General

Malware Config

Signatures

Files

• 171999e6566bf1ec97bf5ccaefef685702144f01cbea19defbbb3a220b14c975

  .exe windows:5 windows x64 arch:x64

  934e26715f8fef03b317167597a7006a

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  advapi32

  AccessCheck

  AdjustTokenPrivileges

  AllocateAndInitializeSid

  BuildExplicitAccessWithNameW

  BuildTrusteeWithSidW

  CheckTokenMembership

  ConvertSidToStringSidW

  ConvertStringSidToSidW

  CreateProcessAsUserW

  DuplicateToken

  DuplicateTokenEx

  EqualSid

  EventRegister

  EventSetInformation

  EventUnregister

  EventWrite

  FreeSid

  GetExplicitEntriesFromAclW

  GetLengthSid

  GetNamedSecurityInfoW

  GetSecurityDescriptorControl

  GetSecurityDescriptorDacl

  GetSecurityDescriptorGroup

  GetSecurityDescriptorOwner

  GetSecurityDescriptorSacl

  GetTokenInformation

  GetUserNameW

  IsValidAcl

  IsValidSecurityDescriptor

  IsValidSid

  LookupPrivilegeValueW

  OpenProcessToken

  RegCloseKey

  RegCreateKeyExW

  RegDeleteKeyExW

  RegDeleteKeyW

  RegDeleteValueW

  RegEnumKeyExW

  RegEnumValueW

  RegGetKeySecurity

  RegNotifyChangeKeyValue

  RegOpenKeyExW

  RegQueryInfoKeyW

  RegQueryValueExW

  RegSetValueExW

  SetEntriesInAclW

  SetNamedSecurityInfoW

  SetSecurityInfo

  dbghelp

  SymCleanup

  SymFromAddr

  SymGetLineFromAddr64

  SymGetSearchPathW

  SymInitialize

  SymSetOptions

  SymSetSearchPathW

  oleaut32

  SafeArrayCreate

  SafeArrayGetVartype

  SafeArrayPutElement

  SysAllocString

  SysAllocStringByteLen

  SysFreeString

  SysStringByteLen

  VarUI4FromStr

  VariantClear

  VariantInit

  VariantTimeToSystemTime

  shell32

  CommandLineToArgvW

  ord190

  ord155

  ord680

  SHChangeNotify

  SHCreateItemFromParsingName

  SHGetFolderPathW

  SHGetKnownFolderPath

  SHOpenWithDialog

  ShellExecuteExW

  ShellExecuteW

  shlwapi

  PathMatchSpecW

  SHDeleteKeyW

  user32

  AllowSetForegroundWindow

  CharLowerW

  CharNextW

  CharUpperW

  CreateWindowExW

  DefWindowProcW

  DestroyWindow

  DispatchMessageW

  FindWindowExW

  GetActiveWindow

  GetDesktopWindow

  GetForegroundWindow

  GetQueueStatus

  GetWindowRect

  KillTimer

  LoadStringW

  MessageBoxW

  MsgWaitForMultipleObjectsEx

  PeekMessageW

  PostMessageW

  PostQuitMessage

  RegisterClassExW

  SendInput

  SendNotifyMessageW

  SetForegroundWindow

  SetTimer

  SetWindowPos

  ShowWindow

  TranslateMessage

  UnregisterClassW

  WaitForInputIdle

  winmm

  timeBeginPeriod

  timeEndPeriod

  timeGetTime

  ws2_32

  WSACloseEvent

  WSACreateEvent

  WSAEnumNetworkEvents

  WSAEventSelect

  WSAGetLastError

  WSAGetOverlappedResult

  WSAResetEvent

  WSAStartup

  accept

  closesocket

  getsockname

  ioctlsocket

  recv

  recvfrom

  sendto

  shutdown

  kernel32

  AcquireSRWLockExclusive

  AssignProcessToJobObject

  CloseHandle

  CompareStringOrdinal

  CompareStringW

  CopyFileW

  CreateDirectoryW

  CreateEventW

  CreateFileA

  CreateFileW

  CreateIoCompletionPort

  CreateMutexW

  CreatePipe

  CreateProcessW

  CreateThread

  CreateToolhelp32Snapshot

  DecodePointer

  DeleteCriticalSection

  DeleteFileW

  DeleteProcThreadAttributeList

  DeviceIoControl

  DuplicateHandle

  EncodePointer

  EnterCriticalSection

  EnumSystemLocalesW

  ExitProcess

  ExitThread

  ExpandEnvironmentStringsW

  FileTimeToSystemTime

  FindClose

  FindFirstFileExW

  FindNextFileW

  FindResourceExW

  FindResourceW

  FlsAlloc

  FlsFree

  FlsGetValue

  FlsSetValue

  FlushFileBuffers

  FormatMessageA

  FreeEnvironmentStringsW

  FreeLibrary

  FreeLibraryAndExitThread

  GetACP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  GetConsoleMode

  GetConsoleOutputCP

  GetCurrentDirectoryW

  GetCurrentProcess

  GetCurrentProcessId

  GetCurrentThread

  GetCurrentThreadId

  GetDateFormatW

  GetDriveTypeW

  GetEnvironmentStringsW

  GetEnvironmentVariableW

  GetExitCodeProcess

  GetFileAttributesW

  GetFileInformationByHandle

  GetFileSizeEx

  GetFileType

  GetFullPathNameW

  GetHandleInformation

  GetLastError

  GetLocalTime

  GetLocaleInfoW

  GetLogicalDrives

  GetLogicalProcessorInformation

  GetLogicalProcessorInformationEx

  GetLongPathNameW

  GetModuleFileNameW

  GetModuleHandleA

  GetModuleHandleExW

  GetModuleHandleW

  GetNativeSystemInfo

  GetOEMCP

  GetProcAddress

  GetProcessHeap

  GetProcessId

  GetProcessMitigationPolicy

  GetProductInfo

  GetQueuedCompletionStatus

  GetStartupInfoW

  GetStdHandle

  GetStringTypeW

  GetSystemDirectoryW

  GetSystemInfo

  GetSystemTime

  GetSystemTimeAsFileTime

  GetTempPathW

  GetThreadId

  GetThreadPreferredUILanguages

  GetThreadPriority

  GetTickCount

  GetTimeFormatW

  GetTimeZoneInformation

  GetUserDefaultLCID

  GetVersionExW

  GetWindowsDirectoryW

  HeapAlloc

  HeapDestroy

  HeapFree

  HeapReAlloc

  HeapSize

  InitOnceExecuteOnce

  InitializeConditionVariable

  InitializeCriticalSectionAndSpinCount

  InitializeCriticalSectionEx

  InitializeProcThreadAttributeList

  InitializeSListHead

  IsDebuggerPresent

  IsProcessorFeaturePresent

  IsValidCodePage

  IsValidLocale

  IsWow64Process

  K32GetModuleFileNameExW

  K32GetModuleInformation

  K32QueryWorkingSetEx

  LCMapStringW

  LeaveCriticalSection

  LoadLibraryExA

  LoadLibraryExW

  LoadLibraryW

  LoadResource

  LocalAlloc

  LocalFree

  LockResource

  MoveFileExW

  MoveFileW

  MultiByteToWideChar

  OpenEventW

  OpenProcess

  OutputDebugStringA

  OutputDebugStringW

  PostQueuedCompletionStatus

  Process32FirstW

  Process32NextW

  QueryPerformanceCounter

  QueryPerformanceFrequency

  QueryThreadCycleTime

  RaiseException

  ReadConsoleW

  ReadFile

  RegisterWaitForSingleObject

  ReleaseMutex

  ReleaseSRWLockExclusive

  RemoveDirectoryW

  ReplaceFileW

  ResetEvent

  RtlCaptureContext

  RtlCaptureStackBackTrace

  RtlLookupFunctionEntry

  RtlPcToFileHeader

  RtlUnwind

  RtlUnwindEx

  RtlVirtualUnwind

  SetEndOfFile

  SetEnvironmentVariableW

  SetEvent

  SetFileAttributesW

  SetFilePointerEx

  SetHandleInformation

  SetLastError

  SetStdHandle

  SetThreadPriority

  SetUnhandledExceptionFilter

  SizeofResource

  Sleep

  SleepConditionVariableSRW

  SystemTimeToFileTime

  SystemTimeToTzSpecificLocalTime

  TerminateProcess

  TlsAlloc

  TlsFree

  TlsGetValue

  TlsSetValue

  TryAcquireSRWLockExclusive

  TzSpecificLocalTimeToSystemTime

  UnhandledExceptionFilter

  UnregisterWaitEx

  UpdateProcThreadAttribute

  VirtualAlloc

  VirtualFree

  VirtualProtect

  VirtualQuery

  WaitForMultipleObjects

  WaitForSingleObject

  WaitForSingleObjectEx

  WakeAllConditionVariable

  WakeConditionVariable

  WideCharToMultiByte

  WriteConsoleW

  WriteFile

  lstrcmpiW

  lstrlenA

  lstrlenW

  ole32

  CoAllowSetForegroundWindow

  CoCreateInstance

  CoInitializeEx

  CoRegisterInitializeSpy

  CoRevokeInitializeSpy

  CoTaskMemAlloc

  CoTaskMemFree

  CoTaskMemRealloc

  CoUninitialize

  IIDFromString

  PropVariantClear

  StringFromGUID2

  bcrypt

  BCryptCloseAlgorithmProvider

  BCryptCreateHash

  BCryptDestroyHash

  BCryptFinishHash

  BCryptHashData

  BCryptOpenAlgorithmProvider

  secur32

  GetUserNameExW

  crypt32

  CryptBinaryToStringW

  propsys

  InitPropVariantFromCLSID

  ntdll

  NtDeleteKey

  userenv

  CreateEnvironmentBlock

  DestroyEnvironmentBlock

  api-ms-win-core-winrt-l1-1-0

  RoInitialize

  RoUninitialize

  Exports

  Exports

  GetHandleVerifier

  Launch

  Sections

  .text

  Size: 1.7MB - Virtual size: 1.7MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 227KB - Virtual size: 226KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 62KB - Virtual size: 123KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 55KB - Virtual size: 55KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .00cfg

  Size: 512B - Virtual size: 48B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .gxfg

  Size: 12KB - Virtual size: 11KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .retplne

  Size: 512B - Virtual size: 172B

  .tls

  Size: 512B - Virtual size: 489B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  LZMADEC

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  _RDATA

  Size: 512B - Virtual size: 348B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  malloc_h

  Size: 512B - Virtual size: 228B

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 196KB - Virtual size: 196KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 572KB - Virtual size: 576KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE