AcSpecfc[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

AcSpecfc.dll
Size

461KB
MD5

775c3b0a043bd1320fa32b48b5675f52
SHA1

57d1e6e74f5004975be274f1a8c504f40e361fa6
SHA256

224f0f89c9127b45e192f0b1afbabf3c6d4a03dfba6c34c9257ea1f9ea153e40
SHA512

dc0903600be15ef7adb851ed47861d7eff89ba3897c2c72e8e27b127e8d4af0180ea87d60c5e97e71695bcc213d6292e359eab28a86c79207ff4520565b79205
SSDEEP

6144:Q41wUGijRJ/zkq0hqjQmBF12qcax6OWeJoPT+WO6UMVLdyKfWVxD:/16ioATFQqDx6OhJoilhjD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AcSpecfc.dll

Files

AcSpecfc.dll
.dll windows:10 windows x86 arch:x86

70e1b4a1de437fc61543d23da3d10e40

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

AcSpecfc.pdb

Imports

apphelp

SE_CALLBACK_AddHook
SE_CALLBACK_Lookup
SE_COM_AddHook
SE_COM_AddServer
SE_COM_HookObject
SE_COM_Lookup
SE_COM_HookInterface
SE_ShimDPF
SE_GetShimId

msvcrt

__CxxFrameHandler3
_wcsicmp
_wcsnicmp
_stricmp
strncmp
_wtol
strstr
_strlwr
_vsnprintf
strrchr
_wtoi
memcpy
memcmp
wcsrchr
strcat_s
_strnicmp
strcpy_s
isalpha
wcsstr
wcstol
wcscat_s
_vsnwprintf
wcsspn
iswctype
towlower
towupper
wcsncmp
_CxxThrowException
memmove
_itow_s
wcschr
wcspbrk
_wcsupr
_wcslwr
_vscwprintf
_vscprintf
_except_handler4_common
_onexit
__dllonexit
_unlock
_lock
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_initterm
malloc
free
_amsg_exit
_XcptFilter
_wsplitpath_s
iswspace
memset

ntdll

RtlFreeHeap
LdrFindEntryForAddress
RtlInitUnicodeString
RtlGUIDFromString
RtlSubAuthorityCountSid
RtlSubAuthoritySid
RtlGetDaclSecurityDescriptor
RtlGetNtSystemRoot
NtProtectVirtualMemory
RtlCreateUnicodeStringFromAsciiz
RtlFreeUnicodeString
NtQueryInformationThread
NtClose
LdrEnumerateLoadedModules
NtQueryInformationFile
NtQueryObject
NtSetValueKey
RtlAllocateHeap
NtCreateKey
NtDeleteKey
NtEnumerateKey
NtQueryValueKey
NtOpenKey
RtlFormatCurrentUserKeyPath

api-ms-win-core-registry-l1-1-0

RegOpenKeyExA
RegDeleteValueA
RegSetValueExA
RegQueryValueExW
RegGetValueW
RegQueryInfoKeyW
RegEnumKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegOpenKeyExW
RegSetValueExW
RegQueryValueExA
RegEnumValueW
RegCreateKeyExA

api-ms-win-security-base-l1-1-0

CreateWellKnownSid
GetSecurityDescriptorDacl
AccessCheck
AllocateAndInitializeSid
CheckTokenMembership
SetTokenInformation
AdjustTokenPrivileges
FreeSid
InitializeSecurityDescriptor
GetTokenInformation

sspicli

GetUserNameExW

comctl32

ImageList_Destroy
ord386
ord332
ord336
ImageList_Create
ord328
ord337
ord385
ImageList_Remove
ImageList_Add
ImageList_ReplaceIcon
ImageList_Replace
ord335
ord334

mscms

GetCountColorProfileElements

shlwapi

StrStrW
StrCmpIW
PathFindFileNameW

user32

GetGUIThreadInfo
GetClassNameA
EndPaint
BeginPaint
ReleaseDC
GetDC
FillRect
GetClientRect
SetForegroundWindow
mouse_event
SendMessageW
UnhookWindowsHookEx
SetWindowsHookExW
CallNextHookEx
DefWindowProcW
ValidateRect
SetWindowLongW
GetWindowThreadProcessId
EnumWindows
DestroyWindow
FindWindowExA
InvalidateRect
GetWindowLongW
GetClassInfoA
GetWindowLongA
GetDesktopWindow
GetParent
SetCursorPos
GetWindowRect
FindWindowW
PeekMessageW
GetClassLongA
DispatchMessageW
CreateWindowExA
GetUpdateRect
SendNotifyMessageW
MsgWaitForMultipleObjects
GetThreadDesktop
GetMonitorInfoW
TranslateMessage
SetCursor
GetUserObjectInformationW
PostQuitMessage
GetProcessWindowStation
GetAncestor
EnableWindow
ShowCursor
SetActiveWindow
AllowSetForegroundWindow
SendMessageTimeoutW
CallWindowProcA
SetWindowLongA
GetSystemMetrics
IsZoomed
EnumDisplaySettingsW
SetPropW
RemovePropW
GetPropW
LoadCursorW
CopyIcon
EnumChildWindows
DefWindowProcA
RegisterWindowMessageW
FindWindowA
GetCursorPos
DispatchMessageA
PostMessageA
ChangeDisplaySettingsA
GetClassNameW
RegisterClassA
GetWindowTextW
GetWindowInfo

kernel32

QueryDosDeviceW
VirtualAlloc
GetOverlappedResultEx
GetVersion
SetEvent
GetModuleHandleA
OpenMutexW
ExpandEnvironmentStringsW
lstrcmpW
GetVersionExW
GetLocalTime
SetLocaleInfoA
lstrcmpA
ReleaseMutex
K32GetModuleBaseNameW
WideCharToMultiByte
GetACP
SetFileAttributesW
CreateEventW
ProcessIdToSessionId
GetSystemWindowsDirectoryW
GetWindowsDirectoryW
K32GetModuleInformation
GetCurrentThread
SwitchToThread
TrySubmitThreadpoolCallback
lstrlenA
CompareStringOrdinal
QueryFullProcessImageNameW
GetSystemWindowsDirectoryA
lstrcmpiW
GlobalFree
GetCurrentDirectoryW
MoveFileExW
DeleteFileA
GetFileAttributesA
SetUnhandledExceptionFilter
CompareStringW
UnmapViewOfFile
OpenFileMappingA
FlushViewOfFile
MapViewOfFile
CreateFileMappingA
GetTempFileNameA
GetTempPathA
CreateFileW
SetLastError
GetWindowsDirectoryA
GetFileAttributesW
GetShortPathNameW
GetLongPathNameW
GetFullPathNameW
GetLocaleInfoW
UnhandledExceptionFilter
TerminateProcess
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
ResetEvent
GetExitCodeProcess
SearchPathW
CreateThread
Sleep
K32EnumProcesses
K32GetProcessImageFileNameW
SetEnvironmentVariableW
GetEnvironmentVariableW
LocalAlloc
lstrlenW
DeleteCriticalSection
InitializeCriticalSection
HeapCreate
HeapReAlloc
GetModuleHandleExW
GetCurrentThreadId
SetThreadContext
GetCurrentProcessId
DeleteFileW
K32GetModuleFileNameExW
OpenProcess
MoveFileW
CompareStringA
ExpandEnvironmentStringsA
LockResource
LoadResource
FindResourceW
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
SetCurrentDirectoryW
GetModuleFileNameW
IsBadReadPtr
MultiByteToWideChar
CreateFileA
HeapFree
GetProcessHeap
HeapAlloc
GetModuleFileNameA
LoadLibraryA
GetSystemDirectoryA
FreeLibrary
ExitProcess
CreateProcessA
GetProcAddress
LoadLibraryW
GetCommandLineA
GetSystemDirectoryW
GetCommandLineW
TlsFree
TlsAlloc
TlsSetValue
GetSystemDefaultUILanguage
TlsGetValue
IsBadStringPtrW
IsBadStringPtrA
GetModuleHandleW
VirtualProtect
GetCurrentProcess
IsWow64Process
LocalFree
CopyFileW
CreateDirectoryW
WaitForSingleObject
CloseHandle
CreateProcessW
FindClose
GetLastError
FindFirstFileW
FindNextFileW

gdi32

CreateDIBSection
SetSystemPaletteUse
RealizePalette
SelectPalette
SetViewportExtEx
GetSystemPaletteEntries
DeleteDC
DeleteObject
BitBlt
SelectObject
SetWindowExtEx
SetMapMode
GdiIsScreenDC
CreatePalette
CreateCompatibleBitmap
GetStockObject
CreateCompatibleDC

advapi32

GetNamedSecurityInfoW
EventWriteTransfer
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetNamedSecurityInfoW
RegEnumKeyW
RegDeleteKeyA
RegisterEventSourceW
ReportEventW
DeregisterEventSource
OpenProcessToken
LookupPrivilegeValueW
StartServiceCtrlDispatcherA
CloseServiceHandle
OpenSCManagerW
StartServiceW
OpenServiceW
StartServiceCtrlDispatcherW
SetEntriesInAclW
LsaOpenPolicy
LsaQueryInformationPolicy
LsaFreeMemory
QueryServiceStatus
RegOpenKeyA

ole32

CoCreateInstance
CoTaskMemFree
StringFromCLSID
CoUninitialize
CoGetObjectContext
CoInitialize
CoTaskMemAlloc

shell32

CommandLineToArgvW
ord155
ord102
SHChangeNotify
SHGetFolderPathA
ShellExecuteExW
SHGetFolderPathW
SHGetSpecialFolderPathW

oleaut32

VariantInit

ws2_32

WSASetLastError

userenv

GetUserProfileDirectoryW
GetAllUsersProfileDirectoryW

api-ms-win-mm-time-l1-1-0

timeGetTime

mpr

WNetGetConnectionW
WNetConnectionDialog

winmm

mciSendCommandA

ddraw

DirectDrawCreate

comdlg32

GetFileTitleA

imm32

ImmGetContext

rpcrt4

NdrAsyncClientCall
RpcBindingFree
RpcAsyncCancelCall
RpcStringFreeW
RpcBindingSetAuthInfoExW
RpcAsyncCompleteCall
RpcAsyncInitializeHandle
RpcBindingFromStringBindingW
RpcStringBindingComposeW
I_RpcExceptionFilter

dwmapi

DwmIsCompositionEnabled

msi

ord145

winspool.drv

ord202
OpenPrinterW
EnumFormsW
ord204

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

CleanupIS
GetHookAPIs
NotifyShims
StiCreateInstanceA

Sections

.text
Size: 405KB - Virtual size: 404KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.aomadmi
Size: 512B - Virtual size: 10B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 976B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

70e1b4a1de437fc61543d23da3d10e40

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

apphelp

msvcrt

ntdll

api-ms-win-core-registry-l1-1-0

api-ms-win-security-base-l1-1-0

sspicli

comctl32

mscms

shlwapi

user32

kernel32

gdi32

advapi32

ole32

shell32

oleaut32

ws2_32

userenv

api-ms-win-mm-time-l1-1-0

mpr

winmm

ddraw

comdlg32

imm32

rpcrt4

dwmapi

msi

winspool.drv

api-ms-win-core-apiquery-l1-1-0

Exports

Exports

Sections

.text Size: 405KB - Virtual size: 404KB

.data Size: 4KB - Virtual size: 12KB

.idata Size: 12KB - Virtual size: 11KB

.aomadmi Size: 512B - Virtual size: 10B

.rsrc Size: 1024B - Virtual size: 976B

.reloc Size: 37KB - Virtual size: 37KB

.text
Size: 405KB - Virtual size: 404KB

.data
Size: 4KB - Virtual size: 12KB

.idata
Size: 12KB - Virtual size: 11KB

.aomadmi
Size: 512B - Virtual size: 10B

.rsrc
Size: 1024B - Virtual size: 976B

.reloc
Size: 37KB - Virtual size: 37KB