General

Malware Config

Signatures

Files

• 7caf46f3202073283f9a15c210d9f1f9a7697c944206983f439ae48a8c66cda3

  .exe windows:6 windows x64 arch:x64

  28d3ad9e7b2dd725df12065a08e1370d

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_GUARD_CF

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  PDB Paths

  D:\qb\workspace\21461\source\output\dump64\gfxui\EventManager\igfxEM\Release\igfxEM.pdb

  Imports

  kernel32

  GetModuleFileNameW

  GetModuleHandleW

  GetProcAddress

  LoadLibraryExW

  LoadResource

  LockResource

  SizeofResource

  FindResourceW

  GlobalAlloc

  GlobalUnlock

  GlobalLock

  GlobalHandle

  GlobalFree

  MulDiv

  lstrcmpW

  lstrcmpiW

  MultiByteToWideChar

  WideCharToMultiByte

  DeleteFileW

  FindClose

  FindFirstFileW

  FindNextFileW

  GetExitCodeThread

  GetTickCount

  ExpandEnvironmentStringsW

  SetFileAttributesW

  GetSystemDirectoryW

  CreateDirectoryW

  OpenEventW

  GetCurrentProcessId

  ProcessIdToSessionId

  GetFileAttributesW

  CreateProcessW

  LoadLibraryW

  WTSGetActiveConsoleSessionId

  GetLocaleInfoW

  GetSystemDefaultUILanguage

  GetUserDefaultUILanguage

  GetSystemDefaultLangID

  WriteConsoleW

  SetEndOfFile

  CreateFileW

  SetStdHandle

  SetEnvironmentVariableW

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GetCommandLineA

  FindFirstFileExW

  FlushFileBuffers

  GetOEMCP

  GetACP

  IsValidCodePage

  GetFileSizeEx

  FindResourceExW

  SetFilePointerEx

  ReadConsoleW

  GetConsoleMode

  GetTimeZoneInformation

  GetFileType

  EnumSystemLocalesW

  GetUserDefaultLCID

  IsValidLocale

  LCMapStringW

  CompareStringW

  FlsFree

  FlsSetValue

  FlsGetValue

  FlsAlloc

  GetModuleHandleExW

  ExitProcess

  WriteFile

  GetStdHandle

  ReadFile

  VirtualQuery

  VirtualProtect

  GetSystemInfo

  TlsFree

  TlsSetValue

  TlsGetValue

  TlsAlloc

  RtlPcToFileHeader

  RtlUnwindEx

  GetCPInfo

  LCMapStringEx

  GetStringTypeW

  LocalFree

  GetStartupInfoW

  GetSystemTimeAsFileTime

  QueryPerformanceCounter

  IsProcessorFeaturePresent

  TerminateProcess

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  RtlVirtualUnwind

  RtlLookupFunctionEntry

  RtlCaptureContext

  WaitForSingleObjectEx

  ResetEvent

  InitializeCriticalSectionAndSpinCount

  LoadLibraryExA

  VirtualFree

  VirtualAlloc

  FlushInstructionCache

  GetCurrentProcess

  InterlockedPushEntrySList

  InterlockedPopEntrySList

  InitializeSListHead

  EncodePointer

  OutputDebugStringW

  IsDebuggerPresent

  GetCurrentThreadId

  CreateThread

  Sleep

  CreateEventW

  CreateMutexW

  WaitForSingleObject

  SetEvent

  LeaveCriticalSection

  EnterCriticalSection

  GetProcessHeap

  HeapSize

  HeapFree

  HeapReAlloc

  HeapAlloc

  FreeLibrary

  HeapDestroy

  DecodePointer

  SetLastError

  CloseHandle

  GetCommandLineW

  DeleteCriticalSection

  InitializeCriticalSectionEx

  GetLastError

  RaiseException

  GetConsoleOutputCP

  RtlUnwind

  user32

  IsWindow

  CreateWindowExW

  GetClassInfoExW

  RegisterClassExW

  CallWindowProcW

  DefWindowProcW

  PostThreadMessageW

  SendMessageW

  DispatchMessageW

  TranslateMessage

  GetMessageW

  RegisterWindowMessageW

  UnregisterClassW

  GetSystemMetrics

  GetSubMenu

  IsChild

  TrackPopupMenuEx

  SetMenuDefaultItem

  SetForegroundWindow

  GetWindowRect

  SetWindowContextHelpId

  MessageBoxW

  CreateDialogIndirectParamW

  GetDlgItem

  CharUpperW

  GetCursorPos

  LoadIconW

  LoadImageW

  MapDialogRect

  GetDisplayConfigBufferSizes

  SetDisplayConfig

  QueryDisplayConfig

  DestroyWindow

  SetWindowPos

  InsertMenuW

  MoveWindow

  CharNextW

  SetFocus

  GetFocus

  SetCapture

  ReleaseCapture

  CreateAcceleratorTableW

  DestroyAcceleratorTable

  GetDC

  ReleaseDC

  BeginPaint

  EndPaint

  InvalidateRect

  InvalidateRgn

  ClientToScreen

  RedrawWindow

  SetWindowTextW

  GetWindowTextW

  GetWindowTextLengthW

  KillTimer

  SetTimer

  MapVirtualKeyExW

  GetKeyNameTextW

  SendDlgItemMessageW

  EndDialog

  CreateDialogParamW

  IsWindowVisible

  ShowWindow

  PostQuitMessage

  UnregisterDeviceNotification

  RegisterDeviceNotificationW

  UnregisterHotKey

  RegisterHotKey

  GetKeyboardLayout

  GetKeyboardLayoutList

  ActivateKeyboardLayout

  LoadKeyboardLayoutW

  MsgWaitForMultipleObjects

  PeekMessageW

  FindWindowW

  DestroyMenu

  CreatePopupMenu

  PostMessageW

  LoadCursorW

  GetWindow

  GetClassNameW

  GetParent

  GetDesktopWindow

  SetWindowLongPtrW

  GetWindowLongPtrW

  SetWindowLongW

  GetWindowLongW

  FillRect

  GetSysColor

  ScreenToClient

  GetClientRect

  gdi32

  GetObjectW

  BitBlt

  CreateCompatibleBitmap

  CreateCompatibleDC

  CreateSolidBrush

  DeleteDC

  DeleteObject

  GetDeviceCaps

  SelectObject

  GetStockObject

  advapi32

  RegDeleteKeyW

  ConvertStringSecurityDescriptorToSecurityDescriptorW

  RegQueryValueExW

  RegSetValueExW

  RegQueryInfoKeyW

  RegOpenKeyExW

  RegCloseKey

  RegCreateKeyExW

  RegDeleteValueW

  RegEnumKeyExW

  ole32

  CLSIDFromString

  OleLockRunning

  OleRun

  OleUninitialize

  OleInitialize

  CoInitialize

  CoTaskMemFree

  CoTaskMemRealloc

  CoTaskMemAlloc

  StringFromGUID2

  CLSIDFromProgID

  CoInitializeEx

  CoCreateInstance

  CoReleaseServerProcess

  CoAddRefServerProcess

  CoResumeClassObjects

  CoRevokeClassObject

  CoRegisterClassObject

  CoGetClassObject

  CoUninitialize

  CreateStreamOnHGlobal

  oleaut32

  SysAllocStringLen

  SysStringLen

  VariantInit

  VariantClear

  VarUI4FromStr

  LoadTypeLi

  SysAllocString

  RegisterTypeLi

  UnRegisterTypeLi

  OleCreateFontIndirect

  SysStringByteLen

  SysAllocStringByteLen

  LoadRegTypeLi

  GetErrorInfo

  SysFreeString

  setupapi

  SetupDiCreateDeviceInfoList

  SetupDiGetClassDevsW

  SetupDiGetDevicePropertyW

  SetupDiEnumDeviceInfo

  SetupDiDestroyDeviceInfoList

  SetupDiOpenDeviceInfoW

  SetupDiOpenDevRegKey

  wtsapi32

  WTSUnRegisterSessionNotification

  WTSRegisterSessionNotification

  shell32

  Shell_NotifyIconW

  SHCreateItemFromParsingName

  shlwapi

  StrStrW

  bcrypt

  BCryptHashData

  BCryptCreateHash

  BCryptFinishHash

  BCryptDestroyHash

  BCryptDecrypt

  BCryptEncrypt

  BCryptGenerateSymmetricKey

  BCryptCloseAlgorithmProvider

  BCryptGetProperty

  BCryptOpenAlgorithmProvider

  BCryptDestroyKey

  version

  GetFileVersionInfoSizeExW

  VerQueryValueW

  GetFileVersionInfoExW

  Sections

  .text

  Size: 392KB - Virtual size: 392KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 140KB - Virtual size: 140KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 16KB - Virtual size: 45KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 24KB - Virtual size: 23KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  _RDATA

  Size: 512B - Virtual size: 384B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 148KB - Virtual size: 148KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .zero

  Size: 8KB - Virtual size: 4KB

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ