General

Malware Config

Signatures

Files

• 3f1927b89f9f4d5b2b4c0b74367e8829ad7ce85842eaad3ab2abde0e66e47ce1

  .exe windows:5 windows x86 arch:x86

  a14fe147cbb35ac7afa52e2cceed81b7

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  mscorsvw.pdb

  Imports

  mscoree

  GetRealProcAddress

  GetRequestedRuntimeInfo

  msvcr80

  ?_type_info_dtor_internal_method@type_info@@QAEXXZ

  _crt_debugger_hook

  _controlfp_s

  _invoke_watson

  _decode_pointer

  _onexit

  _lock

  __dllonexit

  _unlock

  ?terminate@@YAXXZ

  _except_handler4_common

  __set_app_type

  _encode_pointer

  __p__fmode

  __p__commode

  _adjust_fdiv

  __setusermatherr

  _configthreadlocale

  _initterm_e

  _initterm

  _acmdln

  exit

  _ismbblead

  _XcptFilter

  _exit

  _cexit

  __getmainargs

  _amsg_exit

  free

  malloc

  wcstoul

  wcscat_s

  towupper

  _vsnprintf

  _vsnwprintf_s

  _vsnprintf_s

  _errno

  wcsncpy_s

  wcscpy_s

  strcpy_s

  _snwprintf_s

  memmove

  memset

  strchr

  _CxxThrowException

  __CxxFrameHandler3

  _wcsicmp

  _purecall

  memcpy

  advapi32

  RegQueryValueExW

  RegCreateKeyExW

  RegCreateKeyExA

  RegSetValueExW

  RegSetValueExA

  RegDeleteKeyW

  RegDeleteKeyA

  RegQueryValueExA

  RegOpenKeyExW

  RegOpenKeyExA

  RegCloseKey

  kernel32

  GetEnvironmentVariableA

  GetEnvironmentVariableW

  GetCurrentProcessId

  LocalAlloc

  FormatMessageA

  FormatMessageW

  EnterCriticalSection

  LeaveCriticalSection

  InitializeCriticalSection

  DeleteCriticalSection

  ResetEvent

  ReleaseSemaphore

  TlsSetValue

  TlsAlloc

  TlsFree

  HeapAlloc

  GetProcessHeap

  HeapFree

  WaitForSingleObjectEx

  ReleaseMutex

  SleepEx

  VirtualAlloc

  VirtualFree

  VirtualQuery

  VirtualProtect

  HeapCreate

  HeapDestroy

  HeapValidate

  InterlockedExchange

  Sleep

  GetStartupInfoA

  SetUnhandledExceptionFilter

  GetTickCount

  UnhandledExceptionFilter

  GetProcAddress

  InterlockedIncrement

  IsDebuggerPresent

  InterlockedDecrement

  TerminateProcess

  GetCurrentProcess

  WaitForMultipleObjects

  CreateThread

  OpenProcess

  SetEvent

  DebugBreak

  TlsGetValue

  InterlockedCompareExchange

  GetLastError

  SetLastError

  GetModuleHandleA

  FreeLibrary

  CloseHandle

  RaiseException

  LocalFree

  MultiByteToWideChar

  GetCPInfo

  GetACP

  GetCurrentThreadId

  QueryPerformanceCounter

  GetSystemTimeAsFileTime

  lstrlenW

  GetVersionExA

  GetModuleHandleW

  GetCommandLineW

  WideCharToMultiByte

  LoadLibraryExA

  LoadLibraryExW

  GetModuleFileNameA

  GetModuleFileNameW

  CreateSemaphoreA

  CreateSemaphoreW

  CreateMutexA

  CreateMutexW

  CreateEventA

  CreateEventW

  OpenEventA

  OpenEventW

  user32

  PeekMessageA

  PeekMessageW

  DispatchMessageA

  DispatchMessageW

  MessageBoxA

  MessageBoxW

  LoadStringA

  LoadStringW

  MsgWaitForMultipleObjects

  ole32

  CoRevokeClassObject

  CoAddRefServerProcess

  CoUninitialize

  CoInitializeEx

  CoRegisterClassObject

  CoReleaseServerProcess

  oleaut32

  SysStringLen

  SetErrorInfo

  Sections

  .text

  Size: 55KB - Virtual size: 55KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 1.2MB - Virtual size: 1.8MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE