General

Malware Config

Signatures

Files

• c24021161d7667ede9dd17081d1cb52d7104f3b0366aa21ae9aacc42d9afaa7f

  .exe windows:5 windows x86 arch:x86

  f478096b403c039b56b3dce71e1b2bd6

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  QueryPerformanceCounter

  GetCurrentProcessId

  GetCurrentThreadId

  GetSystemTimeAsFileTime

  InitializeSListHead

  GetVersionExW

  GetFileSize

  WriteFile

  ReadFile

  FindClose

  lstrcpyW

  GetTempPathW

  CreateFileW

  GetFileAttributesW

  GetFileAttributesExW

  DeleteFileW

  FindFirstFileW

  FindNextFileW

  CopyFileW

  MoveFileExW

  GetTickCount

  DecodePointer

  HeapReAlloc

  HeapSize

  RaiseException

  GetLastError

  InitializeCriticalSectionAndSpinCount

  MultiByteToWideChar

  WideCharToMultiByte

  CreateDirectoryW

  ReleaseMutex

  CreateMutexW

  GetVolumeInformationW

  GetLongPathNameW

  FileTimeToSystemTime

  GlobalAlloc

  OpenProcess

  GetExitCodeProcess

  CreateProcessW

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  DeviceIoControl

  OutputDebugStringA

  SetPriorityClass

  GetTempFileNameW

  EncodePointer

  RtlUnwind

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  LoadLibraryExW

  GetModuleHandleW

  GetModuleHandleExW

  GetStdHandle

  GetACP

  GetStringTypeW

  CompareStringW

  LCMapStringW

  GetLocaleInfoW

  IsValidLocale

  GetUserDefaultLCID

  EnumSystemLocalesW

  GetFileType

  FindFirstFileExW

  IsValidCodePage

  GetOEMCP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableA

  SetConsoleCtrlHandler

  OutputDebugStringW

  SetStdHandle

  GetConsoleMode

  ReadConsoleW

  SetFilePointerEx

  GetConsoleCP

  GetTimeZoneInformation

  FlushFileBuffers

  WriteConsoleW

  SetEndOfFile

  GetPrivateProfileIntW

  GetModuleFileNameW

  GetSystemDirectoryW

  LoadLibraryW

  CreateEventW

  CloseHandle

  Sleep

  WaitForSingleObject

  SetEvent

  DeleteCriticalSection

  LeaveCriticalSection

  EnterCriticalSection

  InitializeCriticalSection

  CreateThread

  IsBadReadPtr

  LoadLibraryA

  GetNativeSystemInfo

  SetLastError

  GetProcessHeap

  HeapFree

  HeapAlloc

  GetStartupInfoW

  IsDebuggerPresent

  IsProcessorFeaturePresent

  TerminateProcess

  GetCurrentProcess

  SetUnhandledExceptionFilter

  ExitProcess

  UnhandledExceptionFilter

  VirtualProtect

  VirtualFree

  VirtualAlloc

  GetProcAddress

  FreeLibrary

  WritePrivateProfileStringW

  GlobalFree

  GetPrivateProfileStringW

  GetFullPathNameW

  GetCurrentDirectoryW

  SetConsoleMode

  ReadConsoleInputA

  SystemTimeToTzSpecificLocalTime

  GetDriveTypeW

  FreeLibraryAndExitThread

  ExitThread

  SystemTimeToFileTime

  GetSystemTime

  GlobalMemoryStatus

  FlushConsoleInputBuffer

  FormatMessageA

  PeekNamedPipe

  WaitForMultipleObjects

  ExpandEnvironmentStringsA

  VerifyVersionInfoA

  QueryPerformanceFrequency

  GetSystemDirectoryA

  GetModuleHandleA

  VerSetConditionMask

  SleepEx

  GetFileAttributesExA

  advapi32

  CryptReleaseContext

  CryptDestroyHash

  CryptSignHashA

  CryptEnumProvidersA

  DeregisterEventSource

  DuplicateTokenEx

  SetSecurityDescriptorDacl

  InitializeSecurityDescriptor

  RegQueryValueExW

  RegOpenKeyW

  RegEnumKeyW

  RegCreateKeyExW

  OpenProcessToken

  ImpersonateLoggedOnUser

  RevertToSelf

  RegisterEventSourceA

  ReportEventA

  CryptAcquireContextA

  CryptCreateHash

  CryptDestroyKey

  CryptSetHashParam

  CryptGetProvParam

  CryptGetUserKey

  CryptExportKey

  CryptDecrypt

  RegCloseKey

  RegOpenKeyExW

  shell32

  SHGetSpecialFolderPathW

  SHGetFolderPathW

  shlwapi

  PathFileExistsW

  user32

  LoadStringW

  wsprintfW

  MessageBoxA

  GetProcessWindowStation

  GetUserObjectInformationW

  ole32

  CoCreateInstance

  CoUninitialize

  CoInitialize

  iphlpapi

  GetAdaptersInfo

  crypt32

  CertOpenStore

  CertCloseStore

  CertEnumCertificatesInStore

  CertFindCertificateInStore

  CertDuplicateCertificateContext

  CertFreeCertificateContext

  CertGetCertificateContextProperty

  ws2_32

  select

  __WSAFDIsSet

  socket

  WSAGetLastError

  getservbyname

  WSASetLastError

  recv

  send

  bind

  closesocket

  gethostbyname

  htonl

  connect

  getpeername

  getsockname

  getsockopt

  htons

  ntohs

  setsockopt

  WSAStartup

  WSACleanup

  getaddrinfo

  freeaddrinfo

  accept

  listen

  recvfrom

  sendto

  ioctlsocket

  gethostname

  shutdown

  WSAIoctl

  wldap32

  ord200

  ord30

  ord79

  ord35

  ord143

  ord33

  ord32

  ord27

  ord26

  ord22

  ord41

  ord50

  ord60

  ord211

  ord46

  ord217

  ord301

  wininet

  HttpQueryInfoW

  InternetCloseHandle

  InternetOpenUrlW

  InternetReadFile

  InternetSetOptionW

  InternetOpenW

  Sections

  .text

  Size: 1.4MB - Virtual size: 1.4MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 401KB - Virtual size: 400KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .data

  Size: 46KB - Virtual size: 70KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .gfids

  Size: 512B - Virtual size: 436B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .tls

  Size: 512B - Virtual size: 9B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 17KB - Virtual size: 16KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 137KB - Virtual size: 140KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE