6e3ca94e94a31c44ce729f9b4fa11451fd8e9b71409931d580c39af63e0225d6

Sharing

Copy URL Twitter E-mail

General

Target

6e3ca94e94a31c44ce729f9b4fa11451fd8e9b71409931d580c39af63e0225d6
Size

648KB
MD5

b3b19c4f360ec9fe9ca8c34a5e2b7544
SHA1

8ac9e587cafd51d7f162859a9d96f093d75f3392
SHA256

6e3ca94e94a31c44ce729f9b4fa11451fd8e9b71409931d580c39af63e0225d6
SHA512

66b3e54ba0fec854dcb890c7d5d5d894d09abba13252bdffaaab33d9bf28cd0c9ea744600e15e617b9e2755fc6c93d51ca1e239378bc07d90865887d0feb5ea9
SSDEEP

6144:TuV2l28cL70t/9BOcWaKDDWwzRG2UrJv4o9lVACyOttbN1ZdIxpdBZD+7yHltcHF:TCK3229BsOrJvZdKcHtoD4

Score

N/A

Malware Config

Signatures

Files

6e3ca94e94a31c44ce729f9b4fa11451fd8e9b71409931d580c39af63e0225d6
.dll regsvr32 windows x86

1713d131c98fae7c014c42976fb0bb97

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcmpiA
SizeofResource
LoadResource
FindResourceA
GetLastError
GetModuleFileNameA
FreeLibrary
IsDBCSLeadByte
DisableThreadLibraryCalls
HeapAlloc
GetSystemInfo
GetVersionExA
LoadLibraryExA
lstrcpynA
HeapDestroy
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
lstrcatA
GetProcAddress
LoadLibraryA
InterlockedDecrement
InterlockedIncrement
DebugBreak
HeapReAlloc
HeapFree
GetModuleHandleA
GetShortPathNameA
WideCharToMultiByte
GetSystemDefaultLCID
lstrlenW
HeapCreate
InitializeCriticalSection
lstrlenA
GetStringTypeW
lstrcpyA
RtlUnwind
MultiByteToWideChar
GetStringTypeA

user32

LoadStringA
GetActiveWindow
CharNextA

advapi32

RegEnumKeyExA
RegSetValueExA
RegDeleteValueA
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegQueryInfoKeyA
RegDeleteKeyA
RegEnumValueA

ole32

ProgIDFromCLSID
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoCreateInstance

oleaut32

SafeArrayGetDim
SafeArrayPutElement
SafeArrayGetElemsize
VarBstrFromI1
VarR8FromUI2
VarBstrFromUI2
SetErrorInfo
CreateErrorInfo
SysFreeString
VariantChangeType
VariantInit
VariantCopy
SysAllocStringLen
SysStringLen
VarBstrFromDate
VariantClear
VarBstrFromBool
VarR8FromBool
SafeArrayCreate
VarR8FromI1
VarBstrFromUI1
VarR8FromUI1
LoadTypeLi
LoadRegTypeLi
VarBstrFromUI4
VarR8FromUI4
VarR8FromStr
VarBstrFromI2
VarR8FromI2
VarBstrFromI4
VarR8FromI4
VarBstrFromR4
VarR8FromR4
VarBstrFromR8
VarBstrFromCy
VarR8FromCy
VarR8FromDate
SysAllocString
VarUI4FromStr
RegisterTypeLi

basroot

??1CExtFIELD_HEAD@@UAE@XZ
?SetMaxVal@CExtFIELD_HEAD@@QAEFPAD@Z
??8CATT_STRU@@QAEFAAV0@@Z
??0CATT_STRU@@QAE@F@Z
??0CATT_STRU@@QAE@PAV0@@Z
?InsertFld@CATT_STRU@@QAEFFPAVCFIELD_HEAD@@F@Z
?DelFld@CATT_STRU@@QAEFF@Z
?AppendFld@CATT_STRU@@QAEFFPAVCFIELD_HEAD@@@Z
??1CFIELD_HEAD@@UAE@XZ
??0CFIELD_HEAD@@QAE@PAV0@@Z
??1CATT_STRU@@UAE@XZ
??0CATT_STRU@@QAE@XZ
?CalSize@CATT_STRU@@UAEJXZ
?Load@CATT_STRU@@UAEFPAVCMapGisFile@@J@Z
?Load@CATT_STRU@@UAEJPADIJ@Z
?Load@CATT_STRU@@UAEFPAVCFile@@J@Z
?Load@CATT_STRU@@UAEFHJ@Z
?Save@CATT_STRU@@UAEJPAVCMapGisFile@@J@Z
?Save@CATT_STRU@@UAEJPADIJ@Z
?Save@CATT_STRU@@UAEJPAVCFile@@J@Z
?Save@CATT_STRU@@UAEJHJ@Z
??4CFIELD_HEAD@@QAEFAAV0@@Z
?Save@CFIELD_HEAD@@QAEJPADIJ@Z
?Load@CFIELD_HEAD@@QAEJPADIJ@Z
?CalSize@CFIELD_HEAD@@QAEJXZ
?DelExtFIELD_HEAD@CFIELD_HEAD@@QAEFXZ
?SetExtFIELD_HEAD@CFIELD_HEAD@@QAEFPAVCExtFIELD_HEAD@@@Z
?HasExtFIELD_HEAD@CFIELD_HEAD@@QAEFXZ
?GetExtFIELD_HEAD@CFIELD_HEAD@@QAEPAVCExtFIELD_HEAD@@XZ
??8CFIELD_HEAD@@QAEFAAV0@@Z
?Set@CFIELD_HEAD@@QAEFPAV1@@Z
?SetMinVal@CExtFIELD_HEAD@@QAEFN@Z
?SetMaxVal@CExtFIELD_HEAD@@QAEFN@Z
?SetDefVal@CExtFIELD_HEAD@@QAEFN@Z
?SetShapeInfo@CExtFIELD_HEAD@@QAEFFPADN@Z
?SetShapeInfo@CExtFIELD_HEAD@@QAEFFPAD0@Z
?SetDefVal@CExtFIELD_HEAD@@QAEFPAD@Z
?SetMinVal@CExtFIELD_HEAD@@QAEFPAD@Z
?HasMinVal@CExtFIELD_HEAD@@QAEFXZ
??4CATT_STRU@@QAEFAAV0@@Z
??1ASK_DB_RCD@@QAE@XZ
??0ASK_DB_RCD@@QAE@H@Z
?HasDefVal@CExtFIELD_HEAD@@QAEFXZ
?HasMaxVal@CExtFIELD_HEAD@@QAEFXZ
??0CExtFIELD_HEAD@@QAE@DF@Z
?GetDefVal@CExtFIELD_HEAD@@QAEFPADJ@Z
?GetFieldType@CExtFIELD_HEAD@@QAEFXZ
?GetMaxVal@CExtFIELD_HEAD@@QAEFPADJ@Z
?GetMinVal@CExtFIELD_HEAD@@QAEFPADJ@Z
?GetShapeInfo@CExtFIELD_HEAD@@QAEFFPADJ0J@Z
?GetShapeInfoNum@CExtFIELD_HEAD@@QAEFXZ

basfile

?SetLength@CSmartFile@@QAEXK@Z
?SeekToEnd@CSmartFile@@QAEKXZ
?Seek@CSmartFile@@QAEJJI@Z
??1CSmartFile@@UAE@XZ
??0CSmartFile@@QAE@DIPBDI@Z
?Write@CSmartFile@@QAEXPBXI@Z
?ReadMemPtr@CSmartFile@@QAEPAXI@Z

bas60

ord415
ord12
ord672
ord1491
ord129
ord128
ord239
ord470
ord340
ord756
ord154
ord220
ord348
ord645
ord644
ord647
ord1505
ord1504
ord408
ord60
ord59
ord58
ord57
ord297
ord409
ord410
ord350
ord246
ord245
ord56
ord55
ord54
ord150
ord234
ord32
ord146
ord734
ord751
ord741
ord745
ord105
ord365
ord207
ord206
ord998
ord947
ord114
ord1501
ord121
ord1500
ord366
ord1506
ord738
ord739
ord364
ord98
ord164
ord166
ord167
ord87
ord88
ord900
ord901
ord170
ord171
ord26
ord174
ord248
ord163
ord83
ord84
ord2260
ord91
ord17
ord18
ord21
ord23
ord22
ord16
ord730
ord732
ord731
ord748
ord749
ord418
ord419
ord420
ord194
ord195
ord196
ord197
ord198
ord199
ord924
ord925
ord891
ord892
ord893
ord894
ord895
ord896
ord897
ord898
ord899
ord842
ord843
ord844
ord848
ord186
ord187
ord283
ord76
ord162
ord19
ord20
ord367
ord368
ord417
ord744
ord740
ord733
ord28
ord29
ord303
ord144
ord30
ord232
ord148
ord1550
ord27
ord34
ord35
ord1554
ord1555
ord1556
ord36
ord37
ord38
ord39
ord153
ord922
ord175
ord1502
ord382
ord363
ord545
ord546
ord520
ord522
ord549
ord521
ord547
ord548
ord523
ord531
ord524
ord544
ord536
ord537
ord538
ord539
ord542
ord543
ord380
ord379
ord381
ord533
ord526
ord527
ord532
ord168
ord169
ord700
ord701
ord702
ord703
ord704
ord705
ord706
ord707
ord708
ord709
ord710
ord711
ord712
ord713
ord714
ord715
ord716
ord717
ord718
ord719
ord720
ord14
ord8
ord755
ord421
ord142
ord820
ord821
ord822
ord823
ord824
ord825
ord826
ord827
ord157
ord159
ord160
ord158
ord667
ord193
ord1490
ord250
ord190
ord640
ord641
ord646
ord642
ord643
ord223
ord224
ord225
ord221
ord222
ord176
ord416
ord200
ord948
ord45
ord251
ord212
ord213
ord214
ord215
ord796
ord797
ord798
ord799
ord216
ord217
ord218
ord219
ord630
ord631
ord669
ord211
ord1508
ord1509
ord1511
ord1512
ord917
ord918
ord919
ord912
ord920
ord921
ord840
ord841
ord839
ord161
ord838
ord143
ord280
ord188
ord541
ord77
ord79
ord1507
ord81
ord86
ord90
ord189
ord226
ord227
ord228
ord229
ord230
ord923
ord1002
ord2100
ord112
ord2
ord9
ord10
ord11
ord525
ord179
ord746
ord742
ord752
ord735
ord147
ord33
ord235
ord152
ord52
ord281
ord282
ord61
ord62
ord63
ord64
ord65
ord66
ord67
ord299
ord343
ord344
ord345
ord1503
ord156
ord758
ord178
ord151
ord42
ord47
ord40
ord41
ord44
ord335
ord46
ord48
ord1577
ord1581
ord1575
ord1576
ord1578
ord1579
ord1580
ord1582
ord43
ord266
ord267
ord268
ord269
ord270
ord271
ord278
ord279
ord347
ord293
ord49
ord272
ord332
ord333
ord273
ord274
ord275
ord276
ord277
ord50
ord51
ord351
ord352
ord353
ord354
ord355
ord356
ord357
ord358
ord359
ord360
ord361
ord362
ord1564
ord336
ord337
ord338
ord53
ord285
ord286
ord287
ord400
ord288
ord289
ord301
ord346
ord177
ord145
ord31
ord233
ord149
ord69
ord70
ord590
ord1562
ord1563
ord743
ord1565
ord1566
ord68
ord236
ord71
ord72
ord73
ord74
ord75
ord747
ord946
ord736
ord155
ord757
ord944
ord945
ord191
ord192
ord201
ord202
ord203

w60area

ord179
ord12
ord23
ord22
ord177
ord24
ord25
ord27
ord26
ord28
ord29
ord68
ord67
ord74
ord270
ord271
ord81
ord82
ord308
ord353
ord10
ord170
ord172
ord174
ord13
ord306
ord176
ord178
ord95
ord96
ord65
ord66
ord75
ord97
ord109
ord180
ord190
ord500
ord315
ord307
ord305
ord11
ord173
ord171
ord313
ord314
ord312
ord311
ord400
ord9
ord202
ord352
ord351
ord350
ord8
ord52
ord300
ord302
ord304
ord303
ord301
ord309
ord316
ord310
ord3
ord94
ord175
ord2
ord91
ord401
ord92

topo60

ord58
ord51
ord50
ord27
ord22
ord21
ord28
ord57
ord25
ord56
ord2
ord24
ord29
ord26
ord23

w60anly

ord200
ord22
ord14
ord13
ord12
ord10
ord7
ord6
ord5
ord4
ord121
ord3
ord201

Exports

Exports

CvtAtt2IRecord
CvtCATT_STRU2IRecord_Head
CvtIArc_Alloc_Info2ARC_ALLOC_INFO
CvtIDList2List
CvtID_3Dot2D_3DOT
CvtID_3DotSet2D_3DOT
CvtID_Dot2D_DOT
CvtID_DotSet2D_DOT
CvtID_Rect2D_RECT
CvtIDate_Stru2DATE_STRU
CvtIExt_Link_Db_Info2EXT_LINK_DB_INFO
CvtIGisEnv2GISENV
CvtIL_3Dot2L_3DOT
CvtIL_3DotSet2L_3DOT
CvtIL_Dot2L_DOT
CvtIL_DotSet2L_DOT
CvtILin_Info2LIN_INFO
CvtILin_Pad2LIN_PAD
CvtILin_Top2LIN_TOP
CvtIMap_Para2MAP_PARA
CvtINet_Info2NET_INFO
CvtINet_Pad2NET_PAD
CvtINod_Barrier_Info2NOD_BARRIER_INFO
CvtINod_Center_Info2NOD_CENTER_INFO
CvtINod_Stop_Info2NOD_STOP_INFO
CvtIPnt_Info2PNT_INFO
CvtIPnt_Pad2PNT_PAD
CvtIRecord2Att
CvtIRecord_Head2CATT_STRU
CvtIReg_Info2REG_INFO
CvtIReg_Pad2REG_PAD
CvtITic_Dot2TIC_DOT
CvtITimeStamp_Stru2TIMESTAMP_STRU
CvtITime_Stru2TIME_STRU
CvtITran_Par2TRAN_PAR
CvtIWin_Org2WIN_ORG
CvtLIN_INFO2ILin_Info
CvtMAP_PARA2IMap_Para
CvtPNT_INFO2IPnt_Info
CvtREG_INFO2IReg_Info
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 252KB - Virtual size: 248KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 308KB - Virtual size: 306KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1713d131c98fae7c014c42976fb0bb97

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ole32

oleaut32

basroot

basfile

bas60

w60area

topo60

w60anly

Exports

Exports

Sections

.text Size: 252KB - Virtual size: 248KB

.rdata Size: 44KB - Virtual size: 41KB

.data Size: 12KB - Virtual size: 9KB

.rsrc Size: 308KB - Virtual size: 306KB

.reloc Size: 28KB - Virtual size: 27KB

.text
Size: 252KB - Virtual size: 248KB

.rdata
Size: 44KB - Virtual size: 41KB

.data
Size: 12KB - Virtual size: 9KB

.rsrc
Size: 308KB - Virtual size: 306KB

.reloc
Size: 28KB - Virtual size: 27KB