advapi32[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

advapi32.dll
Size

715KB
MD5

560720c5e72176ae71c0eb0cf2f4b53f
SHA1

ca65102e5109bc7727ca0ecdc0cef93f1a347b3e
SHA256

25037f091f55244cdf2885f7e444fd2a65838b7d83f65d01119f8f76b96c34a4
SHA512

9dbdbc573ddbbe138af75f23257e28fc0cfde5716ea606a783d43f2afec3f69ce4e8b4d9f0cf61f22afe71c5a50453155aa307a5a1bd8117ac92083f861b6a32
SSDEEP

12288:PauTrChpOrsGV3Qn77WCLgtpWuwoC/+wiU9pkEuJkSNR:3rAp0sGV3+3WU7uFC/+wiiOEuJkSNR

Score

1^/10

Malware Config

Signatures

Files

advapi32.dll
.dll windows:10 windows x64 arch:x64

dc649ce6dc3a3e76d55574e45a065b48

Code Sign

33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03/02/2023, 00:05

Not After

01/02/2024, 00:05

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5f:ff:65:e2:bb:9f:55:17:3d:aa:84:86:e8:cb:a6:c8:77:88:8a:66:48:8f:e7:34:e2:d1:5a:3a:74:da:5a:19
Signer

Actual PE Digest

5f:ff:65:e2:bb:9f:55:17:3d:aa:84:86:e8:cb:a6:c8:77:88:8a:66:48:8f:e7:34:e2:d1:5a:3a:74:da:5a:19

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

wcscpy_s
wcscat_s
swprintf_s
_wcsicmp
_wcsnicmp
tolower
strstr
strchr
_ultow_s
iswctype
wcstoul
_wcstoui64
_wcstoi64
_ultow
wcsstr
_errno
_ui64tow_s
_i64tow_s
_stricmp
memcpy_s
wcsnlen
_resetstkoflw
iswalpha
wcsncmp
_vsnprintf
__CxxFrameHandler4
__CxxFrameHandler3
?terminate@@YAXXZ
wcstok_s
memcmp
memcpy
memmove
_vsnwprintf
wcsrchr
wcschr
swscanf_s
__C_specific_handler
wcsncpy_s
memset

ntdll

RtlIsValidIndexHandle
RtlFreeHandle
NtOpenKey
NtQueryValueKey
NtClose
NtOpenThreadToken
NtOpenProcessToken
RtlEqualSid
RtlLengthSid
RtlAddAccessAllowedAceEx
NtSetInformationToken
RtlCreateSecurityDescriptor
RtlSetOwnerSecurityDescriptor
NtDuplicateToken
NtCompareTokens
RtlAllocateAndInitializeSid
RtlFreeSid
RtlIsGenericTableEmpty
RtlEnumerateGenericTableWithoutSplaying
RtlCopyUnicodeString
RtlDuplicateUnicodeString
RtlExpandEnvironmentStrings_U
NtOpenFile
RtlCreateUnicodeString
NtQueryInformationProcess
RtlGetLastNtStatus
NtQueryKey
RtlValidSid
LdrLoadDll
RtlImageNtHeader
LdrUnloadDll
NtDeviceIoControlFile
NtQuerySystemInformation
EtwEventRegister
EtwEventWrite
NtCreateKey
NtSetValueKey
RtlDeleteElementGenericTable
RtlAppendUnicodeToString
NtDeleteKey
RtlInsertElementGenericTable
RtlCopySid
RtlInitializeHandleTable
RtlDestroyHandleTable
EtwEventUnregister
NtEnumerateKey
RtlIntegerToUnicodeString
RtlStringFromGUID
RtlAppendUnicodeStringToString
RtlFormatCurrentUserKeyPath
RtlInitializeGenericTable
RtlQueryRegistryValuesEx
RtlLookupElementGenericTable
RtlNumberGenericTableElements
RtlGUIDFromString
RtlUpcaseUnicodeChar
NtQueryVolumeInformationFile
NtOpenSymbolicLinkObject
NtQuerySymbolicLinkObject
RtlPrefixUnicodeString
RtlDetermineDosPathNameType_U
NtQueryInformationFile
RtlGetFullPathName_U
RtlUnicodeToMultiByteN
RtlNtStatusToDosErrorNoTeb
RtlUnicodeToMultiByteSize
RtlAnsiCharToUnicodeChar
RtlMultiByteToUnicodeN
NtTraceControl
RtlSetLastWin32Error
RtlInitAnsiStringEx
RtlInitUnicodeStringEx
RtlCreateUnicodeStringFromAsciiz
NtRenameKey
RtlQueryPackageIdentity
RtlOemStringToUnicodeString
RtlIsTextUnicode
NtSetInformationThread
RtlAddAce
RtlValidAcl
RtlSetSaclSecurityDescriptor
RtlInitializeSid
RtlGetControlSecurityDescriptor
RtlAddAuditAccessObjectAce
RtlSetDaclSecurityDescriptor
RtlGetSaclSecurityDescriptor
RtlGetAce
RtlAddAuditAccessAceEx
RtlxAnsiStringToUnicodeSize
RtlGetOwnerSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlAbsoluteToSelfRelativeSD
RtlAddAccessDeniedAceEx
RtlAddAccessAllowedObjectAce
RtlAddAccessDeniedObjectAce
RtlAllocateHandle
RtlSetGroupSecurityDescriptor
RtlGetDaclSecurityDescriptor
RtlDosPathNameToNtPathName_U
EtwEventWriteTransfer
EtwEventSetInformation
RtlImpersonateSelf
RtlAdjustPrivilege
RtlCopyString
RtlTimeToSecondsSince1970
EtwTraceMessage
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwGetTraceEnableFlags
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids
NtWaitForSingleObject
RtlGetVersion
NtQueryInformationThread
NtQuerySecurityObject
RtlRunOnceExecuteOnce
RtlRunOnceBeginInitialize
RtlDllShutdownInProgress
RtlRunOnceInitialize
RtlAcquireSRWLockExclusive
RtlReleaseSRWLockExclusive
TpSetTimer
TpWaitForTimer
TpReleaseTimer
NtQueryPerformanceCounter
RtlDeleteBoundaryDescriptor
NtCreateMutant
NtOpenPrivateNamespace
NtCreatePrivateNamespace
RtlAddSIDToBoundaryDescriptor
RtlCreateBoundaryDescriptor
NtWaitForMultipleObjects
RtlCreateAcl
RtlValidRelativeSecurityDescriptor
NtCreateFile
NtWriteFile
NtFlushBuffersFile
NtSetInformationFile
NtReadFile
RtlWaitOnAddress
RtlWakeAddressAll
RtlQueryPerformanceCounter
RtlInsertElementGenericTableAvl
RtlAcquireSRWLockShared
RtlLookupElementGenericTableAvl
RtlReleaseSRWLockShared
RtlEnumerateGenericTableAvl
RtlDeleteElementGenericTableAvl
RtlInitializeGenericTableAvl
RtlWakeAddressSingle
RtlDosPathNameToRelativeNtPathName_U
RtlReleaseRelativeName
RtlEqualUnicodeString
RtlDestroyQueryDebugBuffer
RtlQueryProcessDebugInformation
NtAlpcQueryInformation
RtlCreateQueryDebugBuffer
NtQueryObject
NtQueryMutant
RtlInitString
RtlAddAccessAllowedAce
RtlOpenCurrentUser
NtReplaceKey
NtSaveKey
NtSaveMergedKeys
RtlLengthSecurityDescriptor
RtlValidSecurityDescriptor
RtlGetNtProductType
RtlConvertSidToUnicodeString
RtlSubAuthorityCountSid
RtlSubAuthoritySid
RtlGetThreadPreferredUILanguages
RtlMakeSelfRelativeSD
RtlFreeHeap
RtlxUnicodeStringToAnsiSize
NtQueryInformationToken
RtlFreeUnicodeString
RtlAllocateHeap
RtlFirstFreeAce
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlInitializeCriticalSection
RtlDeleteCriticalSection
NtSetSystemInformation
RtlLeaveCriticalSection
RtlEnterCriticalSection
DbgPrint
RtlNtStatusToDosError
RtlInitAnsiString
RtlUnicodeStringToAnsiString
RtlGetCurrentTransaction
RtlInitUnicodeString
NtOpenKeyEx
NtSetInformationKey
LdrGetProcedureAddress
LdrGetDllHandle
RtlAnsiStringToUnicodeString
RtlFreeAnsiString
RtlUnicodeStringToInteger

api-ms-win-eventing-controller-l1-1-0

EnableTraceEx2
EnumerateTraceGuidsEx
ControlTraceW
TraceSetInformation
EventAccessRemove
EventAccessQuery
StartTraceW
StopTraceW
QueryAllTracesW
EventAccessControl

api-ms-win-eventing-consumer-l1-1-0

ProcessTrace
CloseTrace
OpenTraceW

api-ms-win-eventing-consumer-l1-1-1

QueryTraceProcessingHandle

kernelbase

lstrcmpiW
RegKrnGetHKEY_ClassesRootAddress
RegKrnGetClassesEnumTableAddressInternal
RegKrnGetTermsrvRegistryExtensionFlags
lstrlenW
LocalAlloc
LocalReAlloc
CreateProcessAsUserW
CreateProcessAsUserA
GetSystemDefaultUILanguage
RegDeleteKeyExInternalW
RegCreateKeyExInternalW
RegOpenKeyExInternalW
CLOSE_LOCAL_HANDLE_INTERNAL
MapPredefinedHandleInternal
RegDeleteKeyExInternalA
RemapPredefinedHandleInternal
RegCreateKeyExInternalA
DisablePredefinedHandleTableInternal
RegOpenKeyExInternalA
GetStagedPackagePathByFullName
PackageIdFromFullName
GetUserDefaultUILanguage
lstrcmpW
Sleep

sechost

QueryAllTracesA
ControlTraceA
StartTraceA

api-ms-win-service-core-l1-1-0

StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerExW

api-ms-win-service-core-l1-1-1

QueryServiceDynamicInformation
EnumServicesStatusExW
EnumDependentServicesW

api-ms-win-service-core-l1-1-2

GetServiceKeyNameW
GetServiceDisplayNameW

api-ms-win-service-management-l1-1-0

CreateServiceW
OpenServiceW
StartServiceW
ControlServiceExW
DeleteService
OpenSCManagerW
CloseServiceHandle

api-ms-win-service-management-l2-1-0

QueryServiceConfigW
SetServiceObjectSecurity
ChangeServiceConfig2W
NotifyServiceStatusChangeW
QueryServiceObjectSecurity
QueryServiceConfig2W
ChangeServiceConfigW
QueryServiceStatusEx

api-ms-win-service-private-l1-1-4

CreateServiceEx

api-ms-win-service-private-l1-1-2

QueryLocalUserServiceName
QueryUserServiceName
I_ScReparseServiceDatabase

api-ms-win-service-private-l1-1-3

QueryUserServiceNameForContext

api-ms-win-service-private-l1-1-0

I_ScSetServiceBitsW
I_ScSetServiceBitsA
WaitServiceState
I_ScRpcBindA
I_ScRpcBindW

api-ms-win-service-winsvc-l1-1-0

RegisterServiceCtrlHandlerW
ChangeServiceConfigA
StartServiceA
OpenServiceA
QueryServiceConfigA
NotifyServiceStatusChangeA
OpenSCManagerA
ControlServiceExA
QueryServiceStatus
StartServiceCtrlDispatcherA
CreateServiceA
QueryServiceConfig2A
ChangeServiceConfig2A
RegisterServiceCtrlHandlerA
ControlService
RegisterServiceCtrlHandlerExA

api-ms-win-core-namedpipe-l1-1-0

ImpersonateNamedPipeClient

api-ms-win-core-processthreads-l1-1-0

OpenThreadToken
GetProcessId
CreateThread
GetPriorityClass
GetCurrentThread
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
OpenProcessToken
OpenThread
SetThreadToken

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-security-base-l1-1-0

AllocateAndInitializeSid
AccessCheckByTypeResultListAndAuditAlarmByHandleW
ObjectDeleteAuditAlarmW
GetSidSubAuthorityCount
SetTokenInformation
AreAnyAccessesGranted
SetSecurityDescriptorRMControl
EqualSid
GetAce
GetSecurityDescriptorRMControl
SetSecurityDescriptorOwner
IsTokenRestricted
PrivilegedServiceAuditAlarmW
InitializeSid
GetSecurityDescriptorOwner
ImpersonateAnonymousToken
EqualDomainSid
ImpersonateLoggedOnUser
SetSecurityDescriptorSacl
IsValidSid
AddAce
AddAuditAccessAce
AccessCheckByTypeResultListAndAuditAlarmW
SetAclInformation
IsValidSecurityDescriptor
AddAccessDeniedAce
CreateRestrictedToken
FreeSid
EqualPrefixSid
GetFileSecurityW
GetSidSubAuthority
CheckTokenMembership
InitializeSecurityDescriptor
InitializeAcl
DuplicateToken
SetPrivateObjectSecurityEx
AddAccessAllowedObjectAce
GetKernelObjectSecurity
MapGenericMask
SetKernelObjectSecurity
AddAccessAllowedAceEx
GetLengthSid
SetSecurityDescriptorControl
DuplicateTokenEx
IsValidAcl
GetSecurityDescriptorLength
AddAccessAllowedAce
AddAccessDeniedObjectAce
MakeSelfRelativeSD
AccessCheckByType
AddAuditAccessAceEx
MakeAbsoluteSD
SetSecurityDescriptorGroup
GetSidIdentifierAuthority
GetTokenInformation
AccessCheckByTypeResultList
PrivilegeCheck
ObjectCloseAuditAlarmW
AccessCheck
DestroyPrivateObjectSecurity
GetSecurityDescriptorGroup
ConvertToAutoInheritPrivateObjectSecurity
DeleteAce
IsWellKnownSid
ObjectPrivilegeAuditAlarmW
GetWindowsAccountDomainSid
SetPrivateObjectSecurity
CopySid
GetSecurityDescriptorControl
SetSecurityAccessMask
AddAccessDeniedAceEx
CreatePrivateObjectSecurity
CreateWellKnownSid
GetPrivateObjectSecurity
AreAllAccessesGranted
CreatePrivateObjectSecurityWithMultipleInheritance
AccessCheckAndAuditAlarmW
AdjustTokenGroups
CreatePrivateObjectSecurityEx
GetAclInformation
SetFileSecurityW
AddAuditAccessObjectAce
AllocateLocallyUniqueId
GetSecurityDescriptorDacl
RevertToSelf
QuerySecurityAccessMask
GetSidLengthRequired
ObjectOpenAuditAlarmW
GetSecurityDescriptorSacl
FindFirstFreeAce
AccessCheckByTypeAndAuditAlarmW
SetSecurityDescriptorDacl
AdjustTokenPrivileges
ImpersonateSelf

api-ms-win-security-base-private-l1-1-0

MakeAbsoluteSD2

api-ms-win-core-registry-l1-1-0

RegDeleteTreeA
RegDisablePredefinedCacheEx
RegNotifyChangeKeyValue
RegGetKeySecurity
RegLoadAppKeyW
RegDeleteKeyExW
RegOpenCurrentUser
RegQueryInfoKeyW
RegGetValueA
RegSaveKeyExA
RegLoadMUIStringA
RegQueryValueExA
RegCreateKeyExA
RegFlushKey
RegCreateKeyExW
RegUnLoadKeyA
RegOpenUserClassesRoot
RegDeleteKeyExA
RegEnumKeyExW
RegSetKeySecurity
RegSaveKeyExW
RegDeleteTreeW
RegLoadMUIStringW
RegSetValueExW
RegLoadAppKeyA
RegSetValueExA
RegCopyTreeW
RegLoadKeyA
RegUnLoadKeyW
RegQueryInfoKeyA
RegLoadKeyW
RegOpenKeyExA
RegGetValueW
RegRestoreKeyW
RegEnumValueA
RegDeleteValueW
RegRestoreKeyA
RegDeleteValueA
RegEnumValueW
RegEnumKeyExA
RegCloseKey
RegOpenKeyExW
RegQueryValueExW

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW
RegDeleteKeyValueA
RegDeleteKeyValueW
RegSetKeyValueA

api-ms-win-core-registry-l1-1-2

RegQueryMultipleValuesA
RegQueryMultipleValuesW

api-ms-win-core-sysinfo-l1-1-0

GetComputerNameExA
GetSystemDirectoryW
GetSystemTimeAsFileTime
GetTickCount
GetLocalTime
GetSystemWindowsDirectoryW
GetComputerNameExW
GetSystemTime

api-ms-win-core-sysinfo-l1-2-0

GetSystemTimePreciseAsFileTime

kernel32

AreFileApisANSI
MultiByteToWideChar
LocalFree
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
GetLastError
GetProcAddress
DelayLoadFailureHook
ResolveDelayLoadedAPI
FreeLibrary
LoadLibraryExW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
QueryPerformanceCounter
CreateEventW
CloseHandle
GetThreadUILanguage
GetCommandLineW
GetModuleHandleExW
WriteFile
ExpandEnvironmentStringsW
SetFilePointer
CreateFileW
FormatMessageW
GetFileAttributesExW
OutputDebugStringW
DeleteFileW
MoveFileW
GetModuleHandleW
GetFileSizeEx
CreateFileMappingW
HeapAlloc
GetProcessHeap
MapViewOfFile
UnmapViewOfFile
HeapFree
GetLongPathNameW
CompareFileTime
FindResourceExW
LoadResource
GetVolumePathNameW
DeleteCriticalSection
WaitForSingleObject
InitOnceBeginInitialize
CompareStringOrdinal
ReleaseMutex
InitOnceComplete
GetComputerNameW
ExpandEnvironmentStringsA
GetModuleFileNameW
SearchPathW
GetFullPathNameW
GetFileAttributesW
SleepEx
LoadLibraryExA
LoadLibraryA
CreateMutexW
CreateThreadpoolTimer
InitializeCriticalSection
SizeofResource
LockResource
SetEvent
ResetEvent
GetFileTime
FileTimeToDosDateTime
DosDateTimeToFileTime
GetFileSize
FindFirstFileExW
FindNextFileW
FindClose
CopyFileExW
TermsrvDeleteKey
TermsrvOpenUserClasses
ReadProcessMemory
DecodePointer
LoadLibraryW
DuplicateHandle
FreeLibraryAndExitThread
EncodePointer
FreeLibraryWhenCallbackReturns
CloseThreadpoolIo
CancelIoEx
CancelThreadpoolIo
CreateThreadpoolIo
DeviceIoControl
StartThreadpoolIo
GetFileMUIPath
EnumUILanguagesW
SetErrorMode
RaiseException
SetFileInformationByHandle
SetLastError

rpcrt4

RpcBindingBind
RpcBindingCreateW
RpcSsDestroyClientContext
RpcBindingSetAuthInfoExW
RpcStringFreeW
RpcBindingFree
NdrClientCall3
RpcExceptionFilter
UuidToStringW
UuidFromStringW
NdrClientCall2
RpcBindingFromStringBindingW
RpcMgmtInqServerPrincNameW
RpcStringBindingComposeW
I_RpcSNCHOption
RpcBindingSetAuthInfoA
RpcEpResolveBinding
RpcBindingSetAuthInfoW
I_RpcMapWin32Status
I_RpcExceptionFilter

api-ms-win-core-timezone-l1-1-0

EnumDynamicTimeZoneInformation
GetDynamicTimeZoneInformationEffectiveYears

api-ms-win-security-audit-l1-1-1

AuditLookupSubCategoryNameW
AuditQuerySecurity
AuditEnumeratePerUserPolicy
AuditSetPerUserPolicy
AuditEnumerateSubCategories
AuditQueryGlobalSaclW
AuditEnumerateCategories
AuditQueryPerUserPolicy
AuditLookupCategoryNameW
AuditSetGlobalSaclW
AuditSetSecurity

api-ms-win-security-audit-l1-1-0

AuditComputeEffectivePolicyBySid
AuditFree
AuditQuerySystemPolicy
AuditSetSystemPolicy

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventRegister
EventUnregister
EventWriteTransfer

api-ms-win-core-pcw-l1-1-0

PcwCollectData
PcwSetQueryItemUserData
PcwAddQueryItem
PcwRemoveQueryItem
PcwSendNotification
PcwSendStatelessNotification
PcwCreateNotifier
PcwEnumerateInstances
PcwCreateQuery

Exports

Exports

A_SHAFinal
A_SHAInit
A_SHAUpdate
AbortSystemShutdownA
AbortSystemShutdownW
AccessCheck
AccessCheckAndAuditAlarmA
AccessCheckAndAuditAlarmW
AccessCheckByType
AccessCheckByTypeAndAuditAlarmA
AccessCheckByTypeAndAuditAlarmW
AccessCheckByTypeResultList
AccessCheckByTypeResultListAndAuditAlarmA
AccessCheckByTypeResultListAndAuditAlarmByHandleA
AccessCheckByTypeResultListAndAuditAlarmByHandleW
AccessCheckByTypeResultListAndAuditAlarmW
AddAccessAllowedAce
AddAccessAllowedAceEx
AddAccessAllowedObjectAce
AddAccessDeniedAce
AddAccessDeniedAceEx
AddAccessDeniedObjectAce
AddAce
AddAuditAccessAce
AddAuditAccessAceEx
AddAuditAccessObjectAce
AddConditionalAce
AddMandatoryAce
AddUsersToEncryptedFile
AddUsersToEncryptedFileEx
AdjustTokenGroups
AdjustTokenPrivileges
AllocateAndInitializeSid
AllocateLocallyUniqueId
AreAllAccessesGranted
AreAnyAccessesGranted
AuditComputeEffectivePolicyBySid
AuditComputeEffectivePolicyByToken
AuditEnumerateCategories
AuditEnumeratePerUserPolicy
AuditEnumerateSubCategories
AuditFree
AuditLookupCategoryGuidFromCategoryId
AuditLookupCategoryIdFromCategoryGuid
AuditLookupCategoryNameA
AuditLookupCategoryNameW
AuditLookupSubCategoryNameA
AuditLookupSubCategoryNameW
AuditQueryGlobalSaclA
AuditQueryGlobalSaclW
AuditQueryPerUserPolicy
AuditQuerySecurity
AuditQuerySystemPolicy
AuditSetGlobalSaclA
AuditSetGlobalSaclW
AuditSetPerUserPolicy
AuditSetSecurity
AuditSetSystemPolicy
BackupEventLogA
BackupEventLogW
BaseRegCloseKey
BaseRegCreateKey
BaseRegDeleteKeyEx
BaseRegDeleteValue
BaseRegFlushKey
BaseRegGetVersion
BaseRegLoadKey
BaseRegOpenKey
BaseRegRestoreKey
BaseRegSaveKeyEx
BaseRegSetKeySecurity
BaseRegSetValue
BaseRegUnLoadKey
BuildExplicitAccessWithNameA
BuildExplicitAccessWithNameW
BuildImpersonateExplicitAccessWithNameA
BuildImpersonateExplicitAccessWithNameW
BuildImpersonateTrusteeA
BuildImpersonateTrusteeW
BuildSecurityDescriptorA
BuildSecurityDescriptorW
BuildTrusteeWithNameA
BuildTrusteeWithNameW
BuildTrusteeWithObjectsAndNameA
BuildTrusteeWithObjectsAndNameW
BuildTrusteeWithObjectsAndSidA
BuildTrusteeWithObjectsAndSidW
BuildTrusteeWithSidA
BuildTrusteeWithSidW
CancelOverlappedAccess
ChangeServiceConfig2A
ChangeServiceConfig2W
ChangeServiceConfigA
ChangeServiceConfigW
CheckForHiberboot
CheckTokenMembership
ClearEventLogA
ClearEventLogW
CloseCodeAuthzLevel
CloseEncryptedFileRaw
CloseEventLog
CloseServiceHandle
CloseThreadWaitChainSession
CloseTrace
CommandLineFromMsiDescriptor
ComputeAccessTokenFromCodeAuthzLevel
ControlService
ControlServiceExA
ControlServiceExW
ControlTraceA
ControlTraceW
ConvertAccessToSecurityDescriptorA
ConvertAccessToSecurityDescriptorW
ConvertSDToStringSDDomainW
ConvertSDToStringSDRootDomainA
ConvertSDToStringSDRootDomainW
ConvertSecurityDescriptorToAccessA
ConvertSecurityDescriptorToAccessNamedA
ConvertSecurityDescriptorToAccessNamedW
ConvertSecurityDescriptorToAccessW
ConvertSecurityDescriptorToStringSecurityDescriptorA
ConvertSecurityDescriptorToStringSecurityDescriptorW
ConvertSidToStringSidA
ConvertSidToStringSidW
ConvertStringSDToSDDomainA
ConvertStringSDToSDDomainW
ConvertStringSDToSDRootDomainA
ConvertStringSDToSDRootDomainW
ConvertStringSecurityDescriptorToSecurityDescriptorA
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertStringSidToSidA
ConvertStringSidToSidW
ConvertToAutoInheritPrivateObjectSecurity
CopySid
CreateCodeAuthzLevel
CreatePrivateObjectSecurity
CreatePrivateObjectSecurityEx
CreatePrivateObjectSecurityWithMultipleInheritance
CreateProcessAsUserA
CreateProcessAsUserW
CreateProcessWithLogonW
CreateProcessWithTokenW
CreateRestrictedToken
CreateServiceA
CreateServiceEx
CreateServiceW
CreateTraceInstanceId
CreateWellKnownSid
CredBackupCredentials
CredDeleteA
CredDeleteW
CredEncryptAndMarshalBinaryBlob
CredEnumerateA
CredEnumerateW
CredFindBestCredentialA
CredFindBestCredentialW
CredFree
CredGetSessionTypes
CredGetTargetInfoA
CredGetTargetInfoW
CredIsMarshaledCredentialA
CredIsMarshaledCredentialW
CredIsProtectedA
CredIsProtectedW
CredMarshalCredentialA
CredMarshalCredentialW
CredProfileLoaded
CredProfileLoadedEx
CredProfileUnloaded
CredProtectA
CredProtectW
CredReadA
CredReadByTokenHandle
CredReadDomainCredentialsA
CredReadDomainCredentialsW
CredReadW
CredRenameA
CredRenameW
CredRestoreCredentials
CredUnmarshalCredentialA
CredUnmarshalCredentialW
CredUnprotectA
CredUnprotectW
CredWriteA
CredWriteDomainCredentialsA
CredWriteDomainCredentialsW
CredWriteW
CredpConvertCredential
CredpConvertOneCredentialSize
CredpConvertTargetInfo
CredpDecodeCredential
CredpEncodeCredential
CredpEncodeSecret
CryptAcquireContextA
CryptAcquireContextW
CryptContextAddRef
CryptCreateHash
CryptDecrypt
CryptDeriveKey
CryptDestroyHash
CryptDestroyKey
CryptDuplicateHash
CryptDuplicateKey
CryptEncrypt
CryptEnumProviderTypesA
CryptEnumProviderTypesW
CryptEnumProvidersA
CryptEnumProvidersW
CryptExportKey
CryptGenKey
CryptGenRandom
CryptGetDefaultProviderA
CryptGetDefaultProviderW
CryptGetHashParam
CryptGetKeyParam
CryptGetProvParam
CryptGetUserKey
CryptHashData
CryptHashSessionKey
CryptImportKey
CryptReleaseContext
CryptSetHashParam
CryptSetKeyParam
CryptSetProvParam
CryptSetProviderA
CryptSetProviderExA
CryptSetProviderExW
CryptSetProviderW
CryptSignHashA
CryptSignHashW
CryptVerifySignatureA
CryptVerifySignatureW
CveEventWrite
DecryptFileA
DecryptFileW
DeleteAce
DeleteService
DeregisterEventSource
DestroyPrivateObjectSecurity
DuplicateEncryptionInfoFile
DuplicateToken
DuplicateTokenEx
EnableTrace
EnableTraceEx
EnableTraceEx2
EncryptFileA
EncryptFileW
EncryptedFileKeyInfo
EncryptionDisable
EnumDependentServicesA
EnumDependentServicesW
EnumDynamicTimeZoneInformation
EnumServiceGroupW
EnumServicesStatusA
EnumServicesStatusExA
EnumServicesStatusExW
EnumServicesStatusW
EnumerateTraceGuids
EnumerateTraceGuidsEx
EqualDomainSid
EqualPrefixSid
EqualSid
EventAccessControl
EventAccessQuery
EventAccessRemove
EventActivityIdControl
EventEnabled
EventProviderEnabled
EventRegister
EventSetInformation
EventUnregister
EventWrite
EventWriteEndScenario
EventWriteEx
EventWriteStartScenario
EventWriteString
EventWriteTransfer
FileEncryptionStatusA
FileEncryptionStatusW
FindFirstFreeAce
FlushEfsCache
FlushTraceA
FlushTraceW
FreeEncryptedFileKeyInfo
FreeEncryptedFileMetadata
FreeEncryptionCertificateHashList
FreeInheritedFromArray
FreeSid
GetAccessPermissionsForObjectA
GetAccessPermissionsForObjectW
GetAce
GetAclInformation
GetAuditedPermissionsFromAclA
GetAuditedPermissionsFromAclW
GetCurrentHwProfileA
GetCurrentHwProfileW
GetDynamicTimeZoneInformationEffectiveYears
GetEffectiveRightsFromAclA
GetEffectiveRightsFromAclW
GetEncryptedFileMetadata
GetEventLogInformation
GetExplicitEntriesFromAclA
GetExplicitEntriesFromAclW
GetFileSecurityA
GetFileSecurityW
GetInformationCodeAuthzLevelW
GetInformationCodeAuthzPolicyW
GetInheritanceSourceA
GetInheritanceSourceW
GetKernelObjectSecurity
GetLengthSid
GetLocalManagedApplicationData
GetLocalManagedApplications
GetManagedApplicationCategories
GetManagedApplications
GetMultipleTrusteeA
GetMultipleTrusteeOperationA
GetMultipleTrusteeOperationW
GetMultipleTrusteeW
GetNamedSecurityInfoA
GetNamedSecurityInfoExA
GetNamedSecurityInfoExW
GetNamedSecurityInfoW
GetNumberOfEventLogRecords
GetOldestEventLogRecord
GetOverlappedAccessResults
GetPrivateObjectSecurity
GetSecurityDescriptorControl
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorLength
GetSecurityDescriptorOwner
GetSecurityDescriptorRMControl
GetSecurityDescriptorSacl
GetSecurityInfo
GetSecurityInfoExA
GetSecurityInfoExW
GetServiceDisplayNameA
GetServiceDisplayNameW
GetServiceKeyNameA
GetServiceKeyNameW
GetSidIdentifierAuthority
GetSidLengthRequired
GetSidSubAuthority
GetSidSubAuthorityCount
GetStringConditionFromBinary
GetThreadWaitChain
GetTokenInformation
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
GetTrusteeFormA
GetTrusteeFormW
GetTrusteeNameA
GetTrusteeNameW
GetTrusteeTypeA
GetTrusteeTypeW
GetUserNameA
GetUserNameW
GetWindowsAccountDomainSid
I_QueryTagInformation
I_ScGetCurrentGroupStateW
I_ScIsSecurityProcess
I_ScPnPGetServiceName
I_ScQueryServiceConfig
I_ScRegisterPreshutdownRestart
I_ScReparseServiceDatabase
I_ScSendPnPMessage
I_ScSendTSMessage
I_ScSetServiceBitsA
I_ScSetServiceBitsW
I_ScValidatePnPService
IdentifyCodeAuthzLevelW
ImpersonateAnonymousToken
ImpersonateLoggedOnUser
ImpersonateNamedPipeClient
ImpersonateSelf
InitializeAcl
InitializeSecurityDescriptor
InitializeSid
InitiateShutdownA
InitiateShutdownW
InitiateSystemShutdownA
InitiateSystemShutdownExA
InitiateSystemShutdownExW
InitiateSystemShutdownW
InstallApplication
IsTextUnicode
IsTokenRestricted
IsTokenUntrusted
IsValidAcl
IsValidRelativeSecurityDescriptor
IsValidSecurityDescriptor
IsValidSid
IsWellKnownSid
LockServiceDatabase
LogonUserA
LogonUserExA
LogonUserExExW
LogonUserExW
LogonUserW
LookupAccountNameA
LookupAccountNameW
LookupAccountSidA
LookupAccountSidW
LookupPrivilegeDisplayNameA
LookupPrivilegeDisplayNameW
LookupPrivilegeNameA
LookupPrivilegeNameW
LookupPrivilegeValueA
LookupPrivilegeValueW
LookupSecurityDescriptorPartsA
LookupSecurityDescriptorPartsW
LsaAddAccountRights
LsaAddPrivilegesToAccount
LsaClearAuditLog
LsaClose
LsaConfigureAutoLogonCredentials
LsaCreateAccount
LsaCreateSecret
LsaCreateTrustedDomain
LsaCreateTrustedDomainEx
LsaDelete
LsaDeleteTrustedDomain
LsaDisableUserArso
LsaEnableUserArso
LsaEnumerateAccountRights
LsaEnumerateAccounts
LsaEnumerateAccountsWithUserRight
LsaEnumeratePrivileges
LsaEnumeratePrivilegesOfAccount
LsaEnumerateTrustedDomains
LsaEnumerateTrustedDomainsEx
LsaFreeMemory
LsaGetAppliedCAPIDs
LsaGetDeviceRegistrationInfo
LsaGetQuotasForAccount
LsaGetRemoteUserName
LsaGetSystemAccessAccount
LsaGetUserName
LsaICLookupNames
LsaICLookupNamesWithCreds
LsaICLookupSids
LsaICLookupSidsWithCreds
LsaInvokeTrustScanner
LsaIsUserArsoAllowed
LsaIsUserArsoEnabled
LsaLookupNames
LsaLookupNames2
LsaLookupPrivilegeDisplayName
LsaLookupPrivilegeName
LsaLookupPrivilegeValue
LsaLookupSids
LsaLookupSids2
LsaManageSidNameMapping
LsaNtStatusToWinError
LsaOpenAccount
LsaOpenPolicy
LsaOpenPolicySce
LsaOpenSecret
LsaOpenTrustedDomain
LsaOpenTrustedDomainByName
LsaProfileDeleted
LsaQueryCAPs
LsaQueryDomainInformationPolicy
LsaQueryForestTrustInformation
LsaQueryForestTrustInformation2
LsaQueryInfoTrustedDomain
LsaQueryInformationPolicy
LsaQuerySecret
LsaQuerySecurityObject
LsaQueryTrustedDomainInfo
LsaQueryTrustedDomainInfoByName
LsaRemoveAccountRights
LsaRemovePrivilegesFromAccount
LsaRetrievePrivateData
LsaSetCAPs
LsaSetDomainInformationPolicy
LsaSetForestTrustInformation
LsaSetForestTrustInformation2
LsaSetInformationPolicy
LsaSetInformationTrustedDomain
LsaSetQuotasForAccount
LsaSetSecret
LsaSetSecurityObject
LsaSetSystemAccessAccount
LsaSetTrustedDomainInfoByName
LsaSetTrustedDomainInformation
LsaStorePrivateData
LsaValidateProcUniqueLuid
MD4Final
MD4Init
MD4Update
MD5Final
MD5Init
MD5Update
MIDL_user_free_Ext
MSChapSrvChangePassword
MSChapSrvChangePassword2
MakeAbsoluteSD

Sections

.text
Size: 424KB - Virtual size: 420KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 224KB - Virtual size: 220KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dc649ce6dc3a3e76d55574e45a065b48

Code Sign

33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

5f:ff:65:e2:bb:9f:55:17:3d:aa:84:86:e8:cb:a6:c8:77:88:8a:66:48:8f:e7:34:e2:d1:5a:3a:74:da:5a:19Signer

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

ntdll

api-ms-win-eventing-controller-l1-1-0

api-ms-win-eventing-consumer-l1-1-0

api-ms-win-eventing-consumer-l1-1-1

kernelbase

sechost

api-ms-win-service-core-l1-1-0

api-ms-win-service-core-l1-1-1

api-ms-win-service-core-l1-1-2

api-ms-win-service-management-l1-1-0

api-ms-win-service-management-l2-1-0

api-ms-win-service-private-l1-1-4

api-ms-win-service-private-l1-1-2

api-ms-win-service-private-l1-1-3

api-ms-win-service-private-l1-1-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-security-base-l1-1-0

api-ms-win-security-base-private-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-registry-l1-1-1

api-ms-win-core-registry-l1-1-2

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

kernel32

rpcrt4

api-ms-win-core-timezone-l1-1-0

api-ms-win-security-audit-l1-1-1

api-ms-win-security-audit-l1-1-0

api-ms-win-core-apiquery-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-pcw-l1-1-0

Exports

Exports

Sections

.text Size: 424KB - Virtual size: 420KB

.rdata Size: 224KB - Virtual size: 220KB

.data Size: 12KB - Virtual size: 17KB

.pdata Size: 20KB - Virtual size: 17KB

.didat Size: 4KB - Virtual size: 1KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 8KB - Virtual size: 6KB

33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

5f:ff:65:e2:bb:9f:55:17:3d:aa:84:86:e8:cb:a6:c8:77:88:8a:66:48:8f:e7:34:e2:d1:5a:3a:74:da:5a:19
Signer

.text
Size: 424KB - Virtual size: 420KB

.rdata
Size: 224KB - Virtual size: 220KB

.data
Size: 12KB - Virtual size: 17KB

.pdata
Size: 20KB - Virtual size: 17KB

.didat
Size: 4KB - Virtual size: 1KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 6KB