d091138c18f038e504b21e2d485b5a26bc15ab3e21e0c63f13fa5f226c2b9569

Sharing

Copy URL Twitter E-mail

General

Target

d091138c18f038e504b21e2d485b5a26bc15ab3e21e0c63f13fa5f226c2b9569
Size

1.1MB
MD5

0f353f228db101f51a89f7e4577b0f60
SHA1

21ce8a636660b54be99e086902e818231a2827b9
SHA256

d091138c18f038e504b21e2d485b5a26bc15ab3e21e0c63f13fa5f226c2b9569
SHA512

3827c5f364fe68c07107dbc56ee179be85e09633e68cde030720acaa3860d9abfac54226cd63b1435734492cd00f331df27f046e389746ac1bdeebd483770824
SSDEEP

12288:LX2lbx6IEOIby3HoGOm15EkPlNM35ILlHROP0OsbwRaxRK+5Ny/9XhhX9XiiOIZh:Ko/booGOm15GU3vK6GZv/

Score

N/A

Malware Config

Signatures

Files

d091138c18f038e504b21e2d485b5a26bc15ab3e21e0c63f13fa5f226c2b9569
.exe windows x64

37d3bf940a97a015a14d0e76805fee2d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

Imports

advapi32

AllocateAndInitializeSid
FreeSid
CheckTokenMembership
RegEnumKeyExW
RegCloseKey
RegOpenKeyExW

kernel32

CreateEventW
HeapSetInformation
GetVersionExW
VirtualProtect
Sleep
CloseHandle
GetLastError
GetModuleHandleW
QueryPerformanceCounter
GetProcAddress
UnhandledExceptionFilter
GetCurrentProcess
SetUnhandledExceptionFilter
RtlPcToFileHeader
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
OutputDebugStringA
GetStartupInfoW
SetThreadExecutionState
CreateMutexW
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentThreadId

user32

EnableWindow
RegisterWindowMessageW
IsIconic
SetForegroundWindow
EnumWindows
ShowWindow
SendMessageTimeoutW
MessageBoxW
GetSystemMetrics

mfc42u

ord3164
ord4371
ord4983
ord4770
ord1063
ord5724
ord5065
ord6053
ord4214
ord6813
ord4836
ord2559
ord2515
ord6071
ord4191
ord5630
ord4077
ord5615
ord659
ord3916
ord1430
ord3830
ord2412
ord3468
ord5722
ord4368
ord5730
ord5711
ord5687
ord6437
ord1777
ord4771
ord5406
ord2517
ord1505
ord4598
ord4988
ord4365
ord4752
ord2399
ord5586
ord6812
ord4694
ord4017
ord5229
ord2670
ord2060
ord6814
ord3933
ord5484
ord1736
ord5683
ord2457
ord2140
ord5699
ord6886
ord4083
ord4082
ord3046
ord3166
ord3052
ord3366
ord3231
ord4815
ord3362
ord3243
ord3049
ord5636
ord6887
ord1584
ord1463
ord1388

msvcrt

__set_app_type
_unlock
__dllonexit
_lock
_amsg_exit
??1type_info@@UEAA@XZ
memcpy
memset
memmove
??0__non_rtti_object@@QEAA@PEBD@Z
??1__non_rtti_object@@UEAA@XZ
??0__non_rtti_object@@QEAA@AEBV0@@Z
??0bad_typeid@@QEAA@AEBV0@@Z
??0bad_cast@@QEAA@PEBD@Z
??1bad_cast@@UEAA@XZ
??0bad_cast@@QEAA@AEBV0@@Z
?terminate@@YAXXZ
isdigit
mbtowc
_fmode
isleadbyte
isxdigit
localeconv
wctomb
iswctype
wcstombs
realloc
__badioinfo
__pioinfo
_read
_fileno
ungetc
_initterm
_wcmdln
exit
_cexit
_commode
__mb_cur_max
__setusermatherr
?name@type_info@@QEBAPEBDXZ
_set_error_mode
free
calloc
malloc
wprintf
_purecall
__CxxFrameHandler
_errno
??0exception@@QEAA@AEBQEBDH@Z
_onexit
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
_CxxThrowException
_callnewh
__wgetmainargs
__C_specific_handler
_XcptFilter
_exit
wcschr
towlower
wcspbrk
iswdigit

shell32

ShellExecuteW

comctl32

InitCommonControlsEx

gdiplus

GdiplusShutdown
GdiplusStartup

wet

?OnWizHelp@CWiz@@MEAAHXZ
??1CWetCommandLineInfo@@UEAA@XZ
??1CSQMData@@UEAA@XZ
?RegisterControlClass@CMigrationCheckBox@@SAXPEAUHINSTANCE__@@@Z
?UnregisterControlClass@CMigrationCheckBox@@SAXPEAUHINSTANCE__@@@Z
?WizLib_OnInitInstance@@YAHXZ
?GetWetBuildVersion@@YAPEAVString@UnBCL@@XZ
?RegisterControlClass@CMigrationStatus@@SAXPEAUHINSTANCE__@@@Z
?UnregisterControlClass@CMigrationStatus@@SAXPEAUHINSTANCE__@@@Z
?LoadResourceString@@YAPEAGI@Z
?RegisterControlClass@CEnhancedStatic@@SAXPEAUHINSTANCE__@@@Z
?UnregisterControlClass@CEnhancedStatic@@SAXPEAUHINSTANCE__@@@Z
?RegisterControlClass@CMigrationDetail@@SAXPEAUHINSTANCE__@@@Z
?UnregisterControlClass@CMigrationDetail@@SAXPEAUHINSTANCE__@@@Z
?RegisterControlClass@CWinListBox@@SAXPEAUHINSTANCE__@@@Z
?UnregisterControlClass@CWinListBox@@SAXPEAUHINSTANCE__@@@Z
??0CWetCommandLineInfo@@QEAA@XZ
?ParseParam@CWetCommandLineInfo@@UEAAXPEBGHH@Z
?GetError@CWetCommandLineInfo@@UEBAHXZ
?SetError@CWetCommandLineInfo@@UEAAXH@Z
?GetRunId@CWetCommandLineInfo@@UEBAKXZ
?GetMigFile@CWetCommandLineInfo@@UEBAPEAVString@UnBCL@@XZ
?get_ConnectionMedia@CWetCommandLineInfo@@UEBAPEAW4CONNECTION_MEDIA@@XZ
?get_EndPoint@CWetCommandLineInfo@@UEBAPEAEXZ
?get_ConnectionKey@CWetCommandLineInfo@@UEBAPEAVString@UnBCL@@XZ
?get_EncryptionKey@CWetCommandLineInfo@@UEBAPEAVString@UnBCL@@XZ
?get_PeerUpdate@CWetCommandLineInfo@@UEBAHXZ
?get_OldWindowHandle@CWetCommandLineInfo@@UEBAPEAUHWND__@@XZ
?get_PageHistory@CWetCommandLineInfo@@UEBAPEAVString@UnBCL@@XZ
?get_PrintWetVersion@CWetCommandLineInfo@@UEAAHXZ
?GetRuntimeClass@CWiz@@UEBAPEAUCRuntimeClass@@XZ
?SetIcon@CWiz@@QEAAXI@Z
?OnWizQuit@CWiz@@MEAAHXZ
?DrawBackground@CWiz@@MEAAXAEAVCDC@@@Z
?DoDataExchange@CWiz@@MEAAXPEAVCDataExchange@@@Z
?OnOK@CWiz@@MEAAXXZ
?OnCancel@CWiz@@MEAAXXZ
?classCBusinessLogicThread@CBusinessLogicThread@@2UCRuntimeClass@@B
?g_wetLocale@@3KA
?IsLocaleSupported@@YAHK@Z
??0CThemeManager@@QEAA@XZ
??1CThemeManager@@QEAA@XZ
?RegisterControlClass@CElementMap@@SAXPEAUHINSTANCE__@@@Z
?UnregisterControlClass@CElementMap@@SAXPEAUHINSTANCE__@@@Z
?RegisterControlClass@CMigrationError@@SAXPEAUHINSTANCE__@@@Z
??0CWizardFrame@@QEAA@PEBGPEAVCWnd@@IPEAVCThemeManager@@W4PageBackgroundThemeType@@PEAUCRuntimeClass@@PEAXKPEAVString@UnBCL@@@Z
??1CWizardFrame@@UEAA@XZ
?Initialize@CWizardFrame@@UEAAXXZ
?AddPage@CWizardFrame@@UEAAXPEAVCWizardPage@@@Z
?ReplacePage@CWizardFrame@@UEAAXPEAVCWizardPage@@0@Z
?GetPageById@CWizardFrame@@UEBAPEAVCWizardPage@@I@Z
?PostLocalBlMessage@CWizardFrame@@UEAAHI_K_J@Z
?PostBlMessage@CWizardFrame@@UEAAHI_K_J@Z
?SetActivePageById@CWizardFrame@@UEAAXI@Z
?SetFirstPage@CWizardFrame@@UEAAXI@Z
?SetNextButton@CWizardFrame@@UEAAXW4NEXT_BUTTON_NAME@@W4NEXT_BUTTON_STATE@@@Z
?SetBackButton@CWizardFrame@@UEAAXW4BACK_BUTTON_STATE@@@Z
?ShowNextPage@CWizardFrame@@UEAAXI@Z
?UpdatePageIdDisplay@CWizardFrame@@UEAAXI@Z
?IsApplyAllowed@CWizardFrame@@UEBAHXZ
?get_PeerUpdate@CWizardFrame@@UEBAHXZ
?set_PeerUpdate@CWizardFrame@@UEAAXH@Z
?PlaceOverOldWet@CWizardFrame@@UEAAXXZ
?ScanForUsbCable@CWizardFrame@@UEAAHXZ
?SetTransferMode@CWizardFrame@@UEAAXE@Z
?OnEndSession@CWizardFrame@@UEAAHXZ
?OnQueryEndSession@CWizardFrame@@UEAAHXZ
?OnHelpInfo@CWizardFrame@@UEAAHPEAUtagHELPINFO@@@Z
?OnMove@CWizardFrame@@UEAAXHH@Z
?SetEndPoint@CWizardFrame@@UEAAXE@Z
?SetWizardPath@CWizardFrame@@UEAAXW4WIZARD_PATH@@@Z
?GetWizardPath@CWizardFrame@@UEAA?AW4WIZARD_PATH@@XZ
?SetPageToReset@CWizardFrame@@UEAAXPEAVCWizardPage@@@Z
?ResetPage@CWizardFrame@@UEAAXPEAVCWizardPage@@@Z
?ResetConnectionAndPeerUpdatePages@CWizardFrame@@UEAAXXZ
?CheckAndPerformPageReset@CWizardFrame@@UEAAXPEAVCWizardPage@@@Z
?SetStoreFileWasLoaded@CWizardFrame@@UEAAXH@Z
?CancelConnectedTransport@CWizardFrame@@UEAAXXZ
?ShowWaitCursor@CWizardFrame@@UEAAXH@Z
?EnableUserInput@CWizardFrame@@UEAAXH@Z
?GetMessageMap@CWizardFrame@@MEBAPEBUAFX_MSGMAP@@XZ
?OnInitDialog@CWizardFrame@@MEAAHXZ
?PostNcDestroy@CWizardFrame@@MEAAXXZ
?OnSysColorChange@CWizardFrame@@MEAAXXZ
?OnPowerBroadcast@CWizardFrame@@MEAA_J_K_J@Z
?OnCtlColor@CWizardFrame@@MEAAPEAUHBRUSH__@@PEAVCDC@@PEAVCWnd@@I@Z
?PreTranslateMessage@CWizardFrame@@MEAAHPEAUtagMSG@@@Z
?OnSetCursor@CWizardFrame@@MEAAHPEAVCWnd@@II@Z
?AutomatedStart@CWizardFrame@@MEAAXXZ
?PlaceUnderOldWet@CWizardFrame@@MEAAXXZ
?OnWizBack@CWizardFrame@@MEAAHXZ
?OnWizNext@CWizardFrame@@MEAAHXZ
?OnBlShutdownDone@CWizardFrame@@MEAA_J_K_J@Z
?OnCommand@CWizardFrame@@MEAAH_K_J@Z
?OnGetDefId@CWizardFrame@@MEAA_J_K_J@Z
?OnTimerTick@CWizardFrame@@MEAA_J_K_J@Z
??0CSQMData@@QEAA@XZ
?SendSQMData@CSQMData@@QEAAXXZ
?SetThreadLocalizedResources@@YAXXZ
?UnregisterControlClass@CMigrationError@@SAXPEAUHINSTANCE__@@@Z

unbcl

??1StringBuilder@UnBCL@@UEAA@XZ
??0StringBuilder@UnBCL@@QEAA@XZ
?IndexOf@String@UnBCL@@QEBAHG@Z
?get_Length@String@UnBCL@@QEBAHXZ
?Free@Allocator@UnBCL@@SAXPEAXI@Z
??0OutOfMemoryException@UnBCL@@QEAA@XZ
?Alloc@Allocator@UnBCL@@SAPEAX_KI@Z
?ReAlloc@Allocator@UnBCL@@SAPEAXPEAX_KI@Z
?Trim@String@UnBCL@@QEBAPEAV12@XZ
?Append@StringBuilder@UnBCL@@QEAAPEAV12@G@Z
?ToString@StringBuilder@UnBCL@@UEBAPEAVString@2@XZ
?get_P@?$SmartPtr@VString@UnBCL@@@UnBCL@@QEBAPEAVString@2@XZ
?EndsWith@String@UnBCL@@QEBAHPEBGH@Z
?Remove@String@UnBCL@@QEBAPEAV12@HH@Z
?Combine@Path@UnBCL@@SAPEAVString@2@PEBV32@0@Z
??1OutOfMemoryException@UnBCL@@UEAA@XZ
??0?$SmartPtr@V?$ArrayList@PEAVString@UnBCL@@@UnBCL@@@UnBCL@@QEAA@PEAV?$ArrayList@PEAVString@UnBCL@@@1@@Z
?Split@String@UnBCL@@QEBAPEAV?$ArrayList@PEAVString@UnBCL@@@2@PEBG@Z
??1?$SmartPtr@V?$ArrayList@PEAVString@UnBCL@@@UnBCL@@@UnBCL@@UEAA@XZ
??C?$SmartPtr@V?$ArrayList@PEAVString@UnBCL@@@UnBCL@@@UnBCL@@QEBAPEAV?$ArrayList@PEAVString@UnBCL@@@1@XZ
??1ArgumentNullException@UnBCL@@UEAA@XZ
??1ArgumentException@UnBCL@@UEAA@XZ
??1ArgumentOutOfRangeException@UnBCL@@UEAA@XZ
??_D?$Array@H@UnBCL@@QEAAXXZ
??1?$ICollection@H@UnBCL@@UEAA@XZ
??1?$IList@H@UnBCL@@UEAA@XZ
??1ISerializable@UnBCL@@UEAA@XZ
??1NotSupportedException@UnBCL@@UEAA@XZ
??0ArgumentOutOfRangeException@UnBCL@@QEAA@PEBG@Z
?MemAllocFailed@Allocator@UnBCL@@SAHXZ
??C?$SmartPtr@VString@UnBCL@@@UnBCL@@QEBAPEAVString@1@XZ
??D?$SmartPtr@VString@UnBCL@@@UnBCL@@QEBAAEAVString@1@XZ
??4?$SmartPtr@VString@UnBCL@@@UnBCL@@QEAAAEAV01@AEBV01@@Z
??1?$SmartPtr@VString@UnBCL@@@UnBCL@@UEAA@XZ
??0?$SmartPtr@VString@UnBCL@@@UnBCL@@QEAA@PEAVString@1@@Z
??0InvalidCastException@UnBCL@@QEAA@XZ
?SanitizeTypeName@SerializationStream@UnBCL@@SAPEAVString@2@AEBV32@@Z
?GetCallingModule@SerializationStream@UnBCL@@SAPEAUHINSTANCE__@@XZ
?CanRegister@SerializationStream@UnBCL@@SAHXZ
?UnregisterType@SerializationStream@UnBCL@@SAXPEBVString@2@HPEAUHINSTANCE__@@@Z
?RegisterType@SerializationStream@UnBCL@@SAXPEBVString@2@HPEAUHINSTANCE__@@PEAUIInstanceFactory@2@@Z
??5SerializationStream@UnBCL@@QEAAAEAV01@AEAH@Z
??5SerializationStream@UnBCL@@QEAAAEAV01@AEAI@Z
??5SerializationStream@UnBCL@@QEAAAEAV01@AEAE@Z
??5SerializationStream@UnBCL@@QEAAAEAV01@AEAPEAVString@1@@Z
??5SerializationStream@UnBCL@@QEAAAEAV01@AEAPEAUISerializable@1@@Z
??6SerializationStream@UnBCL@@QEAAAEAV01@H@Z
??6SerializationStream@UnBCL@@QEAAAEAV01@I@Z
??6SerializationStream@UnBCL@@QEAAAEAV01@E@Z
??6SerializationStream@UnBCL@@QEAAAEAV01@PEBVString@1@@Z
??6SerializationStream@UnBCL@@QEAAAEAV01@PEBUISerializable@1@@Z
?ReadBytes@SerializationStream@UnBCL@@QEAAXPEAEH@Z
?WriteBytes@SerializationStream@UnBCL@@QEAAXPEBEH@Z
??0ArgumentException@UnBCL@@QEAA@PEBG@Z
?SetMessage@Exception@UnBCL@@MEAAXPEAVString@2@@Z
?set_HResult@Exception@UnBCL@@MEAAXJ@Z
?get_HResult@Exception@UnBCL@@UEBAJXZ
?GetBaseException@Exception@UnBCL@@UEBAPEBV12@XZ
?AddStackTrace@Exception@UnBCL@@QEAAXPEBD@Z
?set_Source@Exception@UnBCL@@UEAAXPEBVString@2@@Z
?get_Source@Exception@UnBCL@@UEBAPEBVString@2@XZ
?get_Message@Exception@UnBCL@@UEBAPEBVString@2@XZ
?get_InnerException@Exception@UnBCL@@UEBAPEBV12@XZ
?ToString@Exception@UnBCL@@UEBAPEAVString@2@XZ
??1Exception@UnBCL@@UEAA@XZ
??0Exception@UnBCL@@QEAA@PEBG@Z
?EnqueueSbRegistration@SbRegistrationList@UnBCL@@SAXPEBDHPEAUHINSTANCE__@@PEAUIInstanceFactory@2@@Z
?FromASCII@String@UnBCL@@SAPEAV12@PEBD@Z
?Concat@String@UnBCL@@SAPEAV12@PEBG0@Z
?get_CString@String@UnBCL@@QEBAPEBGXZ
?CompareTo@String@UnBCL@@UEBAHPEBVObject@2@@Z
?Clone@String@UnBCL@@UEBAPEAVObject@2@XZ
?ToString@String@UnBCL@@UEBAPEAV12@XZ
?GetHashCode@String@UnBCL@@UEBAHXZ
?Equals@String@UnBCL@@UEBAHPEBVObject@2@@Z
??1String@UnBCL@@UEAA@XZ
??0String@UnBCL@@QEAA@PEBG@Z
??0String@UnBCL@@QEAA@AEBV01@@Z
?SetLiteralStorage@_@UnBCL@@YAXPEAPEBVString@2@PEBG@Z
??0ArgumentNullException@UnBCL@@QEAA@PEBG@Z
?DecRef@Object@UnBCL@@QEAAHXZ
?AddRef@Object@UnBCL@@QEAAXXZ
??3Object@UnBCL@@SAXPEAX@Z
??2Object@UnBCL@@SAPEAX_K@Z
??2Object@UnBCL@@SAPEAX_KI@Z
?Clone@Object@UnBCL@@UEBAPEAV12@XZ
?CompareTo@Object@UnBCL@@UEBAHPEBV12@@Z
?GetObjectID@Object@UnBCL@@UEBAIXZ
?ToString@Object@UnBCL@@UEBAPEAVString@2@XZ
?GetType@Object@UnBCL@@UEBAPEAVType@2@XZ
?GetHashCode@Object@UnBCL@@UEBAHXZ
?Equals@Object@UnBCL@@UEBAHPEBV12@@Z
??1Object@UnBCL@@UEAA@XZ
??0Object@UnBCL@@QEAA@XZ
??0Object@UnBCL@@QEAA@AEBV01@@Z
?Clone@?$Array@H@UnBCL@@UEBAPEAVObject@2@XZ
?Equals@?$Array@H@UnBCL@@UEBAHPEBVObject@2@@Z
??0?$Array@H@UnBCL@@QEAA@PEBU?$ICollection@H@1@@Z
??0NotSupportedException@UnBCL@@QEAA@PEBG@Z
?IsEnvironmentVarSetTrue@Environment@UnBCL@@SAHPEBVString@2@H@Z
??0InvalidOperationException@UnBCL@@QEAA@PEBVString@1@@Z
??0InvalidOperationException@UnBCL@@QEAA@PEBG@Z
??0InvalidOperationException@UnBCL@@QEAA@PEBVString@1@PEAVException@1@@Z
??1InvalidCastException@UnBCL@@UEAA@XZ
??0?$IEnumerator@PEAVString@UnBCL@@@UnBCL@@QEAA@XZ
??0?$IList@H@UnBCL@@QEAA@XZ
??0?$ICollection@E@UnBCL@@QEAA@XZ
??0?$ICollection@H@UnBCL@@QEAA@XZ
??0ISerializable@UnBCL@@QEAA@XZ
??0?$ICollection@PEAVString@UnBCL@@@UnBCL@@QEAA@XZ
??1InvalidOperationException@UnBCL@@UEAA@XZ

wdscore

CurrentIP
ConstructPartialMsgVW
WdsSetupLogMessageW

Exports

Exports

??0CGrowBuffer@Mig@@QEAA@AEBV01@@Z
??0CGrowBuffer@Mig@@QEAA@_K@Z
??1CGrowBuffer@Mig@@UEAA@XZ
??4CGrowBuffer@Mig@@QEAAAEAV01@AEBV01@@Z
??4CStringPatternUtil@Mig@@QEAAAEAV01@AEBV01@@Z
??_7CGrowBuffer@Mig@@6B@
??_FCGrowBuffer@Mig@@QEAAXXZ
?AppendCString@CGrowBuffer@Mig@@QEAAXPEBG@Z
?AppendCStringN@CGrowBuffer@Mig@@QEAAXPEBGI@Z
?AppendString@CGrowBuffer@Mig@@QEAAXPEAVString@UnBCL@@@Z
?AppendStringN@CGrowBuffer@Mig@@QEAAXPEAVString@UnBCL@@I@Z
?CheckVersionLimit@CStringPatternUtil@Mig@@CAHPEAVString@UnBCL@@0HPEAH@Z
?ComparePatterns@CStringPatternUtil@Mig@@SAHPEAVString@UnBCL@@0H@Z
?Copy@CGrowBuffer@Mig@@QEAAXPEBE_K@Z
?EscapeSpecialChars@CStringPatternUtil@Mig@@SAPEAVString@UnBCL@@PEAV34@0G@Z
?EscapeSpecialChars@CStringPatternUtil@Mig@@SAPEAVString@UnBCL@@PEAV34@@Z
?EscapeSpecialCharsInternal@CStringPatternUtil@Mig@@CAPEAVString@UnBCL@@PEAV34@PEBGG@Z
?GetLiteralPrefix@CStringPatternUtil@Mig@@SAPEAVString@UnBCL@@PEAV34@@Z
?Grow@CGrowBuffer@Mig@@QEAAPEAE_K@Z
?HasWildCards@CStringPatternUtil@Mig@@SAHPEAVString@UnBCL@@@Z
?IsFullPattern@CStringPatternUtil@Mig@@SAHPEAVString@UnBCL@@@Z
?IsNumeric@CStringPatternUtil@Mig@@CAHPEAVString@UnBCL@@H@Z
?IsPatternStringValid@CStringPatternUtil@Mig@@CAHPEBGH@Z
?IsPatternStringValid@CStringPatternUtil@Mig@@SAHPEAVString@UnBCL@@@Z
?IsVersionGreater@CStringPatternUtil@Mig@@SAHPEAVString@UnBCL@@0@Z
?IsVersionGreaterOrEqual@CStringPatternUtil@Mig@@SAHPEAVString@UnBCL@@0@Z
?IsVersionNumeric@CStringPatternUtil@Mig@@SAHPEAVString@UnBCL@@H@Z
?IsVersionNumericWorker@CStringPatternUtil@Mig@@CAHPEAVString@UnBCL@@HH@Z
?IsVersionRangeNumeric@CStringPatternUtil@Mig@@SAHPEAVString@UnBCL@@H@Z
?Match@CStringPatternUtil@Mig@@SAHPEAVString@UnBCL@@0@Z
?MatchCI@CStringPatternUtil@Mig@@SAHPEAVString@UnBCL@@0@Z
?MatchCI@CStringPatternUtil@Mig@@SAHPEBG0@Z
?MatchHelper@CStringPatternUtil@Mig@@CAHPEBGHH0HH@Z
?MatchHelperCI@CStringPatternUtil@Mig@@CAHPEBGHH0HH@Z
?MatchListOfPatterns@CStringPatternUtil@Mig@@SAHPEBG00H@Z
?MatchPath@CStringPatternUtil@Mig@@SAHPEAVString@UnBCL@@0@Z
?MatchPath@CStringPatternUtil@Mig@@SAHPEBG0@Z
?MatchPathHelper@CStringPatternUtil@Mig@@CAHPEBGII0II@Z
?MatchVersion@CStringPatternUtil@Mig@@SAHPEAVString@UnBCL@@0@Z
?MatchVersionRange@CStringPatternUtil@Mig@@CAHPEAVString@UnBCL@@0@Z
?MatchVersionSegment@CStringPatternUtil@Mig@@CAHPEAVString@UnBCL@@0@Z
?Reset@CGrowBuffer@Mig@@QEAAXXZ
?Resize@CGrowBuffer@Mig@@AEAAX_K@Z
?Unescape@CStringPatternUtil@Mig@@SAPEAVString@UnBCL@@PEAV34@G@Z
?get_Buffer@CGrowBuffer@Mig@@UEBAPEBEXZ
?get_Length@CGrowBuffer@Mig@@UEBA_KXZ

Sections

.text
Size: 396KB - Virtual size: 396KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 93KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 588KB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

37d3bf940a97a015a14d0e76805fee2d

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

mfc42u

msvcrt

shell32

comctl32

gdiplus

wet

unbcl

wdscore

Exports

Exports

Sections

.text Size: 396KB - Virtual size: 396KB

.data Size: 24KB - Virtual size: 26KB

.pdata Size: 10KB - Virtual size: 10KB

.rsrc Size: 93KB - Virtual size: 92KB

.reloc Size: 588KB - Virtual size: 1.9MB

.text
Size: 396KB - Virtual size: 396KB

.data
Size: 24KB - Virtual size: 26KB

.pdata
Size: 10KB - Virtual size: 10KB

.rsrc
Size: 93KB - Virtual size: 92KB

.reloc
Size: 588KB - Virtual size: 1.9MB