Extracted

• edcfe06a0db28ab97fdff4c3d57989dc.bin

  .zip

  Password: infected

• b717c966167148b7178e67727be7ac55d76d82acab88782e798e477a00abdd8b.exe

  .exe windows:5 windows x86 arch:x86

  Password: infected

  75f38a281962eafd8c14d2b02cfcdab6

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  msvcrt

  strncpy

  ??_V@YAXPAX@Z

  memchr

  ??_U@YAPAXI@Z

  strtok

  strtok_s

  strcpy_s

  vsprintf_s

  memmove

  strlen

  malloc

  free

  memcmp

  ??2@YAPAXI@Z

  memset

  memcpy

  __CxxFrameHandler3

  kernel32

  InitializeCriticalSectionAndSpinCount

  WideCharToMultiByte

  RaiseException

  GetStringTypeW

  MultiByteToWideChar

  LCMapStringW

  IsValidCodePage

  lstrlenA

  HeapAlloc

  GetProcessHeap

  VirtualProtect

  VirtualQueryEx

  OpenProcess

  ReadProcessMemory

  WriteFile

  GetOEMCP

  GetACP

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsDebuggerPresent

  EncodePointer

  DecodePointer

  TerminateProcess

  GetCurrentProcess

  LeaveCriticalSection

  EnterCriticalSection

  RtlUnwind

  GetProcAddress

  GetModuleHandleW

  ExitProcess

  Sleep

  GetStdHandle

  GetModuleFileNameW

  GetLastError

  LoadLibraryW

  TlsGetValue

  TlsSetValue

  InterlockedIncrement

  SetLastError

  GetCurrentThreadId

  InterlockedDecrement

  GetCPInfo

  Sections

  .text

  Size: 114KB - Virtual size: 113KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 52KB - Virtual size: 51KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 3KB - Virtual size: 2.1MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 17KB - Virtual size: 17KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ