c8f353eb83df98cfdd460f154a24d2d3def4850a68865abac7dc75151ec267f4

Sharing

Copy URL Twitter E-mail

General

Target
c8f353eb83df98cfdd460f154a24d2d3def4850a68865abac7dc75151ec267f4
Size 2.1MB
Sample260529-gs4eeady8w
SHA256 c8f353eb83df98cfdd460f154a24d2d3def4850a68865abac7dc75151ec267f4
MD5 78c8f22934ab3da3c14ea6b608f84c31
SHA1 14ff239cdc5057f697904e6dc79ee176e8d4cc9d
SHA512 0ac46e17eb56bfe41e35897151a549c15e1ba865f2117a14023e279aa340901abb3c0e1689e699ff7e86347ea5c2f5924d3593dd09255a18bb603834ef25d6d8
SSDEEP 49152:av9dpCE9Gzmbpp9qu6fgP7LgoBYdrcAO:avdCyN9ZydrcAO
TLSH
T199A59E5FB2B400B9D06BC1788A46961BE7F174151B24ABDF16A0876A1F23FF116FE321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c8f353eb83df98cfdd460f154a24d2d3def4850a68865abac7dc75151ec267f4

File Explorer

c8f353eb83df98cfdd460f154a24d2d3def4850a68865abac7dc75151ec267f4

.dll 2.1MB

c8f353eb83df98cfdd460f154a24d2d3def4850a68865abac7dc75151ec267f4

IMPHASH b0aa93b7a04656ce20dd76ad62f10f91
SHA256 c8f353eb83df98cfdd460f154a24d2d3def4850a68865abac7dc75151ec267f4
MD5 78c8f22934ab3da3c14ea6b608f84c31
SHA1 14ff239cdc5057f697904e6dc79ee176e8d4cc9d
SHA512 0ac46e17eb56bfe41e35897151a549c15e1ba865f2117a14023e279aa340901abb3c0e1689e699ff7e86347ea5c2f5924d3593dd09255a18bb603834ef25d6d8
SSDEEP 49152:av9dpCE9Gzmbpp9qu6fgP7LgoBYdrcAO:avdCyN9ZydrcAO
TLSH
T199A59E5FB2B400B9D06BC1788A46961BE7F174151B24ABDF16A0876A1F23FF116FE321
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1451656

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

e:\build\workspace\Build_Win_HRA-win10_130.2\windowscode\bin\x64\utility.pdb

hraipcinterface

HraIpcSendMsg

ws2_32

inet_pton send inet_ntop WSAStartup WSACleanup __WSAFDIsSet freeaddrinfo socket recv setsockopt htons ioctlsocket connect inet_addr getaddrinfo select WSAGetLastError closesocket

dbghelp

SymInitializeW SymGetLineFromAddrW64 SymFromAddrW SymCleanup MakeSureDirectoryPathExists

version

GetFileVersionInfoSizeExW VerQueryValueW GetFileVersionInfoExW

shlwapi

PathFileExistsA PathAppendA PathAddBackslashA PathAppendW

kernel32

GetNumaHighestNodeNumber ChangeTimerQueueTimer UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead ReleaseSemaphore VirtualProtect VirtualFree VirtualAlloc SetThreadPriority CreateEventW SetEvent GetModuleHandleA FreeLibraryAndExitThread GetThreadTimes SwitchToThread WaitForSingleObject Sleep GetLastError OpenMutexA CreateMutexA ReleaseMutex CloseHandle DeleteFileA InitializeCriticalSection LeaveCriticalSection CopyFileA EnterCriticalSection FindFirstFileW SetEnvironmentVariableW CreateDirectoryW WideCharToMultiByte CopyFileW GetFileAttributesW CreateProcessA ReadFile MultiByteToWideChar RegisterWaitForSingleObject FindClose GetPrivateProfileStringA GetLocalTime Process32FirstW RemoveDirectoryW CreatePipe Process32NextW FindNextFileA FindNextFileW CreateToolhelp32Snapshot DeleteFileW ExpandEnvironmentStringsW GetFileAttributesA GetCurrentDirectoryW GetCurrentThreadId SetUnhandledExceptionFilter GetCurrentProcess GetCurrentThread LoadLibraryW TerminateProcess GetModuleFileNameW CreateFileW GetProcAddress RtlCaptureStackBackTrace DeleteCriticalSection GetCurrentProcessId FormatMessageA SetThreadAffinityMask GetTimeZoneInformation GetFileInformationByHandle PeekNamedPipe WriteConsoleW GetThreadPriority UnregisterWait SetEnvironmentVariableA SignalObjectAndWait lstrlenA GetProcessAffinityMask DeleteTimerQueueTimer FreeEnvironmentStringsW GetEnvironmentStringsW GetModuleFileNameA SetStdHandle ReadConsoleW GetExitCodeProcess MoveFileExW GetOEMCP GetACP IsValidCodePage FindFirstFileA GetConsoleMode GetConsoleCP SetFilePointerEx GetFileType GetSystemTimeAsFileTime GetStringTypeW DuplicateHandle EncodePointer DecodePointer GetFullPathNameW GetFullPathNameA HeapReAlloc CreateFileA GetFileSize CreateMutexW HeapCompact SetFilePointer TryEnterCriticalSection MapViewOfFile UnmapViewOfFile SetEndOfFile FreeLibrary HeapAlloc SystemTimeToFileTime QueryPerformanceCounter HeapFree UnlockFile FlushViewOfFile LockFile WaitForSingleObjectEx OutputDebugStringW GetTickCount UnlockFileEx GetProcessHeap WriteFile FormatMessageW GetVersionExW HeapDestroy HeapCreate HeapValidate FlushFileBuffers GetTempPathW HeapSize LockFileEx GetDiskFreeSpaceW LoadLibraryA CreateFileMappingA CreateFileMappingW GetDiskFreeSpaceA GetSystemInfo GetFileAttributesExW OutputDebugStringA GetVersionExA GetTempPathA LocalFree GetSystemTime AreFileApisANSI FindFirstFileExA SystemTimeToTzSpecificLocalTime FileTimeToSystemTime IsDebuggerPresent IsProcessorFeaturePresent GetCommandLineA RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx InitializeCriticalSectionAndSpinCount TlsGetValue CreateTimerQueueTimer GetCPInfo CreateThread ExitThread LoadLibraryExW RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter SetLastError TlsAlloc TlsSetValue TlsFree GetStartupInfoW GetModuleHandleW CreateSemaphoreW CreateTimerQueue CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ExitProcess GetModuleHandleExW GetStdHandle FileTimeToLocalFileTime FindFirstFileExW GetDriveTypeW

user32

wsprintfW

advapi32

LookupPrivilegeValueW RegQueryInfoKeyW RegEnumValueW RegOpenKeyExA RegQueryValueExA AdjustTokenPrivileges RegQueryValueExW OpenThreadToken OpenProcessToken RegCloseKey RegOpenKeyExW

shell32

SHGetFolderPathA

ole32

CoUninitialize CoSetProxyBlanket CoInitializeEx CoInitializeSecurity CoCreateInstance

oleaut32

SysFreeString VariantClear SysAllocString

iphlpapi

GetAdaptersAddresses

libcrypto-3-x64

DES_set_key_unchecked DES_ecb_encrypt SHA256

??0CCompressedBuffer@@QEAA@_K@Z ??0CConfigSave@@QEAA@AEBV0@@Z ??0CConfigSave@@QEAA@XZ ??0CDIMutex@@QEAA@XZ ??0CDIMutexGuard@@QEAA@AEAVCDIMutex@@@Z ??0CLoger@@AEAA@XZ ??0CLoger@@QEAA@AEBV0@@Z ??0CMiniDumper@@QEAA@XZ ??0CPatternUpdateUtils@@QEAA@XZ ??0CReportInfo@@QEAA@XZ ??0HraAuthorizeInfo@@AEAA@XZ ??0HraCtrlCmd@@AEAA@XZ ??0HraKbDataMgr@@AEAA@XZ ??0SocketTcpClient@@QEAA@XZ ??0StdOutRedirectHelper@@QEAA@XZ ??0UtilsFileProperty@@QEAA@AEBU0@@Z ??0UtilsFileProperty@@QEAA@XZ ??1CCompressedBuffer@@QEAA@XZ ??1CConfigSave@@QEAA@XZ ??1CDIMutex@@QEAA@XZ ??1CDIMutexGuard@@QEAA@XZ ??1CLoger@@EEAA@XZ ??1CMiniDumper@@QEAA@XZ ??1CPatternUpdateUtils@@QEAA@XZ ??1CReportInfo@@QEAA@XZ ??1HraAuthorizeInfo@@QEAA@XZ ??1HraCtrlCmd@@EEAA@XZ ??1HraKbDataMgr@@EEAA@XZ ??1SocketTcpClient@@UEAA@XZ ??1StdOutRedirectHelper@@QEAA@XZ ??1UtilsFileProperty@@QEAA@XZ ??4CCompressedBuffer@@QEAAAEAV0@AEBV0@@Z ??4CConfigSave@@QEAAAEAV0@AEBV0@@Z ??4CDIMutex@@QEAAAEAV0@AEBV0@@Z ??4CDIMutexGuard@@QEAAAEAV0@AEBV0@@Z ??4CLoger@@QEAAAEAV0@AEBV0@@Z ??4CMiniDumper@@QEAAAEAV0@AEBV0@@Z ??4CPatternUpdateUtils@@QEAAAEAV0@AEBV0@@Z ??4CReportInfo@@QEAAAEAV0@AEBV0@@Z ??4StdOutRedirectHelper@@QEAAAEAV0@AEBV0@@Z ??4UtilsFileProperty@@QEAAAEAU0@AEBU0@@Z ??_7CLoger@@6B@ ??_7HraCtrlCmd@@6B@ ??_7HraKbDataMgr@@6B@ ??_7SocketTcpClient@@6B@ ??_FCCompressedBuffer@@QEAAXXZ ?AuthorizeInfoReset@HraAuthorizeInfo@@QEAAXXZ ?AuthorizedStatusChange@HraAuthorizeInfo@@QEAA_NW4HraModuleType@@@Z ?CheckTableStructure@CConfigSave@@QEAAHPEBD@Z ?CleanLogFile@CLoger@@CAXXZ ?CleanUpWAL@CConfigSave@@QEAAHXZ ?ConfigSaveGetIntegerValue@CConfigSave@@QEAAHAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z ?ConfigSaveGetIntegerValue@CConfigSave@@QEAAHPEBD0@Z ?ConfigSaveGetValue@CConfigSave@@QEAA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV23@0@Z ?ConfigSaveGetValue@CConfigSave@@QEAA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEBD0@Z ?ConfigSaveInit@CConfigSave@@QEAAHPEBD@Z ?ConfigSaveSetIntegerValue@CConfigSave@@QEAAHAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0H@Z ?ConfigSaveSetValue@CConfigSave@@QEAAHAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@00@Z ?ConfigSaveSetValue@CConfigSave@@QEAAHPEBD00@Z ?CopyPatternFromDSA@CPatternUpdateUtils@@QEAAHAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z ?DeleteFileExceptPatternZIP@CPatternUpdateUtils@@QEAAHAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?ExecuteCmd@@YA_NPEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEBDZZ ?ExecuteCommand@@YA_NAEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IPEBDZZ ?ExecuteWithRetry@CConfigSave@@AEAAHPEAUsqlite3@@PEBDH@Z ?Expand@CCompressedBuffer@@AEAAXXZ ?FileIsExist@CPatternUpdateUtils@@QEAA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?FileToJson@@YA?AVValue@Json@@PEBD@Z ?Finish@CCompressedBuffer@@QEAAXXZ ?GetActualSize@CCompressedBuffer@@QEBA_KXZ ?GetAuthorizeInfo@HraAuthorizeInfo@@QEAA?AV?$bitset@$0BA@@std@@XZ ?GetCommandDataFromArrayCmd@@YA?AVValue@Json@@AEBV12@@Z ?GetCompressedSize@CCompressedBuffer@@QEBA_KXZ ?GetInstance@HraAuthorizeInfo@@SAPEAV1@XZ ?GetLogLevel@CLoger@@SA?AW4_LOG_LEVEL@@XZ ?GetOriginalSize@CCompressedBuffer@@QEBA_KXZ ?GetPidByRegexName@@YA?AV?$vector@KV?$allocator@K@std@@@std@@PEB_W@Z ?GetRawBuffer@CCompressedBuffer@@QEBAPEADXZ ?GetRegRootKeyString@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PEAUHKEY__@@@Z ?GetRegsterInfo@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?GetReportJsonBody@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@EPEBDIE@Z ?GetReportPatternUpdateResult@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@HHV12@AEBV12@@Z ?GetReportResultInfo@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEBDH0H@Z ?InitDBTable@CConfigSave@@AEAAHPEBD@Z ?Initialize@CLoger@@SA_NPEBD0@Z ?IsAuthorized@HraAuthorizeInfo@@QEAA_NW4HraModuleType@@@Z ?IsDir@CPatternUpdateUtils@@QEAA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?IsDirExist@@YA_NPEB_W@Z ?JsonToString@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBVValue@Json@@@Z ?KbRequest@CReportInfo@@QEAAH_K@Z ?Lock@CDIMutex@@QEAAXXZ ?Log@CLoger@@SAXHPEBD0H0ZZ ?LogW@CLoger@@SAXHPEBD0HPEB_WZZ ?ParseDotStyleSUVersion@@YA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAH111@Z ?PatternLock@CPatternUpdateUtils@@QEAAXXZ ?PatternUnLock@CPatternUpdateUtils@@QEAAXXZ ?Read@CCompressedBuffer@@QEAA_KPEBD_K@Z ?ReadSUBuildNumberFromMetaInfo@@YA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAH@Z ?ReadSUProdVersionFromMetaInfo@@YA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAH@Z ?ReadSUSchemaVersionFromMetaInfo@@YA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAH@Z ?ReadSUVersionFromMetaInfo@@YA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAV12@@Z ?RedirectTo@StdOutRedirectHelper@@QEAA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?RefreshProcessEnvBlock@@YA_NXZ ?RegQueryIntValue@@YAHAEAHQEAUHKEY__@@PEBD2@Z ?RegQueryStrValue@@YAHPEADHQEAUHKEY__@@PEBD2@Z ?Request@CReportInfo@@QEAAHAEBW4MsgType@HraMsgHead@@EPEBDI@Z ?Restore@StdOutRedirectHelper@@QEAA_NXZ ?SetAuthorizeInfo@HraAuthorizeInfo@@QEAAXW4HraModuleType@@_N@Z ?SetCompress@CReportInfo@@QEAAXW4CompressionMode@@@Z ?SetLogLevel@CLoger@@SAXW4_LOG_LEVEL@@@Z ?SetPkgHdr@CReportInfo@@AEAAHPEAEIAEBW4MsgType@HraMsgHead@@@Z ?ShowRspHdr@CReportInfo@@QEAAXXZ ?SqlLock@CConfigSave@@AEAAXXZ ?SqlUnlock@CConfigSave@@AEAAXXZ ?StackBacktrack@CMiniDumper@@AEAAXPEAU_EXCEPTION_POINTERS@@@Z ?StringToJson@@YA?AVValue@Json@@PEBDI@Z ?UnInitialize@CLoger@@SAXXZ ?UnLock@CDIMutex@@QEAAXXZ ?UtilsAiiscToUtf8@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEBD@Z ?UtilsAppendFilePath@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@PEB_W@Z ?UtilsByteToHexStr@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEAEH@Z ?UtilsCheckCreateDir@@YAHAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?UtilsCopyDirFiles@@YA_NPEB_W0@Z ?UtilsCopyFileToDir@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV12@0@Z ?UtilsDecryptDesEcb@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEBE_K@Z ?UtilsEncryptDesEcb@@YAHPEAPEAEAEA_KPEBD_K@Z ?UtilsFileDecryption@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV12@@Z ?UtilsFileEncryption@@YAHPEAPEAEAEA_KPEBD@Z ?UtilsFindNewestPattPack@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV12@@Z ?UtilsGetAllMatchFileInDir@@YAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0AEAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@2@H@Z ?UtilsGetAppVersion@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?UtilsGetAssetPatternVersion@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?UtilsGetAssetPatternVersionPath@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?UtilsGetAssetTypePattenName@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?UtilsGetBaselinePatternVersion@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?UtilsGetBaselinePatternVersionPath@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?UtilsGetBaselineTypePattenName@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?UtilsGetBuffSHA256@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEBE_K@Z ?UtilsGetDolphinPatternVersion@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?UtilsGetDolphinPatternVersionPath@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?UtilsGetDolphinTypePattenName@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?UtilsGetFileFromDir@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV12@0H@Z ?UtilsGetFileProperty@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV12@0@Z ?UtilsGetFileProperty@@YAHAEAUUtilsFileProperty@@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?UtilsGetFilePropertySub@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PEBXPEB_WK@Z ?UtilsGetFileSHA256@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV12@@Z ?UtilsGetHraIpcName@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?UtilsGetIniValue@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV12@00@Z ?UtilsGetKbCveOsScanPatternVerisionPath@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?UtilsGetLocalTime@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?UtilsGetMetaInfoDir@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV12@@Z ?UtilsGetMicroTimestamp@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?UtilsGetMultiOsScanPatternVersionPath@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?UtilsGetNanoTimestamp@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?UtilsGetOSscanPatternVersion@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?UtilsGetOSscanPatternVersionPath@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?UtilsGetOsReleaseName@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?UtilsGetOsScanTypePattenName@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?UtilsGetParam@@YA_NAEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV12@1@Z ?UtilsGetPatternPath@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV12@0@Z ?UtilsGetProIpcName@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?UtilsGetProgramDataDir@@YAHPEAD_K@Z ?UtilsGetRegDataPath@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV12@@Z ?UtilsGetRunTime@@YAHXZ ?UtilsGetSubFileInDir@@YAXV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEAV?$list@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@2@@Z ?UtilsGetTimestamp@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?UtilsGetUUID@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?UtilsGetVulnPocPatternVersion@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?UtilsGetVulnPocPatternVersionPath@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?UtilsGetVulnPocTypePattenName@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?UtilsGetVulnZipPathFromZips@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@2@AEBV12@@Z ?UtilsGetWMIInfo@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@JPEAUIWbemLocator@@PEAUIWbemServices@@AEBV12@22@Z ?UtilsGetWMIInfoOnce@@YAHAEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV12@11@Z ?UtilsGetWorkPath@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?UtilsHexStrToByte@@YAHPEBDIPEAEI@Z ?UtilsInitWMI@@YAHAEAJPEAPEAUIWbemLocator@@PEAPEAUIWbemServices@@@Z ?UtilsIsFileExist@@YA_NPEB_W@Z ?UtilsLTrim@@YAAEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAV12@PEBD@Z ?UtilsMatchRegex@@YA_NPEBD0@Z ?UtilsPasswdFuzz@@YAXAEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?UtilsPathAppend@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV12@PEBD@Z ?UtilsRTrim@@YAAEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAV12@PEBD@Z ?UtilsRemoveDirectory@@YA_NPEB_W@Z ?UtilsRemoveOldPattPack@@YAHAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?UtilsReplaceAll@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@AEBV12@1@Z ?UtilsReplaceString@@YAAEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEAV12@AEBV12@1_N@Z ?UtilsReplaceTrendInfo@@YAAEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEAV12@@Z ?UtilsStoreAssetPatternVersionFromFile@@YAX_N@Z ?UtilsStoreBaselinePatternVersionFromFile@@YAX_N@Z ?UtilsStoreDolphinPatternVersionFromFile@@YAX_N@Z ?UtilsStoreOSscanPatternVersionFromFile@@YAX_N@Z ?UtilsStoreVulnPocPatternVersionFromFile@@YAX_N@Z ?UtilsStringSplit@@YA?AV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@0@Z ?UtilsStringSplit@@YA?AV?$vector@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@std@@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@0@Z ?UtilsStringToUnicode@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@I@Z ?UtilsStringToUnicode@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PEBDI@Z ?UtilsToLower@@YAAEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAV12@@Z ?UtilsToUpper@@YAAEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAV12@@Z ?UtilsTrim@@YAAEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAV12@PEBD@Z ?UtilsUnicodeToString@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@I@Z ?UtilsUnicodeToString@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEB_WI@Z ?UtilsUninitWMI@@YAHAEAJPEAUIWbemLocator@@PEAUIWbemServices@@@Z ?UtilsUnzip@@YAHV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?UtilsUnzipWithTarget@@YAHAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z ?UtilsUtf8ToAiisc@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEBD@Z ?VerifyPackageSha256@CPatternUpdateUtils@@QEAA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?Write@CCompressedBuffer@@QEAA_KPEBD_K@Z ?clear@HraCtrlCmd@@QEAAXXZ ?clear@HraKbDataMgr@@QEAAXXZ ?clear@UtilsFileProperty@@QEAAXXZ ?close@SocketTcpClient@@QEAAHXZ ?connect@SocketTcpClient@@QEAAHPEBDHH@Z ?connectTestPorts@SocketTcpClient@@QEAAHPEBDAEAV?$vector@HV?$allocator@H@std@@@std@@H@Z ?connectTestPortsIPv6@SocketTcpClient@@QEAAHPEBDAEAV?$vector@HV?$allocator@H@std@@@std@@H@Z ?enablePrivilege@CMiniDumper@@AEAAHPEB_WPEAXPEAU_TOKEN_PRIVILEGES@@@Z ?g_AssetDataDB@@3VCConfigSave@@A ?g_ConfigSave@@3VCConfigSave@@A ?getCmd@HraCtrlCmd@@QEAAH_K@Z ?getData@HraKbDataMgr@@QEAA_NAEAUKbData@1@_K@Z ?getErrorMsg@SocketTcpClient@@QEAAPEBDXZ ?getHandle@SocketTcpClient@@QEAA_KXZ ?getIP@SocketTcpClient@@QEAAPEBDXZ ?getImpersonationToken@CMiniDumper@@AEAA_NPEAPEAX@Z ?getInstance@HraCtrlCmd@@SAPEAV1@XZ ?getInstance@HraKbDataMgr@@SAAEAV1@XZ ?getLogDir@CLoger@@CA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?getNewLogFileName@CLoger@@CA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?getPort@SocketTcpClient@@QEAAHXZ ?getStatStr@SocketTcpClient@@QEAAPEBDXZ ?isConnect@SocketTcpClient@@QEAA_NXZ ?kModeRead@CCompressedBuffer@@2HB ?kModeWrite@CCompressedBuffer@@2HB ?m_authInst@HraAuthorizeInfo@@0V?$unique_ptr@VHraAuthorizeInfo@@U?$default_delete@VHraAuthorizeInfo@@@std@@@std@@A ?m_logPath@CLoger@@0V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@A ?m_onceFlag@HraAuthorizeInfo@@0Uonce_flag@std@@A ?m_pInstance@HraCtrlCmd@@0PEAV1@EA ?m_strLogFileHead@CLoger@@0V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@A ?popCmd@HraCtrlCmd@@QEAAH_K@Z ?popData@HraKbDataMgr@@QEAA_NAEAUKbData@1@_K@Z ?pushCmd@HraCtrlCmd@@QEAA_N_KH@Z ?pushData@HraKbDataMgr@@QEAA_NAEBUKbData@1@@Z ?ready@CLoger@@SA_NXZ ?receive@SocketTcpClient@@QEAAHPEAXHH@Z ?receiveOnce@SocketTcpClient@@QEAAHPEAXHH@Z ?restorePrivilege@CMiniDumper@@AEAAHPEAXPEAU_TOKEN_PRIVILEGES@@@Z ?s_pCriticalSection@CMiniDumper@@0PEAU_RTL_CRITICAL_SECTION@@EA ?s_pMiniDumper@CMiniDumper@@0PEAV1@EA ?send@SocketTcpClient@@QEAAHPEBXHH@Z ?setMiniDumpFileName@CMiniDumper@@AEAAXXZ ?unhandledExceptionHandler@CMiniDumper@@CAJPEAU_EXCEPTION_POINTERS@@@Z ?writeMiniDump@CMiniDumper@@AEAAJPEAU_EXCEPTION_POINTERS@@@Z EngineLogFunEntry

Name

.text

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

355KB

Virtual Size

356KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

59KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

86KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

c8f353eb83df98cfdd460f154a24d2d3def4850a68865abac7dc75151ec267f4

hraipcinterface

ws2_32

dbghelp

version

shlwapi

kernel32

user32

advapi32

shell32

ole32

oleaut32

iphlpapi

libcrypto-3-x64

generic