General

Malware Config

Signatures

Files

• 7187c70ecba0d44df338b18469d2b8ec86874c6fbdc52dbc0d9e0831e1e70281

  .exe windows:5 windows x86 arch:x86

  c8f585918987a310f6428f02fe881c59

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  D:\Jenkins\.jenkins\workspace\gamemaster\installanduninstall\Inst\Install_Exe.pdb

  Imports

  kernel32

  SizeofResource

  ReadFile

  FindClose

  CloseHandle

  MulDiv

  GetSystemTime

  CreatePipe

  PeekNamedPipe

  lstrcmpW

  lstrcmpiW

  lstrcpynW

  lstrlenA

  lstrlenW

  CreateMutexW

  LoadLibraryW

  LoadLibraryExW

  GetModuleFileNameW

  GetModuleHandleW

  CreateProcessW

  GetStartupInfoW

  FindResourceW

  FindResourceExW

  GetSystemDirectoryW

  DeleteFileW

  FindFirstFileW

  FindNextFileW

  GetVersionExW

  MultiByteToWideChar

  WideCharToMultiByte

  LocalFree

  GetCommandLineW

  GetWindowsDirectoryW

  WritePrivateProfileStringW

  IsDebuggerPresent

  OutputDebugStringW

  EncodePointer

  InitializeSListHead

  InterlockedPopEntrySList

  InterlockedPushEntrySList

  FlushInstructionCache

  IsProcessorFeaturePresent

  VirtualAlloc

  VirtualFree

  LoadLibraryExA

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  TerminateProcess

  QueryPerformanceCounter

  GetCurrentProcessId

  GetSystemTimeAsFileTime

  GetFileSize

  WriteFile

  FlushFileBuffers

  CreateFileW

  DeviceIoControl

  lstrcmpA

  lstrcmpiA

  CreateFileA

  RtlUnwind

  TlsAlloc

  TlsGetValue

  TlsSetValue

  LeaveCriticalSection

  CreateThread

  ExitThread

  FreeLibraryAndExitThread

  GetModuleHandleExW

  ExitProcess

  GetStdHandle

  GetACP

  Sleep

  GetFileType

  LCMapStringW

  FindFirstFileExW

  IsValidCodePage

  GetOEMCP

  GetCPInfo

  GetCommandLineA

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  WaitForSingleObjectEx

  SetStdHandle

  GetConsoleCP

  GetConsoleMode

  SetFilePointerEx

  ReadConsoleW

  WriteConsoleW

  InterlockedCompareExchange

  GetPrivateProfileStringW

  LocalAlloc

  GetSystemInfo

  ResetEvent

  CreateDirectoryW

  GetTempFileNameW

  FormatMessageW

  GlobalAddAtomW

  TerminateThread

  CopyFileW

  ReleaseMutex

  GetExitCodeProcess

  GetFileAttributesExW

  CreateFileMappingW

  UnmapViewOfFile

  MapViewOfFile

  SetFilePointer

  WaitForMultipleObjects

  GetExitCodeThread

  MoveFileW

  GetLocalTime

  GetFileSizeEx

  GlobalFree

  MoveFileExW

  GetFileAttributesW

  SetFileAttributesW

  GetTickCount

  GetFullPathNameW

  RemoveDirectoryW

  GetDiskFreeSpaceExW

  GetTempPathW

  GetDriveTypeW

  GetLogicalDriveStringsW

  Process32NextW

  Process32FirstW

  CreateToolhelp32Snapshot

  GlobalFindAtomW

  GlobalDeleteAtom

  OpenProcess

  GetLongPathNameW

  CreateEventW

  SetEvent

  LoadResource

  GetStringTypeW

  EnterCriticalSection

  InitializeCriticalSection

  SetErrorMode

  SetLastError

  GetCurrentThreadId

  GetCurrentProcess

  GlobalMemoryStatusEx

  GlobalUnlock

  GlobalLock

  GlobalAlloc

  GetProcAddress

  FreeLibrary

  LockResource

  InterlockedDecrement

  InterlockedIncrement

  FreeResource

  GetSystemWindowsDirectoryW

  SetEndOfFile

  SetFileTime

  WaitForSingleObject

  GetFileInformationByHandle

  GetModuleHandleA

  InterlockedExchange

  DeleteCriticalSection

  InitializeCriticalSectionAndSpinCount

  GetLastError

  DecodePointer

  RaiseException

  GetProcessHeap

  HeapSize

  HeapFree

  HeapReAlloc

  HeapAlloc

  HeapDestroy

  TlsFree

  user32

  MonitorFromWindow

  LoadImageW

  PtInRect

  GetCursorPos

  MonitorFromPoint

  DialogBoxParamW

  CopyRect

  EndDialog

  LoadCursorW

  TrackPopupMenu

  AppendMenuW

  DestroyMenu

  GetSystemMetrics

  KillTimer

  SetTimer

  IsIconic

  UnregisterClassW

  ShowWindowAsync

  CharUpperW

  SetWindowLongW

  GetDesktopWindow

  GetParent

  FindWindowW

  GetClassNameW

  CreatePopupMenu

  GetWindow

  MessageBoxW

  UnhookWinEvent

  SetWinEventHook

  SystemParametersInfoW

  SetCursor

  OffsetRect

  SetWindowRgn

  UpdateLayeredWindow

  SetRect

  GetMonitorInfoW

  UpdateWindow

  PostQuitMessage

  IsRectEmpty

  WaitForInputIdle

  SendMessageTimeoutW

  GetWindowThreadProcessId

  FindWindowExW

  PostThreadMessageW

  wsprintfW

  RegisterWindowMessageW

  GetMessageW

  TranslateMessage

  DispatchMessageW

  PeekMessageW

  SendMessageW

  GetWindowLongW

  FillRect

  GetSysColor

  MapWindowPoints

  ScreenToClient

  ClientToScreen

  GetWindowRect

  GetClientRect

  GetWindowTextLengthW

  GetWindowTextW

  SetWindowTextW

  RedrawWindow

  InvalidateRgn

  InvalidateRect

  EndPaint

  BeginPaint

  ReleaseDC

  GetDC

  SetForegroundWindow

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  ReleaseCapture

  SetCapture

  GetFocus

  SetFocus

  CharNextW

  GetDlgItem

  BringWindowToTop

  IsWindowVisible

  SetWindowPos

  MoveWindow

  ShowWindow

  DestroyWindow

  IsChild

  IsWindow

  CreateWindowExW

  GetClassInfoExW

  RegisterClassExW

  CallWindowProcW

  DefWindowProcW

  PostMessageW

  shlwapi

  PathFindExtensionW

  StrToInt64ExW

  wvnsprintfW

  PathIsDirectoryW

  wnsprintfW

  SHStrDupW

  PathAppendW

  PathStripToRootW

  PathFindFileNameW

  PathIsPrefixW

  StrToIntW

  StrCmpIW

  StrStrIA

  StrTrimA

  StrCmpNIW

  PathFileExistsW

  PathCombineW

  PathRemoveFileSpecW

  SHDeleteValueW

  SHGetValueA

  SHGetValueW

  SHSetValueW

  StrStrIW

  wnsprintfA

  SHDeleteKeyW

  PathRelativePathToW

  PathIsRelativeW

  StrCmpW

  SHSetValueA

  comctl32

  _TrackMouseEvent

  InitCommonControlsEx

  version

  GetFileVersionInfoW

  VerQueryValueW

  GetFileVersionInfoSizeW

  gdiplus

  GdipDrawImageRectRectI

  GdipSetStringFormatTrimming

  GdipSetStringFormatLineAlign

  GdipSetStringFormatAlign

  GdipSetStringFormatFlags

  GdipDeleteStringFormat

  GdipCreateStringFormat

  GdipGetImageWidth

  GdipDisposeImage

  GdipCloneImage

  GdipFree

  GdipAlloc

  GdiplusStartup

  GdiplusShutdown

  GdipGetImageHeight

  GdipCreateBitmapFromStream

  GdipMeasureString

  GdipDrawString

  GdipDeleteFont

  GdipCreateFont

  GdipDeleteFontFamily

  GdipCreateBitmapFromStreamICM

  GdipSetTextRenderingHint

  GdipSetImageAttributesColorMatrix

  GdipDisposeImageAttributes

  GdipCreateImageAttributes

  GdipCreateSolidFill

  GdipDeleteBrush

  GdipDrawImagePointRectI

  GdipCreateFontFamilyFromName

  GdipDrawImageRectRect

  GdipDeleteGraphics

  GdipCreateFromHDC

  GdipCreateBitmapFromFile

  gdi32

  CreateRectRgn

  EnumFontFamiliesW

  CreateFontW

  ExtTextOutW

  CombineRgn

  SetTextColor

  SetBkMode

  SetBkColor

  GetCurrentObject

  CreateFontIndirectW

  BitBlt

  CreateCompatibleBitmap

  CreateCompatibleDC

  CreateSolidBrush

  DeleteObject

  GetDeviceCaps

  GetStockObject

  SelectObject

  GetObjectW

  RestoreDC

  SaveDC

  DeleteDC

  SetViewportOrgEx

  advapi32

  GetUserNameW

  RegQueryValueExA

  RegOpenKeyExA

  RegEnumKeyExA

  RegSetValueExW

  RegQueryValueExW

  RegQueryInfoKeyW

  RegOpenKeyExW

  RegCloseKey

  RegCreateKeyExW

  RegDeleteKeyW

  GetTokenInformation

  GetTrusteeNameW

  BuildExplicitAccessWithNameW

  SetNamedSecurityInfoW

  GetNamedSecurityInfoW

  GetExplicitEntriesFromAclW

  SetEntriesInAclW

  LookupAccountNameW

  LookupAccountSidW

  DeleteAce

  EqualSid

  LookupPrivilegeValueW

  RegEnumKeyExW

  RegDeleteValueW

  OpenProcessToken

  AdjustTokenPrivileges

  shell32

  SHLoadInProc

  ShellExecuteExW

  ord75

  SHFileOperationW

  ShellExecuteW

  ord165

  SHChangeNotify

  CommandLineToArgvW

  Shell_NotifyIconW

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHCreateDirectoryExW

  SHGetSpecialFolderPathW

  ord680

  ole32

  CoCreateGuid

  CoInitialize

  CoUninitialize

  CoGetClassObject

  CoSetProxyBlanket

  CreateStreamOnHGlobal

  OleLockRunning

  OleUninitialize

  OleInitialize

  PropVariantClear

  CoTaskMemFree

  CoTaskMemRealloc

  CoTaskMemAlloc

  StringFromGUID2

  CLSIDFromProgID

  CLSIDFromString

  CoCreateInstance

  OleRun

  oleaut32

  SysStringByteLen

  SysAllocStringByteLen

  OleCreateFontIndirect

  LoadRegTypeLi

  LoadTypeLi

  VarUI4FromStr

  VariantClear

  VariantInit

  SysStringLen

  SysFreeString

  SysAllocStringLen

  SysAllocString

  urlmon

  URLDownloadToCacheFileW

  psapi

  GetModuleFileNameExW

  EnumProcesses

  winhttp

  WinHttpOpenRequest

  WinHttpSetTimeouts

  WinHttpAddRequestHeaders

  WinHttpReceiveResponse

  WinHttpSendRequest

  WinHttpSetCredentials

  WinHttpSetOption

  WinHttpQueryDataAvailable

  WinHttpReadData

  WinHttpConnect

  WinHttpCloseHandle

  WinHttpOpen

  WinHttpQueryHeaders

  iphlpapi

  GetAdaptersInfo

  setupapi

  SetupIterateCabinetW

  Sections

  .text

  Size: 516KB - Virtual size: 515KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 236KB - Virtual size: 236KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 17KB - Virtual size: 25KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 3.2MB - Virtual size: 3.2MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 31KB - Virtual size: 30KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ