General

Malware Config

Signatures

Files

• b4012c45423840f0e2e313bb0f66e545b383c714ebdff0e183f8ac33dd04d46c

  .exe windows:6 windows x64 arch:x64

  c3351dc13c0aefa20481960de77efb9f

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  PDB Paths

  C:\Users\Administrator\Desktop\rs\rs\rs\ff\target\release\deps\ff.pdb

  Imports

  ntdll

  NtWriteFile

  RtlLookupFunctionEntry

  NtReadVirtualMemory

  RtlNtStatusToDosError

  RtlVirtualUnwind

  RtlCaptureContext

  NtWaitForSingleObject

  NtCreateThreadEx

  NtProtectVirtualMemory

  NtWriteVirtualMemory

  NtAllocateVirtualMemory

  kernel32

  InitializeSListHead

  GetCurrentThreadId

  UnhandledExceptionFilter

  IsDebuggerPresent

  SetUnhandledExceptionFilter

  GetModuleHandleW

  GetSystemTimeAsFileTime

  GetConsoleWindow

  LoadLibraryA

  GetProcAddress

  WriteProcessMemory

  CreateProcessA

  CreateFileW

  CreateFileMappingW

  CloseHandle

  MapViewOfFile

  UnmapViewOfFile

  GetCurrentProcess

  GetCurrentThread

  ReleaseSRWLockExclusive

  ReleaseMutex

  ReleaseSRWLockShared

  GetLastError

  AddVectoredExceptionHandler

  SetThreadStackGuarantee

  QueryPerformanceCounter

  AcquireSRWLockExclusive

  SetLastError

  GetCurrentDirectoryW

  GetEnvironmentVariableW

  GetStdHandle

  GetCurrentProcessId

  WaitForSingleObject

  TryAcquireSRWLockExclusive

  HeapAlloc

  GetProcessHeap

  HeapFree

  HeapReAlloc

  AcquireSRWLockShared

  WaitForSingleObjectEx

  CreateMutexA

  GetModuleHandleA

  GetConsoleMode

  IsProcessorFeaturePresent

  FormatMessageW

  ExitProcess

  MultiByteToWideChar

  WriteConsoleW

  psapi

  EnumProcessModulesEx

  GetModuleBaseNameW

  user32

  ShowWindow

  SetWindowPos

  vcruntime140

  __C_specific_handler

  __current_exception

  __CxxFrameHandler3

  memcmp

  __current_exception_context

  memmove

  _CxxThrowException

  memset

  memcpy

  api-ms-win-crt-math-l1-1-0

  __setusermatherr

  api-ms-win-crt-runtime-l1-1-0

  _crt_atexit

  _seh_filter_exe

  _set_app_type

  terminate

  _configure_narrow_argv

  _initialize_narrow_environment

  _initterm

  _initterm_e

  exit

  _exit

  _register_onexit_function

  __p___argc

  __p___argv

  _cexit

  _c_exit

  _register_thread_local_exe_atexit_callback

  _get_initial_narrow_environment

  _initialize_onexit_table

  api-ms-win-crt-stdio-l1-1-0

  _set_fmode

  __p__commode

  api-ms-win-crt-locale-l1-1-0

  _configthreadlocale

  api-ms-win-crt-heap-l1-1-0

  _set_new_mode

  free

  Sections

  .text

  Size: 127KB - Virtual size: 127KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 66KB - Virtual size: 66KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 936B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 5KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ