General

Malware Config

Signatures

Files

• 961e9a5562df748f65d02cb709c8d6f1c845a9c11519a68e4de0684b8c55d359

  .exe windows:6 windows x86 arch:x86

  2b99bd8ba4e250bc88271c196822ace9

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  GetLogicalDriveStringsA

  GetDiskFreeSpaceExA

  lstrcmpA

  VirtualFree

  RtlZeroMemory

  InterlockedExchangeAdd

  InterlockedIncrement

  InterlockedDecrement

  HeapDestroy

  HeapCreate

  lstrlenW

  lstrcmpW

  lstrcmpiW

  CreateMutexA

  WaitForSingleObject

  ReleaseMutex

  InitializeCriticalSection

  EnterCriticalSection

  LeaveCriticalSection

  DeleteCriticalSection

  CreateTimerQueue

  GetSystemTimeAsFileTime

  GetLocalTime

  CreateTimerQueueTimer

  ChangeTimerQueueTimer

  DeleteTimerQueueTimer

  DeleteTimerQueueEx

  HeapReAlloc

  ExitProcess

  GetModuleHandleA

  IsBadReadPtr

  GetModuleFileNameA

  CreateDirectoryA

  DeleteFileA

  CreateProcessA

  GetStartupInfoA

  GetUserDefaultLCID

  Sleep

  WriteFile

  SetFilePointer

  GetFileSize

  GetPrivateProfileStringA

  GetTickCount

  WritePrivateProfileStringA

  FindClose

  FindFirstFileA

  FindNextFileA

  CopyFileA

  SetFileAttributesA

  RemoveDirectoryA

  FreeLibrary

  GetProcAddress

  Process32First

  LCMapStringA

  CreateFileW

  GetConsoleMode

  GetConsoleCP

  FlushFileBuffers

  HeapSize

  SetFilePointerEx

  lstrcpynA

  GetStringTypeW

  SetStdHandle

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GetCommandLineW

  GetCommandLineA

  GetCPInfo

  GetOEMCP

  GetACP

  IsValidCodePage

  FindNextFileW

  FindFirstFileExW

  GetFileType

  DecodePointer

  GetModuleHandleExW

  GetModuleFileNameW

  GetStdHandle

  LoadLibraryExW

  TlsFree

  TlsSetValue

  TlsGetValue

  TlsAlloc

  InitializeCriticalSectionAndSpinCount

  EncodePointer

  SetLastError

  RaiseException

  CreateToolhelp32Snapshot

  WideCharToMultiByte

  lstrlenA

  GetCurrentThreadId

  LocalSize

  GetModuleHandleW

  MultiByteToWideChar

  HeapAlloc

  GetLastError

  ReadFile

  CloseHandle

  GetFileSizeEx

  CreateFileA

  CreateThread

  Wow64RevertWow64FsRedirection

  Wow64DisableWow64FsRedirection

  GetTimeFormatA

  GetDateFormatA

  HeapFree

  GetProcessHeap

  RtlUnwind

  GetCurrentProcess

  IsProcessorFeaturePresent

  GetStartupInfoW

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  IsDebuggerPresent

  InitializeSListHead

  GetCurrentProcessId

  QueryPerformanceCounter

  TerminateProcess

  OpenProcess

  Module32First

  LCMapStringW

  Process32Next

  RtlMoveMemory

  VirtualAlloc

  LoadLibraryA

  WriteConsoleW

  user32

  ShowWindow

  RegisterClassExW

  LoadCursorW

  DefWindowProcW

  SystemParametersInfoW

  LoadIconW

  CreateWindowExW

  UpdateLayeredWindow

  SetWindowsHookExW

  TranslateMessage

  DispatchMessageW

  CallNextHookEx

  MapVirtualKeyA

  GetMessageW

  CallWindowProcW

  BeginPaint

  GetClientRect

  IntersectRect

  EndPaint

  GetFocus

  SetFocus

  SetCapture

  ReleaseCapture

  ScreenToClient

  IsRectEmpty

  IsZoomed

  PtInRect

  MessageBeep

  MessageBoxA

  wsprintfA

  wvsprintfA

  RemovePropA

  InvalidateRect

  ReleaseDC

  GetDC

  OffsetRect

  GetWindowRect

  DefWindowProcA

  GetPropA

  SetPropA

  SetWindowLongW

  GetWindowLongW

  IsWindow

  gdi32

  DeleteDC

  DeleteObject

  SelectObject

  CreateCompatibleBitmap

  CreateCompatibleDC

  GetObjectA

  GetCurrentObject

  BitBlt

  advapi32

  CryptHashData

  CryptDestroyHash

  CryptAcquireContextA

  CryptGetHashParam

  CryptReleaseContext

  CryptDecrypt

  CryptDestroyKey

  CryptEncrypt

  CryptDeriveKey

  CryptCreateHash

  ole32

  CoUninitialize

  CreateStreamOnHGlobal

  CoCreateInstance

  CLSIDFromString

  CLSIDFromProgID

  OleRun

  CoInitialize

  oleaut32

  SafeArrayAllocDescriptor

  SafeArrayAllocData

  RegisterTypeLi

  SafeArrayGetElemsize

  SafeArrayGetUBound

  SafeArrayGetLBound

  SafeArrayAccessData

  SafeArrayUnaccessData

  VariantInit

  SafeArrayGetDim

  VariantTimeToSystemTime

  SysAllocString

  SysFreeString

  SafeArrayCreate

  SafeArrayDestroy

  VariantClear

  VariantCopy

  VariantChangeType

  VarR8FromCy

  VarR8FromBool

  LHashValOfNameSys

  LoadTypeLi

  ws2_32

  WSAStartup

  WSAGetLastError

  WSACleanup

  gdiplus

  GdipCreateFromHDC

  GdiplusStartup

  GdipLoadImageFromStream

  GdipDrawImageRect

  GdipDisposeImage

  GdiplusShutdown

  GdipGetImageDimension

  GdipDeleteGraphics

  ntdll

  RtlComputeCrc32

  NtQueryInformationProcess

  NtQuerySystemInformation

  RtlGetCompressionWorkSpaceSize

  RtlCompressBuffer

  RtlDecompressBuffer

  shlwapi

  PathRemoveBackslashA

  PathFileExistsA

  StrToIntW

  StrToIntExW

  PathFindFileNameA

  PathRemoveFileSpecA

  shell32

  ShellExecuteA

  comdlg32

  GetOpenFileNameW

  GetSaveFileNameA

  imm32

  ImmGetContext

  ImmSetCompositionWindow

  ImmReleaseContext

  ImmSetCandidateWindow

  Sections

  .text

  Size: 571KB - Virtual size: 571KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 47KB - Virtual size: 46KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 53KB - Virtual size: 104KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 18KB - Virtual size: 18KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 21KB - Virtual size: 21KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ