6855b39df6b684378762358347837a9dba0e4505b6c758c27bc5d8c750e65111

Sharing

Copy URL Twitter E-mail

General

Target

6855b39df6b684378762358347837a9dba0e4505b6c758c27bc5d8c750e65111
Size

96KB
MD5

59e5c55db0190bed37f7471335ae752d
SHA1

b594d52c308898b8e7bea5463fa91e1c4ab01f7b
SHA256

6855b39df6b684378762358347837a9dba0e4505b6c758c27bc5d8c750e65111
SHA512

a5a9353e42e9ac82cdc67b3a9c5bba76b73021577ee21e33557e77da77bc8f2b11be8ecd01e10a6abd89c48ad6275674eab42d1404b2516684575e7a7c671a75
SSDEEP

1536:sLtAoZZLMudkKO2JhFu4tnTBBi+fGcJJbPyT0rtT1dKg6rRqoR2RuK5e4ZU:sLtAoZZLMvneu4dTBBiBybPyT0Vyg6rB

Score

N/A

Malware Config

Signatures

Files

6855b39df6b684378762358347837a9dba0e4505b6c758c27bc5d8c750e65111
.exe windows x86

4e474f8e592b8f11a46d3323e214db82

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

rpcrt4

RpcBindingVectorFree
RpcMgmtStopServerListening
NdrServerCall2
RpcServerUseProtseqW
RpcEpUnregister
RpcMgmtWaitServerListen
RpcServerListen
RpcServerRegisterAuthInfoW
RpcEpRegisterW
RpcServerRegisterIf
RpcServerInqBindings

aclocsettings

??5CAcByteStream@@QAEAAV0@AAV?$vector@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@V?$allocator@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@2@@std@@@Z
??0CAcDistPkg@@QAE@ABV0@@Z
?RecoverFromByteStream@CAcDistPkg@@QAEXAAVCAcByteStream@@@Z
??6CAcByteStream@@QAEAAV0@AAH@Z
??6CAcByteStream@@QAEAAV0@AAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?Write@CAcByteStream@@QAEXPAEK@Z
??5CAcByteStream@@QAEAAV0@AAH@Z
??5CAcByteStream@@QAEAAV0@AAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?Read@CAcByteStream@@QAEXPAEK@Z
??6CAcByteStream@@QAEAAV0@AAK@Z
??6CAcByteStream@@QAEAAV0@AAV?$vector@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@V?$allocator@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@2@@std@@@Z
??5CAcByteStream@@QAEAAV0@AAK@Z
??1CAcLocation@@UAE@XZ
??1CAcByteStream@@UAE@XZ
?RecoverFromByteStream@CAcLocation@@QAEXAAVCAcByteStream@@@Z
??0CAcByteStream@@QAE@PAEK@Z
??0CAcLocation@@QAE@XZ
??1CAcGroup@@UAE@XZ
??0CAcDistPkg@@QAE@XZ
?RecoverFromByteStream@CAcGroup@@QAEXAAVCAcByteStream@@@Z
??0CAcGroup@@QAE@XZ
??0CAcSlNumGrp@@QAE@ABV0@@Z
?SetLocationName@CAcLocation@@QAEXQAG@Z
?GetAncData@CAcLocation@@QAE?AV?$vector@VCAcAncData@@V?$allocator@VCAcAncData@@@std@@@std@@XZ
??0CAcAncData@@QAE@XZ
?SetAncData@CAcLocation@@QAEXV?$vector@VCAcAncData@@V?$allocator@VCAcAncData@@@std@@@std@@@Z
?GetAdapters@CAcLocation@@QAE?AV?$vector@PAVCAcAdptSettings@@V?$allocator@PAVCAcAdptSettings@@@std@@@std@@XZ
??5CAcByteStream@@QAEAAV0@AAE@Z
?RecoverFromByteStream@CAcSlNumGrp@@QAEXAAVCAcByteStream@@@Z
??1CAcSlNumGrp@@UAE@XZ
??0CAcSlNumGrp@@QAE@XZ
??4CAcAncData@@QAEAAV0@ABV0@@Z
??0CAcAncData@@QAE@ABV0@@Z
??1CAcAncData@@UAE@XZ
??1CAcDistPkg@@UAE@XZ
?ConvertToByteStream@CAcDistPkg@@QAEXAAVCAcByteStream@@@Z
?ConvertToByteStream@CAcSlNumGrp@@QAEXAAVCAcByteStream@@@Z
?SetGroupName@CAcGroup@@QAEXV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?ConvertToByteStream@CAcGroup@@QAEXAAVCAcByteStream@@@Z
??0CAcByteStream@@QAE@XZ
?SetLocationName@CAcLocation@@QAEXV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?ConvertToByteStream@CAcLocation@@QAEXAAVCAcByteStream@@@Z
?GetBytesStreamd@CAcByteStream@@QAEKXZ
?GetBuffer@CAcByteStream@@QAEPAEXZ

acprfmgr

??1CAcPrfMgr@@QAE@XZ
?GetExpiredProfileList@CAcPrfMgr@@QAEKAAV?$vector@VCAcExpiredLocInfo@@V?$allocator@VCAcExpiredLocInfo@@@std@@@std@@@Z
?WritePacAidGroup@CAcPrfMgr@@QAEKAAVCAcPacAidGroup@@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?ReadPacAidGroup@CAcPrfMgr@@QAEKAAVCAcPacAidGroup@@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?GetPacAidGrpList@CAcPrfMgr@@QAEKAAV?$vector@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@V?$allocator@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@2@@std@@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@3@@Z
?GetGroupList@CAcPrfMgr@@QAEKAAV?$vector@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@V?$allocator@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@2@@std@@@Z
?GetExportableLocationList@CAcPrfMgr@@QAEKAAV?$vector@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@V?$allocator@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@2@@std@@@Z
?GetNonHiddenLocationList@CAcPrfMgr@@QAEKAAV?$vector@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@V?$allocator@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@2@@std@@@Z
?GetLocationList@CAcPrfMgr@@QAEKAAV?$vector@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@V?$allocator@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@2@@std@@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@3@@Z
?GetPreferredLocation@CAcPrfMgr@@QAEKAAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?ReadCcpSettings@CAcPrfMgr@@QAEKAAK0@Z
?ReadLocHideSelection@CAcPrfMgr@@QAEKV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAH@Z
?ReadRoamingSelection@CAcPrfMgr@@QAEKV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAH@Z
?ReadGroup@CAcPrfMgr@@QAEKAAVCAcGroup@@@Z
?GetLastActiveLocation@CAcPrfMgr@@QAEKAAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
??0CAcPrfMgr@@QAE@XZ
?DeleteLocation@CAcPrfMgr@@QAEKAAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@V23@@Z
?SetLastActiveLocation@CAcPrfMgr@@QAEKAAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?WriteGroup@CAcPrfMgr@@QAEKAAVCAcGroup@@@Z
?DeleteGroup@CAcPrfMgr@@QAEKAAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?UpdateRoamingSelection@CAcPrfMgr@@QAEKV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@H@Z
?UpdateLocHideSelection@CAcPrfMgr@@QAEKV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@H@Z
?UpdateLocMember@CAcPrfMgr@@QAEKAAVCAcLocation@@W4__AC_LOC_MEMBER_NAME@@@Z
?WriteCcpSettings@CAcPrfMgr@@QAEKKK@Z
?DeletePacAidGroup@CAcPrfMgr@@QAEKAAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@V23@@Z
?DeleteAllPacAidGroups@CAcPrfMgr@@QAEKV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?SetPreferredLocation@CAcPrfMgr@@QAEKAAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?ReadLocation@CAcPrfMgr@@QAEKAAVCAcLocation@@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@H@Z
?WriteLocation@CAcPrfMgr@@QAEKAAVCAcLocation@@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@H@Z

shlwapi

PathFileExistsW

achelper

?NormalPrintLogFile@AcLogInfo@@QAAXPAGZZ
?ErrorPrintLogFile@AcLogInfo@@QAAXPAGZZ
?GetShellExeName@AcHelper@@SAPBGXZ
ACHlprGetRegDWord
ACHlprGetRegString
?GetLogInfoInstance@AcLogInfo@@SAPAV1@XZ

acon

?IsProcessLaunched@AcProcessHlpr@@SAHPAG@Z
?IsAnyGUIModuleIsRunningOnOtherUserContext@AcProcessHlpr@@SAKK@Z
?FindTheNumberOfInstancesRunning@AcProcessHlpr@@SAKPAG@Z

accrypthlpr

ord15
??0CAcCryptHlpr@@QAE@XZ
ord7
ord8
??1CAcCryptHlpr@@UAE@XZ

userenv

RegisterGPNotification
UnregisterGPNotification

kernel32

GetModuleFileNameW
SetConsoleCtrlHandler
GetCommandLineW
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExW
InitializeCriticalSection
DeleteCriticalSection
SetEvent
HeapAlloc
GetProcessHeap
HeapFree
WaitForSingleObject
CreateProcessW
WaitForMultipleObjects
CreateEventW
CreateThread
GetSystemDirectoryW
lstrcpyW
LoadLibraryW
GetProcAddress
FreeLibrary
CloseHandle
IsBadWritePtr
Sleep
ExitProcess
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetVersionExA
GetLastError

user32

RegisterWindowMessageW
wsprintfW

advapi32

DeleteService
QueryServiceStatus
ControlService
OpenServiceW
RegisterServiceCtrlHandlerW
StartServiceCtrlDispatcherW
RegDeleteKeyW
RegDeleteValueW
RegSetValueExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
SetServiceStatus
CloseServiceHandle
CreateServiceW
RegCreateKeyExW
RegEnumValueW
OpenSCManagerW

shell32

CommandLineToArgvW

ole32

CoInitializeSecurity
CoUninitialize
CoCreateInstance
CoInitializeEx

oleaut32

VariantClear
SysAllocString
SysFreeString

msvcp71

?_Nomemory@std@@YAXXZ
??$?9GU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z
?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
?clear@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z

msvcr71

_callnewh
??1type_info@@UAE@XZ
__security_error_handler
__dllonexit
_onexit
_c_exit
_exit
_XcptFilter
_cexit
__p___initenv
_amsg_exit
memset
_controlfp
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
swscanf
_except_handler3
_stricmp
exit
printf
??1exception@@UAE@XZ
??0exception@@QAE@XZ
__CxxFrameHandler
??3@YAXPAX@Z
free
malloc
??0exception@@QAE@ABV0@@Z
_CxxThrowException

Sections

.text
Size: 40KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4e474f8e592b8f11a46d3323e214db82

Headers

File Characteristics

Imports

rpcrt4

aclocsettings

acprfmgr

shlwapi

achelper

acon

accrypthlpr

userenv

kernel32

user32

advapi32

shell32

ole32

oleaut32

msvcp71

msvcr71

Sections

.text Size: 40KB - Virtual size: 38KB

.rdata Size: 44KB - Virtual size: 41KB

.data Size: 4KB - Virtual size: 3KB

.rsrc Size: 4KB - Virtual size: 2KB

.text
Size: 40KB - Virtual size: 38KB

.rdata
Size: 44KB - Virtual size: 41KB

.data
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 4KB - Virtual size: 2KB