General

Malware Config

Signatures

Files

• a15b3a0bf5a71bc6c19b9d6c95fc6e18

  .exe windows:6 windows x64 arch:x64

  5e1ce5e84cf382d4870fe4cf7fd2541b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  advapi32

  CryptCreateHash

  CryptHashData

  CryptDestroyHash

  CryptGetHashParam

  CryptAcquireContextW

  kernel32

  CreateFileMappingW

  MapViewOfFileEx

  CloseHandle

  UnmapViewOfFile

  LoadLibraryExW

  GetProcAddress

  CreateFileW

  GetFileSize

  MapViewOfFile

  SetConsoleCtrlHandler

  Sleep

  SetErrorMode

  VirtualQuery

  GetModuleFileNameW

  FindResourceW

  LoadResource

  GetCPInfo

  WideCharToMultiByte

  MultiByteToWideChar

  GetFileType

  GetConsoleMode

  EnterCriticalSection

  LeaveCriticalSection

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  SetEvent

  ResetEvent

  WaitForSingleObjectEx

  CreateEventW

  GetModuleHandleW

  RtlCaptureContext

  RtlLookupFunctionEntry

  RtlVirtualUnwind

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  IsDebuggerPresent

  InitializeSListHead

  GetSystemTimeAsFileTime

  GetCurrentThreadId

  TerminateProcess

  IsProcessorFeaturePresent

  GetCurrentProcessId

  QueryPerformanceCounter

  vcruntime140

  __current_exception_context

  memcmp

  memcpy

  memmove

  __C_specific_handler

  __current_exception

  memset

  api-ms-win-crt-heap-l1-1-0

  realloc

  free

  calloc

  malloc

  _set_new_mode

  api-ms-win-crt-convert-l1-1-0

  _wtoi

  _atoflt

  _atodbl

  _ltoa_s

  _atoldbl

  _ltow_s

  _ultow_s

  api-ms-win-crt-time-l1-1-0

  _strtime_s

  _time64

  _strdate_s

  api-ms-win-crt-string-l1-1-0

  strncmp

  wcscat_s

  wcsncat_s

  _strupr_s

  _wcsnicmp

  towupper

  _wcsicmp

  iswspace

  wcscpy_s

  _strnicmp

  wcscmp

  strcpy_s

  _stricmp

  strcat_s

  api-ms-win-crt-stdio-l1-1-0

  _lseek

  _isatty

  _write

  __p__commode

  _fileno

  _set_fmode

  _read

  __acrt_iob_func

  fflush

  _wsopen_s

  _close

  _get_osfhandle

  _tell

  __stdio_common_vsprintf_s

  __stdio_common_vfwprintf

  fputws

  api-ms-win-crt-runtime-l1-1-0

  _initialize_wide_environment

  _get_initial_wide_environment

  _initterm

  _initterm_e

  _exit

  _configure_wide_argv

  _set_app_type

  __p___argc

  _seh_filter_exe

  _cexit

  _c_exit

  _register_thread_local_exe_atexit_callback

  exit

  signal

  __p__wpgmptr

  _initialize_onexit_table

  _register_onexit_function

  _crt_atexit

  terminate

  __p___wargv

  _errno

  api-ms-win-crt-environment-l1-1-0

  _wdupenv_s

  _dupenv_s

  _wgetcwd

  _wputenv_s

  api-ms-win-crt-filesystem-l1-1-0

  _wremove

  _wfullpath

  _wmakepath_s

  _waccess

  _wsplitpath_s

  api-ms-win-crt-process-l1-1-0

  _wspawnlp

  _wspawnvp

  _wspawnv

  api-ms-win-crt-conio-l1-1-0

  _cputws

  __conio_common_vcwprintf

  api-ms-win-crt-math-l1-1-0

  __setusermatherr

  api-ms-win-crt-locale-l1-1-0

  _configthreadlocale

  Sections

  .text

  Size: 254KB - Virtual size: 254KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 270KB - Virtual size: 269KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 42KB - Virtual size: 137KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 7KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 23KB - Virtual size: 23KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 23KB - Virtual size: 23KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ