General

Malware Config

Signatures

Files

• 31a47ff3a5159eccf2e48943cbc855160f26e115359748faa2ce973b9a518674

  .exe windows:5 windows x64 arch:x64

  c54f40d6023142651a792ae38ae262de

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  PDB Paths

  mscorsvw.pdb

  Imports

  mscoree

  GetRequestedRuntimeInfo

  GetRealProcAddress

  msvcr80

  ?_type_info_dtor_internal_method@type_info@@QEAAXXZ

  __crt_debugger_hook

  _decode_pointer

  _onexit

  _lock

  __dllonexit

  _unlock

  ?terminate@@YAXXZ

  __set_app_type

  _encode_pointer

  _fmode

  _commode

  __setusermatherr

  _configthreadlocale

  _initterm_e

  _initterm

  _acmdln

  exit

  _cexit

  _ismbblead

  _exit

  _XcptFilter

  __C_specific_handler

  __getmainargs

  _amsg_exit

  free

  malloc

  _vsnprintf

  _snwprintf_s

  wcstoul

  wcscat_s

  towupper

  _vsnwprintf_s

  _errno

  _vsnprintf_s

  strcpy_s

  wcsncpy_s

  wcscpy_s

  memmove

  _purecall

  _wcsicmp

  memcmp

  memcpy

  _CxxThrowException

  __CxxFrameHandler3

  memset

  advapi32

  RegOpenKeyExA

  RegDeleteKeyW

  RegSetValueExW

  RegCreateKeyExW

  RegQueryValueExW

  RegOpenKeyExW

  RegCloseKey

  kernel32

  VirtualAlloc

  SleepEx

  ReleaseMutex

  CreateMutexW

  WaitForSingleObjectEx

  HeapFree

  GetProcessHeap

  HeapAlloc

  TlsFree

  TlsAlloc

  TlsSetValue

  ReleaseSemaphore

  CreateSemaphoreW

  ResetEvent

  DeleteCriticalSection

  InitializeCriticalSection

  LeaveCriticalSection

  EnterCriticalSection

  GetCurrentProcessId

  VirtualFree

  GetVersionExA

  RaiseException

  CloseHandle

  GetSystemTimeAsFileTime

  QueryPerformanceCounter

  GetCurrentThreadId

  VirtualQuery

  VirtualProtect

  HeapCreate

  HeapDestroy

  HeapValidate

  Sleep

  GetStartupInfoA

  SetUnhandledExceptionFilter

  GetTickCount

  UnhandledExceptionFilter

  RtlVirtualUnwind

  RtlLookupFunctionEntry

  RtlCaptureContext

  LoadLibraryExW

  GetCommandLineW

  GetCurrentProcess

  SetEvent

  GetModuleHandleW

  OpenProcess

  LoadLibraryW

  TerminateProcess

  GetModuleFileNameW

  GetProcAddress

  CreateEventW

  WaitForMultipleObjects

  IsDebuggerPresent

  OpenEventW

  DebugBreak

  CreateThread

  TlsGetValue

  FreeLibrary

  GetLastError

  SetLastError

  LocalFree

  MultiByteToWideChar

  GetACP

  GetCPInfo

  WideCharToMultiByte

  FormatMessageW

  GetEnvironmentVariableW

  lstrlenW

  user32

  LoadStringW

  PeekMessageW

  DispatchMessageW

  MessageBoxW

  MsgWaitForMultipleObjects

  ole32

  CoRegisterClassObject

  CoInitializeEx

  CoReleaseServerProcess

  CoAddRefServerProcess

  CoUninitialize

  CoRevokeClassObject

  oleaut32

  SetErrorInfo

  SysStringLen

  Sections

  .text

  Size: 72KB - Virtual size: 72KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 1024B - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 5KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 568KB - Virtual size: 572KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE