime
FileTimeToSystemTime
FillConsoleOutputAttribute
FillConsoleOutputCharacterA
FillConsoleOutputCharacterW
FindActCtxSectionGuid
FindActCtxSectionStringW
FindClose
FindCloseChangeNotification
FindFirstChangeNotificationA
FindFirstChangeNotificationW
FindFirstFileA
FindFirstFileExA
FindFirstFileExW
FindFirstFileW
FindFirstStreamW
FindFirstVolumeW
FindNLSString
FindNLSStringEx
FindNextChangeNotification
FindNextFileA
FindNextFileW
FindNextStreamW
FindNextVolumeW
FindResourceExW
FindResourceW
FindStringOrdinal
FindVolumeClose
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushConsoleInputBuffer
FlushFileBuffers
FlushInstructionCache
FlushViewOfFile
FoldStringW
FormatMessageA
FormatMessageW
FreeConsole
FreeEnvironmentStringsA
FreeEnvironmentStringsW
FreeLibrary
FreeResource
FreeUserPhysicalPages
GenerateConsoleCtrlEvent
GetACP
GetApplicationRestartSettings
GetCPInfo
GetCPInfoExW
GetCalendarInfoEx
GetCalendarInfoW
GetCommConfig
GetCommMask
GetCommModemStatus
GetCommProperties
GetCommState
GetCommTimeouts
GetCommandLineA
GetCommandLineW
GetCompressedFileSizeA
GetCompressedFileSizeW
GetComputerNameExA
GetComputerNameExW
GetConsoleCP
GetConsoleCursorInfo
GetConsoleInputExeNameA
GetConsoleInputExeNameW
GetConsoleMode
GetConsoleOutputCP
GetConsoleScreenBufferInfo
GetConsoleScreenBufferInfoEx
GetConsoleTitleW
GetCurrentActCtx
GetCurrentDirectoryA
GetCurrentDirectoryW
GetCurrentThreadStackLimits
GetDiskFreeSpaceA
GetDiskFreeSpaceExA
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetDriveTypeA
GetDriveTypeW
GetDynamicTimeZoneInformation
GetDynamicTimeZoneInformationEffectiveYears
GetEnabledXStateFeatures
GetEnvironmentStrings
GetEnvironmentStringsA
GetEnvironmentStringsW
GetEnvironmentVariableA
GetEnvironmentVariableW
GetErrorMode
GetExitCodeThread
GetFileAttributesA
GetFileAttributesExA
GetFileAttributesExW
GetFileAttributesW
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFileMUIInfo
GetFileMUIPath
GetFileSize
GetFileSizeEx
GetFileTime
GetFileType
GetFinalPathNameByHandleA
GetFinalPathNameByHandleW
GetFullPathNameA
GetFullPathNameW
GetGeoInfoW
GetHandleInformation
GetLargePageMinimum
GetLargestConsoleWindowSize
GetLastError
GetLocalTime
GetLocaleInfoA
GetLocaleInfoEx
GetLocaleInfoW
GetLogicalDriveStringsW
GetLogicalDrives
GetLogicalProcessorInformation
GetLogicalProcessorInformationEx
GetLongPathNameA
GetLongPathNameW
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExA
GetModuleHandleExW
GetModuleHandleW
GetNLSVersion
GetNLSVersionEx
GetNamedPipeHandleStateW
GetNamedPipeInfo
GetNativeSystemInfo
GetNumaHighestNodeNumber
GetNumaNodeProcessorMaskEx
GetNumaProximityNodeEx
GetNumberOfConsoleInputEvents
GetOEMCP
GetOverlappedResult
GetOverlappedResultEx
GetPhysicallyInstalledSystemMemory
GetPriorityClass
GetProcessHandleCount
GetProcessHeap
GetProcessId
GetProcessIdOfThread
GetProcessMitigationPolicy
GetProcessPreferredUILanguages
GetProcessPriorityBoost
GetProcessShutdownParameters
GetProcessTimes
GetProcessVersion
GetProcessWorkingSetSizeEx
GetProductInfo
GetQueuedCompletionStatus
GetQueuedCompletionStatusEx
GetShortPathNameW
GetStartupInfoW
GetStdHandle
GetStringTypeA
GetStringTypeExW
GetStringTypeW
GetSystemDefaultLCID
GetSystemDefaultLangID
GetSystemDefaultLocaleName
GetSystemDefaultUILanguage
GetSystemFileCacheSize
GetSystemFirmwareTable
GetSystemInfo
GetSystemPreferredUILanguages
GetSystemTime
GetSystemTimeAdjustment
GetSystemTimeAsFileTime
GetSystemTimePreciseAsFileTime
GetSystemTimes
GetSystemWindowsDirectoryA
GetSystemWindowsDirectoryW
GetSystemWow64DirectoryA
GetSystemWow64DirectoryW
GetTempFileNameA
GetTempFileNameW
GetTempPathA
GetTempPathW
GetThreadContext
GetThreadDescription
GetThreadErrorMode
GetThreadGroupAffinity
GetThreadIOPendingFlag
GetThreadId
GetThreadIdealProcessorEx
GetThreadLocale
GetThreadPreferredUILanguages
GetThreadPriority
GetThreadPriorityBoost
GetThreadTimes
GetThreadUILanguage
GetTimeZoneInformation
GetTimeZoneInformationForYear
GetUserDefaultLCID
GetUserDefaultLangID
GetUserDefaultLocaleName
GetUserDefaultUILanguage
GetUserGeoID
GetUserPreferredUILanguages
GetVersion
GetVersionExA
GetVersionExW
GetVolumeInformationA
GetVolumeInformationByHandleW
GetVolumeInformationW
GetVolumeNameForVolumeMountPointW
GetVolumePathNameW
GetVolumePathNamesForVolumeNameW
GetWindowsDirectoryA
GetWindowsDirectoryW
GetWriteWatch
GetXStateFeaturesMask
GlobalAlloc
GlobalFree
GlobalMemoryStatusEx
HeapAlloc
HeapCompact
HeapFree
HeapLock
HeapQueryInformation
HeapReAlloc
HeapSetInformation
HeapSize
HeapUnlock
HeapValidate
HeapWalk
IdnToAscii
IdnToNameprepUnicode
IdnToUnicode
InitializeContext2
InitializeContext
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
InitializeProcThreadAttributeList
Internal_EnumCalendarInfo
Internal_EnumDateFormats
Internal_EnumLanguageGroupLocales
Internal_EnumSystemCodePages
Internal_EnumSystemLanguageGroups
Internal_EnumTimeFormats
Internal_EnumUILanguages
IsDBCSLeadByte
IsDBCSLeadByteEx
IsDebuggerPresent
IsNormalizedString
IsProcessInJob
IsProcessorFeaturePresent
IsThreadAFiber
IsValidCodePage
IsValidLanguageGroup
IsValidLocale
IsValidLocaleName
IsValidNLSVersion
IsWow64Process2
IsWow64Process
K32EmptyWorkingSet
K32EnumDeviceDrivers
K32EnumPageFilesA
K32EnumPageFilesW
K32EnumProcessModules
K32EnumProcessModulesEx
K32EnumProcesses
K32GetDeviceDriverBaseNameA
K32GetDeviceDriverBaseNameW
K32GetDeviceDriverFileNameA
K32GetDeviceDriverFileNameW
K32GetMappedFileNameA
K32GetMappedFileNameW
K32GetModuleBaseNameA
K32GetModuleBaseNameW
K32GetModuleFileNameExA
K32GetModuleFileNameExW
K32GetModuleInformation
K32GetPerformanceInfo
K32GetProcessImageFileNameA
K32GetProcessImageFileNameW
K32GetProcessMemoryInfo
K32GetWsChanges
K32GetWsChangesEx
K32InitializeProcessForWsWatch
K32QueryWorkingSet
K32QueryWorkingSetEx
LCIDToLocaleName
LCMapStringA
LCMapStringEx
LCMapStringW
LeaveCriticalSection
LoadAppInitDlls
LoadLibraryA
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
LoadPackagedLibrary
LoadResource
LocalAlloc
LocalFileTimeToFileTime
LocalFree
LocalLock
LocalReAlloc
LocalUnlock
LocaleNameToLCID
LocateXStateFeature
LockFile
LockFileEx
LockResource
MapUserPhysicalPages
MapViewOfFile
MapViewOfFileEx
MapViewOfFileExNuma
MoveFileExW
MoveFileWithProgressW
MultiByteToWideChar
NeedCurrentDirectoryForExePathA
NeedCurrentDirectoryForExePathW
NormalizeString
OpenEventA
OpenEventW
OpenFileById
OpenFileMappingW
OpenMutexW
OpenProcess
OpenProcessToken
OpenSemaphoreW
OpenThread
OpenThreadToken
OpenWaitableTimerW
OutputDebugStringW
PathFindFileNameW
PeekConsoleInputA
PeekConsoleInputW
PeekNamedPipe
PostQueuedCompletionStatus
ProcessIdToSessionId
PulseEvent
PurgeComm
QueryActCtxSettingsW
QueryActCtxW
QueryDosDeviceW
QueryFullProcessImageNameA
QueryFullProcessImageNameW
QueryMemoryResourceNotification
QueryPerformanceCounter
QueryPerformanceFrequency
QueryProcessCycleTime
QueryThreadCycleTime
QueryThreadpoolStackInformation
QueryUnbiasedInterruptTime
QueueUserAPC
QueueUserWorkItem
RaiseException
ReOpenFile
ReadConsoleA
ReadConsoleInputA
ReadConsoleInputW
ReadConsoleOutputA
ReadConsoleOutputAttribute
ReadConsoleOutputCharacterA
ReadConsoleOutputCharacterW
ReadConsoleOutputW

ntdll

DbgUiIssueRemoteBreakin
LdrFindEntryForAddress
LdrGetDllDirectory
LdrGetProcedureAddress
LdrSetDllDirectory
NtAddAtom
NtAssignProcessToJobObject
NtClearPowerRequest
NtCreateJobObject
NtCreateMailslotFile
NtCreatePowerRequest
NtCreateSection
NtCreateSemaphore
NtDeleteAtom
NtDeviceIoControlFile
NtFindAtom
NtFsControlFile
NtGetContextThread
NtOpenJobObject
NtPowerInformation
NtProtectVirtualMemory
NtQueryInformationAtom
NtQueryInformationFile
NtQueryInformationJobObject
NtQueryInformationProcess
NtQueryInformationThread
NtQuerySection
NtQuerySystemInformation
NtQuerySystemTime
NtSetContextThread
NtSetInformationFile
NtSetInformationJobObject
NtSetInformationProcess
NtSetInformationThread
NtSetPowerRequest
NtSetThreadExecutionState
NtTerminateJobObject
RtlAcquirePebLock
RtlAddAtomToAtomTable
RtlAllocateHeap
RtlAnsiStringToUnicodeString
RtlCharToInteger
RtlCreateAtomTable
RtlCreateHeap
RtlCreateUnicodeString
RtlCreateUnicodeStringFromAsciiz
RtlDeleteAtomFromAtomTable
RtlDeleteCriticalSection
RtlDeregisterWait
RtlDestroyAtomTable
RtlDestroyHeap
RtlDetermineDosPathNameType_U
RtlDosPathNameToNtPathName_U
RtlDosPathNameToNtPathName_U_WithStatus
RtlEnterCriticalSection
RtlExitUserProcess
RtlExitUserThread
RtlFreeHeap
RtlFreeUnicodeString
RtlGetCurrentPeb
RtlGetProcessHeaps
RtlImageDirectoryEntryToData
RtlImageNtHeader
RtlInitAnsiString
RtlInitUnicodeString
RtlInitializeCriticalSection
RtlIsNameLegalDOS8Dot3
RtlIsTextUnicode
RtlLeaveCriticalSection
RtlLockHeap
RtlLookupAtomInAtomTable
RtlNtStatusToDosError
RtlOemStringToUnicodeString
RtlQueryAtomInAtomTable
RtlReleasePebLock
RtlSetIoCompletionCallback
RtlSetLastWin32Error
RtlSetSearchPathMode
RtlSetUnhandledExceptionFilter
RtlTimeFieldsToTime
RtlTimeToTimeFields
RtlUnicodeStringToAnsiSize
RtlUnicodeStringToAnsiString
RtlUnicodeStringToInteger
RtlUnicodeStringToOemSize
RtlUnicodeStringToOemString
RtlUnicodeToMultiByteN
RtlUnicodeToMultiByteSize
RtlUnicodeToOemN
RtlUnlockHeap
RtlUnwind
RtlUpcaseUnicodeString
RtlUpperChar
RtlWow64EnableFsRedirection
__wine_dbg_header
__wine_dbg_output
__wine_dbg_strdup
_vsnprintf
_vsnwprintf
_wcsicmp
_wcsnicmp
isalpha
islower
memcpy
memmove
memset
strcat
strchr
strcpy
strlen
strpbrk
strrchr
tolower
wcscat
wcschr
wcscmp
wcscpy
wcsncmp
wcsrchr
wcstoul
wine_nt_to_unix_file_name
wine_server_call
wine_unix_to_nt_file_name

Exports

Exports

AcquireSRWLockExclusive
AcquireSRWLockShared
ActivateActCtx
AddAtomA
AddAtomW
AddConsoleAliasA
AddConsoleAliasW
AddDllDirectory
AddRefActCtx
AddVectoredContinueHandler
AddVectoredExceptionHandler
AllocConsole
AllocLSCallback
AllocSLCallback
AllocateUserPhysicalPages
AllocateUserPhysicalPagesNuma
ApplicationRecoveryFinished
ApplicationRecoveryInProgress
AreFileApisANSI
AssignProcessToJobObject
AttachConsole
BackupRead
BackupSeek
BackupWrite
BaseAttachCompleteThunk
BaseCheckAppcompatCache
BaseCleanupAppcompatCache
BaseCleanupAppcompatCacheSupport
BaseDumpAppcompatCache
BaseFlushAppcompatCache
BaseGetNamedObjectDirectory
BaseInitAppcompatCache
BaseInitAppcompatCacheSupport
BaseProcessInitPostImport
BaseThreadInitThunk
BaseUpdateAppcompatCache
BasepDebugDump
Beep
BeginUpdateResourceA
BeginUpdateResourceW
BindIoCompletionCallback
BuildCommDCBA
BuildCommDCBAndTimeoutsA
BuildCommDCBAndTimeoutsW
BuildCommDCBW
CallNamedPipeA
CallNamedPipeW
CallbackMayRunLong
CancelDeviceWakeupRequest
CancelIo
CancelIoEx
CancelSynchronousIo
CancelThreadpoolIo
CancelTimerQueueTimer
CancelWaitableTimer
ChangeTimerQueueTimer
CheckNameLegalDOS8Dot3A
CheckNameLegalDOS8Dot3W
CheckRemoteDebuggerPresent
ClearCommBreak
ClearCommError
CloseConsoleHandle
CloseHandle
CloseProfileUserMapping
ClosePseudoConsole
CloseSystemHandle
CloseThreadpool
CloseThreadpoolCleanupGroup
CloseThreadpoolCleanupGroupMembers
CloseThreadpoolIo
CloseThreadpoolTimer
CloseThreadpoolWait
CloseThreadpoolWork
CmdBatNotification
CommConfigDialogA
CommConfigDialogW
CompareFileTime
CompareStringA
CompareStringEx
CompareStringOrdinal
CompareStringW
ConnectNamedPipe
ConsoleMenuControl
ConsoleSubst
ContinueDebugEvent
ConvertDefaultLocale
ConvertFiberToThread
ConvertThreadToFiber
ConvertThreadToFiberEx
ConvertToGlobalHandle
CopyContext
CopyFileA
CopyFileExA
CopyFileExW
CopyFileW
CopyLZFile
CreateActCtxA
CreateActCtxW
CreateConsoleScreenBuffer
CreateDirectoryA
CreateDirectoryExA
CreateDirectoryExW
CreateDirectoryW
CreateEventA
CreateEventExA
CreateEventExW
CreateEventW
CreateFiber
CreateFiberEx
CreateFile2
CreateFileA
CreateFileMappingA
CreateFileMappingNumaW
CreateFileMappingW
CreateFileW
CreateHardLinkA
CreateHardLinkTransactedA
CreateHardLinkTransactedW
CreateHardLinkW
CreateIoCompletionPort
CreateJobObjectA
CreateJobObjectW
CreateKernelThread
CreateMailslotA
CreateMailslotW
CreateMemoryResourceNotification
CreateMutexA
CreateMutexExA
CreateMutexExW
CreateMutexW
CreateNamedPipeA
CreateNamedPipeW
CreatePipe
CreateProcessA
CreateProcessAsUserA
CreateProcessAsUserW
CreateProcessInternalA
CreateProcessInternalW
CreateProcessW
CreatePseudoConsole
CreateRemoteThread
CreateRemoteThreadEx
CreateSemaphoreA
CreateSemaphoreExA
CreateSemaphoreExW
CreateSemaphoreW
CreateSocketHandle
CreateSymbolicLinkA
CreateSymbolicLinkW
CreateTapePartition
CreateThread
CreateThreadpool
CreateThreadpoolCleanupGroup
CreateThreadpoolIo
CreateThreadpoolTimer
CreateThreadpoolWait
CreateThreadpoolWork
CreateTimerQueue
CreateTimerQueueTimer
CreateToolhelp32Snapshot
CreateVirtualBuffer
CreateWaitableTimerA
CreateWaitableTimerExA
CreateWaitableTimerExW
CreateWaitableTimerW
CtrlRoutine
DeactivateActCtx
DebugActiveProcess
DebugActiveProcessStop
DebugBreak
DebugBreakProcess
DebugSetProcessKillOnExit
DecodePointer
DecodeSystemPointer
DefineDosDeviceA
DefineDosDeviceW
DelayLoadFailureHook
DeleteAtom
DeleteCriticalSection
DeleteFiber
DeleteFileA
DeleteFileW
DeleteProcThreadAttributeList
DeleteTimerQueue
DeleteTimerQueueEx
DeleteTimerQueueTimer
DeleteVolumeMountPointA
DeleteVolumeMountPointW
DeviceIoControl
DisableThreadLibraryCalls
DisassociateCurrentThreadFromCallback
DisconnectNamedPipe
DnsHostnameToComputerNameA
DnsHostnameToComputerNameW
DosDateTimeToFileTime
DuplicateConsoleHandle
DuplicateHandle
EncodePointer
EncodeSystemPointer
EndUpdateResourceA
EndUpdateResourceW
EnterCriticalSection
EnumCalendarInfoA
EnumCalendarInfoExA
EnumCalendarInfoExEx
EnumCalendarInfoExW
EnumCalendarInfoW
EnumDateFormatsA
EnumDateFormatsExA
EnumDateFormatsExEx
EnumDateFormatsExW
EnumDateFormatsW
EnumLanguageGroupLocalesA
EnumLanguageGroupLocalesW
EnumResourceLanguagesA
EnumResourceLanguagesExA
EnumResourceLanguagesExW
EnumResourceLanguagesW
EnumResourceNamesA
EnumResourceNamesExA
EnumResourceNamesExW
EnumResourceNamesW
EnumResourceTypesA
EnumResourceTypesExA
EnumResourceTypesExW
EnumResourceTypesW
EnumSystemCodePagesA
EnumSystemCodePagesW
EnumSystemFirmwareTables
EnumSystemGeoID
EnumSystemLanguageGroupsA
EnumSystemLanguageGroupsW
EnumSystemLocalesA
EnumSystemLocalesEx
EnumSystemLocalesW
EnumTimeFormatsA
EnumTimeFormatsEx
EnumTimeFormatsW
EnumUILanguagesA
EnumUILanguagesW
EraseTape
EscapeCommFunction
ExitProcess
ExitThread
ExitVDM
ExpandEnvironmentStringsA
ExpandEnvironmentStringsW
ExpungeConsoleCommandHistoryA
ExpungeConsoleCommandHistoryW
ExtendVirtualBuffer
FT_Exit0
FT_Exit12
FT_Exit16
FT_Exit20
FT_Exit24
FT_Exit28
FT_Exit32
FT_Exit36
FT_Exit4
FT_Exit40
FT_Exit44
FT_Exit48
FT_Exit52
FT_Exit56
FT_Exit8
FT_Prolog
FT_Thunk
FatalAppExitA
FatalAppExitW
FatalExit
FileTimeToDosDateTime
FileTimeToLocalFileTime
FileTimeToSystemTime
FillConsoleOutputAttribute
FillConsoleOutputCharacterA
FillConsoleOutputCharacterW
FindActCtxSectionGuid
FindActCtxSectionStringA
FindActCtxSectionStringW
FindAtomA
FindAtomW
FindClose
FindCloseChangeNotification
FindFirstChangeNotificationA
FindFirstChangeNotificationW
FindFirstFileA
FindFirstFileExA
FindFirstFileExW
FindFirstFileW
FindFirstStreamW
FindFirstVolumeA
FindFirstVolumeMountPointA
FindFirstVolumeMountPointW
FindFirstVolumeW
FindNLSString
FindNLSStringEx
FindNextChangeNotification
FindNextFileA
FindNextFileW
FindNextStreamW
FindNextVolumeA
FindNextVolumeMountPointA
FindNextVolumeMountPointW
FindNextVolumeW
FindResourceA
FindResourceExA
FindResourceExW
FindResourceW
FindStringOrdinal
FindVolumeClose
FindVolumeMountPointClose
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushConsoleInputBuffer
FlushFileBuffers
FlushInstructionCache
FlushProcessWriteBuffers
FlushViewOfFile
FoldStringA
FoldStringW
FormatMessageA
FormatMessageW
FreeConsole
FreeEnvironmentStringsA
FreeEnvironmentStringsW
FreeLSCallback
FreeLibrary
FreeLibraryAndExitThread
FreeLibraryWhenCallbackReturns
FreeResource
FreeSLCallback
FreeUserPhysicalPages
FreeVirtualBuffer
GDIReallyCares
GenerateConsoleCtrlEvent
Get16DLLAddress
GetACP
GetActiveProcessorCount
GetActiveProcessorGroupCount
GetApplicationRestartSettings
GetAtomNameA
GetAtomNameW
GetBinaryType
GetBinaryTypeA
GetBinaryTypeW
GetCPInfo
GetCPInfoExA
GetCPInfoExW
GetCalendarInfoA
GetCalendarInfoEx
GetCalendarInfoW
GetCommConfig
GetCommMask
GetCommModemStatus
GetCommProperties
GetCommState
GetCommTimeouts
GetCommandLineA
GetCommandLineW
GetCompressedFileSizeA
GetCompressedFileSizeW
GetComputerNameA
GetComputerNameExA
GetComputerNameExW
GetComputerNameW
GetConsoleAliasA
GetConsoleAliasExesA
GetConsoleAliasExesLengthA
GetConsoleAliasExesLengthW
GetConsoleAliasExesW
GetConsoleAliasW
GetConsoleAliasesA
GetConsoleAliasesLengthA
GetConsoleAliasesLengthW
GetConsoleAliasesW
GetConsoleCP
GetConsoleCharType
GetConsoleCommandHistoryA
GetConsoleCommandHistoryLengthA
GetConsoleCommandHistoryLengthW
GetConsoleCommandHistoryW
GetConsoleCursorInfo
GetConsoleCursorMode
GetConsoleDisplayMode
GetConsoleFontInfo
GetConsoleFontSize
GetConsoleHardwareState
GetConsoleInputExeNameA
GetConsoleInputExeNameW
GetConsoleInputWaitHandle
GetConsoleKeyboardLayoutNameA
GetConsoleKeyboardLayoutNameW
GetConsoleMode
GetConsoleNlsMode
GetConsoleOutputCP
GetConsoleProcessList
GetConsoleScreenBufferInfo
GetConsoleScreenBufferInfoEx
GetConsoleTitleA
GetConsoleTitleW
GetConsoleWindow
GetCurrencyFormatA
GetCurrencyFormatEx
GetCurrencyFormatW
GetCurrentActCtx
GetCurrentConsoleFont
GetCurrentConsoleFontEx
GetCurrentDirectoryA
GetCurrentDirectoryW
GetCurrentPackageFamilyName
GetCurrentPackageFullName
GetCurrentPackageId
GetCurrentProcess
GetCurrentProcessId
GetCurrentProcessorNumber
GetCurrentProcessorNumberEx
GetCurrentThread
GetCurrentThreadId
GetCurrentThreadStackLimits
GetDateFormatA
GetDateFormatEx
GetDateFormatW
GetDaylightFlag
GetDefaultCommConfigA
GetDefaultCommConfigW
GetDefaultSortkeySize
GetDevicePowerState
GetDiskFreeSpaceA
GetDiskFreeSpaceExA
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetDllDirectoryA
GetDllDirectoryW
GetDriveTypeA
GetDriveTypeW
GetDynamicTimeZoneInformation
GetDynamicTimeZoneInformationEffectiveYears
GetEnabledXStateFeatures
GetEnvironmentStrings
GetEnvironmentStringsA
GetEnvironmentStringsW
GetEnvironmentVariableA
GetEnvironmentVariableW
GetErrorMode
GetExitCodeProcess
GetExitCodeThread
GetExpandedNameA
GetExpandedNameW
GetFileAttributesA
GetFileAttributesExA
GetFileAttributesExW
GetFileAttributesW
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFileMUIInfo
GetFileMUIPath
GetFileSize
GetFileSizeEx
GetFileTime
GetFileType
GetFinalPathNameByHandleA
GetFinalPathNameByHandleW
GetFirmwareEnvironmentVariableA
GetFirmwareEnvironmentVariableW
GetFullPathNameA
GetFullPathNameW
GetGeoInfoA
GetGeoInfoW
GetHandleContext
GetHandleInformation
GetLSCallbackTarget
GetLSCallbackTemplate
GetLargePageMinimum
GetLargestConsoleWindowSize
GetLastError
GetLinguistLangSize
GetLocalTime
GetLocaleInfoA
GetLocaleInfoEx
GetLocaleInfoW
GetLogicalDriveStringsA
GetLogicalDriveStringsW
GetLogicalDrives
GetLogicalProcessorInformation
GetLogicalProcessorInformationEx
GetLongPathNameA
GetLongPathNameW
GetMailslotInfo
GetMaximumProcessorCount
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExA
GetModuleHandleExW
GetModuleHandleW
GetNLSVersion
GetNLSVersionEx
GetNamedPipeClientProcessId

Sections

.text
Size: 200KB - Virtual size: 197KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 528B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 384B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 64KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/4
Size: 4KB - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/19
Size: 656KB - Virtual size: 652KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/31
Size: 40KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/45
Size: 132KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/57
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/70
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/81
Size: 188KB - Virtual size: 185KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/92
Size: 32KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1cb8b68770af551c169bee20790a354c

Headers

DLL Characteristics

File Characteristics

Imports

kernelbase

ntdll

Exports

Exports

Sections

.text Size: 200KB - Virtual size: 197KB

.data Size: 4KB - Virtual size: 528B

.rodata Size: 12KB - Virtual size: 8KB

.rdata Size: 16KB - Virtual size: 13KB

.bss Size: - Virtual size: 384B

.edata Size: 64KB - Virtual size: 61KB

.idata Size: 28KB - Virtual size: 27KB

.rsrc Size: 1.7MB - Virtual size: 1.7MB

.reloc Size: 12KB - Virtual size: 9KB

/4 Size: 4KB - Virtual size: 888B

/19 Size: 656KB - Virtual size: 652KB

/31 Size: 40KB - Virtual size: 37KB

/45 Size: 132KB - Virtual size: 128KB

/57 Size: 32KB - Virtual size: 31KB

/70 Size: 24KB - Virtual size: 23KB

/81 Size: 188KB - Virtual size: 185KB

/92 Size: 32KB - Virtual size: 29KB

.text
Size: 200KB - Virtual size: 197KB

.data
Size: 4KB - Virtual size: 528B

.rodata
Size: 12KB - Virtual size: 8KB

.rdata
Size: 16KB - Virtual size: 13KB

.bss
Size: - Virtual size: 384B

.edata
Size: 64KB - Virtual size: 61KB

.idata
Size: 28KB - Virtual size: 27KB

.rsrc
Size: 1.7MB - Virtual size: 1.7MB

.reloc
Size: 12KB - Virtual size: 9KB

/4
Size: 4KB - Virtual size: 888B

/19
Size: 656KB - Virtual size: 652KB

/31
Size: 40KB - Virtual size: 37KB

/45
Size: 132KB - Virtual size: 128KB

/57
Size: 32KB - Virtual size: 31KB

/70
Size: 24KB - Virtual size: 23KB

/81
Size: 188KB - Virtual size: 185KB

/92
Size: 32KB - Virtual size: 29KB