4304e8894b3dc22f458cce70d58b0a0da69bfd6f860be29dc97b1399281670dd

Sharing

Copy URL Twitter E-mail

General

Target

4304e8894b3dc22f458cce70d58b0a0da69bfd6f860be29dc97b1399281670dd
Size

213KB
MD5

9260cf84b8726decd859c011e9a02ea0
SHA1

ac4436c176e05246e4cf8326ae07c314d3618797
SHA256

4304e8894b3dc22f458cce70d58b0a0da69bfd6f860be29dc97b1399281670dd
SHA512

d2e3c0a0ad36b41b13d283c393cc01f4e0667f20a67df14958badc448c7e70ab3dc4bc465eb97def5a1efc9f8f7176d7ab021c94bad7f5e507f7c463ce20dc25
SSDEEP

3072:i47f1kCb7X6ticrQ37vf7CtlxMWZjODADfFMen5khuieuqPHUp3Ufdy4KhBAK:D7dhX6UH7WtUsjOD+FMKieU1UFLQ

Score

N/A

Malware Config

Signatures

Files

4304e8894b3dc22f458cce70d58b0a0da69bfd6f860be29dc97b1399281670dd
.dll windows x86

e1cfc8f5a36b8f2642529ef96980a753

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_BIND

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualAlloc
MultiByteToWideChar
GetEnvironmentVariableW
LocalAlloc
GetLastError
CloseHandle
WaitForSingleObject
GetCurrentProcess
GetCurrentProcessId
GetProcAddress
LoadLibraryA
ReleaseMutex
CreateMutexA
GetModuleHandleW
Sleep
InterlockedCompareExchange
DisableThreadLibraryCalls
RaiseException
FreeLibrary
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
InterlockedExchange

msvcr80

wcsncpy
calloc
wcscspn
_findclose
_findfirst64i32
_findnext64i32
wcsrchr
wcspbrk
wcsspn
_stat64i32
wcstok
iswalpha
iswdigit
_waccess
swscanf
wcsstr
_vswprintf
_vsnwprintf
towlower
towupper
?terminate@@YAXXZ
_encode_pointer
_malloc_crt
_encoded_null
_decode_pointer
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_crt_debugger_hook
wcschr
mbtowc
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@XZ
_CxxThrowException
strtok
??2@YAPAXI@Z
??_V@YAXPAX@Z
??3@YAXPAX@Z
??0exception@std@@QAE@ABV01@@Z
??1exception@std@@UAE@XZ
getenv
atof
memset
memcpy
__CxxFrameHandler3
_stricmp
_getcwd
_access
_wcsnicmp
_wcsicmp
__CxxUnregisterExceptionObject
__CxxDetectRethrow
__CxxRegisterExceptionObject
__CxxExceptionFilter
__CxxQueryExceptionSize
_cexit
__FrameUnwindFilter
realloc
malloc
free
isalpha

msvcp80

??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
?empty@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE_NXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

msvcm80

?RegisterModuleUninitializer@<CrtImplementationDetails>@@YAXP$AAVEventHandler@System@@@Z
?ThrowModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVString@System@@@Z
?ThrowNestedModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVException@System@@0@Z
?DoCallBackInDefaultDomain@<CrtImplementationDetails>@@YAXP6GJPAX@Z0@Z
?ThrowModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVString@System@@P$AAVException@3@@Z
?DoDllLanguageSupportValidation@<CrtImplementationDetails>@@YAXXZ

mscoree

_CorDllMain

Exports

Exports

??4NativeFileSpec@Print@Bentley@@QAEAAU012@ABU012@@Z
?AddDebugVar@DbgTools@Print@Bentley@@QAEXPBD@Z
?CFGetenv@Print@Bentley@@YAPADPBD@Z
?CFGetenvW@Print@Bentley@@YAPA_WPB_W@Z
?CFIsVariableDefined@Print@Bentley@@YA_NPBD@Z
?CFIsVariableDefinedW@Print@Bentley@@YA_NPB_W@Z
?CFReleaseValue@Print@Bentley@@YAXPAX@Z
?CFSetGetEnvVarCallback@Print@Bentley@@YAXP6AHPB_WPA_WH@Z@Z
?DBATT@Print@Bentley@@YAHPBDZZ
?DBATTW@Print@Bentley@@YAHPB_WZZ
?DBBMSG@Print@Bentley@@YAHKPADZZ
?DBCMSG@Print@Bentley@@YAHKPADZZ
?DBERR@Print@Bentley@@YAHPBDZZ
?DBERRVA@Print@Bentley@@YAHPBDPAD@Z
?DBERRW@Print@Bentley@@YAHPB_WZZ
?DBGETSA@Print@Bentley@@YAHPAD0@Z
?DBGETSW@Print@Bentley@@YAHPAG0@Z
?DBHMSG@Print@Bentley@@YAHPBDZZ
?DBHMSGW@Print@Bentley@@YAHPB_WZZ
?DBINP@Print@Bentley@@YAHPAD0ZZ
?DBInitApp@Print@Bentley@@YAHPAD@Z
?DBLB@Print@Bentley@@YAHPADHZZ
?DBLBV@Print@Bentley@@YAHPADHPAPAD@Z
?DBMB@Print@Bentley@@YAHPAD0I@Z
?DBMEMDUMP@Print@Bentley@@YAHPAXI@Z
?DBMSG@Print@Bentley@@YAHPBDZZ
?DBMSGVA@Print@Bentley@@YAHPBDPAD@Z
?DBMSGW@Print@Bentley@@YAHPB_WZZ
?DBPAUSE@Print@Bentley@@YAHPADZZ
?DBSTRDUMP@Print@Bentley@@YAHPAD@Z
?GEOMAddVector@Print@Bentley@@YAHHPAN00@Z
?GEOMCheckRect@Print@Bentley@@YAHHHPAN@Z
?GEOMCheckRectangularPlotArea@Print@Bentley@@YAHHHPAN@Z
?GEOMComputeCubeDiag@Print@Bentley@@YAHHPAN00@Z
?GEOMComputeCubeIntersection@Print@Bentley@@YAHQAN00000@Z
?GEOMComputeCubeVerts@Print@Bentley@@YAHPAN00@Z
?GEOMComputeMinEnclCube@Print@Bentley@@YAHHQAY02NQAN1@Z
?GEOMComputeMinEnclRect@Print@Bentley@@YAHHQAY01NQAN1@Z
?GEOMComputeRectIntersection@Print@Bentley@@YAHQAN00000@Z
?GEOMComputeRectVerts@Print@Bentley@@YAHPAN00@Z
?GEOMPointsColinear@Print@Bentley@@YAHHHPBN@Z
?GEOMPointsEqual@Print@Bentley@@YAHHHPBN@Z
?GEOMPointsParallelToAxis@Print@Bentley@@YAHHHHPBN@Z
?GEOMPointsParallelToPlane@Print@Bentley@@YAHHHHPBN@Z
?GEOMShapeFindLongestSide@Print@Bentley@@YAHHHPAN0@Z
?GEOMValueInRange@Print@Bentley@@YAHNNN@Z
?GetHfsOrUfs@NativeFileSpec@Print@Bentley@@QBEABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?Instance@DbgTools@Print@Bentley@@SAAAU123@XZ
?IsFlagDefined@DbgTools@Print@Bentley@@QBE_NPBD@Z
?MATBuildInvRotHMat@Print@Bentley@@YAHHPAN0@Z
?MATBuildInvScaleHMat@Print@Bentley@@YAHHPAN0@Z
?MATBuildInvTransHMat@Print@Bentley@@YAHHPAN0@Z
?MATBuildRotAboutZHMat@Print@Bentley@@YAHHNPAN@Z
?MATBuildScaleHMat@Print@Bentley@@YAHHNNNPAN@Z
?MATBuildTransHMat@Print@Bentley@@YAHHNNNPAN@Z
?MATConvertPtDimToHomog@Print@Bentley@@YAXHHPBNPAN@Z
?MATConvertPtHomogToDim@Print@Bentley@@YAXHHPBNPAN@Z
?MATCvtMatToHomog@Print@Bentley@@YAHHPAN0@Z
?MATInvRotMat@Print@Bentley@@YAHHPAN0@Z
?MATMulMatMat@Print@Bentley@@YAHHPAN00@Z
?MATMulVecMat@Print@Bentley@@YAHHPANH00@Z
?MATTransposeMat@Print@Bentley@@YAHHPBNPAN@Z
?OLClear@Print@Bentley@@YAHPAX@Z
?OLCreate@Print@Bentley@@YAPAXXZ
?OLDestroy@Print@Bentley@@YAHPAX@Z
?OLGetNumItems@Print@Bentley@@YAHPAXPAH@Z
?OLItemDelete@Print@Bentley@@YAHPAXH@Z
?OLItemGetByFilter@Print@Bentley@@YAHPAXP6AH00@Z0PAHPAPAX@Z
?OLItemGetByIndex@Print@Bentley@@YAHPAXHPAPAX@Z
?OLItemInsert@Print@Bentley@@YAHPAX0HP6AH000@Z0@Z
?OLItemSet@Print@Bentley@@YAHPAXH0H@Z
?STRCompareCI@Print@Bentley@@YAHPBD0@Z
?STRCompareCICount@Print@Bentley@@YAHPBD0H@Z
?STRCompareCICountW@Print@Bentley@@YAHPB_W0H@Z
?STRCompareCIW@Print@Bentley@@YAHPB_W0@Z
?STRDeleteChar@Print@Bentley@@YAPADPADH0@Z
?STRDeleteCharLead@Print@Bentley@@YAPADPADH0@Z
?STRDeleteCharLeadW@Print@Bentley@@YAPA_WPA_WH0@Z
?STRDeleteCharTrail@Print@Bentley@@YAPADPBDHPAD@Z
?STRDeleteCharTrailW@Print@Bentley@@YAPA_WPB_WHPA_W@Z
?STRDeleteCharW@Print@Bentley@@YAPA_WPA_WH0@Z
?STRDup@Print@Bentley@@YAPADPAD@Z
?STRDupW@Print@Bentley@@YAPA_WPA_W@Z
?STRExtractSubstr@Print@Bentley@@YAPADPADHH0@Z
?STRExtractSubstrW@Print@Bentley@@YAPA_WPA_WHH0@Z
?STRInsertSubstr@Print@Bentley@@YAPADPADH00@Z
?STRInsertSubstrW@Print@Bentley@@YAPA_WPA_WH00@Z
?STRLower@Print@Bentley@@YAPADPAD0@Z
?STRLowerW@Print@Bentley@@YAPA_WPA_W0@Z
?STRMatchPattern@Print@Bentley@@YAHPBD0@Z
?STRMatchPatternCI@Print@Bentley@@YAHPBD0@Z
?STRMatchPatternCIW@Print@Bentley@@YAHPB_W0@Z
?STRMatchPatternW@Print@Bentley@@YAHPB_W0@Z
?STRReplaceChar@Print@Bentley@@YAPADPBDHHPAD@Z
?STRReplaceCharW@Print@Bentley@@YAPA_WPB_WHHPA_W@Z
?STRReverse@Print@Bentley@@YAPADPAD@Z
?STRReverseW@Print@Bentley@@YAPA_WPA_W@Z
?STRUpper@Print@Bentley@@YAPADPAD0@Z
?STRUpperW@Print@Bentley@@YAPA_WPA_W0@Z
?clear@NativeFileSpec@Print@Bentley@@QAEXXZ
CLGrowPolygons
CLaddFenceRef
CLclipFences
CLclipLine
CLclipPolygon
CLdefFence
CLdeleteFence
CLextractPolygons
CLinqFenceInfo
CLreallocClpMem
DbgTools_isDebugOn
FUAppendCompHFS
FUAppendCompHFSW
FUAppendDirSepHFS
FUAppendDirSepHFSW
FUBuildLFS
FUBuildLFSW
FUFindCreateHFS
FUFindCreateHFSW
FUFindFullHFS
FUFindFullHFSW
FUGetUniversalName
FUGetUniversalNameW
FUIsFullHFS
FUIsFullHFSW
FUIsFullLFS
FUIsFullLFSW
FUIsIPAddress
FUIsPortName
FUIsPseudoFile
FUIsUncShare
FUMatchLFSFirst
FUMatchLFSFirstW
FUMatchLFSFree
FUMatchLFSFreeW
FUMatchLFSNext
FUMatchLFSNextW
FUModifyPortName
FUParseUFS
FUParseUFSW
FUPathContainsComp
FUPathContainsCompW
FUPathFree
FUPathGetFirst
FUPathGetFirstW
FUPathGetNext
FUPathGetNextW
FURemoveCompsHFS
FURemoveCompsHFSW
FURemoveDirSepHFS
FURemoveDirSepHFSW
FUResolveAutoIncToken
FUSearchUFS
FUSearchUFSW
FUTrimExtension

Sections

.text
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 101KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e1cfc8f5a36b8f2642529ef96980a753

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcr80

msvcp80

msvcm80

mscoree

Exports

Exports

Sections

.text Size: 58KB - Virtual size: 57KB

.rdata Size: 50KB - Virtual size: 49KB

.data Size: 512B - Virtual size: 2KB

.rsrc Size: 101KB - Virtual size: 101KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 58KB - Virtual size: 57KB

.rdata
Size: 50KB - Virtual size: 49KB

.data
Size: 512B - Virtual size: 2KB

.rsrc
Size: 101KB - Virtual size: 101KB

.reloc
Size: 2KB - Virtual size: 2KB