General

Malware Config

Signatures

Files

• 114b868f319162c5d6ff92796e41910f54de0e89f895a066fd4980c6dba2e323

  .exe windows:6 windows x64 arch:x64

  fcc1e1d34891ecf13d7f9f0c91e336ef

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  kernel32

  GetModuleHandleA

  GetProcAddress

  LoadLibraryA

  GetStdHandle

  SetStdHandle

  CreateFileA

  FindFirstFileExW

  FindNextChangeNotification

  FlushFileBuffers

  GetFileAttributesExW

  GetFileInformationByHandle

  GetFileSize

  GetFileType

  GetFileTime

  LockFile

  LockFileEx

  SetEndOfFile

  SetFilePointer

  SetFilePointerEx

  SetFileValidData

  UnlockFile

  UnlockFileEx

  AreFileApisANSI

  EncodePointer

  DecodePointer

  EncodeSystemPointer

  DecodeSystemPointer

  SetHandleInformation

  SetLastError

  DisconnectNamedPipe

  PeekNamedPipe

  GetNamedPipeInfo

  GetNamedPipeHandleStateW

  HeapCreate

  CreateIoCompletionPort

  PostQueuedCompletionStatus

  InitializeCriticalSection

  EnterCriticalSection

  LeaveCriticalSection

  SetEvent

  ResetEvent

  ReleaseSemaphore

  ReleaseMutex

  WaitForSingleObject

  CreateMutexA

  CreateEventA

  CancelWaitableTimer

  WaitForMultipleObjects

  GetProcessTimes

  GetCurrentProcessId

  GetCurrentThreadId

  GetThreadPriorityBoost

  GetThreadPriority

  GetProcessVersion

  SetPriorityClass

  GetPriorityClass

  GetProcessId

  GetThreadContext

  FlushInstructionCache

  GetThreadTimes

  OpenProcess

  GetProcessHandleCount

  GetProcessPriorityBoost

  SetProcessPriorityBoost

  GetThreadIOPendingFlag

  GetVersion

  GetVersionExA

  GetNativeSystemInfo

  SetSystemTimeAdjustment

  CreateFileMappingW

  FlushViewOfFile

  SetProcessWorkingSetSize

  GetWriteWatch

  ResetWriteWatch

  CreateMemoryResourceNotification

  IsProcessInJob

  AssignProcessToJobObject

  SetInformationJobObject

  DisableThreadLibraryCalls

  FreeResource

  GetModuleFileNameA

  GetModuleFileNameW

  LockResource

  GlobalUnlock

  GlobalCompact

  GlobalUnfix

  GlobalUnWire

  LocalUnlock

  LocalShrink

  LocalCompact

  GetProcessAffinityMask

  GetProcessIoCounters

  ConvertFiberToThread

  CreateFiberEx

  CreateFiber

  ConvertThreadToFiber

  PulseEvent

  GlobalDeleteAtom

  InitAtomTable

  DeleteAtom

  SetHandleCount

  SetMessageWaitingIndicator

  ClearCommBreak

  ClearCommError

  EscapeCommFunction

  GetCommMask

  GetCommModemStatus

  GetCommTimeouts

  TransmitCommChar

  PrepareTape

  EraseTape

  CreateTapePartition

  GetTapeStatus

  MulDiv

  GetMailslotInfo

  SetMailslotInfo

  AddAtomA

  GetNamedPipeHandleStateA

  VerifyVersionInfoA

  MapUserPhysicalPagesScatter

  WriteConsoleW

  CloseHandle

  CreateFileW

  GetConsoleMode

  GetConsoleOutputCP

  HeapReAlloc

  HeapSize

  GetProcessHeap

  LCMapStringW

  FlsFree

  FlsSetValue

  FlsGetValue

  FlsAlloc

  GetStringTypeW

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  WideCharToMultiByte

  MultiByteToWideChar

  GetCommandLineW

  GetCommandLineA

  GetCPInfo

  GetOEMCP

  GetACP

  IsValidCodePage

  FindNextFileW

  FindClose

  HeapFree

  HeapAlloc

  GetModuleHandleExW

  TerminateProcess

  ExitProcess

  GetCurrentProcess

  WriteFile

  RtlPcToFileHeader

  RaiseException

  LoadLibraryExW

  FreeLibrary

  TlsFree

  TlsSetValue

  TlsGetValue

  TlsAlloc

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  GetLastError

  RtlUnwindEx

  GetModuleHandleW

  IsProcessorFeaturePresent

  GetStartupInfoW

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  IsDebuggerPresent

  RtlVirtualUnwind

  RtlLookupFunctionEntry

  RtlCaptureContext

  InitializeSListHead

  GetSystemTimeAsFileTime

  QueryPerformanceCounter

  user32

  GetLayeredWindowAttributes

  GetDlgCtrlID

  GetAsyncKeyState

  TrackPopupMenuEx

  MenuItemFromPoint

  BeginPaint

  GetClassWord

  GetCursorInfo

  CallWindowProcA

  winspool.drv

  ScheduleJob

  FindClosePrinterChangeNotification

  ReadPrinter

  AbortPrinter

  FindFirstPrinterChangeNotification

  shell32

  ord716

  DragQueryFileA

  DragQueryPoint

  DragFinish

  FindExecutableA

  ShellAboutA

  ExtractIconExA

  SHFileOperationA

  SHEmptyRecycleBinA

  Shell_NotifyIconA

  SHGetDiskFreeSpaceExA

  SHSetLocalizedName

  ord727

  ord153

  ord152

  ord24

  ord16

  ord17

  ord21

  ord189

  SHBrowseForFolderA

  SHChangeNotify

  ord191

  ord4

  ord645

  ord47

  ord3

  SHGetSettings

  SHBindToParent

  ShellExecuteExA

  ole32

  CoCancelCall

  CoTestCancel

  CoEnableCallCancellation

  CoDisableCallCancellation

  IIDFromString

  StringFromGUID2

  CoGetTreatAsClass

  CoGetCancelObject

  CoSwitchCallContext

  CoRevertToSelf

  CoCopyProxy

  CoFileTimeNow

  OleDoAutoConvert

  OleRegGetMiscStatus

  OleGetIconOfClass

  IsAccelerator

  MkParseDisplayName

  CoGetObject

  CoIsOle1Class

  CoAllowSetForegroundWindow

  CoGetInstanceFromFile

  CoRevokeInitializeSpy

  CLSIDFromProgIDEx

  CoImpersonateClient

  CoQueryClientBlanket

  CoGetCallerTID

  CoGetCurrentLogicalThreadId

  CoGetContextToken

  CoGetObjectContext

  CoRevokeClassObject

  CoGetMarshalSizeMax

  CoUnmarshalInterface

  CoGetStandardMarshal

  CoGetStdMarshalEx

  CoIsHandlerConnected

  CoMarshalInterThreadInterfaceInStream

  CoQueryProxyBlanket

  CoSetProxyBlanket

  CoSetCancelObject

  CoTaskMemRealloc

  gdiplus

  GdiplusStartup

  userenv

  GetUserProfileDirectoryA

  Sections

  .text

  Size: 763KB - Virtual size: 763KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 274KB - Virtual size: 274KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 204KB - Virtual size: 212KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ