iisw3adm[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

iisw3adm.dll
Size

555KB
MD5

11ba276ee1be1978c04ef4885e58716e
SHA1

c9355fbc17cf36acab5bd46b1bacbb4b10cd0fe6
SHA256

890228800bd541bfe237ae5661ff77c9483c7ec199c60034beb497b30723caa4
SHA512

0e3776a22a86ba643f2fea96d41d3d7eb2c533bfa86d904a9dec1acf4515d471f56c7327cb18e3a3ad9d65b418ec1bbe40ad4f88736713a42f4801406383d415
SSDEEP

6144:wymhJw1sbDBB7Z4SepGlJeenCGFDGd5e6kALy3QObyFkWhcN+HcmhAHUzvKqMbk2:/m746Bj4Se3eKLsALy3bYkWhcqVMbk2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
iisw3adm.dll

Files

iisw3adm.dll
.dll regsvr32 windows:10 windows x64 arch:x64

761056e5429632eccaacc2d6c6685071

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

iisw3adm.pdb

Imports

msvcrt

memcpy
memcmp
free
malloc
_vsnprintf
wcsncmp
memset
wcscpy_s
_wcslwr_s
_onexit
__dllonexit
swprintf_s
_wcsdup
memcpy_s
_unlock
_lock
__C_specific_handler
wcscat_s
_wcsnicmp
_initterm
_vsnwprintf
_amsg_exit
wcstoul
_i64tow
_ltow
wcschr
memmove
_purecall
_ultow
_XcptFilter
_wcsicmp
wcsrchr
_ultow_s
_callnewh
_wcsupr
wcsstr
wcsncpy_s
wcscmp

ntdll

RtlLengthRequiredSid
RtlInitializeSid
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlIpv4StringToAddressW
WinSqmSetDWORD64
WinSqmSetDWORD
RtlNtStatusToDosError
RtlInitUnicodeString
RtlExpandEnvironmentStrings_U
RtlInitUnicodeStringEx
RtlDeregisterWaitEx
RtlRegisterWait
NtQuerySystemInformation
RtlSubAuthoritySid

api-ms-win-service-core-l1-1-1

SetServiceStatus

api-ms-win-service-winsvc-l1-2-0

QueryServiceStatus
RegisterServiceCtrlHandlerW
ControlService

api-ms-win-service-management-l1-1-0

OpenSCManagerW
CloseServiceHandle
StartServiceW
OpenServiceW

api-ms-win-core-synch-l1-2-0

CreateMutexA
CreateEventW
CreateEventA
AcquireSRWLockShared
SetEvent
ReleaseMutex
ReleaseSRWLockShared
EnterCriticalSection
AcquireSRWLockExclusive
LeaveCriticalSection
ReleaseSRWLockExclusive
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
WaitForSingleObject
ResetEvent
InitializeCriticalSection
InitializeSRWLock
Sleep

api-ms-win-core-debug-l1-1-1

OutputDebugStringA
CheckRemoteDebuggerPresent
OutputDebugStringW

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
LoadLibraryExW
DisableThreadLibraryCalls
GetModuleFileNameW
GetModuleHandleW
FreeLibrary

api-ms-win-core-errorhandling-l1-1-1

SetLastError
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-2

GetExitCodeProcess
DeleteProcThreadAttributeList
OpenProcessToken
ResumeThread
OpenProcess
CreateThread
GetExitCodeThread
GetCurrentThread
TerminateProcess
GetCurrentThreadId
CreateProcessAsUserW
SetThreadPriority
UpdateProcThreadAttribute
GetCurrentProcess
InitializeProcThreadAttributeList
CreateProcessW
GetCurrentProcessId

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetSystemTimeAsFileTime
GetVersionExW
GetLogicalProcessorInformationEx
GetSystemInfo
GetSystemDirectoryW

api-ms-win-core-com-l1-1-1

CoTaskMemAlloc
CoTaskMemFree
CoInitializeSecurity
CoFreeUnusedLibrariesEx
CoUninitialize
CoRegisterClassObject
CoRevokeClassObject
CoInitializeEx
CoCreateInstance

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolCleanupGroup
CreateThreadpool
SetThreadpoolThreadMaximum
CloseThreadpool
CloseThreadpoolCleanupGroup
WaitForThreadpoolTimerCallbacks
SetThreadpoolThreadMinimum
WaitForThreadpoolIoCallbacks
CloseThreadpoolIo
StartThreadpoolIo
CreateThreadpoolIo
CloseThreadpoolTimer
TrySubmitThreadpoolCallback
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolCleanupGroupMembers

api-ms-win-core-io-l1-1-1

PostQueuedCompletionStatus
CreateIoCompletionPort
GetQueuedCompletionStatus

api-ms-win-core-heap-l1-2-0

HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc

api-ms-win-core-file-l1-2-1

SetFileAttributesW
ReadFile
CreateDirectoryW
WriteFile
GetTempFileNameW
GetFileAttributesW
SetEndOfFile
RemoveDirectoryW
CreateFileW
DeleteFileW

api-ms-win-security-base-l1-2-0

AddAccessAllowedAce
AllocateLocallyUniqueId
GetSecurityDescriptorDacl
DuplicateTokenEx
EqualSid
AllocateAndInitializeSid
CopySid
CreateWellKnownSid
GetLengthSid
InitializeAcl
GetTokenInformation
InitializeSecurityDescriptor
CreateRestrictedToken
SetSecurityDescriptorDacl
FreeSid
IsValidSid
SetTokenInformation

api-ms-win-core-heap-l2-1-0

LocalAlloc
GlobalFree
LocalFree
GlobalAlloc

api-ms-win-core-processenvironment-l1-2-0

ExpandEnvironmentStringsW
GetEnvironmentStringsW
FreeEnvironmentStringsW

oleaut32

VariantInit
VariantClear
SysFreeString
GetErrorInfo
SysAllocString

api-ms-win-core-file-l2-1-1

MoveFileExW

dnsapi

GetCurrentTimeInSeconds

api-ms-win-core-registry-l1-1-0

RegDeleteKeyExW
RegSetKeySecurity
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegEnumKeyExW
RegNotifyChangeKeyValue

api-ms-win-core-memory-l1-1-2

CreateFileMappingW
UnmapViewOfFile
OpenFileMappingW
MapViewOfFile

api-ms-win-core-libraryloader-l1-2-2

LoadLibraryW

api-ms-win-core-wow64-l1-1-1

GetSystemWow64DirectoryW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-registry-l1-1-1

RegDeleteKeyValueW

logoncli

NetIsServiceAccount
NetGetDCName

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventUnregister
EventSetInformation
EventWriteTransfer

ws2_32

WSAGetLastError
WSAStartup
WSACleanup
GetNameInfoW

api-ms-win-security-provider-l1-1-0

SetSecurityInfo
GetSecurityInfo
SetEntriesInAclW
SetNamedSecurityInfoW

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueTimer
UnregisterWaitEx
CreateTimerQueueTimer

api-ms-win-core-kernel32-legacy-l1-1-1

CreateFileMappingA
GetComputerNameW
RegisterWaitForSingleObject
UnregisterWait
SetDllDirectoryW
GetNumaAvailableMemoryNodeEx

api-ms-win-core-kernel32-legacy-l1-1-5

OpenFileMappingA

api-ms-win-core-job-l2-1-0

SetInformationJobObject
CreateJobObjectW
AssignProcessToJobObject
QueryInformationJobObject

api-ms-win-core-perfcounters-l1-1-0

PerfCreateInstance
PerfSetULongLongCounterValue
PerfStopProvider
PerfSetCounterSetInfo
PerfSetCounterRefValue
PerfStartProvider
PerfDeleteInstance

api-ms-win-core-processtopology-private-l1-1-0

SetProcessGroupAffinity

api-ms-win-core-normalization-l1-1-0

IdnToNameprepUnicode

xmllite

CreateXmlWriter
CreateXmlReader

iisutil

??1ALLOC_CACHE_HANDLER@@QEAA@XZ
??0ALLOC_CACHE_HANDLER@@QEAA@PEBDPEBUALLOC_CACHE_CONFIGURATION@@H@Z
?WriteUnlock@CSmallSpinLock@@QEAAXXZ
??1IPM_MESSAGE_PIPE@@EEAA@XZ
?WriteLock@CSmallSpinLock@@QEAAXXZ
?Find@CLKRHashTable@@QEAA_N_KAEAVCLKRHashTable_Iterator@@@Z
?Erase@CLKRHashTable@@QEAA_NAEAVCLKRHashTable_Iterator@@@Z
?Erase@CLKRHashTable@@QEAA_NAEAVCLKRHashTable_Iterator@@0@Z
?Insert@CLKRHashTable@@QEAA_NPEBXAEAVCLKRHashTable_Iterator@@_N@Z
?Begin@CLKRHashTable@@QEAA?AVCLKRHashTable_Iterator@@XZ
?Size@CLKRHashTable@@QEBAKXZ
?DeleteIf@CLKRHashTable@@QEAAKP6A?AW4LK_PREDICATE@@PEBXPEAX@Z1@Z
?ApplyIf@CLKRHashTable@@QEAAKP6A?AW4LK_PREDICATE@@PEBXPEAX@ZP6A?AW4LK_ACTION@@01@Z1W4LK_LOCKTYPE@@@Z
?Apply@CLKRHashTable@@QEAAKP6A?AW4LK_ACTION@@PEBXPEAX@Z1W4LK_LOCKTYPE@@@Z
?FindRecord@CLKRHashTable@@QEBA?AW4LK_RETCODE@@PEBX@Z
?FindKey@CLKRHashTable@@QEBA?AW4LK_RETCODE@@_KPEAPEBX@Z
?DeleteRecord@CLKRHashTable@@QEAA?AW4LK_RETCODE@@PEBX@Z
?DeleteKey@CLKRHashTable@@QEAA?AW4LK_RETCODE@@_K@Z
?InsertRecord@CLKRHashTable@@QEAA?AW4LK_RETCODE@@PEBX_N@Z
??1CLKRHashTable@@QEAA@XZ
??0CLKRHashTable@@QEAA@PEBDP6A?B_KPEBX@ZP6AK_K@ZP6A_N33@ZP6AX1H@ZNKK_N@Z
??0CLKRHashTable_Iterator@@QEAA@AEBV0@@Z
??1STRU@@QEAA@XZ
??1CLKRHashTable_Iterator@@QEAA@XZ
?End@CLKRHashTable@@QEAA?AVCLKRHashTable_Iterator@@XZ
PuCreateDebugPrintsObject
PuLoadDebugFlagsFromRegStr
PuDbgPrint
PuDbgPrintError
PuDeleteDebugPrintsObject
??0EVENT_LOG@@QEAA@PEBG@Z
??0STRU@@QEAA@XZ
??1BUFFER@@QEAA@XZ
??0BUFFER@@QEAA@XZ
?Free@ALLOC_CACHE_HANDLER@@QEAAHPEAX@Z
??1STRA@@QEAA@XZ
??0CSecurityDispenser@@QEAA@XZ
??1CSecurityDispenser@@QEAA@XZ
?Copy@STRU@@QEAAJPEBG@Z
InitializeIISUtil
?Append@STRU@@QEAAJPEBG@Z
?GetSID@CSecurityDispenser@@QEAAKW4WELL_KNOWN_SID_TYPE@@PEAPEAX@Z
ReadDwordParameterValueFromAnyService
ReadStringParameterValueFromAnyService
?Resize@BUFFER@@QEAA_NK@Z
?GetLocalGroupSID@CSecurityDispenser@@QEAAKPEAPEAX@Z
?GetIisIusrsSID@CSecurityDispenser@@QEAAKPEAPEAX@Z
?Clear@CLKRHashTable@@QEAAXXZ
TerminateIISUtil
?LogEvent@EVENT_LOG@@QEAAXKGQEAPEBGK@Z
??0MULTISZ@@QEAA@XZ
??1MULTISZ@@QEAA@XZ
ReadMultiStringParameterValueFromAnyService
?Append@MULTISZ@@QEAAHPEBG@Z
??0STRU@@QEAA@PEAGK@Z
?FindStringNoCase@MULTISZ@@QEAAHPEBG@Z
IsStringEqualOrdinalIgnoreCase
?SetLen@STRU@@QEAA_NK@Z
?First@MULTISZ@@QEBAPEBGXZ
?Copy@STRU@@QEAAJPEBGK@Z
?Copy@MULTISZ@@QEAAHAEBV1@@Z
IsPathUnc
?Append@STRU@@QEAAJG@Z
?WriteLock@CReaderWriterLock3@@QEAAXXZ
?EqualRange@CLKRHashTable@@QEAA_N_KAEAVCLKRHashTable_Iterator@@1@Z
?Copy@STRU@@QEAAJAEBV1@@Z
?WriteUnlock@CReaderWriterLock3@@QEAAXXZ
?EqualsNoCase@STRU@@QEBA_NAEBV1@@Z
?ReadLock@CReaderWriterLock3@@QEAAXXZ
?ReadUnlock@CReaderWriterLock3@@QEAAXXZ
?Resize@STRU@@QEAAJK@Z
?Copy@STRU@@QEAAJPEBV1@@Z
?FastAppend@MULTISZ@@QEAAHPEBG@Z
??0STRA@@QEAA@XZ
?Append@STRA@@QEAAJPEBD@Z
?AppendW@STRA@@QEAAJPEBG@Z
?EqualsNoCase@STRU@@QEBA_NPEBG@Z
?Record@CLKRHashTable_Iterator@@QEBAPEBXXZ
??9CLKRHashTable_Iterator@@QEBA_NAEBV0@@Z
?Increment@CLKRHashTable_Iterator@@QEAA_NXZ
AllocateAndCreateWellKnownSid
GetTokenUserSID
DupTokenAddAccess
FreeWellKnownSid
FreeTokenUserSID
?Append@STRU@@QEAAJAEBV1@@Z
?IsValid@CLKRHashTable@@QEBA_NXZ
?SyncWithBuffer@STRU@@QEAAXXZ
?GetStringizedIpmOpcode@IPM_MESSAGE_PIPE@@SAPEBGW4IPM_OPCODE@@@Z
GetSecurityAttributesForSid
GenerateNameWithGUID
?CreateIpmMessagePipe@IPM_MESSAGE_PIPE@@SAJPEAVIPM_MESSAGE_ACCEPTOR@@PEBGHPEAU_SECURITY_ATTRIBUTES@@PEAPEAV1@@Z
FreeSecurityAttributes
?DestroyIpmMessagePipe@IPM_MESSAGE_PIPE@@QEAAXXZ
?WriteMessage@IPM_MESSAGE_PIPE@@QEAAJW4IPM_OPCODE@@KPEAX@Z
CreateSubkey
SetStringParameterValueInAnyService
MakeAllProcessHeapsLFH
SetExplicitAccessSettings
??0MULTISZ@@QEAA@PEBG@Z
GetTokenSID
?AdjustTokenForAdministrators@CSecurityDispenser@@QEAAKPEAX@Z
?Clone@MULTISZ@@QEBAHPEAV1@@Z
?Equals@STRU@@QEBA_NAEBV1@@Z
?Equals@MULTISZ@@QEAAHPEAV1@@Z
?Reset@MULTISZ@@QEAAXXZ
?Append@STRU@@QEAAJPEBGK@Z
?Append@MULTISZ@@QEAAHAEAVSTRU@@@Z
?Alloc@ALLOC_CACHE_HANDLER@@QEAAPEAXXZ
DisableTokenBackupPrivilege
?Resize@STRA@@QEAAJK@Z
?Equals@STRA@@QEBA_NAEBV1@@Z
??0STRA@@QEAA@PEADK@Z

nativerd

TerminateNativeConfiguration
GetDefaultNativeConfigurationSystem
CreateNativeConfigurationSystem
InitializeNativeConfiguration

w3tp

ThreadPoolTerminate
ThreadPoolInitialize
ThreadPoolSetInfo

sspicli

LsaFreeReturnBuffer
LogonUserExExW

bcrypt

BCryptCreateHash
BCryptHashData
BCryptFinishHash
BCryptDestroyHash

api-ms-win-security-lsalookup-l2-1-1

LsaManageSidNameMapping

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

api-ms-win-security-logon-l1-1-0

LogonUserExW

api-ms-win-security-lsapolicy-l1-1-0

LsaClose
LsaFreeMemory
LsaAddAccountRights
LsaOpenPolicy

api-ms-win-core-misc-l1-1-0

lstrlenW

Exports

Exports

??0?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@QEAA@PEBDNKK_N@Z
??0?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@QEAA@PEBDNKK_N@Z
??0HASH_POOL_HASH@@QEAA@XZ
??0IPM_MESSAGE_PIPE@@QEAA@AEBV0@@Z
??0POOL_HASH_HASH@@QEAA@XZ
??1?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@QEAA@XZ
??1?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@QEAA@XZ
??1HASH_POOL_HASH@@QEAA@XZ
??1POOL_HASH_HASH@@QEAA@XZ
??4CSecurityDispenser@@QEAAAEAV0@AEBV0@@Z
??4IPM_MESSAGE_PIPE@@QEAAAEAV0@AEBV0@@Z
??_7IPM_MESSAGE_PIPE@@6B@
?AddRefRecord@HASH_POOL_HASH@@SAXPEAVPOOL_HASH_ENTRY@@H@Z
?AddRefRecord@POOL_HASH_HASH@@SAXPEAVPOOL_HASH_ENTRY@@H@Z
?Apply@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@QEAAKP6A?AW4LK_ACTION@@PEAVPOOL_HASH_ENTRY@@PEAX@Z1W4LK_LOCKTYPE@@@Z
?Apply@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@QEAAKP6A?AW4LK_ACTION@@PEAVPOOL_HASH_ENTRY@@PEAX@Z1W4LK_LOCKTYPE@@@Z
?ApplyIf@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@QEAAKP6A?AW4LK_PREDICATE@@PEAVPOOL_HASH_ENTRY@@PEAX@ZP6A?AW4LK_ACTION@@01@Z1W4LK_LOCKTYPE@@@Z
?ApplyIf@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@QEAAKP6A?AW4LK_PREDICATE@@PEAVPOOL_HASH_ENTRY@@PEAX@ZP6A?AW4LK_ACTION@@01@Z1W4LK_LOCKTYPE@@@Z
?CalcKeyHash@HASH_POOL_HASH@@SAKPEBUAPP_POOL_HASH@@@Z
?CalcKeyHash@POOL_HASH_HASH@@SAKPEBG@Z
?ClearHash@HASH_POOL_HASH@@SAXPEAV1@@Z
?ClearHash@POOL_HASH_HASH@@SAXPEAV1@@Z
?DeleteIf@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@QEAAKP6A?AW4LK_PREDICATE@@PEAVPOOL_HASH_ENTRY@@PEAX@Z1@Z
?DeleteIf@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@QEAAKP6A?AW4LK_PREDICATE@@PEAVPOOL_HASH_ENTRY@@PEAX@Z1@Z
?DeleteKey@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@QEAA?AW4LK_RETCODE@@QEBUAPP_POOL_HASH@@@Z
?DeleteKey@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@QEAA?AW4LK_RETCODE@@QEBG@Z
?DeletePoolHashEntriesAction@HASH_POOL_HASH@@SA?AW4LK_ACTION@@PEAVPOOL_HASH_ENTRY@@PEAX@Z
?DeletePoolHashEntriesAction@POOL_HASH_HASH@@SA?AW4LK_ACTION@@PEAVPOOL_HASH_ENTRY@@PEAX@Z
?DeleteRecord@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@QEAA?AW4LK_RETCODE@@PEBVPOOL_HASH_ENTRY@@@Z
?DeleteRecord@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@QEAA?AW4LK_RETCODE@@PEBVPOOL_HASH_ENTRY@@@Z
?EqualKeys@HASH_POOL_HASH@@SA_NPEBUAPP_POOL_HASH@@0@Z
?EqualKeys@POOL_HASH_HASH@@SA_NPEBG0@Z
?EqualRange@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@QEAA_NQEBUAPP_POOL_HASH@@AEAViterator@1@1@Z
?EqualRange@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@QEAA_NQEBGAEAViterator@1@1@Z
?Erase@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@QEAA_NAEAViterator@1@0@Z
?Erase@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@QEAA_NAEAViterator@1@@Z
?Erase@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@QEAA_NAEAViterator@1@0@Z
?Erase@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@QEAA_NAEAViterator@1@@Z
?ExtractKey@HASH_POOL_HASH@@SAPEBUAPP_POOL_HASH@@PEBVPOOL_HASH_ENTRY@@@Z
?ExtractKey@POOL_HASH_HASH@@SAPEBGPEBVPOOL_HASH_ENTRY@@@Z
?Find@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@QEAA_NQEBUAPP_POOL_HASH@@AEAViterator@1@@Z
?Find@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@QEAA_NQEBGAEAViterator@1@@Z
?FindKey@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@QEBA?AW4LK_RETCODE@@QEBUAPP_POOL_HASH@@PEAPEAVPOOL_HASH_ENTRY@@@Z
?FindKey@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@QEBA?AW4LK_RETCODE@@QEBGPEAPEAVPOOL_HASH_ENTRY@@@Z
?FindRecord@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@QEBA?AW4LK_RETCODE@@PEBVPOOL_HASH_ENTRY@@@Z
?FindRecord@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@QEBA?AW4LK_RETCODE@@PEBVPOOL_HASH_ENTRY@@@Z
?Insert@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@QEAA_NPEBVPOOL_HASH_ENTRY@@AEAViterator@1@_N@Z
?Insert@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@QEAA_NPEBVPOOL_HASH_ENTRY@@AEAViterator@1@_N@Z
?InsertRecord@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@QEAA?AW4LK_RETCODE@@PEBVPOOL_HASH_ENTRY@@_N@Z
?InsertRecord@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@QEAA?AW4LK_RETCODE@@PEBVPOOL_HASH_ENTRY@@_N@Z
?QueryState@HTTP_WRAPPER@@QEBA?AW4HTTP_WRAPPER_STATE@@XZ
?_Action@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@CA?AW4LK_ACTION@@PEBXPEAX@Z
?_Action@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@CA?AW4LK_ACTION@@PEBXPEAX@Z
?_AddRefRecord@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@CAXPEBXH@Z
?_AddRefRecord@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@CAXPEBXH@Z
?_CalcKeyHash@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@CAK_K@Z
?_CalcKeyHash@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@CAK_K@Z
?_EqualKeys@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@CA_N_K0@Z
?_EqualKeys@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@CA_N_K0@Z
?_ExtractKey@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@CA?B_KPEBX@Z
?_ExtractKey@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@CA?B_KPEBX@Z
?_Pred@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@CA?AW4LK_PREDICATE@@PEBXPEAX@Z
?_Pred@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@CA?AW4LK_PREDICATE@@PEBXPEAX@Z
?begin@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@QEAA?AViterator@1@XZ
?begin@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@QEAA?AViterator@1@XZ
?end@?$CTypedHashTable@VHASH_POOL_HASH@@VPOOL_HASH_ENTRY@@PEBUAPP_POOL_HASH@@VCLKRHashTable@@@@QEAA?AViterator@1@XZ
?end@?$CTypedHashTable@VPOOL_HASH_HASH@@VPOOL_HASH_ENTRY@@PEBGVCLKRHashTable@@@@QEAA?AViterator@1@XZ
DllRegisterServer
DllUnregisterServer
HostedW3SVCStart
HostedW3SVCStop
ServiceMain

Sections

.text
Size: 390KB - Virtual size: 389KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 145KB - Virtual size: 144KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 408B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

761056e5429632eccaacc2d6c6685071

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

api-ms-win-service-core-l1-1-1

api-ms-win-service-winsvc-l1-2-0

api-ms-win-service-management-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-debug-l1-1-1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-handle-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-com-l1-1-1

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-io-l1-1-1

api-ms-win-core-heap-l1-2-0

api-ms-win-core-file-l1-2-1

api-ms-win-security-base-l1-2-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-processenvironment-l1-2-0

oleaut32

api-ms-win-core-file-l2-1-1

dnsapi

api-ms-win-core-registry-l1-1-0

api-ms-win-core-memory-l1-1-2

api-ms-win-core-libraryloader-l1-2-2

api-ms-win-core-wow64-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-file-l2-1-2

api-ms-win-core-registry-l1-1-1

logoncli

api-ms-win-eventing-provider-l1-1-0

ws2_32

api-ms-win-security-provider-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-kernel32-legacy-l1-1-5

api-ms-win-core-job-l2-1-0

api-ms-win-core-perfcounters-l1-1-0

api-ms-win-core-processtopology-private-l1-1-0

api-ms-win-core-normalization-l1-1-0

xmllite

iisutil

nativerd

w3tp

sspicli

bcrypt

api-ms-win-security-lsalookup-l2-1-1

api-ms-win-core-delayload-l1-1-1

api-ms-win-security-logon-l1-1-0

api-ms-win-security-lsapolicy-l1-1-0

api-ms-win-core-misc-l1-1-0

Exports

Exports

Sections

.text Size: 390KB - Virtual size: 389KB

.rdata Size: 145KB - Virtual size: 144KB

.data Size: 3KB - Virtual size: 4KB

.pdata Size: 13KB - Virtual size: 13KB

.didat Size: 512B - Virtual size: 408B

.rsrc Size: 1024B - Virtual size: 1024B

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 390KB - Virtual size: 389KB

.rdata
Size: 145KB - Virtual size: 144KB

.data
Size: 3KB - Virtual size: 4KB

.pdata
Size: 13KB - Virtual size: 13KB

.didat
Size: 512B - Virtual size: 408B

.rsrc
Size: 1024B - Virtual size: 1024B

.reloc
Size: 1KB - Virtual size: 1KB