AcGenral[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

AcGenral.dll
Size

2.3MB
MD5

846dd4117506d29130e5e2aa4cfdcdd0
SHA1

04186d68414817a93810c9a229c606fa97c3f8b6
SHA256

9c3f852d22a872c372a9d66307e76ad5c90d9ad2b174921af83048a575e1b1f4
SHA512

6b64e5bc89bc45ae985fa0508657a8760823809d97f10b0e0c68a7bec4600222dcb5a5da554d4c4db49d163ba228b86e0fa28f099399b663dd8ff665c5f7223f
SSDEEP

12288:qVq/scXF7Fu/PqI875PRVE17+gqHrKHhcNEhcNEhcNZhcNghcN6hcN6hcN3hcN+c:qVq/PCPqI87vVu7+gUrKD6U

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AcGenral.dll

Files

AcGenral.dll
.dll windows:10 windows x86 arch:x86

cccbf30752f2e66a299e247637f06c32

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

AcGenral.pdb

Imports

apphelp

SE_COM_AddHook
SE_COM_HookObject
SE_COM_Lookup
SE_COM_HookInterface
SE_CALLBACK_AddHook
SE_ShimDPF
SdbInitDatabase
SdbGetPDBFromGUID
SdbResolveDatabase
SdbOpenLocalDatabase
SdbFindFirstTag
SE_COM_AddServer
SE_GetShimId
SE_CALLBACK_Lookup
SdbReleaseDatabase
SdbGetStringTagPtr
SdbFindNextTag

msvcrt

memcmp
_local_unwind4
_CxxThrowException
memcpy
__CxxFrameHandler3
_wcsicmp
_vsnwprintf
_XcptFilter
memmove
free
malloc
_initterm
?terminate@@YAXXZ
_except_handler4_common
_lock
_unlock
__dllonexit
_onexit
_amsg_exit
??1type_info@@UAE@XZ
_vscprintf
_wcsupr
wcspbrk
wcschr
wcscpy_s
towupper
towlower
iswctype
wcsspn
memset
toupper
_wcsnicmp
strchr
strtoul
wcstol
atoi
_vscwprintf
_vsnprintf
wcsncmp
strtok
atol
wcsstr
_stricmp
strstr
qsort
_wtoi
wprintf
_wcslwr_s
_wcslwr
_wsplitpath_s
iswspace
swscanf_s
_strnicmp
strncmp
wcscat_s
wcstok_s
_tempnam
wcstoul
strrchr
wcsrchr

ntdll

NtRequestWaitReplyPort
RtlInitializeCriticalSection
NtQueryInformationThread
NtQueryVirtualMemory
NtProtectVirtualMemory
NtSetInformationProcess
NtClose
RtlInitAnsiString
RtlAnsiStringToUnicodeString
RtlUnicodeStringToInteger
RtlInitUnicodeString
RtlGUIDFromString
RtlCreateServiceSid
RtlGetNtSystemRoot
RtlDosPathNameToNtPathName_U
NtOpenFile
NtQuerySecurityObject
RtlGetOwnerSecurityDescriptor
RtlEqualSid
NtOpenKey
NtQueryValueKey
NtCreateKey
NtSetValueKey
RtlFormatCurrentUserKeyPath
NtQueryObject
RtlIsDosDeviceName_U
RtlIsNameInExpression
NtQueryVolumeInformationFile
RtlFreeUnicodeString
RtlOemStringToUnicodeString
RtlNtStatusToDosError
RtlImageNtHeader
RtlReAllocateHeap
RtlSubAuthoritySid
RtlIdentifierAuthoritySid
RtlGetDaclSecurityDescriptor
RtlSubAuthorityCountSid
RtlFreeHeap
RtlAllocateHeap
NtConnectPort
RtlLengthRequiredSid
RtlInitializeSid
NtQueryInformationToken
NtOpenThreadToken
NtOpenProcessToken
NtQueryInformationProcess

api-ms-win-service-core-l1-1-1

EnumDependentServicesW

api-ms-win-service-winsvc-l1-1-0

ControlService

api-ms-win-service-management-l1-1-0

CloseServiceHandle
OpenSCManagerW
DeleteService
CreateServiceW
StartServiceW
OpenServiceW

api-ms-win-service-management-l2-1-0

ChangeServiceConfigW
QueryServiceStatusEx

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer

shlwapi

SHStrDupW
ord619
SHDeleteKeyW
SHGetValueW

uxtheme

SetThemeAppProperties
ord67

user32

AllowSetForegroundWindow
MsgWaitForMultipleObjects
PeekMessageW
SetWindowsHookExAW
SetCursor
GetWindowLongA
mouse_event
GetForegroundWindow
ShowWindow
InvalidateRect
SetForegroundWindow
PostMessageW
GetAncestor
GetClassNameW
EmptyClipboard
CharUpperW
DestroyIcon
CreateIconIndirect
GetIconInfo
SetPropW
RemovePropW
PostQuitMessage
RegisterWindowMessageA
EnumDesktopWindows
GetWindowTextA
GetWindowTextLengthA
ScreenToClient
GetWindowInfo
IsWindowVisible
GetWindow
IsChild
WindowFromDC
GetUpdateRgn
ShowCursor
GetActiveWindow
DefWindowProcA
GetShellWindow
SystemParametersInfoA
CloseDesktop
IsCharAlphaA
SetThreadDesktop
OpenInputDesktop
EnumDisplayDevicesW
ReleaseDC
GetDC
CallNextHookEx
GetKeyState
SetWindowsHookExA
DispatchMessageW
TranslateMessage
GetMessageW
SetSystemCursor
DestroyCursor
CopyIcon
LoadCursorW
GetWindowLongW
CallWindowProcA
EnumDisplaySettingsW
SendMessageW
RegisterSuspendResumeNotification
GetParent
SetWindowPos
GetWindowRect
GetDesktopWindow
GetMonitorInfoW
MonitorFromRect
GetSystemMetrics
SetRect
SystemParametersInfoW
GetWindowThreadProcessId
GetGUIThreadInfo
wvsprintfA
ChangeWindowMessageFilterEx
ChangeDisplaySettingsA
EnumDisplaySettingsA
SetDlgItemTextA
IsWindow
GetClientRect
CharNextA
GetPropW

gdi32

CreatePalette
SelectPalette
RealizePalette
DeleteObject
GetCurrentObject
GetPaletteEntries
GetClipBox
SetSystemPaletteUse
GetRgnBox
CreateRectRgn
SetRectRgn
CombineRgn
GetStockObject
CreateDIBSection
GetObjectW
CreateCompatibleDC
CreateRectRgnIndirect
SelectObject
SetViewportOrgEx
DeleteDC
BitBlt
CreateDCW
GetDeviceCaps

winmm

mciSendCommandA

samcli

NetLocalGroupAddMembers
NetLocalGroupAdd

ole32

CoUninitialize
CoInitialize
CoGetObject
CoTaskMemFree
StringFromCLSID
StringFromGUID2
CoCreateInstance

oleaut32

SysFreeString
RegisterTypeLibForUser
SysAllocString

msacm32

acmStreamOpen
acmStreamSize

version

GetFileVersionInfoExW
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

shell32

SHGetFolderPathW
SHGetFolderPathEx
SHCreateDirectoryExW
SHGetSpecialFolderPathA
ShellExecuteExA
SHGetMalloc
ShellExecuteExW
ord165
SHChangeNotify
SHGetSpecialFolderPathW

userenv

GetAllUsersProfileDirectoryW
GetUserProfileDirectoryW
GetUserProfileDirectoryA

dwmapi

DwmIsCompositionEnabled

urlmon

CoInternetSetFeatureEnabled

kernel32

FindNextFileA
GetDriveTypeA
WritePrivateProfileStringW
GetPrivateProfileStringW
CompareStringOrdinal
SetProcessAffinityMask
CompareStringW
CompareStringA
IsDBCSLeadByteEx
lstrlenA
GetLocaleInfoW
IsValidLocale
lstrcmpA
GetVolumeInformationW
DeviceIoControl
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetModuleHandleA
CheckElevationEnabled
ExpandEnvironmentStringsW
GetUserDefaultUILanguage
ResumeThread
WriteProcessMemory
DuplicateHandle
VirtualAllocEx
ReadProcessMemory
OpenProcess
GetWindowsDirectoryW
lstrcmpW
FormatMessageW
QueryPerformanceFrequency
GetSystemTime
ReadFile
Wow64RevertWow64FsRedirection
Wow64DisableWow64FsRedirection
GetSystemWindowsDirectoryW
AddDllDirectory
IsNLSDefinedString
FindNLSStringEx
WideCharToMultiByte
HeapReAlloc
LCMapStringEx
GetLocaleInfoEx
InitializeCriticalSection
OutputDebugStringA
RaiseException
SearchPathA
ProcessIdToSessionId
QueryActCtxSettingsW
GetShortPathNameW
GetLongPathNameW
GetFullPathNameW
GetTempPathW
GetTempFileNameW
SearchPathW
lstrcmpiW
GlobalAlloc
GetModuleFileNameA
ResolveDelayLoadedAPI
DelayLoadFailureHook
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
SetThreadPriorityBoost
LCIDToLocaleName
CompareStringEx
GetTickCount64
GetBinaryTypeW
GetShortPathNameA
Module32First
CreateToolhelp32Snapshot
SetEvent
ResetEvent
WaitForMultipleObjects
CreateEventW
LoadLibraryA
GetSystemDirectoryA
CreateThread
ReleaseActCtx
QueryActCtxW
CreateActCtxW
SetThreadPriority
GetVersionExW
GetCommandLineW
GetDiskFreeSpaceExW
GetDiskFreeSpaceExA
GlobalFree
GetUserDefaultLCID
FreeLibrary
LoadLibraryExW
SetEnvironmentVariableA
FlushFileBuffers
DeleteFileW
FreeResource
GetFileSize
MapViewOfFile
UnmapViewOfFile
SetFileAttributesA
CopyFileA
MoveFileA
GetFileAttributesA
GetEnvironmentVariableA
MultiByteToWideChar
FindResourceW
DeleteCriticalSection
CreateFileW
CloseHandle
OpenMutexW
GetCurrentProcessId
CreateMutexW
Sleep
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetModuleHandleW
GetProcAddress
HeapAlloc
GetProcessHeap
GetCommandLineA
GetEnvironmentVariableW
SetEnvironmentVariableW
CreateProcessA
ExitProcess
EnterCriticalSection
LeaveCriticalSection
HeapSize
HeapValidate
InitializeCriticalSectionAndSpinCount
VirtualAlloc
VirtualFree
SetProcessInformation
IsWow64Process
WaitForSingleObject
GetExitCodeProcess
GetModuleFileNameW
HeapFree
GetCurrentThread
CreateFileMappingA
CreateFileMappingW
GetLastError
LocalFree
GetDriveTypeW
CopyFileW
SetFileAttributesW
GetSystemDirectoryW
LoadLibraryW
MoveFileExW
GetTempPathA
GetTempFileNameA
CreateProcessW
WriteFile
GetFileAttributesW
FindFirstFileW
FindNextFileW
FindClose
GetLogicalDrives
lstrlenW
FindResourceA
SizeofResource
LocalAlloc
LoadResource
LockResource
CreateFileA
DeleteFileA
SetErrorMode
SetLastError
GetCurrentDirectoryW
IsDBCSLeadByte
IsBadWritePtr
IsBadReadPtr
IsBadStringPtrA
IsBadStringPtrW
VirtualQuery
VirtualProtect
GlobalMemoryStatusEx
GetSystemInfo

advapi32

GetLengthSid
RegQueryValueExW
RegCloseKey
RegCreateKeyExW
RegQueryInfoKeyW
RegEnumValueW
RegSetValueExW
RegEnumKeyExW
ConvertStringSidToSidW
LookupAccountSidW
RegOpenKeyExA
RegQueryValueExA
SetNamedSecurityInfoW
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorDacl
GetSecurityDescriptorControl
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
QueryServiceStatus
GetTokenInformation
CheckTokenMembership
RegUnLoadKeyW
RegLoadKeyW
GetNamedSecurityInfoW
RegGetValueW
FreeSid
AllocateAndInitializeSid
EqualSid
GetAclInformation
SetEntriesInAclW
GetExplicitEntriesFromAclW
GetAce
AddAccessAllowedAce
InitializeAcl
RegDeleteKeyExW
RegSetKeySecurity
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetSecurityDescriptorLength
RegGetKeySecurity
LsaClose
LsaAddAccountRights
LsaNtStatusToWinError
LsaOpenPolicy
CreateWellKnownSid
RegSetValueExA
RegDeleteValueW
RegOpenKeyExW

winspool.drv

EnumPrintersA
ClosePrinter
OpenPrinterA
ord201
GetPrinterA

rpcrt4

I_RpcExceptionFilter
RpcStringBindingComposeW
NdrAsyncClientCall
RpcBindingFromStringBindingW
RpcAsyncInitializeHandle
RpcAsyncCompleteCall
RpcBindingSetAuthInfoExW
RpcStringFreeW
RpcAsyncCancelCall
RpcBindingFree

mpr

WNetGetConnectionW

sspicli

GetUserNameExW

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

GetHookAPIs
NotifyShims

Sections

.text
Size: 662KB - Virtual size: 662KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

TEXT
Size: 512B - Virtual size: 237B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cccbf30752f2e66a299e247637f06c32

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

apphelp

msvcrt

ntdll

api-ms-win-service-core-l1-1-1

api-ms-win-service-winsvc-l1-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-service-management-l2-1-0

api-ms-win-eventing-provider-l1-1-0

shlwapi

uxtheme

user32

gdi32

winmm

samcli

ole32

oleaut32

msacm32

version

shell32

userenv

dwmapi

urlmon

kernel32

advapi32

winspool.drv

rpcrt4

mpr

sspicli

api-ms-win-core-apiquery-l1-1-0

Exports

Exports

Sections

.text Size: 662KB - Virtual size: 662KB

TEXT Size: 512B - Virtual size: 237B

.data Size: 13KB - Virtual size: 21KB

.idata Size: 15KB - Virtual size: 14KB

.didat Size: 512B - Virtual size: 24B

.rsrc Size: 1.5MB - Virtual size: 1.5MB

.reloc Size: 60KB - Virtual size: 60KB

.text
Size: 662KB - Virtual size: 662KB

TEXT
Size: 512B - Virtual size: 237B

.data
Size: 13KB - Virtual size: 21KB

.idata
Size: 15KB - Virtual size: 14KB

.didat
Size: 512B - Virtual size: 24B

.rsrc
Size: 1.5MB - Virtual size: 1.5MB

.reloc
Size: 60KB - Virtual size: 60KB