General

Malware Config

Signatures

Files

• b0fc12e028d3e7bcdb1c211489462146

  .exe windows:6 windows x64 arch:x64

  f67ac9047f861e765075e62785358b5a

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  kernel32

  FindResourceExW

  LoadResource

  WaitForSingleObject

  GetExitCodeProcess

  Sleep

  CloseHandle

  GetTempFileNameW

  NeedCurrentDirectoryForExePathW

  GetSystemTimeAsFileTime

  CreateFileW

  SetFileTime

  FindFirstFileW

  FindClose

  FindNextFileW

  GetFileTime

  WideCharToMultiByte

  LoadLibraryExW

  GetLastError

  GetEnvironmentVariableW

  GetModuleHandleW

  GetProcAddress

  EncodePointer

  DecodePointer

  HeapAlloc

  GetProcessHeap

  HeapFree

  GetUserDefaultUILanguage

  SetErrorMode

  VirtualQuery

  GetModuleFileNameW

  GetFileSizeEx

  GetFileType

  GetConsoleMode

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  GetDateFormatW

  GetTimeFormatW

  RtlLookupFunctionEntry

  RtlVirtualUnwind

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  TerminateProcess

  IsProcessorFeaturePresent

  QueryPerformanceCounter

  GetCurrentProcessId

  GetCurrentThreadId

  IsDebuggerPresent

  InitializeSListHead

  RtlCaptureContext

  vcruntime140

  __current_exception

  memset

  wcsstr

  wcsrchr

  wcschr

  __C_specific_handler

  __current_exception_context

  memcpy

  memmove

  api-ms-win-crt-heap-l1-1-0

  realloc

  malloc

  free

  _set_new_mode

  api-ms-win-crt-string-l1-1-0

  iswdigit

  wcsncpy_s

  wcsncmp

  wcsncat_s

  _wcsupr_s

  wcscat_s

  wcscpy_s

  _wcsnicmp

  wcstok_s

  towupper

  iswspace

  wcspbrk

  _wcsicmp

  iswalpha

  wcsspn

  api-ms-win-crt-environment-l1-1-0

  _wputenv

  _wputenv_s

  _wgetenv_s

  _wgetcwd

  __p__wenviron

  _wdupenv_s

  _wsearchenv

  api-ms-win-crt-stdio-l1-1-0

  __stdio_common_vswprintf_s

  __stdio_common_vfwprintf

  fputwc

  fflush

  _fcloseall

  __p__commode

  _wfopen_s

  fgetws

  setvbuf

  _get_osfhandle

  __stdio_common_vswscanf

  _wfsopen

  fclose

  fwrite

  __acrt_iob_func

  feof

  _wsopen_s

  ungetwc

  _dup2

  _set_fmode

  getwc

  _dup

  _lseek

  _close

  _fileno

  api-ms-win-crt-runtime-l1-1-0

  signal

  _crt_atexit

  _initialize_onexit_table

  _wcserror_s

  exit

  __p__wpgmptr

  _set_invalid_parameter_handler

  _register_thread_local_exe_atexit_callback

  _register_onexit_function

  _c_exit

  _errno

  _cexit

  __doserrno

  __p___wargv

  _seh_filter_exe

  _set_app_type

  terminate

  _configure_wide_argv

  _initialize_wide_environment

  _get_initial_wide_environment

  _initterm

  _initterm_e

  _exit

  __p___argc

  api-ms-win-crt-convert-l1-1-0

  wcstol

  _itow_s

  wcstoul

  api-ms-win-crt-process-l1-1-0

  _wspawnvp

  api-ms-win-crt-filesystem-l1-1-0

  _wchdir

  _wremove

  _waccess

  _wsplitpath_s

  _wmakepath_s

  _waccess_s

  _wunlink

  _chdrive

  api-ms-win-crt-locale-l1-1-0

  _configthreadlocale

  setlocale

  api-ms-win-crt-conio-l1-1-0

  _putwch

  __conio_common_vcwprintf

  api-ms-win-crt-math-l1-1-0

  __setusermatherr

  Sections

  .text

  Size: 65KB - Virtual size: 64KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 15KB - Virtual size: 15KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 162KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 12KB - Virtual size: 11KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 268B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ