AcLayers[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

AcLayers.dll
Size

325KB
MD5

3a515be88a59d8e0abaa0c299a5019b1
SHA1

0af8f3d0d3a34032b285433728ab4017e5c4a2c6
SHA256

5620f93cbde964ed16b7f3fadc74751e1867447a625da8593424ee3c2e0e7b8e
SHA512

71fdf1ee7e4e3f3d498e19ebce5ff2c9e0ed6891bf39295821e376cf928b4abfaf292e8fe6299fecd5f04716186a5a7d29218096f6e2b3964c2b1aa4dd08ff82
SSDEEP

6144:9BHWoCb3lqocQ5VcmFv6IjG6PQOymwXxzoi35K5w1FwvF:9BHWoI3lNcQ5VccVGK5+wN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AcLayers.dll

Files

AcLayers.dll
.dll windows:10 windows x64 arch:x64

c4de04f54385594ec210f75cb67e2063

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

AcLayers.pdb

Imports

apphelp

SE_GetShimId
SE_ShimDPF

msvcrt

memmove
memcpy
_CxxThrowException
memset
__CxxFrameHandler3
_wcsicmp
_vscwprintf
_vsnwprintf
_vsnprintf
_stricmp
__C_specific_handler
sprintf_s
vsprintf_s
atol
_scwprintf
_wcsnicmp
wcsrchr
wcsncmp
wcsspn
iswctype
towlower
wcschr
wcspbrk
wcsstr
_vscprintf
iswspace
_XcptFilter
_amsg_exit
free
malloc
_initterm
??1type_info@@UEAA@XZ
strcmp

ntdll

RtlAllocateHeap
RtlFreeHeap
NtQueryKey
RtlNtStatusToDosError
RtlReportException
NtTerminateProcess
RtlRaiseException
NtQueryInformationProcess
RtlUniform
RtlValidateHeap
RtlCaptureStackBackTrace
RtlImageNtHeader
RtlCaptureContext
WinSqmAddToStream
RtlInitUnicodeString
NtOpenFile
NtQuerySystemInformation
RtlLengthRequiredSid
RtlInitializeSid
NtQueryInformationToken
RtlSubAuthoritySid
RtlCreateUnicodeStringFromAsciiz
RtlFreeUnicodeString
RtlMultiByteToUnicodeN
RtlUnicodeToMultiByteSize
RtlUnicodeToMultiByteN
RtlGetOwnerSecurityDescriptor
RtlEqualSid
NtQueryObject
RtlAppendUnicodeToString
RtlFormatCurrentUserKeyPath
RtlGetLastNtStatus
RtlSetLastWin32ErrorAndNtStatusFromNtStatus
RtlVirtualUnwind
RtlLookupFunctionEntry

api-ms-win-core-registry-l1-1-0

RegDeleteKeyExW
RegQueryValueExW
RegCloseKey
RegEnumKeyExW
RegOpenKeyExA
RegSetValueExW
RegGetKeySecurity
RegOpenKeyExW

api-ms-win-security-base-l1-1-0

GetAclInformation
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
GetAce
CopySid
GetSecurityDescriptorDacl
GetFileSecurityW
GetTokenInformation

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer

user32

GetSystemMetrics
EnumDisplaySettingsW
CharUpperW

shell32

ShellExecuteExW

shlwapi

PathFindFileNameW

kernel32

CompareStringEx
LCIDToLocaleName
DeleteCriticalSection
GetProcAddress
GetModuleHandleW
GetTickCount
GetSystemTimeAsFileTime
QueryPerformanceCounter
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
SearchPathW
CreateMutexW
OpenMutexW
ReleaseActCtx
QueryActCtxW
CreateActCtxW
GetTempFileNameW
GetTempPathW
GetTempFileNameA
GetTempPathA
InitializeCriticalSectionAndSpinCount
ExpandEnvironmentStringsA
LeaveCriticalSection
EnterCriticalSection
GetFileSize
SetFilePointer
CreateFileW
LocalFree
LocalAlloc
GetVolumeNameForVolumeMountPointW
GetSystemDirectoryW
GetModuleFileNameW
GetWindowsDirectoryW
GetShortPathNameW
ExpandEnvironmentStringsW
FindClose
FindFirstFileW
GetDriveTypeW
GetLogicalDriveStringsW
GetFileAttributesW
RegisterApplicationRestart
GetApplicationRestartSettings
WerRegisterMemoryBlock
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
CloseHandle
SetNamedPipeHandleState
GetCurrentProcessId
SetLastError
CreateEventW
InitializeCriticalSection
OutputDebugStringA
WriteFile
CancelIo
WaitForSingleObject
ReadFile
InitializeSRWLock
GetCurrentThread
GetCurrentProcess
QueryFullProcessImageNameW
LoadLibraryW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockShared
GetCurrentThreadId
AcquireSRWLockShared
IsNLSDefinedString
FindNLSStringEx
WideCharToMultiByte
HeapReAlloc
GetLastError
LCMapStringEx
HeapFree
MultiByteToWideChar
GetProcessHeap
HeapAlloc
GetLocaleInfoEx
GetCommandLineW

advapi32

OpenProcessToken
GetSecurityInfo
GetFileSecurityA
OpenThreadToken

sfc

SfcIsKeyProtected

winspool.drv

ord203

Exports

Exports

GetHookAPIs
NotifyShims

Sections

.text
Size: 171KB - Virtual size: 170KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 117KB - Virtual size: 117KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 4.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c4de04f54385594ec210f75cb67e2063

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

apphelp

msvcrt

ntdll

api-ms-win-core-registry-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-eventing-provider-l1-1-0

user32

shell32

shlwapi

kernel32

advapi32

sfc

winspool.drv

Exports

Exports

Sections

.text Size: 171KB - Virtual size: 170KB

.rdata Size: 117KB - Virtual size: 117KB

.data Size: 24KB - Virtual size: 4.3MB

.pdata Size: 7KB - Virtual size: 7KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 171KB - Virtual size: 170KB

.rdata
Size: 117KB - Virtual size: 117KB

.data
Size: 24KB - Virtual size: 4.3MB

.pdata
Size: 7KB - Virtual size: 7KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 2KB