General

Malware Config

Signatures

Files

• 2024-05-23_f75a8d687a3b5a81d112effb45d278eb_backswap_mafia

  .exe windows:4 windows x86 arch:x86

  eb248eb1139039af28f5f2ad4ada1499

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  g:\Acro_root_ns\BuildResults\bin\Release\PDFPrevHndlrShim.pdb

  Imports

  kernel32

  LeaveCriticalSection

  GetModuleFileNameW

  FreeLibrary

  MultiByteToWideChar

  SizeofResource

  LoadResource

  FindResourceW

  LoadLibraryExW

  GetModuleHandleW

  CloseHandle

  WaitForSingleObject

  Sleep

  EnterCriticalSection

  CreateEventW

  GetCurrentThreadId

  SetEvent

  GetCommandLineW

  o5

  o5

  (

  InterlockedDecrement

  InterlockedIncrement

  lstrcmpiW

  GetLastError

  DeleteCriticalSection

  InitializeCriticalSection

  RaiseException

  CreateThread

  lstrlenW

  +r�
  

  (/

  (

  _
  

  r1
  

  ~M

  

  ,M�

  3M

  
  

  M

  

  +6~M

  o,

  

  
  

  ,(

  
  0

  
  

  �**

  0
  

  

  o(

   
  

  o

  K

  

  r�

  (

  *{K

  

  0

  Q-s

  o

  o

  (

  
  (

  t

  user32

  TranslateMessage

  DispatchMessageW

  GetMessageW

  PostThreadMessageW

  CharUpperW

  CharNextW

  RegQuerMZ�

  RegSetValueExW

  RegOpenKeyExW

  RegCreateKeyExW

  RegCloseKey

  RegDeleteValueW

  RegDeleteKeyW

  �

  

  s program cannot be run in DOS mode. $

  be run in DOS mode. $

  $

  
  

  
  
  

  �

  ord6

  ord7

  ord162

  ord161

  ord2

  ord186

  ord163

  ord277

  r`;$"

  h

  F���q&2Y\K+�/�w�� |��5�V,~��A8"iW'|��

  �V,~��A8"iW'|��

  h�쉟K�eO�1��a�S�+]+%�4�������(PRޏ�2O�_��ϡ<�A�r`;$"

  4�������(PRޏ�2O�_��ϡ<�A�r`;$"

  Sections

  .text

  Size: 56KB - Virtual size: 52KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .orpc

  Size: 4KB - Virtual size: 539B

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 20KB - Virtual size: 18KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 8KB - Virtual size: 8KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 8KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 8KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ