General

Malware Config

Signatures

Files

• 0aa15604795087d7f963ccc634f7582134a78171bc8a1239917c2239ba4418d1

  .dll windows:4 windows x86 arch:x86

  ae118f3d7fe149b456ac30484c6830f8

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  Imports

  kernel32

  FindClose

  LocalFree

  FindNextFileA

  LocalReAlloc

  LocalAlloc

  FindFirstFileA

  RemoveDirectoryA

  SetFileAttributesA

  ReadFile

  MoveFileA

  WaitForSingleObject

  FreeLibrary

  GetProcAddress

  LoadLibraryA

  GetTickCount

  WinExec

  LocalSize

  GetCurrentProcessId

  Process32Next

  TerminateProcess

  OpenProcess

  Process32First

  CopyFileA

  GetModuleFileNameA

  GlobalMemoryStatusEx

  GetCurrentDirectoryA

  FreeConsole

  GetModuleHandleA

  SetEvent

  GetLogicalDriveStringsA

  GetProcessHeap

  VirtualProtect

  HeapFree

  InitializeCriticalSection

  DeleteCriticalSection

  CreateThread

  LeaveCriticalSection

  EnterCriticalSection

  GlobalFree

  GlobalUnlock

  GlobalLock

  GlobalAlloc

  GlobalSize

  QueryPerformanceFrequency

  QueryPerformanceCounter

  GetSystemDirectoryA

  GetStartupInfoA

  CreatePipe

  DisconnectNamedPipe

  TerminateThread

  PeekNamedPipe

  WaitForMultipleObjects

  CreateEventA

  WritePrivateProfileStringA

  GetPrivateProfileStringA

  lstrcmpiA

  GetCurrentThreadId

  GetSystemInfo

  GetVolumeInformationA

  GetDiskFreeSpaceExA

  GetDriveTypeA

  ExpandEnvironmentStringsA

  lstrcatA

  CreateProcessA

  lstrlenA

  lstrcpyA

  GetFileAttributesA

  CreateDirectoryA

  GetLastError

  DeleteFileA

  GetCurrentProcess

  IsWow64Process

  GetFileSize

  CreateFileA

  SetFilePointer

  WriteFile

  VirtualFree

  CloseHandle

  Sleep

  InterlockedExchange

  VirtualAlloc

  HeapAlloc

  user32

  GetUserObjectInformationA

  GetThreadDesktop

  wsprintfA

  SetThreadDesktop

  CloseDesktop

  GetCursorPos

  GetCursorInfo

  GetClipboardData

  OpenClipboard

  EmptyClipboard

  SetClipboardData

  CloseClipboard

  mouse_event

  MapVirtualKeyA

  keybd_event

  CharNextA

  SystemParametersInfoA

  SendMessageA

  ReleaseDC

  BlockInput

  DestroyCursor

  LoadCursorA

  GetDC

  GetLastInputInfo

  OpenInputDesktop

  GetSystemMetrics

  ChangeDisplaySettingsA

  GetWindowThreadProcessId

  gdi32

  CreateCompatibleBitmap

  GetDIBits

  CreateRectRgnIndirect

  CombineRgn

  GetRegionData

  BitBlt

  DeleteObject

  CreateCompatibleDC

  CreateDIBSection

  SelectObject

  DeleteDC

  GetDeviceCaps

  advapi32

  OpenServiceA

  QueryServiceStatus

  ControlService

  CloseServiceHandle

  RegQueryValueA

  RegOpenKeyExA

  RegSetValueExA

  RegCloseKey

  GetUserNameA

  OpenSCManagerA

  shell32

  SHGetFolderPathA

  ShellExecuteExA

  SHGetFileInfoA

  SHGetSpecialFolderPathA

  ole32

  CoCreateInstance

  CoInitialize

  oleaut32

  VariantClear

  VariantInit

  mfc42

  ord823

  ord825

  msvcrt

  _strupr

  _stricmp

  _strcmpi

  _strnicmp

  exit

  fprintf

  sscanf

  getenv

  _adjust_fdiv

  _initterm

  _onexit

  __dllonexit

  ??1type_info@@UAE@XZ

  _beginthreadex

  _iob

  _errno

  realloc

  strchr

  wcstombs

  vsprintf

  sprintf

  ceil

  _ftol

  __CxxFrameHandler

  _CxxThrowException

  free

  malloc

  _except_handler3

  strstr

  strncpy

  strrchr

  memmove

  _local_unwind2

  rand

  printf

  atoi

  strcspn

  urlmon

  URLDownloadToFileA

  ws2_32

  inet_ntoa

  recv

  send

  select

  __WSAFDIsSet

  recvfrom

  sendto

  gethostbyname

  connect

  inet_addr

  WSAStartup

  WSACleanup

  accept

  socket

  htons

  bind

  listen

  getsockname

  ntohs

  closesocket

  getpeername

  msvcp60

  ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z

  ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB

  ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

  ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z

  ?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z

  ?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z

  ?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z

  ?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ

  ?_Xran@std@@YAXXZ

  ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB

  iphlpapi

  GetAdaptersInfo

  GetIfTable

  Exports

  Exports

  DllUpdate

  Install

  MainThread

  ServiceMain

  Uninstall

  Sections

  .text

  Size: 460KB - Virtual size: 460KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rodata

  Size: 12KB - Virtual size: 11KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rotext

  Size: 108KB - Virtual size: 107KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 244KB - Virtual size: 244KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 48KB - Virtual size: 472KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 22KB - Virtual size: 22KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ