General

Malware Config

Signatures

Files

• 91599f575746308d2b7ac70f5e3081b7b3959d9cf9bc23e8140b6d9fd0342f44

  .exe windows:5 windows x86 arch:x86

  d2df2b5eef80dc5d191058b4c90f9924

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  GetLastError

  MultiByteToWideChar

  LocalFree

  FormatMessageW

  GetFileAttributesW

  MoveFileExW

  SetFileTime

  SetFileAttributesW

  LocalFileTimeToFileTime

  VirtualAlloc

  VirtualFree

  GetModuleHandleW

  FindClose

  FindFirstFileW

  FindNextFileW

  GetSystemTimeAsFileTime

  FileTimeToDosDateTime

  DosDateTimeToFileTime

  GetSystemInfo

  FileTimeToLocalFileTime

  ResetEvent

  ReleaseSemaphore

  CreateSemaphoreW

  GetCurrentProcessId

  GetCurrentThreadId

  GetTickCount

  QueryPerformanceCounter

  GetVersionExW

  WaitForMultipleObjects

  WriteFile

  SetEndOfFile

  SetLastError

  GetSystemDirectoryW

  GetCurrentDirectoryW

  CreateDirectoryW

  RemoveDirectoryW

  GetModuleHandleA

  GlobalFree

  LocalAlloc

  HeapAlloc

  HeapFree

  GetProcessHeap

  GetCurrentProcess

  TerminateProcess

  GetExitCodeProcess

  lstrcpyW

  CreateProcessW

  SleepEx

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  DecodePointer

  HeapDestroy

  HeapReAlloc

  HeapSize

  RaiseException

  InitializeCriticalSectionAndSpinCount

  CopyFileW

  GetLongPathNameW

  GetEnvironmentVariableW

  WinExec

  GetPrivateProfileIntW

  GetPrivateProfileStringW

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsProcessorFeaturePresent

  MulDiv

  GetStartupInfoW

  InitializeSListHead

  GetVolumeInformationW

  FileTimeToSystemTime

  ReleaseMutex

  CreateMutexW

  DeviceIoControl

  SetPriorityClass

  FlushInstructionCache

  HeapCreate

  FreeResource

  LockResource

  LoadResource

  SizeofResource

  FindResourceW

  GetFullPathNameW

  GetLocalTime

  GetVersionExA

  LoadLibraryA

  OutputDebugStringW

  RtlUnwind

  EncodePointer

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  LoadLibraryExW

  ExitThread

  FreeLibraryAndExitThread

  GetModuleHandleExW

  ExitProcess

  GetStdHandle

  GetACP

  GetFileType

  GetStringTypeW

  GetDateFormatW

  GetTimeFormatW

  CompareStringW

  LCMapStringW

  GetLocaleInfoW

  IsValidLocale

  GetUserDefaultLCID

  EnumSystemLocalesW

  GetConsoleMode

  ReadConsoleW

  SetFilePointerEx

  GetTimeZoneInformation

  GetConsoleCP

  FindFirstFileExW

  IsValidCodePage

  GetOEMCP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableA

  SetConsoleCtrlHandler

  WaitForSingleObjectEx

  SetStdHandle

  FlushFileBuffers

  WriteConsoleW

  PeekNamedPipe

  ExpandEnvironmentStringsA

  VerSetConditionMask

  GetSystemDirectoryA

  VerifyVersionInfoA

  SwitchToFiber

  DeleteFiber

  CreateFiber

  IsDebuggerPresent

  FormatMessageA

  ConvertFiberToThread

  ConvertThreadToFiber

  SetConsoleMode

  ReadConsoleA

  GetSystemTime

  SystemTimeToFileTime

  InterlockedCompareExchange

  GetFileInformationByHandle

  GetFileSizeEx

  MapViewOfFile

  UnmapViewOfFile

  CreateFileMappingW

  lstrlenA

  GetDriveTypeW

  SystemTimeToTzSpecificLocalTime

  GlobalUnlock

  GlobalLock

  GlobalAlloc

  DeleteFileW

  GetTempPathW

  SetCurrentDirectoryW

  GetModuleFileNameW

  WideCharToMultiByte

  OutputDebugStringA

  InterlockedDecrement

  InterlockedIncrement

  CreateFileW

  WritePrivateProfileStringW

  ReadFile

  GetFileSize

  CreateEventW

  Sleep

  WaitForSingleObject

  SetEvent

  DeleteCriticalSection

  LeaveCriticalSection

  EnterCriticalSection

  InitializeCriticalSection

  GetExitCodeThread

  TerminateThread

  CreateThread

  QueryDosDeviceW

  GetWindowsDirectoryW

  LoadLibraryW

  GetLogicalDriveStringsW

  lstrlenW

  lstrcmpiW

  CloseHandle

  OpenProcess

  GetProcAddress

  FreeLibrary

  user32

  SetMenuContextHelpId

  MsgWaitForMultipleObjects

  GetMessageW

  CharNextW

  LoadImageW

  CreateIconFromResource

  LoadBitmapW

  DestroyIcon

  ScreenToClient

  SetCaretPos

  HideCaret

  GetCaretBlinkTime

  CreateCaret

  GetCursorPos

  InvalidateRect

  EndPaint

  BeginPaint

  UpdateWindow

  ReleaseCapture

  SetCapture

  GetCapture

  IsZoomed

  IsIconic

  SetLayeredWindowAttributes

  AnimateWindow

  PostQuitMessage

  PostMessageW

  TrackMouseEvent

  GetMonitorInfoW

  MonitorFromWindow

  GetWindow

  GetParent

  MapWindowPoints

  GetWindowRect

  GetClientRect

  GetActiveWindow

  GetDlgItem

  CreateWindowExW

  RegisterClassExW

  CallWindowProcW

  DefWindowProcW

  GetFocus

  SetFocus

  GetMenuItemInfoW

  IsRectEmpty

  UnionRect

  CopyRect

  SetRect

  SetCursor

  KillTimer

  SetTimer

  DestroyWindow

  DestroyCursor

  LoadCursorW

  IntersectRect

  LoadStringW

  GetKeyState

  SetWindowLongW

  GetWindowLongW

  GetForegroundWindow

  SetMenuInfo

  GetMenuInfo

  TrackPopupMenu

  AppendMenuW

  SendMessageW

  ShowWindow

  SetWindowPos

  SetWindowTextW

  IsWindow

  SetForegroundWindow

  FindWindowW

  UnregisterClassW

  GetClassNameW

  PeekMessageW

  DispatchMessageW

  TranslateMessage

  wsprintfW

  CharPrevExA

  CharUpperW

  GetIconInfo

  DrawIconEx

  OffsetRect

  InflateRect

  ReleaseDC

  GetMenuItemCount

  ClientToScreen

  DestroyMenu

  CreatePopupMenu

  IsWindowEnabled

  IsMenu

  UpdateLayeredWindow

  MapVirtualKeyA

  CharLowerBuffW

  SystemParametersInfoA

  DrawTextW

  IsWindowVisible

  MessageBoxW

  GetSystemMetrics

  GetSysColor

  EnableMenuItem

  PtInRect

  SystemParametersInfoW

  GetUserObjectInformationW

  GetProcessWindowStation

  GetDC

  EqualRect

  advapi32

  RegCreateKeyExW

  RegSetValueExW

  RegQueryValueExW

  RegOpenKeyExW

  RegCloseKey

  ReportEventW

  DeregisterEventSource

  LookupAccountNameW

  GetFileSecurityW

  SetFileSecurityW

  GetSecurityDescriptorDacl

  OpenProcessToken

  GetTokenInformation

  SetTokenInformation

  InitializeSecurityDescriptor

  SetSecurityDescriptorDacl

  LookupAccountSidW

  CreateProcessAsUserW

  DuplicateTokenEx

  RevertToSelf

  ImpersonateLoggedOnUser

  GetSecurityDescriptorControl

  RegDeleteValueW

  RegEnumKeyW

  RegOpenKeyW

  RegCreateKeyW

  RegDeleteKeyW

  RegSetValueW

  EqualSid

  GetLengthSid

  InitializeAcl

  GetAclInformation

  AddAccessAllowedAce

  GetAce

  AddAce

  CryptAcquireContextW

  CryptReleaseContext

  CryptGenRandom

  RegisterEventSourceW

  shell32

  SHBrowseForFolderW

  ShellExecuteExW

  ShellExecuteW

  SHGetSpecialFolderPathW

  SHCreateDirectoryExW

  SHGetFolderPathW

  SHGetPathFromIDListW

  SHFileOperationW

  ole32

  CreateBindCtx

  CLSIDFromProgID

  CLSIDFromString

  OleLockRunning

  CoUninitialize

  CoCreateGuid

  OleInitialize

  CreateStreamOnHGlobal

  CoInitialize

  CoCreateInstance

  OleUninitialize

  psapi

  GetProcessImageFileNameW

  EnumProcessModules

  EnumProcesses

  GetModuleFileNameExW

  shlwapi

  PathFileExistsW

  StrToIntExW

  SHCreateStreamOnFileEx

  gdiplus

  GdipGetImageHeight

  GdipGetImageWidth

  GdipGetImageGraphicsContext

  GdipImageGetFrameCount

  GdipImageSelectActiveFrame

  GdipGetPropertyItemSize

  GdipDisposeImage

  GdipCloneImage

  GdipImageGetFrameDimensionsCount

  GdiplusStartup

  GdipFree

  GdipAlloc

  GdipGetPropertyItem

  GdipCreateBitmapFromStream

  GdipCreateBitmapFromFile

  GdipCreateBitmapFromScan0

  GdipBitmapLockBits

  GdiplusShutdown

  GdipImageGetFrameDimensionsList

  GdipBitmapUnlockBits

  GdipDeleteGraphics

  GdipDrawImageI

  GdipSaveImageToFile

  GdipGraphicsClear

  GdipDrawImageRectI

  GdipGetImageEncodersSize

  GdipGetImageEncoders

  imm32

  ImmGetContext

  ImmReleaseContext

  ImmAssociateContext

  gdi32

  SelectObject

  SelectClipRgn

  IntersectClipRect

  GetRegionData

  GdiFlush

  GetTextFaceW

  ExtTextOutW

  SetWorldTransform

  GetTextMetricsW

  SetTextAlign

  SetTextColor

  RemoveFontMemResourceEx

  AddFontMemResourceEx

  GetTextExtentPointI

  GetGlyphIndicesW

  GetFontUnicodeRanges

  GetOutlineTextMetricsW

  GetGlyphOutlineW

  GetFontData

  GetCharABCWidthsW

  EnumFontFamiliesExW

  ExtCreateRegion

  DeleteObject

  DeleteDC

  CreateBitmap

  StretchBlt

  CreateRoundRectRgn

  EnumFontsW

  BitBlt

  GetViewportOrgEx

  GetCurrentObject

  SetViewportOrgEx

  GetObjectW

  CreateDIBSection

  SetBkMode

  Rectangle

  GetStockObject

  CreateSolidBrush

  CreateFontIndirectW

  SetGraphicsMode

  CreateCompatibleDC

  GetDeviceCaps

  oleaut32

  SysAllocString

  SysFreeString

  VariantClear

  VariantCopy

  SysAllocStringLen

  crypt32

  CryptMsgGetParam

  CertCloseStore

  CertFindCertificateInStore

  CertFreeCertificateContext

  CertGetNameStringW

  CryptQueryObject

  CryptMsgClose

  userenv

  DestroyEnvironmentBlock

  CreateEnvironmentBlock

  wldap32

  ord35

  ord200

  ord301

  ord79

  ord30

  ord143

  ord46

  ord211

  ord60

  ord50

  ord41

  ord22

  ord26

  ord27

  ord33

  ord32

  ws2_32

  sendto

  accept

  listen

  ioctlsocket

  gethostname

  recvfrom

  WSAStartup

  WSACleanup

  recv

  send

  WSAGetLastError

  __WSAFDIsSet

  select

  WSASetLastError

  bind

  closesocket

  connect

  getpeername

  getsockname

  freeaddrinfo

  getsockopt

  htons

  ntohs

  setsockopt

  socket

  WSAIoctl

  getaddrinfo

  usp10

  ScriptFreeCache

  ScriptItemize

  ScriptShape

  Sections

  .text

  Size: 3.4MB - Virtual size: 3.4MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 940KB - Virtual size: 940KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 79KB - Virtual size: 206KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .gfids

  Size: 512B - Virtual size: 432B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .tls

  Size: 512B - Virtual size: 9B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 35.6MB - Virtual size: 35.6MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 190KB - Virtual size: 189KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ