General

Malware Config

Signatures

Files

• 74fbb62f6c8094e505c672439a2d7318

  .exe windows:6 windows x86 arch:x86

  6199b3f7b851154bc163fe8a178b52cd

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  advapi32

  TraceMessage

  GetTraceEnableFlags

  GetTraceEnableLevel

  GetTraceLoggerHandle

  RegisterTraceGuidsW

  UnregisterTraceGuids

  RegCloseKey

  RegDeleteValueW

  RegEnumValueW

  RegQueryInfoKeyW

  RegOpenKeyExW

  RegEnumKeyExW

  UpdateTraceW

  ControlTraceW

  StopTraceW

  EnableTraceEx

  StartTraceW

  RegQueryValueExW

  QueryTraceW

  IsValidSid

  CloseTrace

  ProcessTrace

  OpenTraceW

  ConvertSidToStringSidW

  RegSetValueExW

  RegCreateKeyExW

  DeregisterEventSource

  ReportEventW

  RegisterEventSourceW

  CopySid

  GetLengthSid

  GetTokenInformation

  CloseServiceHandle

  QueryServiceStatus

  OpenServiceW

  OpenSCManagerW

  OpenProcessToken

  ConvertStringSecurityDescriptorToSecurityDescriptorW

  SetNamedSecurityInfoW

  GetSecurityDescriptorOwner

  GetSecurityDescriptorDacl

  RevertToSelf

  ImpersonateLoggedOnUser

  RegGetValueW

  TraceEvent

  kernel32

  GetTickCount

  SetThreadPriority

  GetCurrentThread

  CreateMutexW

  GetCommandLineW

  HeapSetInformation

  GetLogicalProcessorInformationEx

  LocalFree

  FreeLibrary

  GetProcAddress

  LoadLibraryW

  GetUserGeoID

  GetSystemDefaultLCID

  GetSystemDefaultUILanguage

  GlobalMemoryStatusEx

  GetSystemInfo

  GetActiveProcessorCount

  GetProductInfo

  CompareFileTime

  GetLastError

  OpenMutexW

  ReleaseMutex

  LoadLibraryExW

  FindResourceW

  SizeofResource

  LoadResource

  LockResource

  FreeResource

  GetModuleHandleW

  FileTimeToSystemTime

  FileTimeToDosDateTime

  GetTempFileNameW

  GlobalFree

  WaitForMultipleObjects

  GetTempPathW

  GetLongPathNameW

  SetLastError

  WideCharToMultiByte

  CreateDirectoryW

  GetFileAttributesW

  GetFileSizeEx

  SetFilePointerEx

  InterlockedDecrement

  OpenFileMappingW

  CreateFileMappingW

  MapViewOfFile

  VirtualAlloc

  UnmapViewOfFile

  VirtualFree

  InterlockedIncrement

  ResetEvent

  CreateThread

  InterlockedExchange

  Sleep

  InterlockedCompareExchange

  GetStartupInfoA

  SetUnhandledExceptionFilter

  GetModuleHandleA

  QueryPerformanceCounter

  GetCurrentThreadId

  GetCurrentProcessId

  GetSystemTimeAsFileTime

  TerminateProcess

  GetCurrentProcess

  UnhandledExceptionFilter

  FreeLibraryAndExitThread

  DeleteCriticalSection

  InitializeCriticalSectionAndSpinCount

  CreateEventW

  GetFileSize

  ReadFile

  DuplicateHandle

  SetEvent

  EnterCriticalSection

  LeaveCriticalSection

  RaiseException

  GetSystemDirectoryW

  ExpandEnvironmentStringsW

  GetEnvironmentVariableW

  lstrlenW

  SystemTimeToFileTime

  GetModuleFileNameW

  LocalAlloc

  GetLocalTime

  CreateFileW

  SetFileAttributesW

  WriteFile

  CreateProcessW

  WaitForSingleObject

  GetExitCodeProcess

  CloseHandle

  DeleteFileW

  GetFileAttributesExW

  FindNextFileW

  FindFirstFileW

  FindClose

  MoveFileExW

  GetVersionExW

  GetSystemTime

  GetThreadPriority

  user32

  LoadStringW

  PeekMessageW

  MsgWaitForMultipleObjects

  DispatchMessageW

  TranslateMessage

  GetSystemMetrics

  msvcrt

  _initterm

  wcstoul

  _controlfp

  _except_handler4_common

  ?terminate@@YAXXZ

  _onexit

  _lock

  __dllonexit

  _unlock

  __set_app_type

  __p__fmode

  __p__commode

  __setusermatherr

  _amsg_exit

  wcstok_s

  _acmdln

  exit

  _ismbblead

  _XcptFilter

  _exit

  _cexit

  __getmainargs

  free

  _callnewh

  malloc

  wcschr

  memset

  __CxxFrameHandler3

  towupper

  _vsnwprintf

  wcsstr

  wcsrchr

  memcpy

  _vsnprintf

  memmove

  _wcsicmp

  realloc

  _wcsnicmp

  ceil

  _ftol2

  _purecall

  shlwapi

  PathRemoveExtensionW

  PathFindFileNameW

  PathCombineW

  StrStrIW

  StrToIntExW

  PathFileExistsW

  ord437

  PathAppendW

  tdh

  TdhGetProperty

  TdhGetPropertySize

  ole32

  CoCreateGuid

  StringFromGUID2

  shell32

  CommandLineToArgvW

  SHGetFolderPathW

  SHGetFolderPathAndSubDirW

  winhttp

  WinHttpGetIEProxyConfigForCurrentUser

  WinHttpGetProxyForUrl

  WinHttpQueryHeaders

  WinHttpSetOption

  WinHttpOpen

  WinHttpGetDefaultProxyConfiguration

  WinHttpWriteData

  WinHttpCrackUrl

  WinHttpSetTimeouts

  WinHttpSetCredentials

  WinHttpTimeFromSystemTime

  WinHttpCloseHandle

  WinHttpReadData

  WinHttpSetStatusCallback

  WinHttpAddRequestHeaders

  WinHttpOpenRequest

  WinHttpReceiveResponse

  WinHttpConnect

  WinHttpSendRequest

  wevtapi

  EvtClose

  EvtNext

  EvtQuery

  EvtRender

  EvtCreateRenderContext

  powrprof

  PowerDeterminePlatformRole

  ntdll

  NtQuerySystemTime

  RtlFreeHeap

  RtlAllocateHeap

  oleaut32

  SysFreeString

  SysAllocString

  Sections

  .text

  Size: 205KB - Virtual size: 204KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .data

  Size: 512B - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 29KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 13KB - Virtual size: 13KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE