General

Malware Config

Signatures

Files

• 6d711bd12d13e9e4316f034771b151505f4abf5524834ded1b735b04a09a379b

  .exe windows:5 windows x64 arch:x64

  9ae9f98381fff4298caad75bd75fc8ea

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  advapi32

  AccessCheck

  AdjustTokenPrivileges

  AllocateAndInitializeSid

  BuildExplicitAccessWithNameW

  BuildSecurityDescriptorW

  BuildTrusteeWithSidW

  CheckTokenMembership

  ConvertSidToStringSidW

  ConvertStringSecurityDescriptorToSecurityDescriptorW

  ConvertStringSidToSidW

  CreateProcessAsUserW

  CredFree

  CredReadW

  CredWriteW

  CryptAcquireContextW

  CryptCreateHash

  CryptDestroyHash

  CryptGetHashParam

  CryptHashData

  CryptReleaseContext

  DuplicateToken

  DuplicateTokenEx

  EqualSid

  EventRegister

  EventSetInformation

  EventUnregister

  EventWrite

  FreeSid

  GetExplicitEntriesFromAclW

  GetLengthSid

  GetNamedSecurityInfoW

  GetSecurityDescriptorControl

  GetSecurityDescriptorDacl

  GetSecurityDescriptorGroup

  GetSecurityDescriptorOwner

  GetSecurityDescriptorSacl

  GetTokenInformation

  GetUserNameW

  ImpersonateNamedPipeClient

  InitializeAcl

  InitializeSecurityDescriptor

  IsValidAcl

  IsValidSecurityDescriptor

  IsValidSid

  LookupPrivilegeValueW

  OpenProcessToken

  OpenThreadToken

  RegCloseKey

  RegCreateKeyExW

  RegDeleteKeyExW

  RegDeleteKeyW

  RegDeleteValueA

  RegDeleteValueW

  RegEnumKeyExW

  RegEnumValueW

  RegGetKeySecurity

  RegNotifyChangeKeyValue

  RegOpenKeyExW

  RegQueryInfoKeyW

  RegQueryValueExA

  RegQueryValueExW

  RegSetValueExA

  RegSetValueExW

  RevertToSelf

  SetEntriesInAclW

  SetNamedSecurityInfoW

  SetSecurityDescriptorDacl

  SetSecurityInfo

  dbghelp

  MiniDumpWriteDump

  SymCleanup

  SymFromAddr

  SymGetLineFromAddr64

  SymGetSearchPathW

  SymInitialize

  SymSetOptions

  SymSetSearchPathW

  oleaut32

  SafeArrayCreate

  SafeArrayGetVartype

  SafeArrayPutElement

  SysAllocString

  SysAllocStringByteLen

  SysFreeString

  SysStringByteLen

  SysStringLen

  VarUI4FromStr

  VariantClear

  VariantCopy

  VariantInit

  VariantTimeToSystemTime

  shell32

  CommandLineToArgvW

  ord680

  SHChangeNotify

  SHGetFolderPathW

  SHGetKnownFolderPath

  SHOpenWithDialog

  ShellExecuteExW

  shlwapi

  PathMatchSpecW

  SHDeleteKeyW

  user32

  AllowSetForegroundWindow

  CharLowerW

  CharNextW

  CharUpperW

  CreateWindowExW

  DefWindowProcW

  DestroyWindow

  DispatchMessageW

  FindWindowExW

  GetActiveWindow

  GetDesktopWindow

  GetForegroundWindow

  GetMessageW

  GetQueueStatus

  GetWindowLongPtrW

  KillTimer

  MessageBoxW

  MsgWaitForMultipleObjectsEx

  PeekMessageW

  PostMessageW

  PostQuitMessage

  RegisterClassExW

  RegisterClassW

  SendInput

  SendNotifyMessageW

  SetForegroundWindow

  SetTimer

  SetWindowLongPtrW

  TranslateMessage

  UnregisterClassW

  WaitForInputIdle

  wsprintfW

  version

  GetFileVersionInfoSizeW

  GetFileVersionInfoW

  VerQueryValueW

  winmm

  timeBeginPeriod

  timeEndPeriod

  timeGetTime

  ws2_32

  WSACleanup

  WSACloseEvent

  WSACreateEvent

  WSAEnumNetworkEvents

  WSAEventSelect

  WSAGetLastError

  WSAGetOverlappedResult

  WSAIoctl

  WSAResetEvent

  WSASetLastError

  WSAStartup

  WSAWaitForMultipleEvents

  __WSAFDIsSet

  accept

  bind

  closesocket

  connect

  freeaddrinfo

  getaddrinfo

  getpeername

  getsockname

  getsockopt

  htonl

  htons

  inet_ntop

  inet_pton

  ioctlsocket

  listen

  ntohs

  recv

  recvfrom

  select

  send

  sendto

  setsockopt

  shutdown

  socket

  kernel32

  AcquireSRWLockExclusive

  AcquireSRWLockShared

  AddVectoredExceptionHandler

  AssignProcessToJobObject

  CancelIo

  CloseHandle

  CompareStringOrdinal

  CompareStringW

  ConnectNamedPipe

  CopyFileW

  CreateDirectoryW

  CreateEventW

  CreateFileA

  CreateFileMappingW

  CreateFileW

  CreateIoCompletionPort

  CreateJobObjectW

  CreateMutexW

  CreateNamedPipeW

  CreatePipe

  CreateProcessW

  CreateSemaphoreW

  CreateThread

  DecodePointer

  DeleteCriticalSection

  DeleteFileW

  DeleteProcThreadAttributeList

  DeviceIoControl

  DisconnectNamedPipe

  DuplicateHandle

  EncodePointer

  EnterCriticalSection

  EnumSystemLocalesW

  ExitProcess

  ExitThread

  ExpandEnvironmentStringsW

  FileTimeToSystemTime

  FindClose

  FindFirstFileExW

  FindNextFileW

  FindResourceExW

  FindResourceW

  FlsAlloc

  FlsFree

  FlsGetValue

  FlsSetValue

  FlushFileBuffers

  FlushViewOfFile

  FormatMessageA

  FormatMessageW

  FreeEnvironmentStringsW

  FreeLibrary

  FreeLibraryAndExitThread

  GetACP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  GetConsoleMode

  GetConsoleOutputCP

  GetCurrentDirectoryW

  GetCurrentProcess

  GetCurrentProcessId

  GetCurrentThread

  GetCurrentThreadId

  GetDateFormatW

  GetDriveTypeW

  GetEnvironmentStringsW

  GetEnvironmentVariableA

  GetEnvironmentVariableW

  GetExitCodeProcess

  GetFileAttributesExW

  GetFileAttributesW

  GetFileInformationByHandle

  GetFileInformationByHandleEx

  GetFileSizeEx

  GetFileTime

  GetFileType

  GetFullPathNameW

  GetHandleInformation

  GetLastError

  GetLocalTime

  GetLocaleInfoW

  GetLogicalDrives

  GetLogicalProcessorInformation

  GetLogicalProcessorInformationEx

  GetLongPathNameW

  GetModuleFileNameW

  GetModuleHandleA

  GetModuleHandleExW

  GetModuleHandleW

  GetNamedPipeClientProcessId

  GetNamedPipeServerProcessId

  GetNativeSystemInfo

  GetOEMCP

  GetProcAddress

  GetProcessHandleCount

  GetProcessHeap

  GetProcessId

  GetProcessMitigationPolicy

  GetProcessTimes

  GetProductInfo

  GetQueuedCompletionStatus

  GetStartupInfoW

  GetStdHandle

  GetStringTypeW

  GetSystemDefaultLCID

  GetSystemDirectoryW

  GetSystemInfo

  GetSystemTime

  GetSystemTimeAsFileTime

  GetTempPathW

  GetThreadContext

  GetThreadId

  GetThreadLocale

  GetThreadPreferredUILanguages

  GetThreadPriority

  GetTickCount

  GetTimeFormatW

  GetTimeZoneInformation

  GetUserDefaultLCID

  GetVersionExW

  GetVolumeInformationW

  GetWindowsDirectoryW

  GlobalFree

  GlobalMemoryStatusEx

  HeapAlloc

  HeapDestroy

  HeapFree

  HeapReAlloc

  HeapSize

  InitOnceExecuteOnce

  InitializeConditionVariable

  InitializeCriticalSection

  InitializeCriticalSectionAndSpinCount

  InitializeCriticalSectionEx

  InitializeProcThreadAttributeList

  InitializeSListHead

  InitializeSRWLock

  IsDebuggerPresent

  IsProcessorFeaturePresent

  IsValidCodePage

  IsValidLocale

  IsWow64Process

  K32GetModuleInformation

  K32GetPerformanceInfo

  K32GetProcessMemoryInfo

  K32QueryWorkingSetEx

  LCMapStringW

  LeaveCriticalSection

  LoadLibraryExA

  LoadLibraryExW

  LoadLibraryW

  LoadResource

  LocalAlloc

  LocalFree

  LockFileEx

  LockResource

  MapViewOfFile

  MoveFileExW

  MoveFileW

  MultiByteToWideChar

  OpenEventW

  OpenMutexW

  OpenProcess

  OutputDebugStringA

  OutputDebugStringW

  PeekNamedPipe

  PostQueuedCompletionStatus

  ProcessIdToSessionId

  QueryFullProcessImageNameW

  QueryPerformanceCounter

  QueryPerformanceFrequency

  QueryThreadCycleTime

  RaiseException

  ReadConsoleW

  ReadFile

  ReadProcessMemory

  RegisterWaitForSingleObject

  ReleaseMutex

  ReleaseSRWLockExclusive

  ReleaseSRWLockShared

  ReleaseSemaphore

  RemoveDirectoryW

  ReplaceFileW

  ResetEvent

  ResumeThread

  RtlCaptureContext

  RtlCaptureStackBackTrace

  RtlLookupFunctionEntry

  RtlPcToFileHeader

  RtlUnwind

  RtlUnwindEx

  RtlVirtualUnwind

  SetConsoleCtrlHandler

  SetEndOfFile

  SetEnvironmentVariableW

  SetEvent

  SetFileAttributesW

  SetFileInformationByHandle

  SetFilePointerEx

  SetHandleInformation

  SetInformationJobObject

  SetLastError

  SetNamedPipeHandleState

  SetProcessShutdownParameters

  SetStdHandle

  SetThreadPriority

  SetUnhandledExceptionFilter

  SizeofResource

  Sleep

  SleepConditionVariableSRW

  SleepEx

  SuspendThread

  SwitchToThread

  SystemTimeToFileTime

  SystemTimeToTzSpecificLocalTime

  TerminateProcess

  TlsAlloc

  TlsFree

  TlsGetValue

  TlsSetValue

  TransactNamedPipe

  TryAcquireSRWLockExclusive

  TzSpecificLocalTimeToSystemTime

  UnhandledExceptionFilter

  UnlockFileEx

  UnmapViewOfFile

  UnregisterWait

  UnregisterWaitEx

  UpdateProcThreadAttribute

  VerSetConditionMask

  VerifyVersionInfoW

  VirtualAlloc

  VirtualFree

  VirtualProtect

  VirtualQuery

  VirtualQueryEx

  WaitForMultipleObjects

  WaitForSingleObject

  WaitForSingleObjectEx

  WaitNamedPipeW

  WakeAllConditionVariable

  WakeConditionVariable

  WerRegisterRuntimeExceptionModule

  WideCharToMultiByte

  Wow64GetThreadContext

  WriteConsoleW

  WriteFile

  lstrcmpA

  lstrcmpiW

  lstrcpyW

  lstrcpynW

  lstrlenA

  lstrlenW

  ole32

  CoAllowSetForegroundWindow

  CoCreateInstance

  CoInitializeEx

  CoInitializeSecurity

  CoRegisterInitializeSpy

  CoRevokeInitializeSpy

  CoSetProxyBlanket

  CoTaskMemAlloc

  CoTaskMemFree

  CoTaskMemRealloc

  CoUninitialize

  IIDFromString

  PropVariantClear

  StringFromGUID2

  bcrypt

  BCryptCloseAlgorithmProvider

  BCryptCreateHash

  BCryptDestroyHash

  BCryptFinishHash

  BCryptGenRandom

  BCryptHashData

  BCryptOpenAlgorithmProvider

  crypt32

  CertAddCertificateContextToStore

  CertCloseStore

  CertCreateCertificateChainEngine

  CertEnumCertificatesInStore

  CertFindCertificateInStore

  CertFindExtension

  CertFreeCertificateChain

  CertFreeCertificateChainEngine

  CertFreeCertificateContext

  CertGetCertificateChain

  CertGetNameStringW

  CertOpenStore

  CryptBinaryToStringW

  CryptDecodeObject

  CryptDecodeObjectEx

  CryptEnumOIDInfo

  CryptHashCertificate

  CryptMsgClose

  CryptMsgGetParam

  CryptProtectData

  CryptQueryObject

  CryptStringToBinaryW

  CryptUnprotectData

  PFXImportCertStore

  secur32

  GetUserNameExW

  iphlpapi

  GetAdaptersAddresses

  winhttp

  WinHttpAddRequestHeaders

  WinHttpCloseHandle

  WinHttpConnect

  WinHttpCrackUrl

  WinHttpGetIEProxyConfigForCurrentUser

  WinHttpGetProxyForUrl

  WinHttpOpen

  WinHttpOpenRequest

  WinHttpQueryHeaders

  WinHttpReadData

  WinHttpReceiveResponse

  WinHttpSendRequest

  WinHttpSetTimeouts

  WinHttpWriteData

  credui

  CredUIPromptForCredentialsW

  wintrust

  WinVerifyTrust

  ntdll

  NtDeleteKey

  RtlGetLastNtStatus

  userenv

  CreateEnvironmentBlock

  DestroyEnvironmentBlock

  api-ms-win-core-winrt-l1-1-0

  RoInitialize

  RoUninitialize

  Exports

  Exports

  GetHandleVerifier

  Sections

  .text

  Size: 4.4MB - Virtual size: 4.4MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 681KB - Virtual size: 681KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 72KB - Virtual size: 153KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 140KB - Virtual size: 140KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .00cfg

  Size: 512B - Virtual size: 48B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .gxfg

  Size: 13KB - Virtual size: 13KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .retplne

  Size: 512B - Virtual size: 172B

  .tls

  Size: 1024B - Virtual size: 617B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  CPADinfo

  Size: 512B - Virtual size: 64B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  LZMADEC

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  _RDATA

  Size: 512B - Virtual size: 348B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  malloc_h

  Size: 512B - Virtual size: 228B

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 80KB - Virtual size: 79KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 584KB - Virtual size: 588KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE