Malware_MSEXE_a1e72b9ca39ea15358d81d694fec70de61266ef0776beb126837ae5c2206531e[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

Malware_MSEXE_a1e72b9ca39ea15358d81d694fec70de61266ef0776beb126837ae5c2206531e.zip
Size

60KB
MD5

fecbbeae6513e9ccb88b063b3155ed16
SHA1

82861e2e8fd041a63f9bc62ec9755a4b8ad5bbac
SHA256

e54662b65bbab928fc043a5c3554ddeb63a90428900b0193ddafb5d6137ee4e8
SHA512

66ad2b231868fda2408130081d55ff15e9a7e5de43e9051ff10df476391c36d9abbced645bf14f8713bc0026b695b14fd1594105864b2ad719ffd6df80ae86e4
SSDEEP

1536:lMzogOtUWI1FbvLxFYRdl9j4IPCNkehpUGjjMp+bxu:lHUtJOdlCIaNk0K

Score

1^/10

Malware Config

Signatures

Files

Malware_MSEXE_a1e72b9ca39ea15358d81d694fec70de61266ef0776beb126837ae5c2206531e.zip
.zip

Password: infected
Malware_MSEXE_a1e72b9ca39ea15358d81d694fec70de61266ef0776beb126837ae5c2206531e
.exe windows:6 windows x64 arch:x64

dd60077115da4ed76d10eeb0170e5b90

Code Sign

0a:3d:2d:f5:02:51:04:16:9e:00:31:5d:78:df:c8:a4
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

22/10/2019, 00:00

Not After

27/10/2022, 23:59

Subject

CN=ETM professional control GmbH,O=ETM professional control GmbH,L=Eisenstadt,ST=Burgenland,C=AT

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

cf:60:14:a5:5e:f2:72:0c:21:d5:8c:1a:b6:07:9a:3b:e8:b0:94:3a:5b:dc:b5:7f:43:e9:35:cf:95:17:ad:36
Signer

Actual PE Digest

cf:60:14:a5:5e:f2:72:0c:21:d5:8c:1a:b6:07:9a:3b:e8:b0:94:3a:5b:dc:b5:7f:43:e9:35:cf:95:17:ad:36

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\work\WinCCOA\build\windows-64\build\bin\WCCOAsnmpa.pdb

Imports

libmanagerv317

?dpCreated@Manager@@MEAAXVSystemNumType@@AEBVCharString@@AEBVDpIdentifier@@@Z
?doSystemDisconnect@Manager@@MEAAXVSystemNumType@@@Z
?doRefresh@Manager@@MEAAXAEBVManagerIdentifier@@@Z
?doReceive@OaManager@@UEAAXPEAVSysMsg@@@Z
?doReceive@OaManager@@UEAAXPEAVDpMsg@@@Z
?doInitConfig@Manager@@MEBAXPEBVDpICGroup@@PEBVDpConfig@@@Z
?doHandleNoCallBackAnswer@Manager@@EEAAXPEAVDpMsgAnswer@@@Z
?doConnectionClose@Manager@@MEAAXAEBVManagerIdentifier@@@Z
?checkConnections@Manager@@MEAAIXZ
?addInitToken@Manager@@MEAAXAEBVManagerIdentifier@@AEAVInitSysMsg@@@Z
?connectToEvent@OaManager@@SAII@Z
?manPtr@Manager@@0PEAV1@EA
??0OaManager@@QEAA@AEBVManagerIdentifier@@@Z
?doReceive@Manager@@MEAAXAEAVSysMsg@@@Z
?doReceive@Manager@@MEAAXAEAVDpMsg@@@Z
?connectToData@Manager@@KAIEPEBW4DpConfigNrType@@I@Z
?send@Manager@@SAIAEAVDpMsg@@PEAVWaitForAnswer@@I@Z
?dispatch@Manager@@SAXAEAJ0@Z
?initUserTable@Manager@@SAXXZ
?exit@Manager@@SAXH@Z
?dpSet@Manager@@SAIAEBVDpIdentifier@@AEBVVariable@@AEBVManagerIdentifier@@PEAVWaitForAnswer@@I@Z
?dataId@Manager@@2VManagerIdentifier@@A
?eventId@Manager@@2VManagerIdentifier@@A
?needRefresh@WaitForAnswer@@UEAAIPEAVDpMsg@@@Z
?isA@WaitForAnswer@@UEAA?AW4answerType@1@XZ
?getUserDefinedType@WaitForAnswer@@UEAAIXZ
?getUserName@OaManager@@SAPEBDG@Z
?send@Manager@@SAIAEAVSysMsg@@@Z
?dpDisconnect@Manager@@SAIAEBVDpIdentList@@AEBVManagerIdentifier@@@Z
?dpDisconnect@Manager@@SAIAEBVDpIdentifier@@AEBVManagerIdentifier@@@Z
?dpConnect@Manager@@SAIAEBVDpIdentList@@AEBVManagerIdentifier@@PEAVWaitForAnswer@@I@Z
?dpConnect@Manager@@SAIAEBVDpIdentifier@@AEBVManagerIdentifier@@PEAVWaitForAnswer@@I@Z
??1WaitForAnswer@@UEAA@XZ
?handleShutDownReceived@Manager@@MEAAXAEBVManagerIdentifier@@AEBVErrClass@@@Z
?isAuthorizedToConnect@Manager@@UEAAIAEBVManagerIdentifier@@AEBVCharString@@AEBVDynVar@@AEAG@Z
?isEvInitialized@Manager@@UEAAIXZ
?isRedundantConnection@Manager@@UEAAIAEBVManagerIdentifier@@@Z
?loopHook@Manager@@UEAAXXZ
?newDiagWaitObject@Manager@@UEAAPEAVHotLinkWaitForAnswer@@AEAVDiagItcIOHandler@@@Z
?notifyFileList@Manager@@UEAAIAEBVManagerIdentifier@@AEBVDynVar@@1@Z
?prefixConnectFromClient@Manager@@UEAAIAEAVManagerIdentifier@@0@Z
?prefixConnectFromServer@Manager@@UEAAIAEAVManagerIdentifier@@0@Z
?prefixConnectFromServer@Manager@@UEAAIAEAVManagerIdentifier@@0AEBVInitSysMsg@@@Z
?prefixConnectFromServer@Manager@@UEAAIAEAVManagerIdentifier@@0AEBVInitSysMsg@@AEAVErrClass@@@Z
?reduRecvMsgLogic@Manager@@UEAAIAEBVManagerIdentifier@@AEBVMsg@@@Z
?reduSendMsgLogic@Manager@@UEAAIAEBVManagerIdentifier@@AEBVMsg@@@Z
?reduSwitchConnectionStateLogic@Manager@@UEAAXAEBVManagerIdentifier@@I@Z
?reduSwitchManagerStateLogic@Manager@@UEAAXAEBVManagerIdentifier@@I@Z
?reportStatus@Manager@@UEBAXAEAV?$basic_ostream@DU?$char_traits@D@std@@@std@@@Z
?setupRouting@Manager@@UEBAIAEAVMsg@@@Z
?setupSystem@Manager@@UEBAIAEAVMsg@@@Z
?signalHandler@Manager@@MEAAXH@Z
?useServerTime@Manager@@MEAA_NXZ
?managerState@Manager@@1W4ManagerState@1@A
??1OaManager@@UEAA@XZ
?handleNameServerSysMsg@Manager@@MEAAIAEBVNameServerSysMsg@@@Z
?handleManagerUpdate@Manager@@MEAAXAEBVManagerIdentifier@@I@Z
?handleManagerConnect@Manager@@MEAAXAEBVManagerIdentifier@@I@Z
?handleInitToken@Manager@@MEAAIAEBVManagerIdentifier@@AEBVCharString@@1@Z
?handleFileTransferSysMsg@Manager@@MEAAXAEAVFileTransferSysMsg@@@Z
?handleBCMBufferOverflow@Manager@@UEAAIAEBVManagerIdentifier@@@Z
?getAttribut@Manager@@UEBAPEAVVariable@@AEBVDpIdentifier@@I@Z
?dpTypeDoomed@Manager@@MEAAXVSystemNumType@@F@Z
?dpTypeDeleted@Manager@@MEAAXVSystemNumType@@F@Z
?dpTypeCreated@Manager@@MEAAXVSystemNumType@@AEBVDpType@@@Z
?dpTypeChanged@Manager@@MEAAXVSystemNumType@@AEBVDpType@@@Z
?dpRenamed@Manager@@MEAAXVSystemNumType@@AEBVCharString@@AEBVDpIdentifier@@@Z
?dpDeleted@Manager@@MEAAXVSystemNumType@@I@Z

agent++

??0MibLeaf@@QEAA@AEBVOidx@@W4mib_access@@PEAVSnmpSyntax@@H@Z
?value_ok@MibLeaf@@UEAA_NAEBVVbx@@@Z
?row_init@MibTable@@UEAAXPEAVMibTableRow@@AEBVOidx@@PEAV1@@Z
?row_added@MibTable@@UEAAXPEAVMibTableRow@@AEBVOidx@@PEAV1@@Z
?reset@MibTable@@UEAAXXZ
?ready_for_service@MibTable@@UEAA_NPEAVVbx@@H@Z
?is_persistent@MibTable@@MEAA_NPEAVMibTableRow@@@Z
??1MibTable@@UEAA@XZ
??0MibTable@@QEAA@AEBVOidx@@H_N@Z
?get_index@MibTableRow@@QEAA?AVOidx@@XZ
?set@MibLeaf@@UEAAHAEBVVbx@@@Z
?prepare_set_request@MibLeaf@@UEAAHPEAVRequest@@AEAH@Z
??1MibLeaf@@UEAA@XZ
??0MibLeaf@@QEAA@AEBVOidx@@W4mib_access@@PEAVSnmpSyntax@@@Z
?last@Oidx@@QEBAKXZ
??0Oidx@@QEAA@XZ
?instance@snmpCommunityEntry@@2PEAV1@EA
?value_ok@TestAndIncr@@UEAA_NAEBVVbx@@@Z
?update@MibTable@@UEAAXPEAVRequest@@@Z
?unset@MibLeaf@@UEAAHXZ
?unlock_request@RequestList@@UEAAXPEAVRequest@@@Z
?undo_set_request@MibTable@@UEAAHPEAVRequest@@AEAH@Z
??0Oidx@@QEAA@PEBD@Z
??1Oidx@@UEAA@XZ
??1Snmpx@@UEAA@XZ
??0RequestList@@QEAA@XZ
??1RequestList@@UEAA@XZ
??0Mib@@QEAA@XZ
??1Mib@@UEAA@XZ
?set_request_list@Mib@@SAXPEAVRequestList@@@Z
??0snmpGroup@@QEAA@XZ
??1snmpGroup@@UEAA@XZ
?create_engine_id@SnmpEngineID@@SA?AVOctetStr@@G@Z
??0TestAndIncr@@QEAA@AEBVOidx@@@Z
??1TestAndIncr@@UEAA@XZ
??0sysGroup@@QEAA@PEBDAEBVOidx@@H000@Z
??1sysGroup@@UEAA@XZ
??0snmp_target_mib@@QEAA@XZ
??1snmp_target_mib@@UEAA@XZ
??0snmp_notification_mib@@QEAA@XZ
??1snmp_notification_mib@@UEAA@XZ
??0snmp_community_mib@@QEAA@XZ
??1snmp_community_mib@@UEAA@XZ
??0V3SnmpEngine@@QEAA@XZ
??1V3SnmpEngine@@UEAA@XZ
??0UsmUserTable@@QEAA@XZ
??1UsmUserTable@@UEAA@XZ
??0UsmStats@@QEAA@XZ
??1UsmStats@@UEAA@XZ
??0usm_mib@@QEAA@PEAVUsmUserTable@@@Z
??1usm_mib@@UEAA@XZ
??0Vacm@@QEAA@AEAVMib@@@Z
??1Vacm@@UEAA@XZ
?addNewContext@Vacm@@QEAA_NAEBVOctetStr@@@Z
?addNewGroup@Vacm@@QEAA_NHAEBVOctetStr@@0H@Z
?addNewAccessEntry@Vacm@@QEAA_NAEBVOctetStr@@0HHH000H@Z
?addNewView@Vacm@@QEAA_NAEBVOctetStr@@AEBVOidx@@0HH@Z
?add@Mib@@UEAAPEAVMibEntry@@AEBVOctetStr@@PEAV2@@Z
?add@Mib@@UEAAPEAVMibEntry@@PEAV2@@Z
?add_agent_caps@Mib@@UEAA_NAEBVOctetStr@@AEBVOidx@@0@Z
?add_change_notification@MibEntry@@UEAAXPEAV1@@Z
?add_col@MibTable@@UEAAXPEAVMibLeaf@@@Z
?add_col@MibTable@@UEAAXPEAVsnmpRowStatus@@@Z
?add_context@Mib@@UEAAPEAVMibContext@@AEBVOctetStr@@@Z
?add_listener@MibTable@@UEAAXPEAV1@@Z
?add_request@RequestList@@MEAAPEAVRequest@@PEAV2@@Z
?add_row@MibTable@@UEAAPEAVMibTableRow@@AEBVOidx@@@Z
?add_storage_col@StorageTable@@UEAAXPEAVStorageType@@@Z
?add_voter@MibTable@@UEAAXPEAVMibTableVoter@@@Z
?answer@RequestList@@UEAAXPEAVRequest@@@Z
?authenticationFailure@RequestList@@MEAAXAEBVOctetStr@@AEBVGenAddress@@H@Z
?change_notification@MibEntry@@UEAAXAEBVOidx@@E@Z
?check_creation@MibTable@@MEAAHPEAVRequest@@AEAH@Z
?cleanup@Mib@@UEAAXXZ
?cleanup_set_request@MibEntry@@UEAAXPEAVRequest@@AEAH@Z
?cleanup_set_request@MibLeaf@@UEAAXPEAVRequest@@AEAH@Z
?cleanup_set_request@MibTable@@UEAAXPEAVRequest@@AEAH@Z
?clear@MibTable@@UEAAXXZ
?clone@MibEntry@@UEAAPEAV1@XZ
?clone@MibLeaf@@UEAAPEAVMibEntry@@XZ
?clone@MibTable@@UEAAPEAVMibEntry@@XZ
?commit_set_request@MibEntry@@UEAAHPEAVRequest@@H@Z
?commit_set_request@MibLeaf@@UEAAHPEAVRequest@@H@Z
?commit_set_request@MibTable@@UEAAHPEAVRequest@@H@Z
?community_ok@RequestList@@MEAA_NHAEBVOctetStr@@@Z
?could_ever_be_managed@MibTable@@MEAA_NAEBVOidx@@AEAH@Z
?delete_request@Mib@@MEAAXPEAVRequest@@@Z
?deserialize@MibEntry@@UEAA_NPEADAEAH@Z
?deserialize@MibLeaf@@UEAA_NPEADAEAH@Z
?deserialize@MibTable@@UEAA_NPEADAEAH@Z
?do_process_request@Mib@@UEAAXPEAVRequest@@@Z
?done@RequestList@@UEAA_NKHAEBVVbx@@@Z
?error@RequestList@@UEAAXKHH@Z
?finalize@Mib@@MEAAXPEAVRequest@@@Z
?find_group_of@Mib@@UEAAPEAVMibGroup@@AEBVOctetStr@@AEBVOidx@@@Z
?find_managing_object@Mib@@UEAAHPEAVMibContext@@AEBVOidx@@AEAPEAVMibEntry@@PEAVRequest@@@Z
?find_next@Mib@@UEAAHPEAVMibContext@@AEBVOidx@@AEAPEAVMibEntry@@PEAVRequest@@HAEAV3@@Z
?find_next@MibTable@@UEAAPEAVMibLeaf@@AEBVOidx@@@Z
?find_request_on_id@RequestList@@UEAAPEAVRequest@@K@Z
?find_succ@MibEntry@@UEAA?AVOidx@@AEBV2@PEAVRequest@@@Z
?find_succ@MibTable@@MEAA?AVOidx@@AEBV2@PEAVRequest@@@Z
?get@Mib@@UEAAPEAVMibEntry@@AEBVOctetStr@@AEBVOidx@@@Z
?get@Mib@@UEAAPEAVMibEntry@@AEBVOidx@@@Z
?getViewName@Vacm@@UEAAHHAEBVOctetStr@@HH0AEAV2@@Z
?get_access@MibEntry@@UEAA?AW4mib_access@@XZ
?get_boot_counter@Mib@@UEAAHAEBVOctetStr@@AEAI@Z
?get_columns@MibTable@@UEAAPEAVMibTableRow@@XZ
?get_contents@MibTable@@UEAAXAEAPEAPEAVVbx@@AEAH1H@Z
?get_context@Mib@@UEAAPEAVMibContext@@AEBVOctetStr@@@Z
?get_next_avail_index@MibTable@@UEBA?AVOidx@@XZ
?get_next_request@MibEntry@@UEAAXPEAVRequest@@H@Z
?get_next_request@MibLeaf@@UEAAXPEAVRequest@@H@Z
?get_next_request@MibTable@@UEAAXPEAVRequest@@H@Z
?get_persistent_objects_path@Mib@@UEBA?AVOctetStr@@XZ
?get_request@MibEntry@@UEAAXPEAVRequest@@H@Z
?get_request@MibLeaf@@UEAAXPEAVRequest@@H@Z
?get_request@MibTable@@UEAAXPEAVRequest@@H@Z
?get_request@RequestList@@UEAAPEAVRequest@@K@Z
?get_request_id@RequestList@@UEAAKAEBVVbx@@@Z
?get_required_columns@MibTable@@MEAAXPEA_NPEAVVbx@@@Z
?get_rows@MibTable@@UEAAPEAV?$List@VMibTableRow@@@@H@Z
?get_rows_cloned@MibTable@@UEAAPEAV?$List@VMibTableRow@@@@H@Z
?get_rows_cloned@MibTable@@UEAAPEAV?$List@VMibTableRow@@@@PEBVOidx@@H@Z
?get_state@TestAndIncr@@UEAAJXZ
?get_syntax@MibLeaf@@UEBAKXZ
?get_v3mp@RequestList@@UEAAPEAVv3MP@@XZ
?get_vacm@RequestList@@UEAAPEAVVacm@@XZ
?get_value@MibLeaf@@UEBA?AVVbx@@XZ
?get_value@MibLeaf@@UEBAHAEAH@Z
?get_value@MibLeaf@@UEBAHAEAJ@Z
?get_value@MibLeaf@@UEBAHAEAK@Z
?get_value@MibLeaf@@UEBAHAEAVSnmpSyntax@@@Z
?get_value@MibLeaf@@UEBAHPEAD@Z
?init@Mib@@UEAA_NXZ
?init@MibLeaf@@UEAAXPEAVSnmpSyntax@@H@Z
?init_row@MibTable@@UEAAPEAVMibTableRow@@AEBVOidx@@PEAVVbx@@@Z
?isAccessAllowed@Vacm@@UEAAHAEBVOctetStr@@AEBVOidx@@@Z
?isAccessAllowed@Vacm@@UEAAHHAEBVOctetStr@@HH0AEBVOidx@@@Z
?is_complex_node@Mib@@UEAA_NAEBQEAVMibEntry@@@Z
?is_empty@MibEntry@@UEAA_NXZ
?is_empty@MibTable@@UEAA_NXZ
?is_index_valid@MibTable@@UEBA_NAEBVOidx@@@Z
?is_persistent@StorageTable@@MEAA_NPEAVMibTableRow@@@Z
?is_transition_ok@MibTableVoter@@UEAAHPEAVMibTable@@PEAVMibTableRow@@AEBVOidx@@HH@Z
?is_volatile@MibEntry@@UEAA_NXZ
?is_volatile@TestAndIncr@@UEAA_NXZ
?load@Mib@@UEAA_NIAEBVOctetStr@@@Z
?load_from_file@MibEntry@@UEAAXPEBD@Z
?load_from_file@MibGroup@@UEAAXPEBD@Z
?lock_request@RequestList@@UEAAXPEAVRequest@@@Z
?max_key@MibEntry@@UEAAPEAVOidx@@XZ
?max_key@MibLeaf@@UEAAPEAVOidx@@XZ
?max_key@MibTable@@UEAAPEAVOidx@@XZ
?next_access_control@Mib@@MEAAHPEAVRequest@@QEAVMibEntry@@AEAVOidx@@AEBV4@@Z
?notify@Mib@@UEAAHAEBVOctetStr@@AEBVOidx@@PEAVVbx@@HI@Z
?notify_change@MibEntry@@UEAAXAEBVOidx@@E@Z
?prepare_set_request@MibEntry@@UEAAHPEAVRequest@@AEAH@Z
?prepare_set_request@MibTable@@UEAAHPEAVRequest@@AEAH@Z
?prepare_set_request@TestAndIncr@@UEAAHPEAVRequest@@AEAH@Z
?process_cleanup_set_request@Mib@@UEAAXPEAVRequest@@@Z
?process_commit_set_request@Mib@@UEAAHPEAVRequest@@@Z
?process_get_bulk_request@Mib@@UEAAXPEAVRequest@@@Z
?process_prepare_set_request@Mib@@UEAAHPEAVRequest@@@Z
?process_request@Mib@@MEAA_NPEAVRequest@@H@Z
?process_request@Mib@@UEAAXPEAVRequest@@@Z
?process_set_request@Mib@@UEAAXPEAVRequest@@@Z
?process_undo_set_request@Mib@@UEAAHPEAVRequest@@@Z
?ready@MibTable@@MEAA_NPEAVVbx@@HPEAVMibTableRow@@@Z
?ready_for_service@UsmUserTable@@UEAA_NPEAVVbx@@H@Z
?receive@RequestList@@UEAAPEAVRequest@@H@Z
?register_for_notifications@MibEntry@@UEAAXPEAV1@@Z
?reinit@MibTable@@UEAAXXZ
?remove@Mib@@UEAA_NAEBVOctetStr@@AEBVOidx@@@Z
?remove@Mib@@UEAA_NAEBVOidx@@@Z
?remove_agent_caps@Mib@@UEAAXAEBVOctetStr@@AEBVOidx@@@Z
?remove_context@Mib@@UEAAXAEBVOctetStr@@@Z
?remove_listener@MibTable@@UEAAXPEAV1@@Z
?remove_request@RequestList@@UEAAXPEAVRequest@@@Z
?remove_row@MibTable@@UEAAXAEBVOidx@@@Z
?remove_voter@MibTable@@UEAAXPEAVMibTableVoter@@@Z
?replace_col@MibTable@@UEAAXIPEAVMibLeaf@@@Z
?replace_value@MibLeaf@@UEAAXPEAVSnmpSyntax@@@Z
?report@RequestList@@UEAAXPEAVRequest@@@Z
?reset@MibEntry@@UEAAXXZ
?reset@StorageTable@@UEAAXXZ
?row_activated@MibTable@@UEAAXPEAVMibTableRow@@AEBVOidx@@PEAV1@@Z
?row_added@UsmUserTable@@UEAAXPEAVMibTableRow@@AEBVOidx@@PEAVMibTable@@@Z
?row_deactivated@MibTable@@UEAAXPEAVMibTableRow@@AEBVOidx@@PEAV1@@Z
?row_delete@MibTable@@UEAAXPEAVMibTableRow@@AEBVOidx@@PEAV1@@Z
?row_init@UsmUserTable@@UEAAXPEAVMibTableRow@@AEBVOidx@@PEAVMibTable@@@Z
?save@Mib@@UEAA_NIAEBVOctetStr@@@Z
?save_all@Mib@@UEAAXXZ
?save_to_file@MibEntry@@UEAAXPEBD@Z
?save_to_file@MibGroup@@UEAAXPEBD@Z
?serialize@MibEntry@@UEAA_NAEAPEADAEAH@Z
?serialize@MibLeaf@@UEAA_NAEAPEADAEAH@Z
?serialize@MibTable@@UEAA_NAEAPEADAEAH@Z
?set@TestAndIncr@@UEAAHAEBVVbx@@@Z
?set_address_validation@RequestList@@UEAAX_N@Z
?set_boot_counter@Mib@@UEAAHAEBVOctetStr@@I@Z
?set_persistent_objects_path@Mib@@UEAAXPEBVOctetStr@@@Z
?set_snmp@RequestList@@UEAAXPEAVSnmpx@@@Z
?set_state@TestAndIncr@@UEAAXJ@Z
?set_v3mp@RequestList@@UEAAXPEAVv3MP@@@Z
?set_vacm@RequestList@@UEAAXPEAVVacm@@@Z
?set_value@MibLeaf@@UEAAHAEBVVbx@@@Z
?set_value@MibLeaf@@UEAAXAEBVSnmpSyntax@@@Z
?set_value@MibLeaf@@UEAAXK@Z
?set_value@MibTable@@UEAAHPEAVRequest@@H@Z
?size@MibTable@@UEAAHXZ
?trylock_request@RequestList@@UEAA?AW4TryLockResult@Synchronized@@PEAVRequest@@@Z
?type@MibGroup@@UEBA?AW4mib_type@@XZ
?type@MibLeaf@@UEBA?AW4mib_type@@XZ
?type@MibTable@@UEBA?AW4mib_type@@XZ
?undo_set_request@MibEntry@@UEAAHPEAVRequest@@AEAH@Z
?undo_set_request@MibLeaf@@UEAAHPEAVRequest@@AEAH@Z

snmp++

?instance@DefaultLog@@1PEAVAgentLog@@EA
?init_ts@DefaultLog@@SAPEAVAgentLog@@PEAV2@@Z
??YOctetStr@@QEAAAEAV0@E@Z
??4OctetStr@@QEAAAEAV0@AEBV0@@Z
??0OctetStr@@QEAA@XZ
?valid@SnmpUInt32@@UEBA_NXZ
?get_syntax@SnmpUInt32@@UEBAKXZ
?get_printable@SnmpUInt32@@UEBAPEBDXZ
?get_asn1_length@SnmpUInt32@@UEBAHXZ
?clone@SnmpUInt32@@UEBAPEAVSnmpSyntax@@XZ
?clear@SnmpUInt32@@UEAAXXZ
??4SnmpUInt32@@UEAAAEAVSnmpSyntax@@AEBV1@@Z
?get_value@Vb@@QEBAHPEAEAEAKK_N@Z
??0Vb@@QEAA@AEBV0@@Z
??1SnmpUInt32@@UEAA@XZ
??0SnmpUInt32@@QEAA@K@Z
??YOid@@QEAAAEAV0@K@Z
?valid@OctetStr@@UEBA_NXZ
?trap@Snmp@@UEAAHAEAVPdu@@AEBVSnmpTarget@@@Z
?set@Snmp@@UEAAHAEAVPdu@@AEAVSnmpTarget@@Q6AXHPEAV1@01PEAX@ZPEBX@Z
?set@Snmp@@UEAAHAEAVPdu@@AEAVSnmpTarget@@@Z
?send_raw_data@Snmp@@UEAAHPEAE_KAEAVUdpAddress@@1@Z
?response@Snmp@@UEAAHAEAVPdu@@AEAVSnmpTarget@@_K@Z
?report@Snmp@@UEAAHAEAVPdu@@AEAVSnmpTarget@@@Z
?notify_unregister@Snmp@@UEAAHXZ
?notify_set_listen_port@Snmp@@UEAAXH@Z
?notify_register@Snmp@@UEAAHAEBV?$SnmpCollection@VOid@@@@AEBV?$SnmpCollection@VSnmpTarget@@@@Q6AXHPEAV1@AEAVPdu@@AEAVSnmpTarget@@PEAX@ZPEBX@Z
?notify_get_listen_port@Snmp@@UEAAHXZ
?inform@Snmp@@UEAAHAEAVPdu@@AEAVSnmpTarget@@Q6AXHPEAV1@01PEAX@ZPEBX@Z
?inform@Snmp@@UEAAHAEAVPdu@@AEAVSnmpTarget@@@Z
??0Oid@@QEAA@PEBD_N@Z
?get_notify_filter@Snmp@@UEAAHAEAV?$SnmpCollection@VOid@@@@AEAV?$SnmpCollection@VSnmpTarget@@@@@Z
?get_next@Snmp@@UEAAHAEAVPdu@@AEAVSnmpTarget@@Q6AXHPEAV1@01PEAX@ZPEBX@Z
?get_next@Snmp@@UEAAHAEAVPdu@@AEAVSnmpTarget@@@Z
?get_bulk@Snmp@@UEAAHAEAVPdu@@AEAVSnmpTarget@@HHQ6AXHPEAV1@01PEAX@ZPEBX@Z
?get_bulk@Snmp@@UEAAHAEAVPdu@@AEAVSnmpTarget@@HH@Z
?get_asn1_length@OctetStr@@UEBAHXZ
?get@Snmp@@UEAAHAEAVPdu@@AEAVSnmpTarget@@Q6AXHPEAV1@01PEAX@ZPEBX@Z
?get@Snmp@@UEAAHAEAVPdu@@AEAVSnmpTarget@@@Z
?engine_id_discovery@Snmp@@UEAAHAEAVOctetStr@@HAEBVUdpAddress@@@Z
?clone@OctetStr@@UEBAPEAVSnmpSyntax@@XZ
?clear@OctetStr@@UEAAXXZ
?cancel@Snmp@@UEAAHK@Z
?broadcast_discovery@Snmp@@UEAAHAEAV?$SnmpCollection@VUdpAddress@@@@HAEBVUdpAddress@@W4snmp_version@@PEBVOctetStr@@@Z
??4OctetStr@@UEAAAEAVSnmpSyntax@@AEBV1@@Z
??0Snmp@@QEAA@AEAHG_N@Z
??1v3MP@@QEAA@XZ
??0v3MP@@QEAA@AEBVOctetStr@@IAEAH@Z
?saveBootCounter@@YAHPEBDAEBVOctetStr@@I@Z
?getBootCounter@@YAHPEBDAEBVOctetStr@@AEAI@Z
??YPdu@@QEAAAEAV0@AEBVVb@@@Z
??1Pdu@@UEAA@XZ
??0Pdu@@QEAA@XZ
??1CTarget@@UEAA@XZ
??0CTarget@@QEAA@AEBVAddress@@@Z
?set_value@Vb@@QEAAXAEBVSnmpSyntax@@@Z
?set_oid@Vb@@QEAAXAEBVOid@@@Z
??1Vb@@QEAA@XZ
??0Vb@@QEAA@XZ
?set_port@UdpAddress@@QEAAXG@Z
??1UdpAddress@@UEAA@XZ
??0UdpAddress@@QEAA@PEBD@Z
?get_printable@OctetStr@@UEBAPEBDXZ
??4OctetStr@@QEAAAEAV0@PEBD@Z
??1OctetStr@@UEAA@XZ
??0OctetStr@@QEAA@AEBV0@@Z
??0OctetStr@@QEAA@PEBD@Z
??1Oid@@UEAA@XZ
?get_syntax@OctetStr@@UEBAKXZ

libmessagesv317

?getFirstItem@AnswerGroup@@QEBAPEAVAnswerItem@@XZ
?getNext@?$DynPtrArray@VAnswerItem@@@@QEBAPEAVAnswerItem@@XZ
?appendId@DpMsgConnection@@QEAAIAEBVDpIdentifier@@@Z
??1DpMsgConnection@@UEAA@XZ
??0DpMsgConnection@@QEAA@W4MsgType@@@Z
?getDpIdResponse@NameServerSysMsg@@QEBA?AW4NameServerResponseStatus@@AEAVCharString@@AEAEAEAVDpIdentifier@@@Z
??1NameServerSysMsg@@UEAA@XZ
??0NameServerSysMsg@@QEAA@AEBVManagerIdentifier@@@Z

libbasicsv317

?compareDp@DpIdentifier@@SAHPEBV1@0@Z
?append@DpIdentList@@QEAAXAEBVDpIdentifier@@@Z
??1DpIdentList@@QEAA@XZ
??_7DpIdentifier@@6B@
??0CharString@@QEAA@AEBV0@@Z
??H@YA?AVCharString@@AEBV0@H@Z
?getValue@DpVCItem@@QEBAAEBVVariable@@XZ
??4DpIdentifier@@QEAAAEBV0@AEBV0@@Z
?isLogFlagCerr@DebugOutput@@YA_NXZ
?getDbgFlagName@DebugOutput@@YA?AVCharString@@F@Z
?getProgNameAndTime@Resources@@SA?AVCharString@@XZ
?ownManId@Resources@@1VManagerIdentifier@@A
??0UIntegerVar@@QEAA@I@Z
??ACharString@@QEAAAEAD_K@Z
??5@YAAEAV?$basic_istream@DU?$char_traits@D@std@@@std@@AEAV01@AEAVCharString@@@Z
??0PtrList@@QEAA@XZ
?icmp@CharString@@QEBAHPEBD@Z
?endsWith@CharString@@QEBAHPEBD@Z
?begin@Resources@@SAXAEAHQEAPEAD@Z
?isSection@Resources@@SAIAEBVCharString@@@Z
?generalSection@Resources@@SAIXZ
?end@Resources@@SAXAEAHQEAPEAD@Z
?getDataDir@Resources@@SA?AVCharString@@H@Z
?printHelp@Resources@@SAXXZ
?printHelpDbg@Resources@@SAXXZ
?getNextEntry@Resources@@KAXXZ
??6@YAAEAV?$basic_ostream@DU?$char_traits@D@std@@@std@@AEAV01@AEBVUIntegerVar@@@Z
??1UIntegerVar@@UEAA@XZ
?getCfgStream@Resources@@KAAEAV?$basic_istream@DU?$char_traits@D@std@@@std@@XZ
?unknownKeyWordError@Resources@@KAXXZ
?getCfgState@Resources@@KA?AW4CfgState@1@XZ
?getKeyWord@Resources@@KAAEBVCharString@@XZ
?error@ErrHdl@@SAXAEBVErrClass@@@Z
??0TextVar@@QEAA@XZ
??0Bit32Var@@QEAA@AEBVBit32@@@Z
?isNull@DpIdentifier@@QEBAHXZ
??8CharString@@QEBAHPEBD@Z
??1DpIdentifier@@UEAA@XZ
??4TimeVar@@QEAAAEAV0@AEBV0@@Z
??6@YAAEAV?$basic_ostream@DU?$char_traits@D@std@@@std@@AEAV01@AEBVTimeVar@@@Z
??0TimeVar@@QEAA@XZ
??4AlertTime@@QEAAAEAV0@AEBV0@@Z
??6@YAAEAV?$basic_ostream@DU?$char_traits@D@std@@@std@@AEAV01@AEBVBit32Var@@@Z
?Second@BC_CTime@@QEBAIXZ
?debug@Variable@@SAXAEAV?$basic_ostream@DU?$char_traits@D@std@@@std@@HW4VariableType@@@Z
?isA@Variable@@QEBA?AW4VariableType@@XZ
??6@YAAEAV?$basic_ostream@DU?$char_traits@D@std@@@std@@AEAV01@AEBQEAVVariable@@@Z
?setCharStr@CharString@@QEAAXPEBD_K@Z
?cmp@CharString@@QEBAHPEBD@Z
??6@YAAEAV?$basic_ostream@DU?$char_traits@D@std@@@std@@AEAV01@AEBVCharString@@@Z
??4CharString@@QEAAAEBV0@AEBV0@@Z
?getTime@TimeVar@@QEBA?BVBC_CTime@@XZ
?TimeFromGMT@BC_CTime@@SA_JXZ
?Year@BC_CTime@@QEBAIXZ
?Day@BC_CTime@@QEBAIXZ
??0CharString@@QEAA@XZ
??1CharString@@QEAA@XZ
??H@YA?AVCharString@@AEBV0@PEBD@Z
?format@CharString@@QEAAXPEBDZZ
?dup@CharString@@QEBAPEADXZ
?isDbgFlag@DebugOutput@@YA_NF@Z
?error@ErrHdl@@SAXW4ErrPrio@ErrClass@@W4ErrType@3@IPEBD22@Z
??0CharString@@QEAA@PEBD_K@Z
??H@YA?AVCharString@@AEBV0@0@Z
??1Bit32Var@@UEAA@XZ
??1TimeVar@@UEAA@XZ
?getVersion@Resources@@SA?BVCharString@@XZ
??0TextVar@@QEAA@PEBD_K@Z
?getValue@TextVar@@QEBAPEBDXZ
??1TextVar@@UEAA@XZ
?addVersionInfo@Resources@@0VCharString@@A
?helpFlag@Resources@@1IA
?helpDbgFlag@Resources@@1IA
??1BC_CTime@@QEAA@XZ
?Hour@BC_CTime@@QEBAIXZ
?Minute@BC_CTime@@QEBAIXZ
?Month@BC_CTime@@QEBAIXZ

msvcp140

?_Xbad_alloc@std@@YAXXZ
_Mbrtowc
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?_W_Getdays@_Locinfo@std@@QEBAPEBGXZ
?_W_Getmonths@_Locinfo@std@@QEBAPEBGXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?uncaught_exception@std@@YA_NXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z

vcruntime140

__std_terminate
__CxxFrameHandler3
memcpy
memset
__C_specific_handler
__std_exception_copy
__std_exception_destroy
_CxxThrowException
__std_type_info_destroy_list
memmove

api-ms-win-crt-heap-l1-1-0

free
malloc
realloc
calloc
_set_new_mode
_callnewh

api-ms-win-crt-string-l1-1-0

strtok

api-ms-win-crt-time-l1-1-0

_time64
__timezone
_localtime64

api-ms-win-crt-runtime-l1-1-0

_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
_cexit
_set_app_type
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_initterm_e
exit
_register_onexit_function
_exit
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_seh_filter_dll
signal
terminate
_wassert
_seh_filter_exe
_configure_narrow_argv
_initialize_onexit_table

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf
__p__commode
_set_fmode
__stdio_common_vsscanf

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

kernel32

IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
GetStartupInfoW
RtlCaptureContext
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry

Sections

.text
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 70KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

dd60077115da4ed76d10eeb0170e5b90

Code Sign

0a:3d:2d:f5:02:51:04:16:9e:00:31:5d:78:df:c8:a4Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

cf:60:14:a5:5e:f2:72:0c:21:d5:8c:1a:b6:07:9a:3b:e8:b0:94:3a:5b:dc:b5:7f:43:e9:35:cf:95:17:ad:36Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

libmanagerv317

agent++

snmp++

libmessagesv317

libbasicsv317

msvcp140

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

kernel32

Sections

.text Size: 75KB - Virtual size: 74KB

.rdata Size: 70KB - Virtual size: 70KB

.data Size: 2KB - Virtual size: 3KB

.pdata Size: 5KB - Virtual size: 5KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 1KB

0a:3d:2d:f5:02:51:04:16:9e:00:31:5d:78:df:c8:a4
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

cf:60:14:a5:5e:f2:72:0c:21:d5:8c:1a:b6:07:9a:3b:e8:b0:94:3a:5b:dc:b5:7f:43:e9:35:cf:95:17:ad:36
Signer

.text
Size: 75KB - Virtual size: 74KB

.rdata
Size: 70KB - Virtual size: 70KB

.data
Size: 2KB - Virtual size: 3KB

.pdata
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 1KB