General

Malware Config

Signatures

Files

• 79f8d7b9ac8178b6f9d7daafa17309bc.bin

  .exe windows:5 windows x86 arch:x86

  9a11d54486321d15743e9644d8652e51

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  D:\Jenkins\.jenkins\workspace\master_lu\lds_install_and_uninstall\install_and_uninstall\Release\Install.pdb

  Imports

  kernel32

  GetStartupInfoW

  GetPrivateProfileStringW

  GetTempFileNameW

  GetPrivateProfileIntW

  OpenEventW

  GlobalAddAtomW

  GetFileSizeEx

  DecodePointer

  InterlockedIncrement

  InterlockedDecrement

  lstrcmpiW

  LoadLibraryA

  LoadLibraryExW

  GetCommandLineW

  CopyFileW

  GetLocalTime

  SystemTimeToFileTime

  VirtualAllocEx

  VirtualFreeEx

  ReadProcessMemory

  WriteProcessMemory

  OutputDebugStringA

  GetLongPathNameW

  GlobalFree

  GlobalUnlock

  GlobalLock

  GlobalAlloc

  CreateEventW

  WaitForMultipleObjects

  WaitForSingleObject

  SetEvent

  DeleteCriticalSection

  LeaveCriticalSection

  EnterCriticalSection

  InitializeCriticalSection

  GetDiskFreeSpaceExW

  GetSystemDirectoryW

  GetDriveTypeW

  GetLogicalDriveStringsW

  MoveFileExW

  MoveFileW

  FindNextFileW

  FindFirstFileW

  DeleteFileW

  GetFileAttributesW

  SetFileAttributesW

  GetFullPathNameW

  RemoveDirectoryW

  GetWindowsDirectoryW

  GetTempPathW

  WriteConsoleW

  ReadConsoleW

  SetStdHandle

  SetEnvironmentVariableW

  SetEnvironmentVariableA

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GetCommandLineA

  GetOEMCP

  IsValidCodePage

  FindFirstFileExW

  FindFirstFileExA

  SetConsoleCtrlHandler

  EnumSystemLocalesW

  GetUserDefaultLCID

  IsValidLocale

  GetTimeFormatW

  GetDateFormatW

  lstrlenW

  GetConsoleCP

  SetFilePointerEx

  GetFileType

  GetACP

  GetModuleFileNameA

  ExitProcess

  GetTimeZoneInformation

  GetModuleHandleExW

  ResumeThread

  ExitThread

  RtlUnwind

  WaitForMultipleObjectsEx

  UnregisterWaitEx

  QueryDepthSList

  InterlockedFlushSList

  ReleaseSemaphore

  SetProcessAffinityMask

  VirtualProtect

  GetModuleHandleA

  FreeLibraryAndExitThread

  GetThreadTimes

  UnregisterWait

  RegisterWaitForSingleObject

  SetThreadAffinityMask

  GetProcessAffinityMask

  SetCurrentDirectoryW

  GetExitCodeProcess

  TerminateProcess

  GetCurrentProcess

  InitializeCriticalSectionAndSpinCount

  GetCurrentThreadId

  RaiseException

  MultiByteToWideChar

  GetFileSize

  UnlockFile

  OpenProcess

  LockFile

  MulDiv

  Process32NextW

  Process32FirstW

  CreateToolhelp32Snapshot

  GlobalFindAtomW

  CreateMutexW

  GetVersion

  GetCurrentProcessId

  WideCharToMultiByte

  FindClose

  SetLastError

  GetTickCount

  Sleep

  GetLastError

  LocalFree

  LocalAlloc

  GetVersionExW

  WritePrivateProfileStringW

  FindResourceExW

  FindResourceW

  GetModuleHandleW

  GetModuleFileNameW

  DeviceIoControl

  SizeofResource

  LoadResource

  FreeLibrary

  LockResource

  GetFileAttributesExW

  CreateFileW

  CreateFileMappingW

  UnmapViewOfFile

  MapViewOfFile

  OutputDebugStringW

  LoadLibraryW

  DosDateTimeToFileTime

  LocalFileTimeToFileTime

  SetFilePointer

  ReadFile

  GetProcessHeap

  HeapSize

  GetNumaHighestNodeNumber

  DeleteTimerQueueTimer

  ChangeTimerQueueTimer

  CreateTimerQueueTimer

  GetLogicalProcessorInformation

  GetThreadPriority

  SetThreadPriority

  CreateThread

  SignalObjectAndWait

  CreateTimerQueue

  FileTimeToDosDateTime

  FileTimeToLocalFileTime

  GetSystemTime

  GetFileTime

  ReleaseMutex

  FindNextFileA

  FindFirstFileA

  lstrlenA

  lstrcmpiA

  lstrcmpA

  GetSystemWindowsDirectoryW

  FreeResource

  GetStdHandle

  SetEndOfFile

  GetFileInformationByHandle

  CompareFileTime

  FindCloseChangeNotification

  RtlCaptureStackBackTrace

  FindFirstChangeNotificationW

  SearchPathW

  SetFileTime

  FlushFileBuffers

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  OpenFileMappingW

  GetCPInfo

  GetLocaleInfoW

  LCMapStringW

  CompareStringW

  GetNativeSystemInfo

  GetExitCodeThread

  GetCurrentThread

  WaitForSingleObjectEx

  DuplicateHandle

  GetSystemTimeAsFileTime

  TlsFree

  TlsSetValue

  TlsGetValue

  TlsAlloc

  SwitchToThread

  TryEnterCriticalSection

  QueryPerformanceFrequency

  HeapFree

  HeapReAlloc

  HeapAlloc

  QueryPerformanceCounter

  GetStringTypeW

  LoadLibraryExA

  VirtualFree

  VirtualAlloc

  IsProcessorFeaturePresent

  FlushInstructionCache

  InterlockedPushEntrySList

  InterlockedPopEntrySList

  InitializeSListHead

  EncodePointer

  IsDebuggerPresent

  InterlockedCompareExchange

  InterlockedExchange

  GetEnvironmentVariableW

  CreateDirectoryW

  FormatMessageW

  GetShortPathNameW

  GetSystemInfo

  ResetEvent

  HeapDestroy

  GetProcAddress

  DeleteFileA

  CreateFileA

  GetTempFileNameA

  GetTempPathA

  CreateProcessW

  GlobalDeleteAtom

  GetCurrentDirectoryW

  CloseHandle

  GetConsoleMode

  WriteFile

  user32

  BeginPaint

  DrawFocusRect

  CopyRect

  PtInRect

  ScreenToClient

  LoadCursorW

  OffsetRect

  SetRect

  SetCursor

  IsWindow

  PostMessageW

  GetWindowThreadProcessId

  FindWindowExW

  SetForegroundWindow

  IsIconic

  IsRectEmpty

  DefWindowProcW

  CallWindowProcW

  IsWindowVisible

  ShowWindow

  SendMessageW

  ReleaseDC

  GetDC

  KillTimer

  SetTimer

  UnregisterClassA

  SendNotifyMessageW

  SendMessageTimeoutW

  MessageBoxW

  wsprintfW

  IsDialogMessageW

  EndPaint

  ExitWindowsEx

  EndDialog

  DialogBoxParamW

  UnregisterClassW

  RegisterClassExW

  GetClassInfoExW

  CreateWindowExW

  InvalidateRect

  GetClientRect

  GetWindowRect

  GetWindowLongW

  SetWindowLongW

  EnableWindow

  RedrawWindow

  GetMonitorInfoW

  LoadImageW

  GetWindow

  FindWindowW

  MapWindowPoints

  SetWindowTextW

  GetSystemMetrics

  MoveWindow

  PostQuitMessage

  GetParent

  RegisterWindowMessageW

  SetProcessDPIAware

  CharNextW

  BringWindowToTop

  DestroyWindow

  PeekMessageW

  DispatchMessageW

  TranslateMessage

  GetMessageW

  GetWindowTextLengthW

  DrawTextW

  UnhookWinEvent

  SetWinEventHook

  GetWindowTextW

  MonitorFromWindow

  GetShellWindow

  WaitForInputIdle

  SystemParametersInfoW

  SetWindowRgn

  SetWindowPos

  UpdateLayeredWindow

  gdi32

  SaveDC

  RestoreDC

  SetTextColor

  SetBkMode

  CreateRectRgn

  CombineRgn

  SetViewportOrgEx

  CreateCompatibleDC

  CreateCompatibleBitmap

  ExtTextOutW

  SetBkColor

  DeleteDC

  SelectObject

  GetTextExtentPoint32W

  GetDeviceCaps

  CreateFontIndirectW

  EnumFontFamiliesW

  DeleteObject

  CreateFontW

  BitBlt

  advapi32

  LockServiceDatabase

  RegQueryValueExA

  RegOpenKeyExA

  RegEnumKeyExA

  GetTokenInformation

  CryptContextAddRef

  CryptDecrypt

  CryptEncrypt

  CryptImportKey

  CryptGenRandom

  CryptSetKeyParam

  CryptDestroyKey

  RegSetValueExW

  RegQueryInfoKeyW

  RegDeleteValueW

  RegDeleteKeyW

  RegCreateKeyExW

  RegEnumValueW

  DuplicateTokenEx

  RegQueryValueExW

  RegOpenKeyExW

  RegEnumKeyExW

  RegCloseKey

  LookupPrivilegeValueW

  AdjustTokenPrivileges

  OpenProcessToken

  UnlockServiceDatabase

  StartServiceW

  QueryServiceStatusEx

  QueryServiceStatus

  QueryServiceLockStatusW

  QueryServiceConfig2W

  QueryServiceConfigW

  OpenServiceW

  OpenSCManagerW

  RegGetValueW

  DeleteService

  CreateServiceW

  ControlService

  CloseServiceHandle

  ChangeServiceConfig2W

  ChangeServiceConfigW

  CryptReleaseContext

  GetUserNameW

  AllocateAndInitializeSid

  FreeSid

  CheckTokenMembership

  EqualSid

  DeleteAce

  LookupAccountSidW

  LookupAccountNameW

  SetEntriesInAclW

  GetExplicitEntriesFromAclW

  GetNamedSecurityInfoW

  SetNamedSecurityInfoW

  BuildExplicitAccessWithNameW

  GetTrusteeNameW

  CryptAcquireContextW

  shell32

  SHFileOperationW

  SHGetPathFromIDListW

  SHCreateDirectoryExW

  SHGetSpecialFolderLocation

  ord165

  SHChangeNotify

  ShellExecuteExW

  ShellExecuteW

  SHLoadInProc

  SHBrowseForFolderW

  CommandLineToArgvW

  SHGetSpecialFolderPathW

  SHGetDesktopFolder

  ole32

  CoTaskMemRealloc

  CoTaskMemAlloc

  CoInitializeSecurity

  CoInitializeEx

  CoUninitialize

  CoCreateGuid

  CoCreateInstance

  CoTaskMemFree

  OleRun

  CreateStreamOnHGlobal

  StringFromGUID2

  CoInitialize

  CoSetProxyBlanket

  oleaut32

  VariantCopy

  CreateErrorInfo

  SetErrorInfo

  VariantChangeType

  GetErrorInfo

  VariantInit

  SysStringLen

  VariantClear

  SysAllocStringByteLen

  SysStringByteLen

  VarUI4FromStr

  SysFreeString

  SysAllocString

  shlwapi

  PathIsRelativeW

  StrStrIA

  StrCmpNIW

  StrTrimA

  StrCmpIW

  StrToIntExW

  SHGetValueA

  PathAppendA

  PathFindFileNameA

  PathRenameExtensionA

  PathAppendW

  PathCombineW

  PathFileExistsW

  PathRemoveFileSpecW

  PathFindExtensionW

  wnsprintfW

  StrCmpW

  PathFindFileNameW

  SHGetValueW

  PathUnquoteSpacesW

  SHSetValueW

  PathIsPrefixW

  AssocQueryStringW

  PathIsRootW

  StrStrIW

  SHDeleteKeyW

  PathIsDirectoryW

  SHDeleteValueW

  SHSetValueA

  comctl32

  _TrackMouseEvent

  InitCommonControlsEx

  gdiplus

  GdipSetStringFormatFlags

  GdipFillRectangleI

  GdipCreateFont

  GdipGraphicsClear

  GdipDrawImagePointRectI

  GdipSetStringFormatTrimming

  GdipSetStringFormatLineAlign

  GdipDeleteFontFamily

  GdipCreateFontFamilyFromName

  GdipSetTextRenderingHint

  GdiplusStartup

  GdipDeleteFont

  GdipAlloc

  GdipFree

  GdipCloneImage

  GdipDisposeImage

  GdipGetImageWidth

  GdipGetImageHeight

  GdipCreateBitmapFromStream

  GdipCreateBitmapFromFile

  GdipCreateBitmapFromStreamICM

  GdipCreateBitmapFromFileICM

  GdipCreateFromHDC

  GdipDeleteGraphics

  GdipDrawImageRectRect

  GdipDrawImageRectRectI

  GdipCloneBrush

  GdipDeleteBrush

  GdipCreateSolidFill

  GdipCreateImageAttributes

  GdipDeleteStringFormat

  GdipDrawString

  GdiplusShutdown

  GdipDisposeImageAttributes

  GdipSetImageAttributesColorMatrix

  GdipCreateStringFormat

  GdipMeasureString

  GdipSetStringFormatAlign

  cabinet

  ord22

  ord23

  ord20

  version

  GetFileVersionInfoW

  VerQueryValueW

  GetFileVersionInfoSizeW

  psapi

  GetModuleFileNameExW

  EnumProcesses

  setupapi

  SetupIterateCabinetW

  iphlpapi

  GetAdaptersInfo

  wininet

  InternetGetConnectedState

  urlmon

  URLDownloadToFileW

  URLDownloadToCacheFileW

  secur32

  GetUserNameExW

  crypt32

  CryptBinaryToStringW

  CertGetNameStringW

  CryptStringToBinaryA

  CryptBinaryToStringA

  CryptStringToBinaryW

  wintrust

  WinVerifyTrust

  WTHelperProvDataFromStateData

  Exports

  Exports

  StartEast

  _Start@12

  Sections

  .text

  Size: 1.5MB - Virtual size: 1.5MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 323KB - Virtual size: 323KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 36KB - Virtual size: 51KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 3.0MB - Virtual size: 3.0MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 82KB - Virtual size: 81KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ