4de7c7e447f6a28c68c7a7949af29469b5df9e5347765a9755435e8daf3fde36

Sharing

Copy URL Twitter E-mail

General

Target

4de7c7e447f6a28c68c7a7949af29469b5df9e5347765a9755435e8daf3fde36
Size

1.1MB
MD5

44c1613964cfb4db328edbf89071afe0
SHA1

1286c36390aea2c63d91d08aa0706a2ac8be6fe3
SHA256

4de7c7e447f6a28c68c7a7949af29469b5df9e5347765a9755435e8daf3fde36
SHA512

831eac136896473633b4f007bb4931b5c375742bf03d47dc9b534bbb941ac3cd8ee96b2456cf0203b4d8cc965e546eb00263f3ff3d7477a92dabfb461db5e1c6
SSDEEP

24576:zo/bRoGOm15/0eLZrQvPgyOpOLCYcxWokC/laM:zolt15/0IZrQngyaOncxW

Score

N/A

Malware Config

Signatures

Files

4de7c7e447f6a28c68c7a7949af29469b5df9e5347765a9755435e8daf3fde36
.exe windows x64

37d3bf940a97a015a14d0e76805fee2d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

Imports

advapi32

AllocateAndInitializeSid
FreeSid
CheckTokenMembership
RegEnumKeyExW
RegCloseKey
RegOpenKeyExW

kernel32

CreateEventW
HeapSetInformation
GetVersionExW
VirtualProtect
Sleep
CloseHandle
GetLastError
GetModuleHandleW
QueryPerformanceCounter
GetProcAddress
UnhandledExceptionFilter
GetCurrentProcess
SetUnhandledExceptionFilter
RtlPcToFileHeader
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
OutputDebugStringA
GetStartupInfoW
SetThreadExecutionState
CreateMutexW
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentThreadId

user32

EnableWindow
RegisterWindowMessageW
IsIconic
SetForegroundWindow
EnumWindows
ShowWindow
SendMessageTimeoutW
MessageBoxW
GetSystemMetrics

mfc42u

ord3164
ord4371
ord4983
ord4770
ord1063
ord5724
ord5065
ord6053
ord4214
ord6813
ord4836
ord2559
ord2515
ord6071
ord4191
ord5630
ord4077
ord5615
ord659
ord3916
ord1430
ord3830
ord2412
ord3468
ord5722
ord4368
ord5730
ord5711
ord5687
ord6437
ord1777
ord4771
ord5406
ord2517
ord1505
ord4598
ord4988
ord4365
ord4752
ord2399
ord5586
ord6812
ord4694
ord4017
ord5229
ord2670
ord2060
ord6814
ord3933
ord5484
ord1736
ord5683
ord2457
ord2140
ord5699
ord6886
ord4083
ord4082
ord3046
ord3166
ord3052
ord3366
ord3231
ord4815
ord3362
ord3243
ord3049
ord5636
ord6887
ord1584
ord1463
ord1388

msvcrt

__set_app_type
_unlock
__dllonexit
_lock
_amsg_exit
??1type_info@@UEAA@XZ
memcpy
memset
memmove
??0__non_rtti_object@@QEAA@PEBD@Z
??1__non_rtti_object@@UEAA@XZ
??0__non_rtti_object@@QEAA@AEBV0@@Z
??0bad_typeid@@QEAA@AEBV0@@Z
??0bad_cast@@QEAA@PEBD@Z
??1bad_cast@@UEAA@XZ
??0bad_cast@@QEAA@AEBV0@@Z
?terminate@@YAXXZ
isdigit
mbtowc
_fmode
isleadbyte
isxdigit
localeconv
wctomb
iswctype
wcstombs
realloc
__badioinfo
__pioinfo
_read
_fileno
ungetc
_initterm
_wcmdln
exit
_cexit
_commode
__mb_cur_max
__setusermatherr
?name@type_info@@QEBAPEBDXZ
_set_error_mode
free
calloc
malloc
wprintf
_purecall
__CxxFrameHandler
_errno
??0exception@@QEAA@AEBQEBDH@Z
_onexit
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
_CxxThrowException
_callnewh
__wgetmainargs
__C_specific_handler
_XcptFilter
_exit
wcschr
towlower
wcspbrk
iswdigit

shell32

ShellExecuteW

comctl32

InitCommonControlsEx

gdiplus

GdiplusShutdown
GdiplusStartup

wet

?OnWizHelp@CWiz@@MEAAHXZ
??1CWetCommandLineInfo@@UEAA@XZ
??1CSQMData@@UEAA@XZ
?RegisterControlClass@CMigrationCheckBox@@SAXPEAUHINSTANCE__@@@Z
?UnregisterControlClass@CMigrationCheckBox@@SAXPEAUHINSTANCE__@@@Z
?WizLib_OnInitInstance@@YAHXZ
?GetWetBuildVersion@@YAPEAVString@UnBCL@@XZ
?RegisterControlClass@CMigrationStatus@@SAXPEAUHINSTANCE__@@@Z
?UnregisterControlClass@CMigrationStatus@@SAXPEAUHINSTANCE__@@@Z
?LoadResourceString@@YAPEAGI@Z
?RegisterControlClass@CEnhancedStatic@@SAXPEAUHINSTANCE__@@@Z
?UnregisterControlClass@CEnhancedStatic@@SAXPEAUHINSTANCE__@@@Z
?RegisterControlClass@CMigrationDetail@@SAXPEAUHINSTANCE__@@@Z
?UnregisterControlClass@CMigrationDetail@@SAXPEAUHINSTANCE__@@@Z
?RegisterControlClass@CWinListBox@@SAXPEAUHINSTANCE__@@@Z
?UnregisterControlClass@CWinListBox@@SAXPEAUHINSTANCE__@@@Z
??0CWetCommandLineInfo@@QEAA@XZ
?ParseParam@CWetCommandLineInfo@@UEAAXPEBGHH@Z
?GetError@CWetCommandLineInfo@@UEBAHXZ
?SetError@CWetCommandLineInfo@@UEAAXH@Z
?GetRunId@CWetCommandLineInfo@@UEBAKXZ
?GetMigFile@CWetCommandLineInfo@@UEBAPEAVString@UnBCL@@XZ
?get_ConnectionMedia@CWetCommandLineInfo@@UEBAPEAW4CONNECTION_MEDIA@@XZ
?get_EndPoint@CWetCommandLineInfo@@UEBAPEAEXZ
?get_ConnectionKey@CWetCommandLineInfo@@UEBAPEAVString@UnBCL@@XZ
?get_EncryptionKey@CWetCommandLineInfo@@UEBAPEAVString@UnBCL@@XZ
?get_PeerUpdate@CWetCommandLineInfo@@UEBAHXZ
?get_OldWindowHandle@CWetCommandLineInfo@@UEBAPEAUHWND__@@XZ
?get_PageHistory@CWetCommandLineInfo@@UEBAPEAVString@UnBCL@@XZ
?get_PrintWetVersion@CWetCommandLineInfo@@UEAAHXZ
?GetRuntimeClass@CWiz@@UEBAPEAUCRuntimeClass@@XZ
?SetIcon@CWiz@@QEAAXI@Z
?OnWizQuit@CWiz@@MEAAHXZ
?DrawBackground@CWiz@@MEAAXAEAVCDC@@@Z
?DoDataExchange@CWiz@@MEAAXPEAVCDataExchange@@@Z
?OnOK@CWiz@@MEAAXXZ
?OnCancel@CWiz@@MEAAXXZ
?classCBusinessLogicThread@CBusinessLogicThread@@2UCRuntimeClass@@B
?g_wetLocale@@3KA
?IsLocaleSupported@@YAHK@Z
??0CThemeManager@@QEAA@XZ
??1CThemeManager@@QEAA@XZ
?RegisterControlClass@CElementMap@@SAXPEAUHINSTANCE__@@@Z
?UnregisterControlClass@CElementMap@@SAXPEAUHINSTANCE__@@@Z
?RegisterControlClass@CMigrationError@@SAXPEAUHINSTANCE__@@@Z
??0CWizardFrame@@QEAA@PEBGPEAVCWnd@@IPEAVCThemeManager@@W4PageBackgroundThemeType@@PEAUCRuntimeClass@@PEAXKPEAVString@UnBCL@@@Z
??1CWizardFrame@@UEAA@XZ
?Initialize@CWizardFrame@@UEAAXXZ
?AddPage@CWizardFrame@@UEAAXPEAVCWizardPage@@@Z
?ReplacePage@CWizardFrame@@UEAAXPEAVCWizardPage@@0@Z
?GetPageById@CWizardFrame@@UEBAPEAVCWizardPage@@I@Z
?PostLocalBlMessage@CWizardFrame@@UEAAHI_K_J@Z
?PostBlMessage@CWizardFrame@@UEAAHI_K_J@Z
?SetActivePageById@CWizardFrame@@UEAAXI@Z
?SetFirstPage@CWizardFrame@@UEAAXI@Z
?SetNextButton@CWizardFrame@@UEAAXW4NEXT_BUTTON_NAME@@W4NEXT_BUTTON_STATE@@@Z
?SetBackButton@CWizardFrame@@UEAAXW4BACK_BUTTON_STATE@@@Z
?ShowNextPage@CWizardFrame@@UEAAXI@Z
?UpdatePageIdDisplay@CWizardFrame@@UEAAXI@Z
?IsApplyAllowed@CWizardFrame@@UEBAHXZ
?get_PeerUpdate@CWizardFrame@@UEBAHXZ
?set_PeerUpdate@CWizardFrame@@UEAAXH@Z
?PlaceOverOldWet@CWizardFrame@@UEAAXXZ
?ScanForUsbCable@CWizardFrame@@UEAAHXZ
?SetTransferMode@CWizardFrame@@UEAAXE@Z
?OnEndSession@CWizardFrame@@UEAAHXZ
?OnQueryEndSession@CWizardFrame@@UEAAHXZ
?OnHelpInfo@CWizardFrame@@UEAAHPEAUtagHELPINFO@@@Z
?OnMove@CWizardFrame@@UEAAXHH@Z
?SetEndPoint@CWizardFrame@@UEAAXE@Z
?SetWizardPath@CWizardFrame@@UEAAXW4WIZARD_PATH@@@Z
?GetWizardPath@CWizardFrame@@UEAA?AW4WIZARD_PATH@@XZ
?SetPageToReset@CWizardFrame@@UEAAXPEAVCWizardPage@@@Z
?ResetPage@CWizardFrame@@UEAAXPEAVCWizardPage@@@Z
?ResetConnectionAndPeerUpdatePages@CWizardFrame@@UEAAXXZ
?CheckAndPerformPageReset@CWizardFrame@@UEAAXPEAVCWizardPage@@@Z
?SetStoreFileWasLoaded@CWizardFrame@@UEAAXH@Z
?CancelConnectedTransport@CWizardFrame@@UEAAXXZ
?ShowWaitCursor@CWizardFrame@@UEAAXH@Z
?EnableUserInput@CWizardFrame@@UEAAXH@Z
?GetMessageMap@CWizardFrame@@MEBAPEBUAFX_MSGMAP@@XZ
?OnInitDialog@CWizardFrame@@MEAAHXZ
?PostNcDestroy@CWizardFrame@@MEAAXXZ
?OnSysColorChange@CWizardFrame@@MEAAXXZ
?OnPowerBroadcast@CWizardFrame@@MEAA_J_K_J@Z
?OnCtlColor@CWizardFrame@@MEAAPEAUHBRUSH__@@PEAVCDC@@PEAVCWnd@@I@Z
?PreTranslateMessage@CWizardFrame@@MEAAHPEAUtagMSG@@@Z
?OnSetCursor@CWizardFrame@@MEAAHPEAVCWnd@@II@Z
?AutomatedStart@CWizardFrame@@MEAAXXZ
?PlaceUnderOldWet@CWizardFrame@@MEAAXXZ
?OnWizBack@CWizardFrame@@MEAAHXZ
?OnWizNext@CWizardFrame@@MEAAHXZ
?OnBlShutdownDone@CWizardFrame@@MEAA_J_K_J@Z
?OnCommand@CWizardFrame@@MEAAH_K_J@Z
?OnGetDefId@CWizardFrame@@MEAA_J_K_J@Z
?OnTimerTick@CWizardFrame@@MEAA_J_K_J@Z
??0CSQMData@@QEAA@XZ
?SendSQMData@CSQMData@@QEAAXXZ
?SetThreadLocalizedResources@@YAXXZ
?UnregisterControlClass@CMigrationError@@SAXPEAUHINSTANCE__@@@Z

unbcl

??1StringBuilder@UnBCL@@UEAA@XZ
??0StringBuilder@UnBCL@@QEAA@XZ
?IndexOf@String@UnBCL@@QEBAHG@Z
?get_Length@String@UnBCL@@QEBAHXZ
?Free@Allocator@UnBCL@@SAXPEAXI@Z
??0OutOfMemoryException@UnBCL@@QEAA@XZ
?Alloc@Allocator@UnBCL@@SAPEAX_KI@Z
?ReAlloc@Allocator@UnBCL@@SAPEAXPEAX_KI@Z
?Trim@String@UnBCL@@QEBAPEAV12@XZ
?Append@StringBuilder@UnBCL@@QEAAPEAV12@G@Z
?ToString@StringBuilder@UnBCL@@UEBAPEAVString@2@XZ
?get_P@?$SmartPtr@VString@UnBCL@@@UnBCL@@QEBAPEAVString@2@XZ
?EndsWith@String@UnBCL@@QEBAHPEBGH@Z
?Remove@String@UnBCL@@QEBAPEAV12@HH@Z
?Combine@Path@UnBCL@@SAPEAVString@2@PEBV32@0@Z
??1OutOfMemoryException@UnBCL@@UEAA@XZ
??0?$SmartPtr@V?$ArrayList@PEAVString@UnBCL@@@UnBCL@@@UnBCL@@QEAA@PEAV?$ArrayList@PEAVString@UnBCL@@@1@@Z
?Split@String@UnBCL@@QEBAPEAV?$ArrayList@PEAVString@UnBCL@@@2@PEBG@Z
??1?$SmartPtr@V?$ArrayList@PEAVString@UnBCL@@@UnBCL@@@UnBCL@@UEAA@XZ
??C?$SmartPtr@V?$ArrayList@PEAVString@UnBCL@@@UnBCL@@@UnBCL@@QEBAPEAV?$ArrayList@PEAVString@UnBCL@@@1@XZ
??1ArgumentNullException@UnBCL@@UEAA@XZ
??1ArgumentException@UnBCL@@UEAA@XZ
??1ArgumentOutOfRangeException@UnBCL@@UEAA@XZ
??_D?$Array@H@UnBCL@@QEAAXXZ
??1?$ICollection@H@UnBCL@@UEAA@XZ
??1?$IList@H@UnBCL@@UEAA@XZ
??1ISerializable@UnBCL@@UEAA@XZ
??1NotSupportedException@UnBCL@@UEAA@XZ
??0ArgumentOutOfRangeException@UnBCL@@QEAA@PEBG@Z
?MemAllocFailed@Allocator@UnBCL@@SAHXZ
??C?$SmartPtr@VString@UnBCL@@@UnBCL@@QEBAPEAVString@1@XZ
??D?$SmartPtr@VString@UnBCL@@@UnBCL@@QEBAAEAVString@1@XZ
??4?$SmartPtr@VString@UnBCL@@@UnBCL@@QEAAAEAV01@AEBV01@@Z
??1?$SmartPtr@VString@UnBCL@@@UnBCL@@UEAA@XZ
??0?$SmartPtr@VString@UnBCL@@@UnBCL@@QEAA@PEAVString@1@@Z
??0InvalidCastException@UnBCL@@QEAA@XZ
?SanitizeTypeName@SerializationStream@UnBCL@@SAPEAVString@2@AEBV32@@Z
?GetCallingModule@SerializationStream@UnBCL@@SAPEAUHINSTANCE__@@XZ
?CanRegister@SerializationStream@UnBCL@@SAHXZ
?UnregisterType@SerializationStream@UnBCL@@SAXPEBVString@2@HPEAUHINSTANCE__@@@Z
?RegisterType@SerializationStream@UnBCL@@SAXPEBVString@2@HPEAUHINSTANCE__@@PEAUIInstanceFactory@2@@Z
??5SerializationStream@UnBCL@@QEAAAEAV01@AEAH@Z
??5SerializationStream@UnBCL@@QEAAAEAV01@AEAI@Z
??5SerializationStream@UnBCL@@QEAAAEAV01@AEAE@Z
??5SerializationStream@UnBCL@@QEAAAEAV01@AEAPEAVString@1@@Z
??5SerializationStream@UnBCL@@QEAAAEAV01@AEAPEAUISerializable@1@@Z
??6SerializationStream@UnBCL@@QEAAAEAV01@H@Z
??6SerializationStream@UnBCL@@QEAAAEAV01@I@Z
??6SerializationStream@UnBCL@@QEAAAEAV01@E@Z
??6SerializationStream@UnBCL@@QEAAAEAV01@PEBVString@1@@Z
??6SerializationStream@UnBCL@@QEAAAEAV01@PEBUISerializable@1@@Z
?ReadBytes@SerializationStream@UnBCL@@QEAAXPEAEH@Z
?WriteBytes@SerializationStream@UnBCL@@QEAAXPEBEH@Z
??0ArgumentException@UnBCL@@QEAA@PEBG@Z
?SetMessage@Exception@UnBCL@@MEAAXPEAVString@2@@Z
?set_HResult@Exception@UnBCL@@MEAAXJ@Z
?get_HResult@Exception@UnBCL@@UEBAJXZ
?GetBaseException@Exception@UnBCL@@UEBAPEBV12@XZ
?AddStackTrace@Exception@UnBCL@@QEAAXPEBD@Z
?set_Source@Exception@UnBCL@@UEAAXPEBVString@2@@Z
?get_Source@Exception@UnBCL@@UEBAPEBVString@2@XZ
?get_Message@Exception@UnBCL@@UEBAPEBVString@2@XZ
?get_InnerException@Exception@UnBCL@@UEBAPEBV12@XZ
?ToString@Exception@UnBCL@@UEBAPEAVString@2@XZ
??1Exception@UnBCL@@UEAA@XZ
??0Exception@UnBCL@@QEAA@PEBG@Z
?EnqueueSbRegistration@SbRegistrationList@UnBCL@@SAXPEBDHPEAUHINSTANCE__@@PEAUIInstanceFactory@2@@Z
?FromASCII@String@UnBCL@@SAPEAV12@PEBD@Z
?Concat@String@UnBCL@@SAPEAV12@PEBG0@Z
?get_CString@String@UnBCL@@QEBAPEBGXZ
?CompareTo@String@UnBCL@@UEBAHPEBVObject@2@@Z
?Clone@String@UnBCL@@UEBAPEAVObject@2@XZ
?ToString@String@UnBCL@@UEBAPEAV12@XZ
?GetHashCode@String@UnBCL@@UEBAHXZ
?Equals@String@UnBCL@@UEBAHPEBVObject@2@@Z
??1String@UnBCL@@UEAA@XZ
??0String@UnBCL@@QEAA@PEBG@Z
??0String@UnBCL@@QEAA@AEBV01@@Z
?SetLiteralStorage@_@UnBCL@@YAXPEAPEBVString@2@PEBG@Z
??0ArgumentNullException@UnBCL@@QEAA@PEBG@Z
?DecRef@Object@UnBCL@@QEAAHXZ
?AddRef@Object@UnBCL@@QEAAXXZ
??3Object@UnBCL@@SAXPEAX@Z
??2Object@UnBCL@@SAPEAX_K@Z
??2Object@UnBCL@@SAPEAX_KI@Z
?Clone@Object@UnBCL@@UEBAPEAV12@XZ
?CompareTo@Object@UnBCL@@UEBAHPEBV12@@Z
?GetObjectID@Object@UnBCL@@UEBAIXZ
?ToString@Object@UnBCL@@UEBAPEAVString@2@XZ
?GetType@Object@UnBCL@@UEBAPEAVType@2@XZ
?GetHashCode@Object@UnBCL@@UEBAHXZ
?Equals@Object@UnBCL@@UEBAHPEBV12@@Z
??1Object@UnBCL@@UEAA@XZ
??0Object@UnBCL@@QEAA@XZ
??0Object@UnBCL@@QEAA@AEBV01@@Z
?Clone@?$Array@H@UnBCL@@UEBAPEAVObject@2@XZ
?Equals@?$Array@H@UnBCL@@UEBAHPEBVObject@2@@Z
??0?$Array@H@UnBCL@@QEAA@PEBU?$ICollection@H@1@@Z
??0NotSupportedException@UnBCL@@QEAA@PEBG@Z
?IsEnvironmentVarSetTrue@Environment@UnBCL@@SAHPEBVString@2@H@Z
??0InvalidOperationException@UnBCL@@QEAA@PEBVString@1@@Z
??0InvalidOperationException@UnBCL@@QEAA@PEBG@Z
??0InvalidOperationException@UnBCL@@QEAA@PEBVString@1@PEAVException@1@@Z
??1InvalidCastException@UnBCL@@UEAA@XZ
??0?$IEnumerator@PEAVString@UnBCL@@@UnBCL@@QEAA@XZ
??0?$IList@H@UnBCL@@QEAA@XZ
??0?$ICollection@E@UnBCL@@QEAA@XZ
??0?$ICollection@H@UnBCL@@QEAA@XZ
??0ISerializable@UnBCL@@QEAA@XZ
??0?$ICollection@PEAVString@UnBCL@@@UnBCL@@QEAA@XZ
??1InvalidOperationException@UnBCL@@UEAA@XZ

wdscore

CurrentIP
ConstructPartialMsgVW
WdsSetupLogMessageW

Exports

Exports

??0CGrowBuffer@Mig@@QEAA@AEBV01@@Z
??0CGrowBuffer@Mig@@QEAA@_K@Z
??1CGrowBuffer@Mig@@UEAA@XZ
??4CGrowBuffer@Mig@@QEAAAEAV01@AEBV01@@Z
??4CStringPatternUtil@Mig@@QEAAAEAV01@AEBV01@@Z
??_7CGrowBuffer@Mig@@6B@
??_FCGrowBuffer@Mig@@QEAAXXZ
?AppendCString@CGrowBuffer@Mig@@QEAAXPEBG@Z
?AppendCStringN@CGrowBuffer@Mig@@QEAAXPEBGI@Z
?AppendString@CGrowBuffer@Mig@@QEAAXPEAVString@UnBCL@@@Z
?AppendStringN@CGrowBuffer@Mig@@QEAAXPEAVString@UnBCL@@I@Z
?CheckVersionLimit@CStringPatternUtil@Mig@@CAHPEAVString@UnBCL@@0HPEAH@Z
?ComparePatterns@CStringPatternUtil@Mig@@SAHPEAVString@UnBCL@@0H@Z
?Copy@CGrowBuffer@Mig@@QEAAXPEBE_K@Z
?EscapeSpecialChars@CStringPatternUtil@Mig@@SAPEAVString@UnBCL@@PEAV34@0G@Z
?EscapeSpecialChars@CStringPatternUtil@Mig@@SAPEAVString@UnBCL@@PEAV34@@Z
?EscapeSpecialCharsInternal@CStringPatternUtil@Mig@@CAPEAVString@UnBCL@@PEAV34@PEBGG@Z
?GetLiteralPrefix@CStringPatternUtil@Mig@@SAPEAVString@UnBCL@@PEAV34@@Z
?Grow@CGrowBuffer@Mig@@QEAAPEAE_K@Z
?HasWildCards@CStringPatternUtil@Mig@@SAHPEAVString@UnBCL@@@Z
?IsFullPattern@CStringPatternUtil@Mig@@SAHPEAVString@UnBCL@@@Z
?IsNumeric@CStringPatternUtil@Mig@@CAHPEAVString@UnBCL@@H@Z
?IsPatternStringValid@CStringPatternUtil@Mig@@CAHPEBGH@Z
?IsPatternStringValid@CStringPatternUtil@Mig@@SAHPEAVString@UnBCL@@@Z
?IsVersionGreater@CStringPatternUtil@Mig@@SAHPEAVString@UnBCL@@0@Z
?IsVersionGreaterOrEqual@CStringPatternUtil@Mig@@SAHPEAVString@UnBCL@@0@Z
?IsVersionNumeric@CStringPatternUtil@Mig@@SAHPEAVString@UnBCL@@H@Z
?IsVersionNumericWorker@CStringPatternUtil@Mig@@CAHPEAVString@UnBCL@@HH@Z
?IsVersionRangeNumeric@CStringPatternUtil@Mig@@SAHPEAVString@UnBCL@@H@Z
?Match@CStringPatternUtil@Mig@@SAHPEAVString@UnBCL@@0@Z
?MatchCI@CStringPatternUtil@Mig@@SAHPEAVString@UnBCL@@0@Z
?MatchCI@CStringPatternUtil@Mig@@SAHPEBG0@Z
?MatchHelper@CStringPatternUtil@Mig@@CAHPEBGHH0HH@Z
?MatchHelperCI@CStringPatternUtil@Mig@@CAHPEBGHH0HH@Z
?MatchListOfPatterns@CStringPatternUtil@Mig@@SAHPEBG00H@Z
?MatchPath@CStringPatternUtil@Mig@@SAHPEAVString@UnBCL@@0@Z
?MatchPath@CStringPatternUtil@Mig@@SAHPEBG0@Z
?MatchPathHelper@CStringPatternUtil@Mig@@CAHPEBGII0II@Z
?MatchVersion@CStringPatternUtil@Mig@@SAHPEAVString@UnBCL@@0@Z
?MatchVersionRange@CStringPatternUtil@Mig@@CAHPEAVString@UnBCL@@0@Z
?MatchVersionSegment@CStringPatternUtil@Mig@@CAHPEAVString@UnBCL@@0@Z
?Reset@CGrowBuffer@Mig@@QEAAXXZ
?Resize@CGrowBuffer@Mig@@AEAAX_K@Z
?Unescape@CStringPatternUtil@Mig@@SAPEAVString@UnBCL@@PEAV34@G@Z
?get_Buffer@CGrowBuffer@Mig@@UEBAPEBEXZ
?get_Length@CGrowBuffer@Mig@@UEBA_KXZ

Sections

.text
Size: 396KB - Virtual size: 396KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 93KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 564KB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

37d3bf940a97a015a14d0e76805fee2d

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

mfc42u

msvcrt

shell32

comctl32

gdiplus

wet

unbcl

wdscore

Exports

Exports

Sections

.text Size: 396KB - Virtual size: 396KB

.data Size: 24KB - Virtual size: 26KB

.pdata Size: 10KB - Virtual size: 10KB

.rsrc Size: 93KB - Virtual size: 92KB

.reloc Size: 564KB - Virtual size: 1.9MB

.text
Size: 396KB - Virtual size: 396KB

.data
Size: 24KB - Virtual size: 26KB

.pdata
Size: 10KB - Virtual size: 10KB

.rsrc
Size: 93KB - Virtual size: 92KB

.reloc
Size: 564KB - Virtual size: 1.9MB