acf22cf506a9be435a781f587f82cb6a9ffdb7cc0bc3a59eaae0fff3460943c0

Sharing

Copy URL

Twitter E-mail

General

Target

acf22cf506a9be435a781f587f82cb6a9ffdb7cc0bc3a59eaae0fff3460943c0
Size

120KB
MD5

b8362ce10347a7e1bf4e7ce7137dd040
SHA1

58cf17d2960fffddbd357c51b0d0434c7ee54e0f
SHA256

acf22cf506a9be435a781f587f82cb6a9ffdb7cc0bc3a59eaae0fff3460943c0
SHA512

20056181b5bb22789d28b1099accaef8b8d2ee16e34dbaa60629253b2201897f0ba4793a3188cf0c4a7f0667de05a3930d1cd2ed4081826d898687174f0869b3
SSDEEP

1536:FTsYdETM9ryESRjCjoZha19+WSGRNIMfmxDIIPQ8GGTZpVJQg00wWNzagRDoz:FTfd1AEKQGh0HNYx0M93/VCtWZa+u

Score

N/A

Malware Config

Signatures

Files

acf22cf506a9be435a781f587f82cb6a9ffdb7cc0bc3a59eaae0fff3460943c0
.dll windows x86

85182403f10b9d3e888f6fa8a5c773fc

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

GetCurrentHwProfileA
ObjectCloseAuditAlarmA
GetExplicitEntriesFromAclW
RevertToSelf
ControlService
ObjectPrivilegeAuditAlarmW
LookupPrivilegeValueW
GetCurrentHwProfileW
ConvertStringSecurityDescriptorToSecurityDescriptorA
RegQueryValueA
SystemFunction009
SystemFunction007
RegQueryInfoKeyW
CryptSetProviderExA
CreateServiceA
RegEnumKeyW
GetEffectiveRightsFromAclW
CreatePrivateObjectSecurity
ElfBackupEventLogFileW
SetNamedSecurityInfoExW
MakeSelfRelativeSD
QueryServiceConfigA
ElfCloseEventLog
CryptDestroyHash
RegDeleteValueA
CryptGetProvParam
RegCreateKeyExA
TrusteeAccessToObjectA
LsaLookupNames
AddAccessAllowedAceEx
StartServiceCtrlDispatcherW
ReadEventLogW
GetAccessPermissionsForObjectW
DecryptFileW
CloseEventLog
AddAccessAllowedAce
LsaAddAccountRights
LsaEnumeratePrivileges
GetTokenInformation
RegReplaceKeyW
CryptSignHashA
CryptExportKey
GetSidIdentifierAuthority
OpenThreadToken
LsaOpenSecret
QueryRecoveryAgentsOnEncryptedFile
GetTrusteeTypeW
QueryServiceConfig2A
LsaAddPrivilegesToAccount
LsaGetRemoteUserName
DuplicateTokenEx
LookupSecurityDescriptorPartsW
SystemFunction002
SetEntriesInAccessListA
RegConnectRegistryA
SystemFunction019
AddAuditAccessObjectAce
GetMultipleTrusteeOperationW
GetAuditedPermissionsFromAclA
LsaSetInformationTrustedDomain
ReportEventA
InitiateSystemShutdownW
CryptGetHashParam
AccessCheckByTypeAndAuditAlarmW
LsaQueryInfoTrustedDomain
SetSecurityDescriptorSacl
LsaQueryDomainInformationPolicy
BuildImpersonateTrusteeA
BuildImpersonateExplicitAccessWithNameW
SystemFunction030
LsaSetTrustedDomainInfoByName
CryptCreateHash
MapGenericMask
ElfNumberOfRecords
GetFileSecurityW
ChangeServiceConfig2W
AddAccessDeniedAceEx
ElfChangeNotify
RegCreateKeyW
CheckTokenMembership
CryptVerifySignatureA
ConvertAccessToSecurityDescriptorW
QueryServiceStatus
ReadEventLogA
RegisterEventSourceW
ConvertSidToStringSidA
GetSecurityDescriptorControl
FileEncryptionStatusW
LsaRemovePrivilegesFromAccount
LsaDeleteTrustedDomain
CryptGetKeyParam
SetEntriesInAclW
ConvertSecurityDescriptorToAccessA
SystemFunction020

comctl32

ImageList_GetIconSize
ImageList_Create
ord8
ImageList_GetImageInfo
ord4
InitCommonControlsEx
ImageList_SetImageCount
ord16
InitializeFlatSB
FlatSB_SetScrollRange
PropertySheetA
ImageList_GetImageCount
ImageList_SetIconSize
ImageList_SetOverlayImage
ImageList_LoadImageW
ord17
FlatSB_SetScrollProp
ImageList_Write
PropertySheetW
FlatSB_GetScrollRange
ord7
UninitializeFlatSB
DestroyPropertySheetPage
DrawStatusTextW
ImageList_LoadImageA
ImageList_SetFilter
FlatSB_EnableScrollBar
ImageList_Copy
FlatSB_ShowScrollBar
ord3
ImageList_Remove
ImageList_Add
ImageList_Draw
ord6
FlatSB_GetScrollPos
CreateToolbarEx
ImageList_ReplaceIcon
ImageList_AddIcon
ImageList_DragMove
ImageList_GetDragImage
ImageList_DragEnter
ImageList_BeginDrag
FlatSB_SetScrollPos
CreatePropertySheetPageW
ImageList_SetBkColor
ImageList_Duplicate
ImageList_Destroy
FlatSB_SetScrollInfo
ImageList_Merge
ImageList_Replace
ImageList_DrawEx
ImageList_GetIcon
FlatSB_GetScrollProp
_TrackMouseEvent
CreatePropertySheetPageA
ord13
ImageList_DrawIndirect
ord5
ord2
ImageList_GetImageRect
ImageList_Read
ord14
FlatSB_GetScrollInfo
ImageList_AddMasked
ImageList_EndDrag
ImageList_GetBkColor
ImageList_DragLeave
CreateStatusWindowW
ord15
ImageList_DragShowNolock
ImageList_SetDragCursorImage

kernel32

VirtualAlloc
GetModuleHandleA
CreateMailslotA
CancelIo
GetCommProperties
GetNumberFormatW
GetNextVDMCommand
GetVersion
Heap32ListNext
TerminateThread
GetConsoleKeyboardLayoutNameW
ReadConsoleW
ClearCommBreak
LoadResource
SetThreadAffinityMask
CreateJobObjectW
CreateToolhelp32Snapshot
GetProcAddress
SetConsoleCursorPosition
OpenConsoleW
FindVolumeMountPointClose
OpenMutexA
LoadLibraryA
EnterCriticalSection
EnumDateFormatsA
ReadFileScatter
GetAtomNameA
RtlUnwind
RegisterWowExec
GetLargestConsoleWindowSize
GetProfileIntA
GetHandleInformation
EnumTimeFormatsA
GlobalFree
GetProcessHeaps
IsValidLocale
SetFilePointerEx
GetConsoleCursorInfo
MoveFileWithProgressA
Heap32ListFirst
GetVolumePathNameW
Process32Next
LockResource
SystemTimeToFileTime
OutputDebugStringA
SuspendThread
LocalFileTimeToFileTime
GetProcessTimes
IsBadCodePtr
GetStartupInfoW
SetFileApisToOEM
lstrcatW
CompareFileTime
GetSystemTime
WriteProcessMemory
MultiByteToWideChar
Sleep
EnumResourceLanguagesA
CreateDirectoryExA
GetFileAttributesExA
CreateFileA
GetShortPathNameW
SearchPathA
SetVolumeMountPointA
CreateMutexA
lstrcpyA
EnumResourceTypesA
UTUnRegister
CreateHardLinkW
CmdBatNotification
InterlockedExchangeAdd
GetVersionExW
DosDateTimeToFileTime
_lclose
AddAtomW
ReadConsoleOutputAttribute
TransactNamedPipe
GetCurrentThread

shell32

ExtractAssociatedIconExW
RegenerateUserEnvironment
SHInvokePrinterCommandA
StrRChrIA
ExtractIconW
StrChrIW
ord179
InternalExtractIconListW
SHGetSpecialFolderLocation
StrCmpNW
ShellAboutA
StrChrIA
ord180
SHLoadInProc
SheGetDirA
SHGetDesktopFolder
SHGetInstanceExplorer
DoEnvironmentSubstA
SHGetDataFromIDListA
ShellExecuteExA
StrRChrA
StrRStrIW
RealShellExecuteExA
StrCmpNA
RealShellExecuteExW
DuplicateIcon
SHGetSettings
SheChangeDirExW
SHFileOperationA
StrNCmpW
DragQueryFileAorW
SHGetSpecialFolderPathA
StrStrIW
ExtractAssociatedIconW
CheckEscapesW
SHFileOperationW
SHEmptyRecycleBinW
FindExecutableA
SHChangeNotify
Shell_NotifyIconA
StrNCmpIW
SHQueryRecycleBinW
SHFormatDrive
StrChrA
StrStrW
SHGetSpecialFolderPathW
ExtractAssociatedIconA
DragQueryFileW
ShellAboutW

winspool.drv

DeletePrinterDriverA
DeletePrinter
SetPrinterDataExW
AddJobW
EnumJobsA
ord205
DeletePrinterDriverW
ConvertUnicodeDevModeToAnsiDevmode
ADVANCEDSETUPDIALOG
EnumPrintProcessorDatatypesW
AddPortW
EnumPrinterKeyW
DeleteFormW
ord210
DeletePrintProvidorA
AddPrinterDriverExA
DocumentPropertiesW
DeletePrinterConnectionA
DeletePrintProvidorW
FindClosePrinterChangeNotification
GetPrinterDataA
EnumPrintProcessorDatatypesA
DeletePortA
DeletePrintProcessorA
AddMonitorW
PlayGdiScriptOnPrinterIC
EnumPrinterDataExW
SetFormW
AddPrinterConnectionW
AddJobA
QueryRemoteFonts
GetJobW
DevicePropertySheets
DocumentEvent
DeletePrinterConnectionW
EnumPrinterDataExA

msvcrt

ldexp
_mbsdec
_mbsupr
_mbsnset
_mbsinc
_mbsnccnt
_mbsicoll
wprintf
_strerror
__RTtypeid
__p__iob
ungetc
_wfindnext
scanf
is_wctype
fwprintf
isdigit
__wgetmainargs
strcmp
_mbccpy
_mbsnbcat
_getch
strstr
_mbsncpy
exp
_ismbcpunct
_spawnlp
vswprintf
getc
_fgetwchar
_ecvt
_fileno
_getpid
__p___argv
_spawnle
_wgetdcwd
_adj_fdiv_m16i
fprintf
srand
fputc
_Gettnames
getwc
_logb
asin
fwrite
fputs
fread
_cputs
printf
_CItan
_ismbbkana
_sys_nerr
_fputwchar
_mbsnicoll
_spawnl
_spawnve
_CxxThrowException
strcat
_spawnv
_mbslwr
_mbctombb
fopen
_fpieee_flt
_HUGE
_unlink
_CIlog10
_acmdln
_ltoa
fgetc
fmod
ftell
__p___initenv
__CxxLongjmpUnwind
_getdllprocaddr
_adj_fdiv_m32i
_get_osfhandle
ferror
_safe_fprem
_toupper
_ismbblead
_mbsnbcoll
_ismbcsymbol
_mbscspn
strncat
_wexecle
cosh
_isctype
strtol
memset
iswpunct
fsetpos
wcsftime
_controlfp
vsprintf
__p__acmdln
fclose
_wcslwr
_fstat
_wexecve
_atoi64
tolower
wcspbrk
_CIsin
feof
sprintf
_adj_fdivr_m16i
fseek
_callnewh
_strdup
_putch
_j0
_wpopen
_mbscat
__p__osver
__threadhandle
ispunct
wcsstr

Exports

Exports

ggbwyrvjlyu

Sections

.text
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 56KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

85182403f10b9d3e888f6fa8a5c773fc

Headers

File Characteristics

Imports

advapi32

comctl32

kernel32

shell32

winspool.drv

msvcrt

Exports

Exports

Sections

.text Size: 36KB - Virtual size: 32KB

.rdata Size: 16KB - Virtual size: 12KB

.data Size: 56KB - Virtual size: 52KB

.reloc Size: 8KB - Virtual size: 5KB

.text
Size: 36KB - Virtual size: 32KB

.rdata
Size: 16KB - Virtual size: 12KB

.data
Size: 56KB - Virtual size: 52KB

.reloc
Size: 8KB - Virtual size: 5KB