General

Malware Config

Signatures

Files

• MrsMajor 3.0.7z

  .7z

  Password: DYG-Q5ntBT?JmezjzY[(jn2T(65f5(-4

• MrsMajor 3.0.exe

  .exe windows:4 windows x64 arch:x64

  Password: DYG-Q5ntBT?JmezjzY[(jn2T(65f5(-4

  167fe7dad034e11847397d501baf6f5e

  
  

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  msvcrt

  memset

  wcsncmp

  memmove

  wcsncpy

  wcsstr

  _wcsnicmp

  _wcsicmp

  wcslen

  wcscpy

  wcscmp

  memcpy

  tolower

  wcscat

  malloc

  free

  kernel32

  GetModuleHandleW

  HeapCreate

  GetStdHandle

  HeapDestroy

  ExitProcess

  WriteFile

  LoadLibraryExW

  EnumResourceTypesW

  FreeLibrary

  RemoveDirectoryW

  GetExitCodeProcess

  EnumResourceNamesW

  GetTempFileNameW

  GetCommandLineW

  LoadResource

  SizeofResource

  FreeResource

  FindResourceW

  GetShortPathNameW

  GetSystemDirectoryW

  EnterCriticalSection

  CloseHandle

  LeaveCriticalSection

  InitializeCriticalSection

  WaitForSingleObject

  TerminateThread

  CreateThread

  Sleep

  WideCharToMultiByte

  HeapAlloc

  HeapFree

  LoadLibraryW

  GetProcAddress

  GetCurrentProcessId

  GetCurrentThreadId

  GetModuleFileNameW

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GetCurrentProcess

  TerminateProcess

  RtlLookupFunctionEntry

  RtlVirtualUnwind

  RemoveVectoredExceptionHandler

  AddVectoredExceptionHandler

  HeapSize

  MultiByteToWideChar

  CreateDirectoryW

  SetFileAttributesW

  DeleteFileW

  GetTempPathW

  GetCurrentDirectoryW

  SetCurrentDirectoryW

  CreateFileW

  SetFilePointer

  TlsFree

  TlsGetValue

  TlsSetValue

  TlsAlloc

  HeapReAlloc

  DeleteCriticalSection

  GetLastError

  SetLastError

  UnregisterWait

  GetCurrentThread

  DuplicateHandle

  RegisterWaitForSingleObject

  shell32

  ShellExecuteExW

  SHGetFolderLocation

  SHGetPathFromIDListW

  winmm

  timeBeginPeriod

  ole32

  CoInitialize

  CoTaskMemFree

  shlwapi

  PathQuoteSpacesW

  PathAddBackslashW

  PathRenameExtensionW

  PathRemoveArgsW

  PathRemoveBackslashW

  user32

  CharUpperW

  CharLowerW

  MessageBoxW

  DefWindowProcW

  GetWindowLongPtrW

  GetWindowTextLengthW

  GetWindowTextW

  EnableWindow

  DestroyWindow

  UnregisterClassW

  LoadIconW

  LoadCursorW

  RegisterClassExW

  IsWindowEnabled

  GetSystemMetrics

  CreateWindowExW

  SetWindowLongPtrW

  SendMessageW

  SetFocus

  CreateAcceleratorTableW

  SetForegroundWindow

  BringWindowToTop

  GetMessageW

  TranslateAcceleratorW

  TranslateMessage

  DispatchMessageW

  DestroyAcceleratorTable

  PostMessageW

  GetForegroundWindow

  GetWindowThreadProcessId

  IsWindowVisible

  EnumWindows

  SetWindowPos

  gdi32

  GetStockObject

  comctl32

  InitCommonControlsEx

  Sections

  .code

  Size: 20KB - Virtual size: 20KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .text

  Size: 64KB - Virtual size: 63KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 19KB - Virtual size: 18KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .pdata

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 5KB - Virtual size: 8KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 267KB - Virtual size: 266KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ