General

Malware Config

Signatures

Files

• 8e394afc0b9b053d2b0001faf035e79253bfb3d4a2393f851ed95f3d7a602c19

  .exe windows:5 windows x86 arch:x86

  448d61551c4c56c30b187bd4f9c417a8

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  FreeLibrary

  CloseHandle

  WideCharToMultiByte

  MultiByteToWideChar

  GetModuleHandleA

  GetFullPathNameA

  lstrcpyA

  GetProcAddress

  AreFileApisANSI

  GetLastError

  LoadLibraryA

  GetModuleFileNameA

  GlobalAlloc

  CreateMutexA

  lstrlenW

  GetFileAttributesA

  InterlockedDecrement

  GetStartupInfoA

  CreateProcessA

  SetLastError

  GlobalFree

  GetCurrentProcess

  GetACP

  GetOEMCP

  LocalFree

  VirtualProtect

  OutputDebugStringA

  lstrlenA

  lstrcpynA

  user32

  GetDesktopWindow

  IsWindowVisible

  GetDlgCtrlID

  SetWindowTextA

  SetForegroundWindow

  DrawTextA

  GetSystemMetrics

  IsWindow

  UpdateWindow

  SendMessageA

  FillRect

  SetCapture

  GetWindowRect

  GetWindowTextA

  TabbedTextOutA

  PtInRect

  GrayStringA

  DefWindowProcA

  EnumChildWindows

  GetParent

  EnableWindow

  GetSystemMenu

  GetKeyboardLayout

  GetDoubleClickTime

  IsZoomed

  OffsetRect

  ReleaseCapture

  SetRect

  gdi32

  AbortPath

  AngleArc

  AddFontMemResourceEx

  AbortDoc

  RectVisible

  LPtoDP

  SetRectRgn

  BitBlt

  TextOutA

  CreateFontIndirectA

  DPtoLP

  CreatePolygonRgn

  GetTextColor

  CombineRgn

  Polyline

  CreatePalette

  CreateRectRgn

  PtInRegion

  GetObjectA

  SetPixel

  PtVisible

  AnimatePalette

  advapi32

  LsaFreeMemory

  CryptDestroyHash

  LsaClose

  RegCloseKey

  RegOpenKeyExW

  CryptDeriveKey

  RegOpenKeyExA

  RegDeleteValueA

  RegDeleteValueW

  CryptEncrypt

  RegEnumValueA

  CryptAcquireContextA

  LsaOpenPolicy

  EqualSid

  CryptReleaseContext

  RegEnumValueW

  RegCreateKeyExA

  FreeSid

  RegCreateKeyExW

  CryptCreateHash

  CryptDestroyKey

  CryptDecrypt

  RegSetValueExW

  RegQueryValueExW

  IsTextUnicode

  RegQueryValueExA

  RegDeleteKeyW

  RegOpenCurrentUser

  RegEnumKeyW

  CryptHashData

  RegSetValueExA

  RegOpenKeyW

  shell32

  ShellExecuteA

  SHGetPathFromIDListA

  SHGetMalloc

  SHGetDesktopFolder

  ole32

  CoInitialize

  CLSIDFromProgID

  StringFromCLSID

  CoCreateInstance

  CoTaskMemFree

  CoUninitialize

  comctl32

  InitCommonControlsEx

  _TrackMouseEvent

  version

  VerQueryValueA

  GetFileVersionInfoSizeA

  GetFileVersionInfoA

  oledlg

  OleUIBusyW

  psapi

  GetModuleBaseNameA

  msvcrt

  calloc

  _mbscmp

  __set_app_type

  _CIcos

  _XcptFilter

  _initterm

  _vsnprintf

  _onexit

  ??1type_info@@UAE@XZ

  _controlfp

  __CxxFrameHandler

  ?terminate@@YAXXZ

  __setusermatherr

  free

  __p__commode

  _mbsicmp

  __getmainargs

  _strdup

  __p__fmode

  _setmbcp

  _except_handler3

  _splitpath

  _adjust_fdiv

  _CxxThrowException

  exit

  _exit

  _acmdln

  __dllonexit

  Sections

  .text

  Size: 57KB - Virtual size: 56KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 18KB - Virtual size: 18KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 4KB - Virtual size: 8KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 78KB - Virtual size: 77KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 3KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .htext

  Size: 12KB - Virtual size: 12KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE