2024-03-05_6a12a52562e5102fd59d99106303d328_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-03-05_6a12a52562e5102fd59d99106303d328_mafia
Size

1.9MB
MD5

6a12a52562e5102fd59d99106303d328
SHA1

0c76b9c8468c2391ddd4edbccfd11de30aab076b
SHA256

c49fd642a5902f68ddc235d674f5f6e6ad5bf5d5aa02bb296b8fb18a77dd9aff
SHA512

fa7a20ccb3c1eae293282f385109501b7b4e37d845615931e271e06d818a56bd53df3346353c3004ba332ac09ab59fa1b2dab900717509ea520c883c82860d21
SSDEEP

49152:Cr1GlxcnzphLKEisBuyEV2ci/2xI1RFiaeeNhkBA8kTFpu8qUd+:PcnzeELsydciexAF6mhaA8/h

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-03-05_6a12a52562e5102fd59d99106303d328_mafia

Files

2024-03-05_6a12a52562e5102fd59d99106303d328_mafia
.exe windows:5 windows x86 arch:x86

5a349084c0d6aca70f1180888029e32c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FormatMessageA
MapViewOfFile
Sleep
PulseEvent
LocalFree
GetFullPathNameW
GetPrivateProfileStringW
CreateEventW
OpenEventW
ResetEvent
OpenEventA
GetCurrentProcessId
HeapAlloc
HeapFree
GetProcessHeap
WaitForSingleObject
SetEvent
CreateEventA
FindCloseChangeNotification
FindResourceExW
LockResource
GetSystemInfo
CompareStringW
SetStdHandle
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetTimeZoneInformation
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetConsoleMode
GetConsoleCP
SetHandleCount
IsValidCodePage
GetOEMCP
GetACP
HeapCreate
ExitProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateThread
UnmapViewOfFile
GetSystemTimeAsFileTime
CreateFileMappingW
WaitForMultipleObjects
DuplicateHandle
LoadLibraryW
ReleaseSemaphore
CreateSemaphoreA
OpenProcess
GetTickCount
GetFileTime
CreateFileW
WideCharToMultiByte
lstrlenA
FindFirstChangeNotificationW
FindNextChangeNotification
SetLastError
FlushInstructionCache
GetCurrentProcess
CloseHandle
GetCurrentThreadId
CreateMutexW
InterlockedIncrement
InterlockedDecrement
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetModuleFileNameW
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
MultiByteToWideChar
GetLastError
EnterCriticalSection
ExitThread
GetDateFormatA
GetTimeFormatA
GetStdHandle
GetFileType
WriteConsoleW
RtlUnwind
GetStartupInfoW
HeapSetInformation
GetCommandLineW
GetCPInfo
CreateWaitableTimerA
SetWaitableTimer
SystemTimeToFileTime
ResumeThread
RaiseException
LeaveCriticalSection
TlsFree
lstrcmpiW
FreeLibrary
LCMapStringW
LCMapStringA
GetModuleHandleW
GetStringTypeExA
GetUserDefaultLCID
GetProcAddress
lstrlenW
SetEnvironmentVariableA
DeviceIoControl
DecodePointer
EncodePointer
InitializeCriticalSection
InterlockedCompareExchange
GetVersionExW
AreFileApisANSI
SetFilePointer
ReadFile
WriteFile
SetEndOfFile
FlushFileBuffers
GetFileSize
UnlockFile
LockFile
LockFileEx
UnlockFileEx
GetFileAttributesA
DeleteFileA
GetFileAttributesW
DeleteFileW
GetFileAttributesExW
LoadLibraryA
QueryPerformanceCounter
GetSystemTime
GetTempPathA
GetTempPathW
FormatMessageW
GetFullPathNameA
GetDiskFreeSpaceA
GetDiskFreeSpaceW
CreateFileA
TerminateProcess
GetLocaleInfoW
GetModuleHandleA
WaitNamedPipeW
TlsSetValue
TlsGetValue
TlsAlloc
GetCurrentThread
InterlockedPushEntrySList
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
InterlockedPopEntrySList
HeapDestroy
HeapReAlloc
HeapSize
InterlockedExchange
GetStringTypeW
LocalAlloc

user32

SetWindowTextW
EndDialog
CallWindowProcW
LoadStringW
SetWindowLongW
GetWindowLongW
DestroyWindow
DefWindowProcW
SendMessageW
ShowWindow
GetTopWindow
LoadBitmapW
DialogBoxParamW
SetTimer
KillTimer
TrackMouseEvent
CharNextW
GetDlgItem
MsgWaitForMultipleObjects
FindWindowW
MsgWaitForMultipleObjectsEx
PeekMessageW
IsWindowUnicode
GetMessageW
GetMessageA
TranslateMessage
DispatchMessageW
DispatchMessageA
PostQuitMessage
SetPropW
MessageBoxW
GetClassInfoExW
RegisterClassExW
DrawTextW
InvalidateRect
PtInRect
ReleaseDC
GetDC
GetParent
LoadCursorW
SetCursor
RedrawWindow
wsprintfW
UnregisterClassA
LoadStringA
EndPaint
BeginPaint
SetWindowPos
GetSysColor
CreateWindowExW
FillRect
IsWindow
GetClientRect
MoveWindow
GetWindowRect
SystemParametersInfoW
SetLayeredWindowAttributes
GetActiveWindow
ChildWindowFromPoint
ScreenToClient
GetCursorPos

gdi32

BitBlt
GetTextExtentPoint32W
SetTextColor
GetTextMetricsW
GetStockObject
SetBkMode
CreatePatternBrush
CreateSolidBrush
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
DeleteDC
CreateFontIndirectW
GetObjectW
DeleteObject

advapi32

IsValidSid
AddAce
GetSecurityInfo
GetAclInformation
GetAce
DeleteAce
OpenThreadToken
CloseServiceHandle
StartServiceW
OpenServiceW
OpenSCManagerW
SetKernelObjectSecurity
RegEnumValueW
SetSecurityInfo
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegEnumKeyW
RegNotifyChangeKeyValue
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegQueryValueExW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
RegDeleteKeyW
QueryServiceStatus
GetLengthSid
InitializeAcl
OpenProcessToken
GetTokenInformation
ConvertSidToStringSidW
LookupAccountNameW
ChangeServiceConfigW

shell32

SHGetSpecialFolderPathW

ole32

CoUninitialize
CLSIDFromString
CoInitialize
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
StringFromCLSID
StringFromGUID2
CoTaskMemFree

oleaut32

SysAllocString
SysFreeString
VarUI4FromStr

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

crypt32

CertGetCertificateContextProperty
CryptVerifyMessageSignature
CertFreeCertificateContext

imagehlp

ImageEnumerateCertificates
ImageGetCertificateData

shlwapi

PathRemoveFileSpecW
PathAddBackslashW
UrlIsW
StrStrIW

comctl32

_TrackMouseEvent
InitCommonControlsEx

Exports

Exports

??0?$oserializer@Vbinary_oarchive@archive@boost@@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@detail@archive@boost@@QAE@XZ
??0?$oserializer@Vbinary_oarchive@archive@boost@@VNotifyData@KipodLogger@@@detail@archive@boost@@QAE@XZ
??_B?1??get_instance@?$singleton@V?$extended_type_info_typeid@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@23@XZ@51
??_B?1??get_instance@?$singleton@V?$extended_type_info_typeid@VNotifyData@KipodLogger@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@VNotifyData@KipodLogger@@@23@XZ@51
??_B?1??get_instance@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ@51
??_B?1??get_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ@51
??_B?1??get_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ@51
??_B?1??get_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vbinary_oarchive@archive@boost@@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@detail@archive@3@XZ@51
??_B?1??get_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@VNotifyData@KipodLogger@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vbinary_oarchive@archive@boost@@VNotifyData@KipodLogger@@@detail@archive@3@XZ@51
?get_const_instance@?$singleton@V?$extended_type_info_typeid@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@23@XZ
?get_const_instance@?$singleton@V?$extended_type_info_typeid@VNotifyData@KipodLogger@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@VNotifyData@KipodLogger@@@23@XZ
?get_const_instance@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAABV?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ
?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ
?get_const_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vbinary_oarchive@archive@boost@@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@VNotifyData@KipodLogger@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vbinary_oarchive@archive@boost@@VNotifyData@KipodLogger@@@detail@archive@3@XZ
?get_instance@?$singleton@V?$extended_type_info_typeid@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@23@XZ
?get_instance@?$singleton@V?$extended_type_info_typeid@VNotifyData@KipodLogger@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@VNotifyData@KipodLogger@@@23@XZ
?get_instance@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ
?get_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ
?get_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vbinary_oarchive@archive@boost@@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@detail@archive@3@XZ
?get_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@VNotifyData@KipodLogger@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vbinary_oarchive@archive@boost@@VNotifyData@KipodLogger@@@detail@archive@3@XZ
?get_mutable_instance@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAAV?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ
?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ
?instance@?$singleton@V?$extended_type_info_typeid@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@serialization@boost@@@serialization@boost@@0AAV?$extended_type_info_typeid@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@23@A
?instance@?$singleton@V?$extended_type_info_typeid@VNotifyData@KipodLogger@@@serialization@boost@@@serialization@boost@@0AAV?$extended_type_info_typeid@VNotifyData@KipodLogger@@@23@A
?instance@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@0AAV?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@3@A
?instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@0AAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@A
?instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@0AAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@A
?instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@detail@archive@boost@@@serialization@boost@@0AAV?$oserializer@Vbinary_oarchive@archive@boost@@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@detail@archive@3@A
?instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@VNotifyData@KipodLogger@@@detail@archive@boost@@@serialization@boost@@0AAV?$oserializer@Vbinary_oarchive@archive@boost@@VNotifyData@KipodLogger@@@detail@archive@3@A
?is_destroyed@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ
?save_object_data@?$oserializer@Vbinary_oarchive@archive@boost@@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z
?save_object_data@?$oserializer@Vbinary_oarchive@archive@boost@@VNotifyData@KipodLogger@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z
?t@?1??get_instance@?$singleton@V?$extended_type_info_typeid@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@34@XZ@4V?$singleton_wrapper@V?$extended_type_info_typeid@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@serialization@boost@@@detail@34@A
?t@?1??get_instance@?$singleton@V?$extended_type_info_typeid@VNotifyData@KipodLogger@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@VNotifyData@KipodLogger@@@34@XZ@4V?$singleton_wrapper@V?$extended_type_info_typeid@VNotifyData@KipodLogger@@@serialization@boost@@@detail@34@A
?t@?1??get_instance@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@4@XZ@4V?$singleton_wrapper@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@734@A
?t@?1??get_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ@4V?$singleton_wrapper@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@detail@34@A
?t@?1??get_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ@4V?$singleton_wrapper@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@detail@34@A
?t@?1??get_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vbinary_oarchive@archive@boost@@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@detail@archive@4@XZ@4V?$singleton_wrapper@V?$oserializer@Vbinary_oarchive@archive@boost@@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@detail@archive@boost@@@634@A
?t@?1??get_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@VNotifyData@KipodLogger@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vbinary_oarchive@archive@boost@@VNotifyData@KipodLogger@@@detail@archive@4@XZ@4V?$singleton_wrapper@V?$oserializer@Vbinary_oarchive@archive@boost@@VNotifyData@KipodLogger@@@detail@archive@boost@@@634@A

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.my_data
Size: 1024B - Virtual size: 577B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 232KB - Virtual size: 231KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 71KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

mycode
Size: 1024B - Virtual size: 586B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

bhoprops
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 241KB - Virtual size: 240KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 124KB - Virtual size: 123KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5a349084c0d6aca70f1180888029e32c

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

version

crypt32

imagehlp

shlwapi

comctl32

Exports

Exports

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.my_data Size: 1024B - Virtual size: 577B

.rdata Size: 232KB - Virtual size: 231KB

.data Size: 71KB - Virtual size: 82KB

mycode Size: 1024B - Virtual size: 586B

bhoprops Size: 512B - Virtual size: 28B

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 241KB - Virtual size: 240KB

.reloc Size: 124KB - Virtual size: 123KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.my_data
Size: 1024B - Virtual size: 577B

.rdata
Size: 232KB - Virtual size: 231KB

.data
Size: 71KB - Virtual size: 82KB

mycode
Size: 1024B - Virtual size: 586B

bhoprops
Size: 512B - Virtual size: 28B

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 241KB - Virtual size: 240KB

.reloc
Size: 124KB - Virtual size: 123KB