General

Malware Config

Signatures

Files

• 1c0a4193bf77b9a8dbd00f6078392899b6defa434f20c008e4ea9e20b301c334.exe

  .exe windows:6 windows x86 arch:x86

  894b77336b8d78f9851559454b95443d

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  ntdll

  NtWriteFile

  RtlUnwind

  NtQueryInformationProcess

  RtlNtStatusToDosError

  RtlCaptureContext

  RtlGetVersion

  NtQuerySystemInformation

  kernel32

  GetProcessIoCounters

  IsProcessorFeaturePresent

  WriteProcessMemory

  VirtualProtectEx

  HeapAlloc

  ReadProcessMemory

  SetUnhandledExceptionFilter

  TlsGetValue

  TlsSetValue

  LocalFree

  GetSystemTimes

  UnhandledExceptionFilter

  IsDebuggerPresent

  InitializeSListHead

  GetCurrentProcess

  GetProcAddress

  LoadLibraryA

  OpenProcess

  GetComputerNameExW

  GetLastError

  WaitForSingleObject

  GetCurrentThreadId

  GetProcessTimes

  LoadLibraryExA

  FreeLibrary

  K32GetPerformanceInfo

  GlobalMemoryStatusEx

  VirtualQueryEx

  FormatMessageW

  SleepConditionVariableSRW

  TryAcquireSRWLockExclusive

  HeapFree

  GetProcessHeap

  LoadLibraryExW

  RaiseException

  GetSystemInfo

  ReleaseMutex

  FindClose

  ReleaseSRWLockShared

  AddVectoredExceptionHandler

  SetThreadStackGuarantee

  SwitchToThread

  Sleep

  QueryPerformanceCounter

  GetCurrentThread

  SetLastError

  GetCurrentDirectoryW

  GetEnvironmentVariableW

  VirtualProtect

  ReleaseSRWLockExclusive

  AcquireSRWLockExclusive

  VirtualAlloc

  EncodePointer

  CreateFileW

  DeleteCriticalSection

  GetStdHandle

  GetCurrentProcessId

  TerminateProcess

  WakeAllConditionVariable

  WakeConditionVariable

  HeapReAlloc

  AcquireSRWLockShared

  WaitForSingleObjectEx

  CreateMutexA

  GetModuleHandleA

  GetFileInformationByHandle

  GetFileInformationByHandleEx

  FindFirstFileW

  GetConsoleMode

  InitializeCriticalSectionAndSpinCount

  GetModuleHandleW

  ExitProcess

  GetFullPathNameW

  MultiByteToWideChar

  WriteConsoleW

  CreateThread

  InitOnceBeginInitialize

  TlsAlloc

  InitOnceComplete

  TlsFree

  GetSystemTimeAsFileTime

  CloseHandle

  advapi32

  GetLengthSid

  RegQueryValueExW

  GetTokenInformation

  RegCloseKey

  RegOpenKeyExW

  SystemFunction036

  CopySid

  IsValidSid

  OpenProcessToken

  pdh

  PdhCollectQueryData

  PdhAddEnglishCounterW

  PdhGetFormattedCounterValue

  PdhRemoveCounter

  PdhCloseQuery

  PdhOpenQueryA

  powrprof

  CallNtPowerInformation

  oleaut32

  SysFreeString

  GetErrorInfo

  SysStringLen

  psapi

  GetProcessMemoryInfo

  GetModuleFileNameExW

  shell32

  CommandLineToArgvW

  bcrypt

  BCryptGenRandom

  api-ms-win-crt-heap-l1-1-0

  free

  _set_new_mode

  calloc

  malloc

  api-ms-win-crt-string-l1-1-0

  strcpy_s

  wcslen

  wcsncmp

  api-ms-win-crt-runtime-l1-1-0

  _register_thread_local_exe_atexit_callback

  _cexit

  exit

  _initterm_e

  _initialize_onexit_table

  __p___argv

  _crt_atexit

  _controlfp_s

  abort

  _initterm

  __p___argc

  _get_initial_narrow_environment

  _c_exit

  _exit

  _register_onexit_function

  _initialize_narrow_environment

  _configure_narrow_argv

  terminate

  _set_app_type

  _seh_filter_exe

  api-ms-win-crt-math-l1-1-0

  __setusermatherr

  api-ms-win-crt-stdio-l1-1-0

  _set_fmode

  __p__commode

  api-ms-win-crt-locale-l1-1-0

  _configthreadlocale

  Sections

  .text

  Size: 208KB - Virtual size: 207KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 930KB - Virtual size: 930KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 8KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ