General

Malware Config

Signatures

Files

• 3046a9d268364ab7b3d392390adad72f8d5f68d2148329230582e21baf55d176

  .exe windows:4 windows x86 arch:x86

  611854c8557c80a7c404bd4c7df43f1a

  
  

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  WaitForSingleObject

  CreateMutexA

  GetProcessTimes

  SwitchToThread

  MapViewOfFileEx

  UnmapViewOfFile

  GetProcAddress

  LocalFree

  FormatMessageA

  CreateSemaphoreA

  CreateFileMappingA

  OpenProcess

  GetSystemTimeAsFileTime

  MultiByteToWideChar

  WideCharToMultiByte

  GetEnvironmentVariableA

  SetCurrentDirectoryA

  GetFileAttributesA

  GetFullPathNameA

  GetSystemTime

  FileTimeToSystemTime

  GetTimeZoneInformation

  AreFileApisANSI

  LoadLibraryA

  GetExitCodeProcess

  CreateProcessA

  FreeLibrary

  GetStdHandle

  GetConsoleMode

  ExitThread

  InitializeCriticalSection

  EnterCriticalSection

  LeaveCriticalSection

  DeleteCriticalSection

  DeleteFileA

  SetFileTime

  IsWow64Process

  GlobalFree

  GetProfileStringA

  FlushFileBuffers

  GetFileTime

  ReadFile

  SetFilePointer

  QueryPerformanceCounter

  IsDebuggerPresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsProcessorFeaturePresent

  GetCPInfo

  ExitProcess

  GetModuleHandleW

  GetModuleHandleExW

  CreateThread

  FreeLibraryAndExitThread

  CreateFileW

  GetFileType

  RaiseException

  HeapReAlloc

  GetStringTypeW

  InitializeCriticalSectionAndSpinCount

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  LoadLibraryExW

  CompareStringW

  LCMapStringW

  GetLocaleInfoW

  IsValidLocale

  CloseHandle

  EnumSystemLocalesW

  GetConsoleCP

  SetStdHandle

  HeapSize

  IsValidCodePage

  GetOEMCP

  GetModuleFileNameW

  WriteConsoleW

  EncodePointer

  DecodePointer

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableW

  LocalAlloc

  MapViewOfFile

  OpenFileMappingA

  ReleaseMutex

  GetPrivateProfileStringA

  WritePrivateProfileStringA

  GetPrivateProfileSectionA

  WritePrivateProfileSectionA

  SetEvent

  CreateEventA

  OpenEventA

  WaitForMultipleObjects

  ProcessIdToSessionId

  IsBadWritePtr

  OpenSemaphoreA

  FlushInstructionCache

  GetVersion

  DeviceIoControl

  LockFile

  UnlockFile

  IsBadStringPtrA

  IsBadStringPtrW

  GetDriveTypeA

  GetCommandLineA

  FindNextFileW

  FindFirstFileExW

  InterlockedFlushSList

  InterlockedPushEntrySList

  RtlUnwind

  InitializeSListHead

  LCMapStringEx

  CloseThreadpoolWork

  SubmitThreadpoolWork

  CreateThreadpoolWork

  FreeLibraryWhenCallbackReturns

  InitOnceComplete

  InitOnceBeginInitialize

  SleepConditionVariableSRW

  SleepConditionVariableCS

  WakeAllConditionVariable

  WakeConditionVariable

  InitializeConditionVariable

  TryEnterCriticalSection

  InitializeCriticalSectionEx

  AcquireSRWLockExclusive

  ReleaseSRWLockExclusive

  InitializeSRWLock

  WriteFile

  SetFilePointerEx

  SetEndOfFile

  RemoveDirectoryA

  GetFileSizeEx

  FindNextFileA

  FindFirstFileA

  FindClose

  CreateFileA

  CreateDirectoryA

  Sleep

  GetModuleHandleExA

  IsBadReadPtr

  GetComputerNameA

  GetNativeSystemInfo

  GetSystemWindowsDirectoryA

  GetWindowsDirectoryA

  GetSystemDirectoryA

  GetSystemInfo

  SetLastError

  GetModuleHandleA

  GetModuleFileNameA

  VirtualQuery

  VirtualProtect

  GetVersionExA

  SetPriorityClass

  SetThreadPriority

  GetCurrentThread

  TerminateProcess

  HeapFree

  GetCurrentDirectoryA

  SetConsoleCtrlHandler

  GetTickCount

  GetACP

  SystemTimeToFileTime

  GetLocalTime

  GetTempPathA

  GetDiskFreeSpaceA

  GetUserDefaultUILanguage

  GetExitCodeThread

  GetCurrentThreadId

  DuplicateHandle

  QueryPerformanceFrequency

  ReleaseSemaphore

  GetTickCount64

  GetStartupInfoW

  GetCurrentProcessId

  GetCurrentProcess

  GetPrivateProfileIntA

  GetLastError

  GetProcessHeap

  HeapAlloc

  GetUserDefaultLCID

  HeapCreate

  GetCommandLineW

  user32

  MessageBoxA

  DrawMenuBar

  GetSystemMenu

  AppendMenuA

  LoadStringA

  wsprintfA

  CharLowerBuffA

  GetSystemMetrics

  CharUpperBuffA

  TranslateMessage

  DispatchMessageA

  PeekMessageA

  CallMsgFilterA

  shell32

  ShellExecuteExA

  advapi32

  RegEnumKeyExA

  SetSecurityDescriptorDacl

  CloseEventLog

  OpenEventLogA

  ReadEventLogA

  RegCloseKey

  RegOpenKeyExA

  RegQueryValueExA

  QueryServiceStatusEx

  StartServiceA

  QueryServiceStatus

  QueryServiceConfigA

  OpenServiceA

  OpenSCManagerA

  CloseServiceHandle

  RegFlushKey

  RegDeleteKeyA

  CryptGenRandom

  CryptReleaseContext

  CryptAcquireContextA

  RegSetValueExA

  RegEnumValueA

  InitializeSecurityDescriptor

  RegDeleteValueA

  RegCreateKeyExA

  GetUserNameA

  GetTokenInformation

  OpenProcessToken

  ConvertStringSecurityDescriptorToSecurityDescriptorA

  SetSecurityDescriptorSacl

  GetSecurityDescriptorSacl

  version

  VerQueryValueA

  GetFileVersionInfoA

  GetFileVersionInfoSizeA

  ws2_32

  getaddrinfo

  getnameinfo

  __WSAFDIsSet

  inet_ntoa

  gethostname

  freeaddrinfo

  accept

  WSACleanup

  gethostbyname

  gethostbyaddr

  sendto

  recvfrom

  inet_addr

  bind

  getpeername

  WSAGetLastError

  socket

  shutdown

  setsockopt

  send

  select

  recv

  getsockopt

  ioctlsocket

  connect

  closesocket

  htons

  WSAStartup

  winhttp

  WinHttpOpen

  WinHttpGetIEProxyConfigForCurrentUser

  WinHttpGetProxyForUrl

  WinHttpCloseHandle

  WinHttpGetDefaultProxyConfiguration

  crypt32

  CertGetNameStringW

  CertGetNameStringA

  CertFreeCertificateContext

  CertFindCertificateInStore

  CertCloseStore

  CryptMsgClose

  CryptQueryObject

  CryptMsgGetParam

  wintrust

  WinVerifyTrust

  Sections

  __wibu00

  Size: 496KB - Virtual size: 494KB

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  __wibu01

  Size: 316KB - Virtual size: 315KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  __wibu02

  Size: 72KB - Virtual size: 134KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 32KB - Virtual size: 29KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  __wibu03

  Size: 1.6MB - Virtual size: 1.6MB

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  __wibu04

  Size: 8KB - Virtual size: 8KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  __wibu05

  Size: 52KB - Virtual size: 64KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  __wibu06

  Size: 24KB - Virtual size: 24KB

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE