WhaleBots_1012[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

WhaleBots_1012.zip
Size

10.0MB
MD5

0017a6a2e055f277c00787833961474f
SHA1

c7bd04f9467f3dad9b00c8ab6b203a3011124867
SHA256

0d3ebba9db9211fd7d321b8bdf8970e77fa8cafa755f1bd4da3fb6c6799626e0
SHA512

5045fd02c8177254c7e69ba99a2ef2b1c16d2d38d5d2d4ef40e13cac4096cc665c8de627e3371d7d608217cb7bcf023e80a5d6ae5741fc78909c880e8ee48b07
SSDEEP

196608:3FdP7SlhvZiWLFHx81gdjo5yfswVZSAG6U4/Sv5k4Oq0RqXnPep7Yv74/X:33uLP8udjnssZS/l4R4WoXPeZYeX

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/WhaleBots.dll
unpack001/WhaleBots.exe

Files

WhaleBots_1012.zip
.zip
WhaleBots.dll
.dll windows:6 windows x86 arch:x86

c8ac82ac3168ab543a26ebbeb9ec15df

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

ConvertThreadToFiberEx
ConvertFiberToThread
GetSystemDirectoryA
FormatMessageA
DeleteFiber
CreateFiberEx
SwitchToFiber
ReleaseSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
AcquireSRWLockShared
InitializeSRWLock
SetConsoleMode
ReadConsoleA
GetEnvironmentVariableW
CreateTimerQueue
UnregisterWaitEx
QueryDepthSList
InterlockedPopEntrySList
ReleaseSemaphore
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
SetUnhandledExceptionFilter
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SignalObjectAndWait
WriteConsoleW
SetConsoleCtrlHandler
SetEnvironmentVariableW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
SetFilePointerEx
EnumSystemLocalesW
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetTimeZoneInformation
GetStdHandle
GetConsoleCP
ReadConsoleW
GetConsoleMode
GetSystemInfo
HeapQueryInformation
SetStdHandle
GetCommandLineW
GetCommandLineA
FreeLibraryAndExitThread
ExitThread
GetModuleHandleExW
PeekNamedPipe
GetFileType
GetFileInformationByHandle
GetDriveTypeW
TzSpecificLocalTimeToSystemTime
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
LCMapStringW
GetCPInfo
SwitchToThread
GetStringTypeW
TryEnterCriticalSection
OutputDebugStringW
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
ReleaseMutex
FreeEnvironmentStringsW
UnhandledExceptionFilter
GetUserDefaultLCID
GetTempFileNameW
SearchPathW
GetProfileIntW
GetTempPathW
GetWindowsDirectoryW
FindResourceExW
GetCurrentDirectoryW
lstrcpyW
GlobalFlags
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
SetFileTime
GetFileTime
GetFileSizeEx
GetFileAttributesExW
GetFileAttributesW
FileTimeToLocalFileTime
GlobalGetAtomNameW
SetErrorMode
LocalReAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeSListHead
InitializeCriticalSection
WritePrivateProfileStringW
GetPrivateProfileIntW
lstrcmpA
GetVersionExW
GetCurrentThread
GetThreadLocale
lstrcmpiW
DuplicateHandle
WriteFile
UnlockFile
SetFilePointer
SetEndOfFile
LockFile
GetVolumeInformationW
GetFullPathNameW
FlushFileBuffers
CompareStringW
GlobalFindAtomW
GlobalAddAtomW
lstrcmpW
GlobalDeleteAtom
EncodePointer
SetThreadPriority
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
LoadLibraryExW
InitializeCriticalSectionAndSpinCount
OutputDebugStringA
GlobalSize
SystemTimeToFileTime
GetSystemTime
QueryPerformanceCounter
WaitForSingleObjectEx
VerifyVersionInfoW
VerSetConditionMask
CompareFileTime
GetSystemTimeAsFileTime
GetEnvironmentVariableA
SleepEx
FreeLibrary
GetSystemDirectoryW
LoadLibraryW
QueryPerformanceFrequency
FormatMessageW
SetLastError
GetProcessHeap
DeleteCriticalSection
DecodePointer
HeapAlloc
RaiseException
HeapReAlloc
HeapSize
CreateEventW
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
HeapFree
GetTickCount64
GetCurrentProcessId
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
CreateMutexW
MoveFileW
MoveFileExW
CopyFileW
DeleteFileW
GetComputerNameW
VirtualFree
GetModuleHandleW
VirtualAlloc
lstrcmpiA
LocalFree
LocalAlloc
LoadLibraryA
ResetEvent
FreeResource
GlobalAlloc
GlobalFree
MulDiv
GlobalUnlock
GlobalLock
CreateFileA
MapViewOfFile
CreateFileMappingW
GetModuleFileNameW
VirtualProtect
VirtualQuery
GetExitCodeThread
GetCurrentProcess
GetCurrentThreadId
OpenThread
DeviceIoControl
ResumeThread
ExitProcess
GetNativeSystemInfo
GetProcessTimes
ReadProcessMemory
GetModuleHandleA
GetProcAddress
TerminateProcess
OpenProcess
GetExitCodeProcess
CreateProcessW
WaitForMultipleObjectsEx
WriteFileEx
ReadFileEx
DisconnectNamedPipe
GetOverlappedResult
GetLastError
ConnectNamedPipe
CreateNamedPipeW
Sleep
TerminateThread
SuspendThread
FindClose
FindNextFileW
GetPrivateProfileStringW
FindFirstFileW
ReadFile
GetFileSize
CreateFileW
lstrlenW
lstrlenA
CreateDirectoryW
FindResourceW
LoadResource
LockResource
SizeofResource
WideCharToMultiByte
MultiByteToWideChar
GetTickCount
WaitForSingleObject
SetEvent
CloseHandle
CreateThread
ChangeTimerQueueTimer
GetSystemTimeAsFileTime
CreateEventA
GetModuleFileNameW
GetModuleHandleA
TerminateProcess
GetCurrentProcess
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
LoadLibraryA
FreeLibrary
GetTickCount
SystemTimeToFileTime
FileTimeToSystemTime
GlobalFree
LocalAlloc
LocalFree
GetProcAddress
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
MultiByteToWideChar
GetModuleHandleW
LoadResource
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
GetLastError
FlushFileBuffers
VirtualQuery
GetCommandLineA
HeapFree
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
RaiseException
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
HeapReAlloc
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
WriteFile
RtlUnwind
SetFilePointer
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

CreateDialogIndirectParamW
IntersectRect
InflateRect
GetWindowThreadProcessId
ClientToScreen
GetSystemMetrics
CharUpperW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
IsDialogMessageW
SetWindowTextW
IsWindowEnabled
CheckDlgButton
MoveWindow
EnumDisplayMonitors
SetClassLongW
SetParent
OpenClipboard
SetTimer
GetForegroundWindow
EndDialog
GetClassNameA
GetMonitorInfoW
MonitorFromWindow
WinHelpW
GetScrollInfo
SetScrollInfo
UnhookWindowsHookEx
GetLastActivePopup
GetTopWindow
GetClassNameW
GetClassLongW
SetWindowLongW
EqualRect
MapWindowPoints
ScreenToClient
AdjustWindowRectEx
GetWindowTextLengthW
GetWindowTextW
RemovePropW
GetPropW
SetPropW
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
GetNextDlgTabItem
WindowFromPoint
DestroyMenu
SendDlgItemMessageA
PostQuitMessage
SetWindowContextHelpId
MapDialogRect
ShowOwnedPopups
GetSysColorBrush
CopyImage
RealChildWindowFromPoint
GetAsyncKeyState
GetKeyNameTextW
MapVirtualKeyW
TrackMouseEvent
DestroyIcon
LoadImageW
EndPaint
BeginPaint
SetActiveWindow
CharNextW
CopyAcceleratorTableW
InvalidateRgn
IsRectEmpty
GetNextDlgGroupItem
CreatePopupMenu
GetMenuDefaultItem
DrawFocusRect
EnableScrollBar
HideCaret
InvertRect
NotifyWinEvent
GetWindow
GetWindowTextA
EnableWindow
SetRect
GetDC
ReleaseDC
InvalidateRect
FillRect
GetSysColor
CopyRect
PeekMessageW
TranslateMessage
DispatchMessageW
GetUserObjectInformationW
GetProcessWindowStation
SendMessageW
IsWindow
PtInRect
GetClientRect
SetCursor
LoadCursorW
GetWindowLongW
FrameRect
DrawIconEx
OffsetRect
LoadIconW
LoadBitmapW
GetIconInfo
CreateIconIndirect
DefWindowProcW
GetFocus
GetComboBoxInfo
DrawTextW
IsWindowVisible
RedrawWindow
GetWindowRect
IsZoomed
GetWindowDC
SystemParametersInfoW
TabbedTextOutW
DrawTextExW
GrayStringW
IsMenu
GetMenuItemInfoW
SetMenuItemInfoW
GetSubMenu
GetMenuItemCount
LoadMenuW
AppendMenuW
InsertMenuW
InsertMenuItemW
DeleteMenu
GetMenuItemID
CheckMenuItem
GetMenuState
EnableMenuItem
SetRectEmpty
SetCapture
ReleaseCapture
GetCursorPos
FindWindowA
SwitchToThisWindow
BringWindowToTop
KillTimer
SetWindowRgn
ShowWindow
SetForegroundWindow
MessageBoxW
IsIconic
GetKeyState
GetParent
UnregisterClassW
MessageBeep
GetMenuStringW
RemoveMenu
GetDesktopWindow
GetMessageW
GetActiveWindow
ValidateRect
SetWindowsHookExW
CallNextHookEx
RegisterWindowMessageW
GetMessagePos
GetMessageTime
PostMessageW
CallWindowProcW
RegisterClassW
GetClassInfoW
GetClassInfoExW
CreateWindowExW
IsChild
CloseClipboard
SetClipboardData
EmptyClipboard
DrawStateW
DrawEdge
DrawFrameControl
GetSystemMenu
SetCursorPos
CopyIcon
DrawIcon
RegisterClipboardFormatW
UnionRect
UpdateLayeredWindow
MonitorFromPoint
LoadAcceleratorsW
TranslateAcceleratorW
UnpackDDElParam
ReuseDDElParam
PostThreadMessageW
WaitMessage
GetKeyboardLayout
IsCharLowerW
MapVirtualKeyExW
ToUnicodeEx
GetKeyboardState
CreateAcceleratorTableW
DestroyAcceleratorTable
LockWindowUpdate
SetMenuDefaultItem
GetDoubleClickTime
ModifyMenuW
CharUpperBuffW
IsClipboardFormatAvailable
GetUpdateRect
DrawMenuBar
DefFrameProcW
DefMDIChildProcW
TranslateMDISysAccel
SubtractRect
SetLayeredWindowAttributes
DestroyWindow
SetWindowPos
GetWindowPlacement
SetWindowPlacement
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
DestroyCursor
GetWindowRgn
GetDlgItem
GetDlgCtrlID
CreateMenu
SetFocus
GetCapture
GetMenu
SetMenu
TrackPopupMenu
UpdateWindow
CharUpperBuffW

gdi32

SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetTextAlign
MoveToEx
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
CreateRectRgnIndirect
GetMapMode
PatBlt
SetRectRgn
DPtoLP
GetTextExtentPoint32W
GetTextMetricsW
GetTextColor
GetRgnBox
EnumFontFamiliesExW
CreatePalette
GetNearestPaletteIndex
GetSystemPaletteEntries
RealizePalette
CreateDIBitmap
EnumFontFamiliesW
GetTextCharsetInfo
SetPixel
StretchBlt
CreateDIBSection
SetDIBColorTable
CreateEllipticRgn
Ellipse
CreatePolygonRgn
SelectPalette
Polyline
LPtoDP
Rectangle
OffsetRgn
FillRgn
FrameRgn
GetBoundsRect
PtInRegion
ExtFloodFill
SetPaletteEntries
SetPixelV
GetWindowOrgEx
GetViewportOrgEx
GetTextFaceW
GetDeviceCaps
SelectObject
DeleteDC
DeleteObject
CreateSolidBrush
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
GetBkColor
CreateFontW
GetObjectW
CreateFontIndirectW
GetBitmapBits
SetBitmapBits
CreateBitmap
TextOutW
PtVisible
RectVisible
ExtTextOutW
Escape
GetBkMode
AddFontMemResourceEx
CreateRoundRectRgn
ExtSelectClipRgn
SelectClipRgn
SaveDC
RestoreDC
LineTo
IntersectClipRect
GetWindowExtEx
GetViewportExtEx
SetBkMode
GetClipBox
RoundRect
CopyMetaFileW
CreateDCW
SetBkColor
GetStockObject
GetPixel
Polygon
GetObjectType
SetTextColor
CreateHatchBrush
CreatePen
CreatePatternBrush
CreateRectRgn
ExcludeClipRect
GetPaletteEntries
CombineRgn

msimg32

GradientFill
TransparentBlt
AlphaBlend

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

DeregisterEventSource
CryptDestroyKey
CryptDecrypt
CryptSetHashParam
CryptSignHashW
CryptExportKey
CryptGetProvParam
CryptEnumProvidersW
ReportEventW
RegisterEventSourceW
RegSetKeyValueA
RegGetValueA
RegEnumKeyExW
RegEnumValueW
RegQueryValueW
RegEnumKeyW
RegSetValueExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegQueryValueExA
RegEnumKeyA
RegQueryInfoKeyW
RegCloseKey
RegOpenKeyExA
CryptReleaseContext
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptAcquireContextW
CryptGetUserKey

shell32

SHGetSpecialFolderPathW
Shell_NotifyIconW
CommandLineToArgvW
SHGetFolderPathW
SHGetFileInfoW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetDesktopFolder
SHBrowseForFolderW
DragQueryFileW
SHAppBarMessage
DragFinish
ShellExecuteW

comctl32

InitCommonControlsEx
_TrackMouseEvent

shlwapi

PathFileExistsW
StrStrIW
PathAppendW
StrStrIA
PathRemoveFileSpecW
PathIsUNCW
PathStripToRootW
PathFindExtensionW
StrFormatKBSizeW
PathFindFileNameW

uxtheme

GetThemePartSize
GetThemeSysColor
IsThemeBackgroundPartiallyTransparent
IsAppThemed
GetWindowTheme
GetCurrentThemeName
GetThemeColor
DrawThemeBackground
CloseThemeData
OpenThemeData
DrawThemeParentBackground
DrawThemeText

ole32

OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
OleLockRunning
CoRegisterMessageFilter
CoRevokeClassObject
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
OleGetClipboard
DoDragDrop
OleIsCurrentClipboard
OleFlushClipboard
CoInitializeEx
OleUninitialize
OleInitialize
CoFreeUnusedLibraries
CreateILockBytesOnHGlobal
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CoGetClassObject
CoDisconnectObject
CLSIDFromProgID
CLSIDFromString
CoCreateGuid
CoUninitialize
IsAccelerator
ReleaseStgMedium
OleDuplicateData
CoTaskMemFree
CoTaskMemAlloc
CreateStreamOnHGlobal
CoCreateInstance
CoInitialize

oleaut32

VariantCopy
VarBstrFromDate
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
SysStringLen
LoadTypeLi
SysAllocString
VariantChangeType
VariantClear
VariantInit
SysAllocStringLen
SysFreeString
OleLoadPicture
OleCreateFontIndirect

oledlg

OleUIBusyW

gdiplus

GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipFree
GdipDeleteBrush
GdipCreateSolidFill
GdipRotateWorldTransform
GdipTranslateWorldTransform
GdipSetInterpolationMode
GdipSetSmoothingMode
GdipDeleteGraphics
GdipDrawImageI
GdipCreateFromHDC
GdipBitmapUnlockBits
GdipLoadImageFromFile
GdipGetImageHeight
GdipGetImageWidth
GdipDrawImageRectI
GdiplusShutdown
GdipAlloc
GdipFillPolygonI
GdiplusStartup
GdipCloneImage
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromStream
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageGraphicsContext
GdipLoadImageFromStream
GdipDisposeImage

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueA

crypt32

CertGetEnhancedKeyUsage
CertGetCertificateContextProperty
CertEnumCertificatesInStore
CertOpenSystemStoreW
CertFreeCertificateContext
CertCloseStore
CertDuplicateCertificateContext
CertGetIntendedKeyUsage
CertOpenStore
CertFindCertificateInStore

ws2_32

ioctlsocket
gethostname
select
__WSAFDIsSet
accept
shutdown
bind
htons
gethostbyname
WSAIoctl
socket
connect
setsockopt
getsockopt
listen
getsockname
getpeername
ntohs
WSACloseEvent
WSAResetEvent
WSAEnumNetworkEvents
WSAWaitForMultipleEvents
WSAEventSelect
WSACreateEvent
recv
send
WSAGetLastError
closesocket
WSACleanup
WSAStartup
getservbyname
inet_ntoa
getservbyport
gethostbyaddr
inet_addr
htonl
freeaddrinfo
WSASetLastError
getaddrinfo

wintrust

WinVerifyTrust

mpr

WNetGetProviderNameA

iphlpapi

GetAdaptersInfo

wininet

HttpSendRequestW
InternetQueryDataAvailable
HttpAddRequestHeadersW
HttpOpenRequestW
InternetSetStatusCallbackW
InternetGetLastResponseInfoW
InternetSetOptionW
InternetOpenW
InternetWriteFile
InternetSetFilePointer
InternetReadFile
InternetConnectW
InternetCloseHandle

oleacc

CreateStdAccessibleObject
AccessibleObjectFromWindow
LresultFromObject

imm32

ImmReleaseContext
ImmGetOpenStatus
ImmGetContext

winmm

PlaySoundW

bcrypt

BCryptGenRandom

Exports

Exports

WhaleBots

Sections

.text
Size: - Virtual size: 6.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 897KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.whale0
Size: - Virtual size: 5.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.whale1
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.whale2
Size: 10.1MB - Virtual size: 10.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 37KB - Virtual size: 624KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
WhaleBots.exe
.exe windows:6 windows x86 arch:x86

14d3157d0200aa8a5a978c6960f1b185

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeleteFileW
CloseHandle
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
GetCurrentProcess
TerminateProcess
CreateProcessW
GetModuleFileNameW
GetProcAddress
LoadLibraryW
DecodePointer
RaiseException
GetLastError
InitializeCriticalSectionEx
DeleteCriticalSection
CreateDirectoryW
FindResourceExW
LoadResource
LockResource
SizeofResource
FindResourceW
MultiByteToWideChar
WideCharToMultiByte
OpenProcess
GetModuleHandleA
SetEndOfFile
GetStringTypeW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
SetLastError
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
CreateFileW
GetFileType
ReadFile
SetFileTime
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
ExitProcess
GetModuleHandleExW
GetStdHandle
WriteFile
CompareStringW
LCMapStringW
SetStdHandle
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetFileSizeEx
GetTimeZoneInformation
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
WriteConsoleW

user32

MessageBoxW

shlwapi

PathFileExistsW
StrStrIW
PathFindFileNameW
PathRemoveFileSpecW

Exports

Exports

WhaleBots

Sections

.text
Size: 126KB - Virtual size: 125KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c8ac82ac3168ab543a26ebbeb9ec15df

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

oledlg

gdiplus

version

crypt32

ws2_32

wintrust

mpr

iphlpapi

wininet

oleacc

imm32

winmm

bcrypt

Exports

Exports

Sections

.text Size: - Virtual size: 6.0MB

.rdata Size: - Virtual size: 897KB

.data Size: - Virtual size: 109KB

.whale0 Size: - Virtual size: 5.1MB

.whale1 Size: 8KB - Virtual size: 8KB

.whale2 Size: 10.1MB - Virtual size: 10.1MB

.reloc Size: 2KB - Virtual size: 1KB

.rsrc Size: 37KB - Virtual size: 624KB

14d3157d0200aa8a5a978c6960f1b185

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shlwapi

Exports

Exports

Sections

.text Size: 126KB - Virtual size: 125KB

.rdata Size: 34KB - Virtual size: 33KB

.data Size: 3KB - Virtual size: 5KB

.rsrc Size: 33KB - Virtual size: 33KB

.reloc Size: 5KB - Virtual size: 5KB

.text
Size: - Virtual size: 6.0MB

.rdata
Size: - Virtual size: 897KB

.data
Size: - Virtual size: 109KB

.whale0
Size: - Virtual size: 5.1MB

.whale1
Size: 8KB - Virtual size: 8KB

.whale2
Size: 10.1MB - Virtual size: 10.1MB

.reloc
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 37KB - Virtual size: 624KB

.text
Size: 126KB - Virtual size: 125KB

.rdata
Size: 34KB - Virtual size: 33KB

.data
Size: 3KB - Virtual size: 5KB

.rsrc
Size: 33KB - Virtual size: 33KB

.reloc
Size: 5KB - Virtual size: 5KB