4226fe3241b52a2196db01d620f20c98cf49a68e1fad3e003cc77f6be92faedd

Sharing

Copy URL Twitter E-mail

General

Target

4226fe3241b52a2196db01d620f20c98cf49a68e1fad3e003cc77f6be92faedd
Size

712KB
MD5

64d708f9c842a024dc94aa5133a31c50
SHA1

4d72b852186b0981ef94912f0c8430e554cbfd58
SHA256

4226fe3241b52a2196db01d620f20c98cf49a68e1fad3e003cc77f6be92faedd
SHA512

9e25c7a27efc22056376e6ddc456e24b0d84e78f046d3767c862ad013c84b9c0c6bbdd9d06a73874fc454b9d8f4a832ba93a5a196eac1569110929844841a663
SSDEEP

6144:AHUB1NM9Go6vNzLnAcfOYLoK4xy6L6VC6bdut3PVwoex5:AHQ5o6FAcwy6L6c88+oe3

Score

N/A

Malware Config

Signatures

Files

4226fe3241b52a2196db01d620f20c98cf49a68e1fad3e003cc77f6be92faedd
.dll regsvr32 windows x86

002e69a21438edd94d7d589d84a29770

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

common

??1EcopyWinApp@@UAE@XZ
??1CSDelete@@UAE@XZ
?SecurelyDeleteFile@CSDelete@@QAEHV?$CStringT@GV?$StrTraitMFC@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@HHKH@Z
??0CSDelete@@QAE@XZ
??1StdProfile@@UAE@XZ
??0StdProfile@@QAE@PAVCWinApp@@ABV?$CStringT@GV?$StrTraitMFC@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@@Z
?GetFileVersionStr@CVerInfo@@QAEAAV?$CStringT@GV?$StrTraitMFC@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@XZ
??0CVerInfo@@QAE@AAV?$CStringT@GV?$StrTraitMFC@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@@Z
?WriteProfileStringW@EcopyWinApp@@QAEHPBG00@Z
??1RegManager@@QAE@XZ
?ShowLastSystemError@@YAXH@Z
??0EcopyWinApp@@QAE@XZ
?WriteString@RegManager@@QBE_NPBGABV?$CStringT@GV?$StrTraitMFC@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@@Z
?EncryptString@Encrypt@@QAE?AV?$CStringT@GV?$StrTraitMFC@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@ABV23@PAUHWND__@@@Z
??0Encrypt@@QAE@XZ
?Open@RegManager@@QAE_NPAUHKEY__@@PBGW4Mode@1@_N@Z
??0RegManager@@QAE@XZ
??1Decrypt@@UAE@XZ
?GetDecryptedString@Decrypt@@QAE?AV?$CStringT@GV?$StrTraitMFC@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@XZ
??0Decrypt@@QAE@ABV?$CStringT@GV?$StrTraitMFC@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@@Z
?ReadString@RegManager@@QBE_NPBGAAV?$CStringT@GV?$StrTraitMFC@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@@Z
?GetTraceLevels@CTracerST@@QAEXAAH@Z
?GetThisMessageMap@EcopyWinApp@@KGPBUAFX_MSGMAP@@XZ
??0CeCopyDlg@@QAE@IPAVCWnd@@@Z
?OnSizeDlg@CeCopyDlg@@IAEXIHH@Z
?WriteProfileInt@EcopyWinApp@@QAEHPBG0H@Z
?IsValidPhoneNumber@@YAHV?$CStringT@GV?$StrTraitMFC@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@H@Z
?Initialize@IFaxDispatch@@QAEJPBG@Z
?SetDataLong@IFaxDispatch@@QAEJPBGFJ@Z
?SetDataString@IFaxDispatch@@QAEJPBGF0@Z
?GetData@IFaxDispatch@@QAEJFPAVCOleVariant@@@Z
?SetCoordinates@CeCopyDlg@@QAEXHHHHJ@Z
?GetMessageMap@CeCopyDlg@@MBEPBUAFX_MSGMAP@@XZ
??0RegServer@@QAE@XZ
?CreateDispatch@RegServer@@QAEJPAVCOleDispatchDriver@@PBGPAVCWinApp@@@Z
?Initialize@IKeyboardDispatch@@QAEJPBG@Z
??1RegServer@@UAE@XZ
?SetDataString@IKeyboardDispatch@@QAEJFPBG@Z
?CreateKeyboardDialog@IKeyboardDispatch@@QAEJPBG00000JFFFFJJ@Z
?GetData@IKeyboardDispatch@@QAEJFPAVCOleVariant@@@Z
?GetByLineText@@YAHPAVCWinApp@@AAV?$CStringT@GV?$StrTraitMFC@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@1@Z
??0FileResource@@QAE@XZ
?GetFileSize@FileResource@@QAEJABV?$CStringT@GV?$StrTraitMFC@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@@Z
??1FileResource@@UAE@XZ
?GetTheTracer@@YAPAVCTracerST@@XZ
?ReadMultiByteLine@FileResource@@SAJAAVCFile@@AAV?$CStringT@GV?$StrTraitMFC@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@@Z
?TraceMes@CTracerST@@AAEKHABV?$CStringT@GV?$StrTraitMFC@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@@Z
??0CDrawImage@@QAE@XZ
??1CDrawImage@@QAE@XZ
?SendToLogUserActivity@@YAJJPBGZZ
?SetDataLong@IKeyboardDispatch@@QAEJFJ@Z
?CalcMultiplier@CDrawImage@@QAEXHHHH@Z
?CalcNewSize@CDrawImage@@QAEXPAUtagRECT@@@Z
??1CTracerST@@UAE@XZ
?SetTraceModule@CTracerST@@AAEKPBG@Z
?SetTraceFunction@CTracerST@@AAEKPBG@Z
?GetProfileStringW@EcopyWinApp@@QAE?AV?$CStringT@GV?$StrTraitMFC@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@PBG00@Z
?GetProfileBool@EcopyWinApp@@QAE_NPBG0_N@Z
??1Encrypt@@UAE@XZ
?GetProfileIntW@EcopyWinApp@@QAEIPBG0H@Z

lcppn201

?GetUserNameText@LNNotesSession@@AAE?AVLNString@@XZ
?SetRecipients@LNMailMessage@@ABEKW4LNRECIPIENTTYPE@@ABVLNString@@@Z
??0LNDocument@@QAE@ABV0@@Z
??1LNDocument@@QAE@XZ
??0LNDocument@@QAE@XZ
?Open@LNDocument@@UAEKK@Z
?ValidateNoteType@LNDocument@@MBEXK@Z
?ValidateNoteType@LNDocument@@MBEXPBVLNNoteBody@@@Z
?ValidateNoteType@LNDocument@@MBEXABVLNNote@@@Z
??1LNItem@@QAE@XZ
?SetValue@LNText@@QAEKABVLNString@@@Z
??GLNDatetime@@QBEJABV0@@Z
?GetLastModified@LNNote@@QBE?AVLNDatetime@@XZ
?GetDocument@LNDatabase@@QAEKPBUUNIVERSALNOTEID_tag@@PAVLNDocument@@@Z
?GetDatabase@LNNotesSession@@QAEKABVLNString@@PAVLNDatabase@@0@Z
??1LNRichText@@QAE@XZ
??1LNRTCursor@@QAE@XZ
?CreateAttachment@LNRichText@@QBEKABVLNString@@PAVLNRTCursor@@PAVLNRTAttachment@@@Z
?GetEndCursor@LNRichText@@QBEKPAVLNRTCursor@@@Z
?CreateItem@LNNote@@QBEKABVLNString@@PAVLNItem@@GW4LNITEMOPTION@@@Z
??0LNRTAttachment@@QAE@XZ
??0LNRTCursor@@QAE@XZ
??0LNRichText@@QAE@XZ
?GetServer@LNDatabase@@QBE?AVLNString@@XZ
?GetFilepath@LNDatabase@@QBE?AVLNString@@XZ
?GetViewFolder@LNDatabase@@QAEKABVLNString@@PAVLNViewFolder@@@Z
?GetLocationDocument@LNNotesSession@@QAEKPAVLNDocument@@@Z
?GetTitle@LNDatabase@@QAE?AVLNString@@XZ
??ALNDatabaseArray@@QAE?AVLNDatabase@@K@Z
?GetCount@LNDatabaseArray@@QBEKXZ
?GetAddressBooks@LNNotesSession@@QAEKPAVLNDatabaseArray@@ABVLNString@@@Z
??ALNViewFolder@@QBE?AVLNVFEntry@@K@Z
?Send@LNDocument@@QBEKH@Z
?Append@LNRichText@@QAEKABVLNString@@H@Z
?SetValue@LNRichText@@QAEKABVLNString@@H@Z
?SetSubject@LNMailMessage@@QBEKABVLNString@@@Z
?CreateMailMessage@LNNotesSession@@QAEKPAVLNMailMessage@@@Z
?GetUniversalID@LNNote@@QBEPAUUNIVERSALNOTEID_tag@@XZ
?GetNoteID@LNNote@@QBEKXZ
?Initialize@LNNotesSession@@AAEKKHQAPADPBD@Z
?CreateDocument@LNDatabase@@QAEKPAVLNDocument@@ABVLNString@@@Z
?GetEntry@LNViewFolder@@QBEKPAVLNVFEntry@@@Z
?Close@LNDatabase@@QAEKXZ
??1LNRTEmbeddedObject@@IAE@XZ
??1LNNotesSession@@UAE@XZ
??0LNNotesSession@@QAE@XZ
?Term@LNNotesSession@@QAEKH@Z
?GetText@LNText@@QBEKPAVLNString@@ABV2@@Z
??4LNText@@QAEAAV0@ABVLNItem@@@Z
??4LNItem@@QAEAAV0@ABV0@@Z
?GetColumnItem@LNVFEntry@@QBE?AVLNItem@@KH@Z
?GetPosition@LNVFEntry@@QBEKPAVLNVFPosition@@@Z
?Find@LNViewFolder@@QBEKABVLNString@@PAVLNVFEntry@@PAKPAVLNVFNavigator@@@Z
?Append@LNString@@QAEKABV1@@Z
?AbbreviateName@LNNotesSession@@QBEKABVLNString@@PAV2@@Z
??1LNTextElement@@UAE@XZ
??BLNTextElement@@QBE?AVLNString@@XZ
?SetFlag@LNVFFindOptions@@AAEXGH@Z
??0LNNotesClass@@IAE@XZ
??4LNSmartPtr@@QAEAAV0@ABV0@@Z
??0LNSmartPtr@@QAE@ABV0@@Z
?Goto@LNViewFolder@@ABEKW4LNNAVIGATION@@PAVLNVFEntry@@@Z
??1LNNote@@QAE@XZ
??0LNNote@@QAE@XZ
?Close@LNNote@@UAEKXZ
?Open@LNViewFolder@@UAEKK@Z
?CreateNoteBody@LNNote@@MAEKKKH@Z
?ValidateNoteType@LNViewFolder@@EBEXK@Z
?ValidateNoteType@LNViewFolder@@EBEXPBVLNNoteBody@@@Z
??ALNText@@QBE?AVLNTextElement@@K@Z
?GetItem@LNNote@@QBEKABVLNString@@PAVLNItem@@@Z
?GetDocument@LNVFEntry@@QBEKPAVLNDocument@@@Z
?SetPosition@LNViewFolder@@QBEKABVLNVFPosition@@@Z
?Find@LNViewFolder@@QBEKABVLNString@@ABVLNVFFindOptions@@PAVLNVFEntry@@PAKPAVLNVFNavigator@@@Z
?GetPosition@LNViewFolder@@QBEKPAVLNVFPosition@@@Z
?GetEntryCount@LNViewFolder@@QBEKXZ
?GetDocument@LNDatabase@@QAEKKPAVLNDocument@@@Z
?Open@LNDatabase@@QAEKXZ
?GetMailDatabase@LNNotesSession@@QAEKPAVLNDatabase@@@Z
?DeleteDocument@LNDatabase@@QAEKPAVLNDocument@@@Z
?ValidateNoteType@LNViewFolder@@EBEXABVLNNote@@@Z
?Compare@LNDatetime@@ABEHABV1@@Z
?LNStringCompare@@YAJABVLNString@@0K@Z
?GetPlatformTextPtr@LNString@@ABEPBDXZ
?Setup@LNString@@AAEXPBD@Z
?LNGetErrorMessageText@@YAKKPADKH@Z
??4LNVFPosition@@QAEAAV0@ABV0@@Z
??0LNVFPosition@@QAE@XZ
??1LNVFPosition@@UAE@XZ
?GetDocNumber@LNVFPosition@@QBE?AVLNString@@ABV2@@Z
?Setup@LNString@@AAEXPBDK@Z
?IsNull@LNString@@UBEHXZ
?DeleteBody@LNSmartPtr@@UAEHXZ
??4LNString@@QAEAAV0@ABV0@@Z
??0LNString@@QAE@ABV0@@Z
??4LNDatetime@@QAEAAV0@ABV0@@Z
??0LNDatetime@@QAE@ABV0@@Z
??0LNDatetime@@QAE@XZ
??0LNString@@QAE@XZ
??1LNString@@QAE@XZ
?LNDelete@@YAXPAX@Z
?LNGetClassName@@YAPBDW4LNCLASSID@@H@Z
??1LNNotesClass@@UAE@XZ
?IsOnHeap@LNNotesClass@@UBEHXZ
?Save@LNNote@@QAEKG@Z
?Parse@LNString@@QBEKABV1@PAVLNText@@G@Z
?CreateItem@LNNote@@QBEKABVLNString@@ABVLNItem@@GW4LNITEMOPTION@@PAV3@@Z

cpyaddrbook

?SetFirstName@CPYAddrBookEntry@@QAE_NPBG@Z
?SetLastName@CPYAddrBookEntry@@QAE_NPBG@Z
?Delete@CPYAddrBook@@QAE?AW4CpyAddrStatus@@PAVCPYAddrBookEntry@@@Z
??0CPYAddrBookEntry@@QAE@XZ
?IsConnected@CPYAddrBook@@QAE_NXZ
?GetLastName@CPYAddrBookEntry@@QAEPADXZ
?GetFirstName@CPYAddrBookEntry@@QAEPADXZ
?GetEmailAddr@CPYAddrBookEntry@@QAEPADXZ
?GetEntry@CPYAddrBook@@QAE?AW4CpyAddrStatus@@PAVCPYAddrBookEntry@@@Z
?Search@CPYAddrBook@@QAE?AW4CpyAddrStatus@@PBGPAG@Z
?Search@CPYAddrBook@@QAE?AW4CpyAddrStatus@@PBGPAGPAVCPYAddrBookEntry@@@Z
?Add@CPYAddrBook@@QAE?AW4CpyAddrStatus@@PAVCPYAddrBookEntry@@@Z
?Create@CPYAddrBook@@QAE?AW4CpyAddrStatus@@PBG@Z
?Import@CPYAddrBook@@QAE?AW4CpyAddrStatus@@PBG_N@Z
?Export@CPYAddrBook@@QAE?AW4CpyAddrStatus@@PBG@Z
?GetNumEntries@CPYAddrBook@@QAEHXZ
?SetEmailAddr@CPYAddrBookEntry@@QAE_NPBG@Z
??1CPYAddrBookEntry@@UAE@XZ
?Connect@CPYAddrBook@@QAE?AW4CpyAddrStatus@@PBG@Z
?Clear@CPYAddrBook@@QAE?AW4CpyAddrStatus@@XZ
?Disconnect@CPYAddrBook@@QAE?AW4CpyAddrStatus@@XZ
??1CPYAddrBook@@QAE@XZ
??0CPYAddrBook@@QAE@XZ

kernel32

GetCurrentProcessId
GetVersion
VirtualQuery
FlushInstructionCache
LoadLibraryA
GetSystemDirectoryA
GetWindowsDirectoryA
GetModuleFileNameA
GetModuleHandleA
CompareStringA
SetLastError
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
FindClose
ReadFile
CloseHandle
GetLocalTime
FreeLibrary
GetLastError
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
LoadResource
LockResource
SizeofResource
GetVersionExA
GetSystemTimeAsFileTime
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
ExitProcess
LocalAlloc
LocalFree

advapi32

RegCloseKey

user32

SetTimer
GetDlgItem
KillTimer
ShowScrollBar
ReleaseDC
GetDC
DrawFocusRect
keybd_event
SetRectEmpty
MessageBeep
GetSystemMetrics
IsChild
IsWindowVisible
InvalidateRect
UpdateWindow
IsWindow
CopyRect
ShowWindow
GetParent
GetFocus
GetWindowRect
DestroyWindow
CallNextHookEx
UnhookWindowsHookEx
BringWindowToTop
SetWindowPlacement
GetWindowPlacement
SetWindowPos

gdi32

PatBlt
BitBlt
CreateCompatibleDC
GetStockObject

mfc70u

ord2218
ord2220
ord2210
ord4998
ord5000
ord1388
ord602
ord370
ord856
ord2819
ord782
ord326
ord3068
ord5246
ord5224
ord978
ord314
ord557
ord4036
ord4254
ord2216
ord2839
ord3994
ord1763
ord4029
ord5171
ord5681
ord5784
ord2512
ord891
ord859
ord2212
ord2235
ord2223
ord1499
ord1498
ord1442
ord4624
ord3676
ord1394
ord523
ord1053
ord979
ord1090
ord1061
ord1059
ord1082
ord1006
ord317
ord5808
ord3557
ord3674
ord1009
ord4511
ord5617
ord3670
ord1735
ord1434
ord1617
ord2703
ord3881
ord5410
ord4879
ord2609
ord5409
ord367
ord2887
ord331
ord4098
ord1859
ord896
ord4874
ord3202
ord951
ord716
ord1892
ord2546
ord5248
ord2572
ord985
ord1089
ord1242
ord5341
ord4928
ord1857
ord5945
ord2429
ord2422
ord4338
ord4477
ord3246
ord3440
ord724
ord1817
ord996
ord1994
ord5734
ord4831
ord3146
ord504
ord5733
ord687
ord293
ord5776
ord2187
ord5386
ord1142
ord2960
ord4660
ord5930
ord1087
ord926
ord262
ord706
ord2686
ord3436
ord1072
ord1068
ord705
ord703
ord972
ord261
ord4125
ord2192
ord1746
ord1927
ord5662
ord1463
ord1460
ord3739
ord1264
ord4004
ord4926
ord1751
ord4845
ord5982
ord3957
ord4979
ord3199
ord4494
ord4054
ord1443
ord5707
ord809
ord814
ord818
ord816
ord820
ord2230
ord2214
ord2233
ord2228
ord2205
ord2207
ord2225
ord2017
ord2011
ord1368
ord5984
ord3601
ord5986
ord3143
ord4739
ord1225
ord4947
ord1805
ord4965
ord2347
ord2537
ord2639
ord4079
ord2520
ord2666
ord2350
ord2454
ord2343
ord2790
ord3513
ord3514
ord3504
ord2452
ord3742
ord4258
ord4033
ord2963
ord518
ord528
ord1939
ord1493
ord1437
ord4015
ord2782
ord3122
ord689
ord952
ord977
ord1637
ord2007
ord5831
ord5806
ord5989
ord2465
ord2003
ord4951
ord3984
ord4507
ord4662
ord1861
ord1514
ord1513
ord5659
ord1263
ord4016
ord4968
ord4034
ord2981
ord546
ord300
ord5584
ord5362
ord4352
ord257
ord1171
ord2015
ord5279
ord1933
ord1484
ord1414
ord4010
ord2757
ord3028
ord599
ord1008
ord1936
ord4012
ord3115
ord682
ord1397
ord2994
ord561
ord1636
ord3009
ord1775
ord2188
ord3003
ord1143
ord1772
ord1335
ord3875
ord1930
ord1390
ord4006
ord2970
ord532
ord256
ord710
ord664
ord5169
ord1084
ord3898
ord889
ord5216
ord3094
ord477
ord408
ord407
ord406
ord5943
ord5052
ord1758
ord2013
ord5412
ord3782
ord571
ord1862
ord2855
ord3237
ord1260
ord5973
ord1774
ord1336
ord3876
ord1932
ord1413
ord4009
ord3027
ord598
ord1258
ord1723
ord3554
ord3823
ord3805
ord5983
ord3600
ord5985
ord1904
ord5332
ord3605
ord5926
ord5145
ord3631
ord1761
ord2732
ord4989
ord4991
ord3741
ord4340
ord4995
ord4978
ord5315
ord2642
ord4253
ord3131
ord3629
ord2087
ord936
ord3479
ord5853
ord4092

msvcr70

realloc
_CxxThrowException
_wcsicmp
memmove
wcslen
__CxxFrameHandler
vswprintf
memset
_purecall
wcscat
wcscpy
wcscmp
wcsstr
wcschr
_wcsupr
wcstok
_vsnwprintf
iswspace
__security_error_handler
_adjust_fdiv
_initterm
_onexit
__dllonexit
?terminate@@YAXXZ
??1type_info@@UAE@XZ
swprintf
swscanf
wcsftime
_time64
_localtime64
malloc
free
_wcslwr
_except_handler3
_vscwprintf

ole32

CLSIDFromProgID
OleRun
CoCreateInstance
CLSIDFromString

oleaut32

SystemTimeToVariantTime
VariantClear
VarBstrFromDate
LoadRegTypeLi
LoadTypeLi
SysStringLen
SysAllocStringLen
SysAllocString
GetErrorInfo
VariantChangeType
VariantInit
SetErrorInfo
CreateErrorInfo
SysFreeString

atl70

ord22
ord64
ord32
ord49
ord23
ord61
ord15
ord58
ord31
ord25
ord18

msvcp70

?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ

Exports

Exports

??0CPYAddrBook@@QAE@ABV0@@Z
??0CPYAddrBookEntry@@QAE@ABV0@@Z
??0CSDelete@@QAE@ABV0@@Z
??0CTableCombo@@QAE@XZ
??0CTableEdit@@QAE@XZ
??0CTableList@@QAE@XZ
??0CTracerST@@QAE@ABV0@@Z
??0CVimConnection@@QAE@XZ
??0IFaxDispatch@@QAE@ABV0@@Z
??0IFaxDispatch@@QAE@PAUIDispatch@@@Z
??0IFaxDispatch@@QAE@XZ
??0IKeyboardDispatch@@QAE@ABV0@@Z
??0IKeyboardDispatch@@QAE@PAUIDispatch@@@Z
??0IKeyboardDispatch@@QAE@XZ
??0VIMDocument@@QAE@XZ
??0_LNDraftMessageInfo@@QAE@ABV0@@Z
??0_LNDraftMessageInfo@@QAE@XZ
??1CTableCombo@@UAE@XZ
??1CTableEdit@@UAE@XZ
??1CTableList@@UAE@XZ
??1CVimConnection@@QAE@XZ
??1CeCopyDlg@@UAE@XZ
??1IFaxDispatch@@QAE@XZ
??1IKeyboardDispatch@@QAE@XZ
??1VIMDocument@@UAE@XZ
??1_LNDraftMessageInfo@@QAE@XZ
??4CDrawImage@@QAEAAV0@ABV0@@Z
??4CPYAddrBook@@QAEAAV0@ABV0@@Z
??4CPYAddrBookEntry@@QAEAAV0@ABV0@@Z
??4CSDelete@@QAEAAV0@ABV0@@Z
??4CTracerST@@QAEAAV0@ABV0@@Z
??4IFaxDispatch@@QAEAAV0@ABV0@@Z
??4IKeyboardDispatch@@QAEAAV0@ABV0@@Z
??4RegManager@@QAEAAV0@ABV0@@Z
??4_LNDraftMessageInfo@@QAEAAV0@ABV0@@Z
??_7CPYAddrBookEntry@@6B@
??_7CSDelete@@6B@
??_7CTableCombo@@6B@
??_7CTableEdit@@6B@
??_7CTableList@@6B@
??_7CTracerST@@6B@
??_7CeCopyDlg@@6B@
??_7VIMDocument@@6B@
?AttachFileToMessage@CVimConnection@@IAEHAAVLNDocument@@ABV?$CStringT@GV?$StrTraitMFC@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@PAUHWND__@@@Z
?CanStayConnected@VIMDocument@@QAEHXZ
?CloseAddressBook@CVimConnection@@QAEKXZ
?CloseSession@CVimConnection@@QAEKXZ
?CompareItem@CTableCombo@@MAEHPAUtagCOMPAREITEMSTRUCT@@@Z
?CreateDisplayFonts@CTableList@@IAEXXZ
?CreateNotesEmail@CVimConnection@@QAEHPAPAV_LNDraftMessageInfo@@PBG1PAUHWND__@@111@Z
?CreateObject@VIMDocument@@SGPAVCObject@@XZ
?DeleteDisplayFonts@CTableList@@IAEXXZ
?DeleteDraftMessage@CVimConnection@@QAEHPAV_LNDraftMessageInfo@@HPAUHWND__@@@Z
?DeleteString@CTableCombo@@IAEHI@Z
?DrawItem@CTableList@@MAEXPAUtagDRAWITEMSTRUCT@@@Z
?EnumerateAddressBookEntries@CVimConnection@@QAEHPAXHAAVLNVFPosition@@AAVCStringList@@@Z
?FormatNote@VIMDocument@@AAEHAAV?$CStringT@GV?$StrTraitMFC@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@ABV23@@Z
?FormatSubject@VIMDocument@@AAEHAAV?$CStringT@GV?$StrTraitMFC@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@ABV23@@Z
?GetADOBindingEntries@CPYAddrBookEntry@@UAGPBUstADO_BINDING_ENTRY@@XZ
?GetAccount@CTableCombo@@QAE?AV?$CStringT@GV?$StrTraitMFC@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@XZ
?GetAddressBookCount@CVimConnection@@QAEKPAX@Z
?GetAddressBookReOpenSchedule@VIMDocument@@QAE?AV?$CStringT@GV?$StrTraitMFC@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@XZ
?GetBeginning@CVimConnection@@QAEHPAVLNVFPosition@@@Z
?GetDisplayType@CTableCombo@@QAEJXZ
?GetDomain@CTableCombo@@QAE?AV?$CStringT@GV?$StrTraitMFC@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@XZ
?GetEmailAddress@CTableCombo@@QAE?AV?$CStringT@GV?$StrTraitMFC@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@XZ
?GetEnd@CVimConnection@@QAEHPAVLNVFPosition@@@Z
?GetEntryIndex@CVimConnection@@IAEKVLNVFEntry@@@Z
?GetEnumRef@CTableCombo@@QAEXPAJ0@Z
?GetEnumRef@CTableList@@QAEXPAJ0PBG@Z
?GetFirstNameFirst@CVimConnection@@QAEHAAV?$CStringT@GV?$StrTraitMFC@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@0@Z
?GetGlobalAddressBook@VIMDocument@@QAEXABV?$CStringT@GV?$StrTraitMFC@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@AAV23@1PAW4NameOrderType@@@Z
?GetHandTyped@CTableCombo@@QAEHXZ
?GetInuse@CVimConnection@@QAEHXZ
?GetJustify@VIMDocument@@QAEJXZ
?GetLocalAddressBookEntry@CTableList@@IAE?AV?$CStringT@GV?$StrTraitMFC@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@XZ
?GetLocalSearchFirst@CTableList@@QAE?AV?$CStringT@GV?$StrTraitMFC@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@XZ
?GetLocalSearchLast@CTableList@@QAE?AV?$CStringT@GV?$StrTraitMFC@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@XZ
?GetMailFileName@CVimConnection@@QAEHAAV?$CStringT@GV?$StrTraitMFC@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@PAUHWND__@@@Z
?GetMailServer@CVimConnection@@QAEHAAV?$CStringT@GV?$StrTraitMFC@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@PAUHWND__@@@Z
?GetMessageMap@CTableCombo@@MBEPBUAFX_MSGMAP@@XZ
?GetMessageMap@CTableEdit@@MBEPBUAFX_MSGMAP@@XZ
?GetMessageMap@CTableList@@MBEPBUAFX_MSGMAP@@XZ
?GetMessageMap@VIMDocument@@MBEPBUAFX_MSGMAP@@XZ
?GetMultipleRecips@VIMDocument@@QAEJXZ
?GetNameOrder@VIMDocument@@QAE?AW4NameOrderType@@ABV?$CStringT@GV?$StrTraitMFC@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@@Z
?GetPassword@CVimConnection@@QAE?AV?$CStringT@GV?$StrTraitMFC@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@XZ
?GetPersonalLogonServer@VIMDocument@@QAE?AV?$CStringT@GV?$StrTraitMFC@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@ABV23@@Z
?GetPersonalLogonServerPort@VIMDocument@@QAEIABV?$CStringT@GV?$StrTraitMFC@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@@Z
?GetPersonalLogonServerSSL@VIMDocument@@QAEHABV?$CStringT@GV?$StrTraitMFC@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@@Z
?GetRenameFile@VIMDocument@@QAEJXZ
?GetRuntimeClass@VIMDocument@@UBEPAUCRuntimeClass@@XZ
?GetThisClass@VIMDocument@@SGPAUCRuntimeClass@@XZ
?GetThisMessageMap@CTableCombo@@KGPBUAFX_MSGMAP@@XZ
?GetThisMessageMap@CTableEdit@@KGPBUAFX_MSGMAP@@XZ
?GetThisMessageMap@CTableList@@KGPBUAFX_MSGMAP@@XZ
?GetThisMessageMap@VIMDocument@@KGPBUAFX_MSGMAP@@XZ
?GetUseLocalList@CTableCombo@@QAEHXZ
?GetUseLocalList@CTableList@@QAEHXZ
?InitComboBox@CTableCombo@@QAEXPAX00@Z
?InitListBox@CTableList@@QAEXPAX00@Z
?IsGlobalAddressBook@VIMDocument@@QAEHABV?$CStringT@GV?$StrTraitMFC@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@@Z
?IsPersonalLogon@VIMDocument@@QAEHABV?$CStringT@GV?$StrTraitMFC@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@@Z
?IsSimpleUI@VIMDocument@@QAEHABV?$CStringT@GV?$StrTraitMFC@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@@Z
?IsSucceeded@RegManager@@ABE_NJ@Z
?LNCPPOpenSession@CVimConnection@@QAEHXZ
?LNString2DWord@CVimConnection@@SAKAAVLNString@@@Z
?LeftAlignEditDlg@CTableCombo@@QAEXHH@Z
?LoadAddressBookList@CVimConnection@@QAEHPAXPAUHWND__@@PAVCListBox@@@Z
?LoadGlobalAddressCombo@CVimConnection@@QAEHPAUHWND__@@PAVCComboBox@@@Z
?MatchAddressBookEntry@CVimConnection@@QAEHPAXPAGAAVLNVFPosition@@@Z
?MeasureItem@CTableCombo@@MAEXPAUtagMEASUREITEMSTRUCT@@@Z
?MeasureItem@CTableList@@MAEXPAUtagMEASUREITEMSTRUCT@@@Z
?OnChanged@CTableCombo@@IAEXXZ
?OnChar@CTableEdit@@IAEXIII@Z
?OnCtlColor@CTableCombo@@IAEPAUHBRUSH__@@PAVCDC@@PAVCWnd@@I@Z
?OnDestroy@CTableCombo@@IAEXXZ
?OnDropDown@CTableList@@QAEXPBG@Z
?OnDropdown@CTableCombo@@IAEXXZ
?OnEditCharacter@CTableCombo@@IAEJIJ@Z
?OnInitializeControl@CTableCombo@@IAEJIJ@Z
?OnInitializeControl@CTableList@@QAEJIJ@Z
?OnIsValidSelection@CTableCombo@@IAEJIJ@Z
?OnKeyDown@CTableList@@IAEXIII@Z
?OnKillFocus@CTableEdit@@IAEXPAVCWnd@@@Z
?OnNewDocument@VIMDocument@@MAEHXZ
?OnSelchange@CTableCombo@@IAEXXZ
?OnSetFocus@CTableEdit@@IAEXPAVCWnd@@@Z
?OnSetMyText@CTableCombo@@IAEJIJ@Z
?OnVScroll@CTableList@@IAEXIIPAVCScrollBar@@@Z
?OpenAddressBook@CVimConnection@@QAEPAXPAGH@Z
?ReportNotesError@CVimConnection@@QAEHKABV?$CStringT@GV?$StrTraitMFC@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@0HPAUHWND__@@@Z
?SaveDraftMessage@CVimConnection@@QAEPAV_LNDraftMessageInfo@@ABV?$CStringT@GV?$StrTraitMFC@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@PAUHWND__@@PBG22@Z
?SendMail1@VIMDocument@@AAEJPBGABVCRect@@J@Z
?SendMail2@VIMDocument@@AAEJPBG0@Z
?SendMail@VIMDocument@@QAEJPBG0ABVCRect@@J@Z
?SendMail@VIMDocument@@QAEJPBGABVCRect@@J@Z
?SendMailMessage@CVimConnection@@QAEHAAV?$CStringT@GV?$StrTraitMFC@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@00000@Z
?SendNotesEmail@CVimConnection@@QAEHPBV_LNDraftMessageInfo@@PAUHWND__@@@Z
?Serialize@VIMDocument@@UAEXAAVCArchive@@@Z
?SetAddressBookReOpenSchedule@VIMDocument@@QAEHH@Z
?SetAddressBookReOpenTimer@CVimConnection@@QAEHXZ
?SetDisplayType@CTableCombo@@QAEXK@Z
?SetDriverDisplayName@VIMDocument@@QAEXABV?$CStringT@GV?$StrTraitMFC@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@@Z
?SetDriverName@VIMDocument@@QAEXPBG@Z
?SetEnumRef@CTableCombo@@QAEXJJ@Z
?SetEnumRef@CTableList@@QAEXJJ@Z
?SetFaxAddress@VIMDocument@@QAEXV?$CStringT@GV?$StrTraitMFC@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@@Z
?SetFaxViaMail@VIMDocument@@QAEXH@Z
?SetFontHeight@CeCopyDlg@@QAEXJ@Z
?SetFunction@CTracerST@@QAEKAAV?$CStringT@GV?$StrTraitMFC@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@@Z
?SetFunction@CTracerST@@QAEKPAG@Z
?SetGlobalAddressBook@VIMDocument@@QAEXABV?$CStringT@GV?$StrTraitMFC@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@H00@Z
?SetInUse@CVimConnection@@QAEXH@Z
?SetJustify@VIMDocument@@QAEXJ@Z
?SetLocalAddressBook@CTableCombo@@QAEXPAVCPYAddrBook@@@Z
?SetLocalAddressBookSearch@CTableList@@IAE?AW4CpyAddrStatus@@XZ
?SetLocalSearchFirst@CTableList@@QAEXV?$CStringT@GV?$StrTraitMFC@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@@Z
?SetLocalSearchLast@CTableList@@QAEXV?$CStringT@GV?$StrTraitMFC@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@@Z
?SetModule@CTracerST@@QAEKAAV?$CStringT@GV?$StrTraitMFC@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@@Z
?SetModule@CTracerST@@QAEKPAG@Z
?SetMultipleRecips@VIMDocument@@QAEXJ@Z
?SetNameOrder@CVimConnection@@QAEHW4NameOrderType@@@Z
?SetNameOrder@VIMDocument@@QAEXABV?$CStringT@GV?$StrTraitMFC@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@@Z
?SetOnCharMessage@CTableEdit@@QAEXI@Z
?SetParent@CTableList@@QAEXPAUHWND__@@@Z
?SetParentWindow@VIMDocument@@QAEXPAUHWND__@@@Z
?SetPassword@CVimConnection@@QAEHABV?$CStringT@GV?$StrTraitMFC@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@PAUHWND__@@@Z
?SetPersonalLogon@VIMDocument@@QAEXABV?$CStringT@GV?$StrTraitMFC@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@H0@Z
?SetPersonalLogonServerPort@VIMDocument@@QAEXABV?$CStringT@GV?$StrTraitMFC@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@I@Z
?SetPersonalLogonServerSSL@VIMDocument@@QAEXABV?$CStringT@GV?$StrTraitMFC@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@H@Z
?SetPositionAbsolute@CVimConnection@@QAEHPAVLNVFPosition@@I@Z
?SetPositionRelative@CVimConnection@@QAEHPAVLNVFPosition@@H@Z
?SetRenameFile@VIMDocument@@QAEXJ@Z
?SetSelection@CTableEdit@@QAEXHHH@Z
?SetSimpleUI@VIMDocument@@QAEXABV?$CStringT@GV?$StrTraitMFC@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@H@Z
?SetUseLocalList@CTableList@@QAEXH@Z
?SetUsingFromField@CTableCombo@@QAEXH@Z
?SetVimDocument@CVimConnection@@QAEXPAVVIMDocument@@@Z
?SetupLocalSearch@CTableCombo@@IAEXV?$CStringT@GV?$StrTraitMFC@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@AAV23@1@Z
?ShowNotesEmail@CVimConnection@@QAEHPBV_LNDraftMessageInfo@@PAUHWND__@@@Z
?ShowVIMError@CVimConnection@@QAEXH@Z
?TerminateSession@VIMDocument@@QAEXXZ
?Trace@CTracerST@@QAAXHPBGZZ
?Trace@CTracerST@@QAEXHPBGPAD@Z
?UseUI@VIMDocument@@AAEHABV?$CStringT@GV?$StrTraitMFC@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@@Z
?VAbsolutePosition@CTableList@@IAEXHH@Z
?VScroll@CTableList@@IAEXH@Z
?_messageEntries@CTableCombo@@0QBUAFX_MSGMAP_ENTRY@@B
?_messageEntries@CTableEdit@@0QBUAFX_MSGMAP_ENTRY@@B
?_messageEntries@CTableList@@0QBUAFX_MSGMAP_ENTRY@@B
?_messageEntries@VIMDocument@@0QBUAFX_MSGMAP_ENTRY@@B
?classVIMDocument@VIMDocument@@2UCRuntimeClass@@B
?getDatabaseFile@_LNDraftMessageInfo@@QBE?AVLNString@@XZ
?getDateTime@_LNDraftMessageInfo@@QBE?AVLNDatetime@@XZ
?getNoteID@_LNDraftMessageInfo@@QBEKXZ
?getServer@_LNDraftMessageInfo@@QBE?AVLNString@@XZ
?getUNID@_LNDraftMessageInfo@@QBE?AUUNIVERSALNOTEID_tag@@XZ
?messageMap@CTableCombo@@1UAFX_MSGMAP@@B
?messageMap@CTableEdit@@1UAFX_MSGMAP@@B
?messageMap@CTableList@@1UAFX_MSGMAP@@B
?messageMap@VIMDocument@@1UAFX_MSGMAP@@B
?rgADOBindingEntries@?1??GetADOBindingEntries@CPYAddrBookEntry@@UAGPBUstADO_BINDING_ENTRY@@XZ@4QBU3@B
?setDatabaseFile@_LNDraftMessageInfo@@QAEXVLNString@@@Z
?setDateTime@_LNDraftMessageInfo@@QAEXVLNDatetime@@@Z
?setNoteID@_LNDraftMessageInfo@@QAEXK@Z
?setServer@_LNDraftMessageInfo@@QAEXVLNString@@@Z
?setUNID@_LNDraftMessageInfo@@QAEXUUNIVERSALNOTEID_tag@@@Z
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 196KB - Virtual size: 192KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text
Size: 360KB - Virtual size: 360KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

002e69a21438edd94d7d589d84a29770

Headers

File Characteristics

Imports

common

lcppn201

cpyaddrbook

kernel32

advapi32

user32

gdi32

mfc70u

msvcr70

ole32

oleaut32

atl70

msvcp70

Exports

Exports

Sections

.text Size: 196KB - Virtual size: 192KB

.rdata Size: 96KB - Virtual size: 95KB

.data Size: 8KB - Virtual size: 15KB

.rsrc Size: 24KB - Virtual size: 21KB

.reloc Size: 24KB - Virtual size: 20KB

.text Size: 360KB - Virtual size: 360KB

.text
Size: 196KB - Virtual size: 192KB

.rdata
Size: 96KB - Virtual size: 95KB

.data
Size: 8KB - Virtual size: 15KB

.rsrc
Size: 24KB - Virtual size: 21KB

.reloc
Size: 24KB - Virtual size: 20KB

.text
Size: 360KB - Virtual size: 360KB