4ded92de4a254ce07810a56c969f0dce

Sharing

Copy URL

Twitter E-mail

General

Target

4ded92de4a254ce07810a56c969f0dce
Size

537KB
MD5

4ded92de4a254ce07810a56c969f0dce
SHA1

50da3dfd04b427738d0490d6eabde2d605a50d0d
SHA256

0cd326ae8195b21bb527e871291c19482e272ce6f871e1d28694c46a08bf694e
SHA512

2fb9022cdc2bed3a4c4e51decadedc16d096a01dd23bcc3ef0557682a2dc9cf1848b4707cbd93672f1bcd4bae76c173c9293e9ce154c439abc47eafe7b922832
SSDEEP

6144:FQQwwx+utzK9+5F9lftw8gYws6WHyB8HNZ9ISmZv+k0a/3OgB+nsbf+s:qxwx+uU94Fwsz6WlqtB+Kfb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4ded92de4a254ce07810a56c969f0dce

Files

4ded92de4a254ce07810a56c969f0dce
.exe windows:5 windows x86 arch:x86

e1537fde3130b342db94b0e622be1c28

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RevertToSelf
OpenProcessToken
ImpersonateLoggedOnUser
RegOpenCurrentUser
RegCloseKey
TraceMessage
InitiateSystemShutdownExW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
SetServiceStatus
ControlService
CloseServiceHandle
OpenServiceW
OpenSCManagerW
RegQueryValueExW
RegOpenKeyW
RegisterServiceCtrlHandlerW
StartServiceCtrlDispatcherW
CheckTokenMembership
ReportEventW
DeregisterEventSource
RegisterEventSourceW
RegOpenKeyExW
LookupPrivilegeValueW
OpenThreadToken
AdjustTokenPrivileges
AddAce
InitializeAcl
GetAclInformation
GetSecurityDescriptorControl
MakeAbsoluteSD
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
InitializeSecurityDescriptor
MakeSelfRelativeSD
GetSecurityDescriptorLength
GetLengthSid
IsValidSid
CopySid
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
GetSidSubAuthority
InitializeSid
GetSidLengthRequired
GetTokenInformation
RegQueryValueExA
RegOpenKeyExA
LookupAccountSidW
ConvertSidToStringSidW
DuplicateToken
EqualSid

kernel32

OutputDebugStringW
HeapReAlloc
HeapDestroy
GetTimeFormatW
GetDateFormatW
WriteFile
TerminateProcess
GetTempFileNameW
MoveFileExW
LocalFree
HeapFree
HeapAlloc
GetVersionExW
DeleteFileW
GetModuleHandleW
GetCurrentThread
GetTempPathW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetUserDefaultLCID
CreateProcessW
GetModuleFileNameW
GetLocalTime
IsDebuggerPresent
UnhandledExceptionFilter
GetCurrentProcessId
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedCompareExchange
InterlockedExchange
InterlockedIncrement
ReleaseMutex
CreateMutexW
GetProcessHeap
FindFirstFileW
FindClose
CompareFileTime
FindNextFileW
GetSystemTimeAsFileTime
ExpandEnvironmentStringsW
GetFileAttributesExW
FileTimeToLocalFileTime
FileTimeToSystemTime
LoadLibraryW
GetProcAddress
FreeLibrary
ProcessIdToSessionId
HeapSetInformation
HeapQueryInformation
HeapCompact
GetProcessHeaps
QueueUserWorkItem
CreateFileW
GetFileInformationByHandle
ReadFile
GetCurrentProcess
DuplicateHandle
GetTickCount
Sleep
WaitForSingleObject
SetEvent
OpenEventW
CreateEventW
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
DeleteCriticalSection
InitializeCriticalSection
OpenProcess
RegisterWaitForSingleObject
UnregisterWaitEx
GetLastError
CloseHandle
SetFileTime
HeapSize

user32

GetMessageW
PostThreadMessageW
DispatchMessageW

msvcp90

??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@0@Z
??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@G@Z
?_Decref@facet@locale@std@@QAEPAV123@XZ
?deallocate@?$allocator@_W@std@@QAEXPA_WI@Z
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAK@Z
?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEGXZ
??_D?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@PB_W@Z
?allocate@?$allocator@_W@std@@QAEPA_WI@Z
?swap@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXAAV12@@Z
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_WH@Z
?seekpos@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE?AV?$fpos@H@2@V32@H@Z
?seekoff@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE?AV?$fpos@H@2@JHH@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHPB_WH@Z
?_Xsgetn_s@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHPA_WIH@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHPA_WH@Z
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?underflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ
?pbackfail@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGG@Z
?overflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGG@Z
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@I@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_WABV10@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
?end@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?begin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?replace@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@V?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@0ABV12@@Z
?reserve@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@I_W@Z
?_Tidy@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@IAEX_NI@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEHPB_WH@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?uncaught_exception@std@@YA_NXZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?_Init@locale@std@@CAPAV_Locimp@12@XZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?grouping@?$numpunct@_W@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?thousands_sep@?$numpunct@_W@std@@QBE_WXZ
?_Xran@_String_base@std@@SAXXZ
??1locale@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?id@?$numpunct@_W@std@@2V0locale@2@A
??Bid@locale@std@@QAEIXZ
?_Getfacet@locale@std@@QBEPBVfacet@12@I@Z
?_Getcat@?$numpunct@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Incref@facet@locale@std@@QAEXXZ
??1_Lockit@std@@QAE@XZ
?_Unlock@_Mutex@std@@QAEXXZ
?_Lock@_Mutex@std@@QAEXXZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@H@Z
?str@?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
??_D?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@_W@Z
??$?6_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YAAAV?$basic_ostream@_WU?$char_traits@_W@std@@@0@AAV10@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?end@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?begin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?toupper@?$ctype@_W@std@@QBE_W_W@Z
?id@?$ctype@_W@std@@2V0locale@2@A
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
??0?$basic_ostringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@H@Z
?ends@std@@YAAAV?$basic_ostream@_WU?$char_traits@_W@std@@@1@AAV21@@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@PBX@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?str@?$basic_ostringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
??_D?$basic_ostringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@II@Z
?_Xinvarg@_String_base@std@@SAXXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z

msvcr90

strcpy_s
wcsrchr
memcpy_s
malloc
free
calloc
_resetstkoflw
??0exception@std@@QAE@ABQBDH@Z
_waccess
_purecall
_stricmp
??0exception@std@@QAE@XZ
??3@YAXPAX@Z
?what@exception@std@@UBEPBDXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_controlfp_s
_invoke_watson
_except_handler4_common
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
abort
wcscat_s
swprintf_s
wcsstr
_vscwprintf
_vsnwprintf_s
_wcsupr_s
memcpy
??_V@YAXPAX@Z
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
??2@YAPAXI@Z
strrchr
_time64
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@PBD@Z
__RTDynamicCast
??0bad_cast@std@@QAE@ABV01@@Z
??8type_info@@QBE_NABV0@@Z
??0exception@std@@QAE@ABQBD@Z
??1exception@std@@UAE@XZ
_wcsicmp
memset
_beginthreadex
srand
rand
wcscpy_s
memmove_s
__CxxFrameHandler3

shell32

SHGetSpecialFolderPathW
ord165
SHChangeNotify

sftsync

?LockShared@SWSyncObject@@MAE_KK@Z
??1SWRAIIExclusiveLock@@UAE@XZ
??1SWRAIISharedLock@@UAE@XZ
?AddRef@SWRefCount@@UAEJXZ
?Release@SWRefCount@@UAEJXZ
??0SWRefCount@@QAE@J@Z
??1SWRefCount@@UAE@XZ
?GetInstance@SWClientSyncInterface@@SAAAV1@XZ

sftuser

?SetDataDirectory@SWUserInfo@@SAXABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0@Z
?ExpandSpecial@SWUserContext@@UBE_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV23@@Z
?SWClearThreadContext@@YA_KK@Z
?SWCreateThread@@YAKP6AXPAX@Z0@Z
?SWSetThreadContext@@YA_KKV?$shared_ptr@VSWUserContext@@@boost@@@Z
?SWRemoveRpcThreadContext@@YA_KXZ
?GetSecurityId@SWUserInfo@@SA_KAAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?SWSetRpcThreadContext@@YA_KV?$shared_ptr@VSWUserContext@@@boost@@@Z
?GetPreference@SWClientPreferences@@QAE_KW4Section@1@_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV34@_N@Z
?SWTerminateThread@@YAXK_N@Z
?GetPreference@SWClientPreferences@@QAE_KW4Section@1@_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAK_N@Z
?Instance@SWClientPreferences@@SAAAV1@XZ
?SWGetThreadContext@@YA?AV?$shared_ptr@VSWUserContext@@@boost@@K@Z
?GetNameAndDomain@SWUserInfo@@SAXAAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0@Z
?GetPreference@SWClientPreferences@@QAE_KW4ID@1@_NAAKPA_N@Z
?SavePreference@SWClientPreferences@@QAE_KW4Section@1@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_N12@Z
?SavePreference@SWClientPreferences@@QAE_KW4Section@1@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_NK2@Z
?Instance@UserContextManager@@SAAAV1@XZ
?DeletePreference@SWClientPreferences@@QAE_KW4ID@1@_N@Z
?SavePreference@SWClientPreferences@@QAE_KW4Section@1@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_NPBEK2@Z
?GetPreference@SWClientPreferences@@QAE_KW4Section@1@_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PAEPAK_N@Z
?GetGlobalDataDirectory@SWUserInfo@@SA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?GetPreference@SWClientPreferences@@QAE_KW4ID@1@_NAAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PA_N@Z
?SWCloseThreadHandle@@YAXK@Z
?ExpandEnvVar@SWUserContext@@UBE_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV23@_N@Z
?SWWaitForThreads@@YA_KPAKHK@Z
?ExpandCSIDL@SWUserContext@@UBE_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV23@@Z

sftcore

SWCreatePackage
?SWGrantFileSystemAccess@@YG_KK@Z
?SWRevokeFileSystemAccess@@YG_KK@Z
SWResetLog
SWIsOperationAllowed
SWCreateApp
SWLaunch
SWShutdown
SWLoad
SWCleanupForUser
SWInitForUser
SWInitInternals
SWInitialize
SWCleanupInternals
SWCleanup
SWUnhandledExceptionCleanup
SWNotifyClientShutdown
SWCleanupForPid
SWGetLogParams
SWSetLogParams
SWGetConnectType
SWSetConnectType
SWGetProxy
SWSetProxy
SWLogMessage
SWGetVersion
SWGetCacheProperties
SWSetCacheProperties
SWGetAssociationList
SWDeleteAssociation
SWEditAssociation
SWGetAssociation
SWCreateAssociation
SWDeleteAction
SWEditAction
SWGetActionList
SWGetDefaultAction
SWAddAction
SWDeleteType
SWEditType
SWGetType
SWGetTypeList
SWCreateType
SWDeleteServer
SWRefreshServerInternal
SWRefreshServer
SWGetServerList
SWGetServer
SWEditServer
SWCreateServer
SWSetImportSearchPath
SWGetImportSearchPath
SWDccEventNotification
SWSetDisconnectSettings
SWGetDisconnectSettings
SWGetDataDirectory
SWSetDataDirectory
SWSetPermissions
SWGetPermissions
SWIsOperationAllowedOnObj
SWRepairPackage
SWUnpublishPackage
SWPublishPackage
SWLockPackage
SWGetPackageInfo2
SWGetPackageList2
SWEditPackage
SWDeletePackage
SWUnloadPackage
SWLoadPackageRange
SWLoadPackage
SWGetAppInfoList
SWGetAppList
SWPublishShortcut
SWImport
SWRegisterEventHandler
SWUnregisterEventHandler
?SWLogMessageParams@@YG_KW4SW_TYPE_SEVERITY@@_KABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@KPB_W333333333333333@Z
SWUnload
SWEditApp
SWIsAppPublished
SWGetAppInfo
SWGetAppStatistics
SWSetOnlineStatus
SWGetOnlineStatus
SWGetAppHandle
SWHandleDisconnect
SWClearSettings
SWDeleteApp
SWCloseHandle
?SWCancelLoad@@YG_KABK@Z
SWForceDismountFilesystem

rpcrt4

RpcMgmtSetCancelTimeout
RpcMgmtStopServerListening
RpcMgmtWaitServerListen
RpcServerUnregisterIf
RpcServerRegisterIf2
RpcServerListen
RpcServerRegisterAuthInfoW
RpcCancelThread
RpcServerUseProtseqEpW
RpcBindingInqAuthClientW
RpcBindingServerFromClient
RpcBindingToStringBindingW
RpcStringFreeW
RpcStringBindingParseW
RpcImpersonateClient
RpcRevertToSelf
NdrServerCall2
NdrClientCall2
RpcBindingSetAuthInfoExW
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcBindingFree

userenv

UnloadUserProfile

comctl32

GetMUILanguage

ole32

CoInitializeEx
StringFromGUID2
CoCreateInstance
CoSetProxyBlanket
CoUninitialize

oleaut32

SysAllocString
VariantClear
VariantInit
SysFreeString

Exports

Exports

??0SWClientSyncInterface@@QAE@ABV0@@Z
??0SWClientSyncInterface@@QAE@XZ
??0SWRAIIExclusiveLock@@QAE@ABV0@@Z
??0SWRAIISharedLock@@QAE@ABV0@@Z
??0SWRefCount@@QAE@ABV0@@Z
??0SWSyncObject@@QAE@ABV0@@Z
??0SWSyncObject@@QAE@XZ
??1SWSyncObject@@UAE@XZ
??4SWClientSyncInterface@@QAEAAV0@ABV0@@Z
??4SWRefCount@@QAEAAV0@ABV0@@Z
??4SWSyncObject@@QAEAAV0@ABV0@@Z
??_7SWClientSyncInterface@@6B@
??_7SWRAIIExclusiveLock@@6B@
??_7SWRAIISharedLock@@6B@
??_7SWRefCount@@6B@
??_7SWSyncObject@@6B@
??_FSWRefCount@@QAEXXZ
?GetName@SWSyncObject@@QAEPB_WXZ
?GetRefCount@SWRefCount@@QAEJXZ
?ReleaseObject@SWRefCount@@SAXPAV1@@Z

Sections

.text
Size: 399KB - Virtual size: 398KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 126KB - Virtual size: 125KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e1537fde3130b342db94b0e622be1c28

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

msvcp90

msvcr90

shell32

sftsync

sftuser

sftcore

rpcrt4

userenv

comctl32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 399KB - Virtual size: 398KB

.data Size: 9KB - Virtual size: 13KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 126KB - Virtual size: 125KB

.text
Size: 399KB - Virtual size: 398KB

.data
Size: 9KB - Virtual size: 13KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 126KB - Virtual size: 125KB