28e908997304a34ed286b49721161960[.]bin

Sharing

Copy URL Twitter E-mail

General

Target

28e908997304a34ed286b49721161960.bin
Size

532KB
MD5

28e908997304a34ed286b49721161960
SHA1

024254855ae22e813ee1720ccd9aa7b3a5c1dfb8
SHA256

ba979a8cd6c3b47aadacb138975140399c8701cd92dd4aa8d3d8d223cf791d63
SHA512

dad56114203e5edecce8cdfc304eab66018e9fa9a9fb4f36ac6cefcfcd019c05d73c7a67f21be999af96e95b8fb45ab4d11b7e20a1554d8c711637791514efb4
SSDEEP

6144:0U23jVDH9S9PC2pNdVIFbLiRoajBRTOQfIRZLO2GOmxg0Io:tjPtUFbLktv6Q8GOm15

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
28e908997304a34ed286b49721161960.bin

Files

28e908997304a34ed286b49721161960.bin
.exe windows x64

37d3bf940a97a015a14d0e76805fee2d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

Imports

advapi32

AllocateAndInitializeSid
FreeSid
CheckTokenMembership
RegEnumKeyExW
RegCloseKey
RegOpenKeyExW

kernel32

CreateEventW
HeapSetInformation
GetVersionExW
VirtualProtect
Sleep
CloseHandle
GetLastError
GetModuleHandleW
QueryPerformanceCounter
GetProcAddress
UnhandledExceptionFilter
GetCurrentProcess
SetUnhandledExceptionFilter
RtlPcToFileHeader
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
OutputDebugStringA
GetStartupInfoW
SetThreadExecutionState
CreateMutexW
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentThreadId

user32

EnableWindow
RegisterWindowMessageW
IsIconic
SetForegroundWindow
EnumWindows
ShowWindow
SendMessageTimeoutW
MessageBoxW
GetSystemMetrics

mfc42u

ord3164
ord4371
ord4983
ord4770
ord1063
ord5724
ord5065
ord6053
ord4214
ord6813
ord4836
ord2559
ord2515
ord6071
ord4191
ord5630
ord4077
ord5615
ord659
ord3916
ord1430
ord3830
ord2412
ord3468
ord5722
ord4368
ord5730
ord5711
ord5687
ord6437
ord1777
ord4771
ord5406
ord2517
ord1505
ord4598
ord4988
ord4365
ord4752
ord2399
ord5586
ord6812
ord4694
ord4017
ord5229
ord2670
ord2060
ord6814
ord3933
ord5484
ord1736
ord5683
ord2457
ord2140
ord5699
ord6886
ord4083
ord4082
ord3046
ord3166
ord3052
ord3366
ord3231
ord4815
ord3362
ord3243
ord3049
ord5636
ord6887
ord1584
ord1463
ord1388

msvcrt

__set_app_type
_unlock
__dllonexit
_lock
_amsg_exit
??1type_info@@UEAA@XZ
memcpy
memset
memmove
??0__non_rtti_object@@QEAA@PEBD@Z
??1__non_rtti_object@@UEAA@XZ
??0__non_rtti_object@@QEAA@AEBV0@@Z
??0bad_typeid@@QEAA@AEBV0@@Z
??0bad_cast@@QEAA@PEBD@Z
??1bad_cast@@UEAA@XZ
??0bad_cast@@QEAA@AEBV0@@Z
?terminate@@YAXXZ
isdigit
mbtowc
_fmode
isleadbyte
isxdigit
localeconv
wctomb
iswctype
wcstombs
realloc
__badioinfo
__pioinfo
_read
_fileno
ungetc
_initterm
_wcmdln
exit
_cexit
_commode
__mb_cur_max
__setusermatherr
?name@type_info@@QEBAPEBDXZ
_set_error_mode
free
calloc
malloc
wprintf
_purecall
__CxxFrameHandler
_errno
??0exception@@QEAA@AEBQEBDH@Z
_onexit
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
_CxxThrowException
_callnewh
__wgetmainargs
__C_specific_handler
_XcptFilter
_exit
wcschr
towlower
wcspbrk
iswdigit

shell32

ShellExecuteW

comctl32

InitCommonControlsEx

gdiplus

GdiplusShutdown
GdiplusStartup

wet

?OnWizHelp@CWiz@@MEAAHXZ
??1CWetCommandLineInfo@@UEAA@XZ
??1CSQMData@@UEAA@XZ
?RegisterControlClass@CMigrationCheckBox@@SAXPEAUHINSTANCE__@@@Z
?UnregisterControlClass@CMigrationCheckBox@@SAXPEAUHINSTANCE__@@@Z
?WizLib_OnInitInstance@@YAHXZ
?GetWetBuildVersion@@YAPEAVString@UnBCL@@XZ
?RegisterControlClass@CMigrationStatus@@SAXPEAUHINSTANCE__@@@Z
?UnregisterControlClass@CMigrationStatus@@SAXPEAUHINSTANCE__@@@Z
?LoadResourceString@@YAPEAGI@Z
?RegisterControlClass@CEnhancedStatic@@SAXPEAUHINSTANCE__@@@Z
?UnregisterControlClass@CEnhancedStatic@@SAXPEAUHINSTANCE__@@@Z
?RegisterControlClass@CMigrationDetail@@SAXPEAUHINSTANCE__@@@Z
?UnregisterControlClass@CMigrationDetail@@SAXPEAUHINSTANCE__@@@Z
?RegisterControlClass@CWinListBox@@SAXPEAUHINSTANCE__@@@Z
?UnregisterControlClass@CWinListBox@@SAXPEAUHINSTANCE__@@@Z
??0CWetCommandLineInfo@@QEAA@XZ
?ParseParam@CWetCommandLineInfo@@UEAAXPEBGHH@Z
?GetError@CWetCommandLineInfo@@UEBAHXZ
?SetError@CWetCommandLineInfo@@UEAAXH@Z
?GetRunId@CWetCommandLineInfo@@UEBAKXZ
?GetMigFile@CWetCommandLineInfo@@UEBAPEAVString@UnBCL@@XZ
?get_ConnectionMedia@CWetCommandLineInfo@@UEBAPEAW4CONNECTION_MEDIA@@XZ
?get_EndPoint@CWetCommandLineInfo@@UEBAPEAEXZ
?get_ConnectionKey@CWetCommandLineInfo@@UEBAPEAVString@UnBCL@@XZ
?get_EncryptionKey@CWetCommandLineInfo@@UEBAPEAVString@UnBCL@@XZ
?get_PeerUpdate@CWetCommandLineInfo@@UEBAHXZ
?get_OldWindowHandle@CWetCommandLineInfo@@UEBAPEAUHWND__@@XZ
?get_PageHistory@CWetCommandLineInfo@@UEBAPEAVString@UnBCL@@XZ
?get_PrintWetVersion@CWetCommandLineInfo@@UEAAHXZ
?GetRuntimeClass@CWiz@@UEBAPEAUCRuntimeClass@@XZ
?SetIcon@CWiz@@QEAAXI@Z
?OnWizQuit@CWiz@@MEAAHXZ
?DrawBackground@CWiz@@MEAAXAEAVCDC@@@Z
?DoDataExchange@CWiz@@MEAAXPEAVCDataExchange@@@Z
?OnOK@CWiz@@MEAAXXZ
?OnCancel@CWiz@@MEAAXXZ
?classCBusinessLogicThread@CBusinessLogicThread@@2UCRuntimeClass@@B
?g_wetLocale@@3KA
?IsLocaleSupported@@YAHK@Z
??0CThemeManager@@QEAA@XZ
??1CThemeManager@@QEAA@XZ
?RegisterControlClass@CElementMap@@SAXPEAUHINSTANCE__@@@Z
?UnregisterControlClass@CElementMap@@SAXPEAUHINSTANCE__@@@Z
?RegisterControlClass@CMigrationError@@SAXPEAUHINSTANCE__@@@Z
??0CWizardFrame@@QEAA@PEBGPEAVCWnd@@IPEAVCThemeManager@@W4PageBackgroundThemeType@@PEAUCRuntimeClass@@PEAXKPEAVString@UnBCL@@@Z
??1CWizardFrame@@UEAA@XZ
?Initialize@CWizardFrame@@UEAAXXZ
?AddPage@CWizardFrame@@UEAAXPEAVCWizardPage@@@Z
?ReplacePage@CWizardFrame@@UEAAXPEAVCWizardPage@@0@Z
?GetPageById@CWizardFrame@@UEBAPEAVCWizardPage@@I@Z
?PostLocalBlMessage@CWizardFrame@@UEAAHI_K_J@Z
?PostBlMessage@CWizardFrame@@UEAAHI_K_J@Z
?SetActivePageById@CWizardFrame@@UEAAXI@Z
?SetFirstPage@CWizardFrame@@UEAAXI@Z
?SetNextButton@CWizardFrame@@UEAAXW4NEXT_BUTTON_NAME@@W4NEXT_BUTTON_STATE@@@Z
?SetBackButton@CWizardFrame@@UEAAXW4BACK_BUTTON_STATE@@@Z
?ShowNextPage@CWizardFrame@@UEAAXI@Z
?UpdatePageIdDisplay@CWizardFrame@@UEAAXI@Z
?IsApplyAllowed@CWizardFrame@@UEBAHXZ
?get_PeerUpdate@CWizardFrame@@UEBAHXZ
?set_PeerUpdate@CWizardFrame@@UEAAXH@Z
?PlaceOverOldWet@CWizardFrame@@UEAAXXZ
?ScanForUsbCable@CWizardFrame@@UEAAHXZ
?SetTransferMode@CWizardFrame@@UEAAXE@Z
?OnEndSession@CWizardFrame@@UEAAHXZ
?OnQueryEndSession@CWizardFrame@@UEAAHXZ
?OnHelpInfo@CWizardFrame@@UEAAHPEAUtagHELPINFO@@@Z
?OnMove@CWizardFrame@@UEAAXHH@Z
?SetEndPoint@CWizardFrame@@UEAAXE@Z
?SetWizardPath@CWizardFrame@@UEAAXW4WIZARD_PATH@@@Z
?GetWizardPath@CWizardFrame@@UEAA?AW4WIZARD_PATH@@XZ
?SetPageToReset@CWizardFrame@@UEAAXPEAVCWizardPage@@@Z
?ResetPage@CWizardFrame@@UEAAXPEAVCWizardPage@@@Z
?ResetConnectionAndPeerUpdatePages@CWizardFrame@@UEAAXXZ
?CheckAndPerformPageReset@CWizardFrame@@UEAAXPEAVCWizardPage@@@Z
?SetStoreFileWasLoaded@CWizardFrame@@UEAAXH@Z
?CancelConnectedTransport@CWizardFrame@@UEAAXXZ
?ShowWaitCursor@CWizardFrame@@UEAAXH@Z
?EnableUserInput@CWizardFrame@@UEAAXH@Z
?GetMessageMap@CWizardFrame@@MEBAPEBUAFX_MSGMAP@@XZ
?OnInitDialog@CWizardFrame@@MEAAHXZ
?PostNcDestroy@CWizardFrame@@MEAAXXZ
?OnSysColorChange@CWizardFrame@@MEAAXXZ
?OnPowerBroadcast@CWizardFrame@@MEAA_J_K_J@Z
?OnCtlColor@CWizardFrame@@MEAAPEAUHBRUSH__@@PEAVCDC@@PEAVCWnd@@I@Z
?PreTranslateMessage@CWizardFrame@@MEAAHPEAUtagMSG@@@Z
?OnSetCursor@CWizardFrame@@MEAAHPEAVCWnd@@II@Z
?AutomatedStart@CWizardFrame@@MEAAXXZ
?PlaceUnderOldWet@CWizardFrame@@MEAAXXZ
?OnWizBack@CWizardFrame@@MEAAHXZ
?OnWizNext@CWizardFrame@@MEAAHXZ
?OnBlShutdownDone@CWizardFrame@@MEAA_J_K_J@Z
?OnCommand@CWizardFrame@@MEAAH_K_J@Z
?OnGetDefId@CWizardFrame@@MEAA_J_K_J@Z
?OnTimerTick@CWizardFrame@@MEAA_J_K_J@Z
??0CSQMData@@QEAA@XZ
?SendSQMData@CSQMData@@QEAAXXZ
?SetThreadLocalizedResources@@YAXXZ
?UnregisterControlClass@CMigrationError@@SAXPEAUHINSTANCE__@@@Z

unbcl

??1StringBuilder@UnBCL@@UEAA@XZ
??0StringBuilder@UnBCL@@QEAA@XZ
?IndexOf@String@UnBCL@@QEBAHG@Z
?get_Length@String@UnBCL@@QEBAHXZ
?Free@Allocator@UnBCL@@SAXPEAXI@Z
??0OutOfMemoryException@UnBCL@@QEAA@XZ
?Alloc@Allocator@UnBCL@@SAPEAX_KI@Z
?ReAlloc@Allocator@UnBCL@@SAPEAXPEAX_KI@Z
?Trim@String@UnBCL@@QEBAPEAV12@XZ
?Append@StringBuilder@UnBCL@@QEAAPEAV12@G@Z
?ToString@StringBuilder@UnBCL@@UEBAPEAVString@2@XZ
?get_P@?$SmartPtr@VString@UnBCL@@@UnBCL@@QEBAPEAVString@2@XZ
?EndsWith@String@UnBCL@@QEBAHPEBGH@Z
?Remove@String@UnBCL@@QEBAPEAV12@HH@Z
?Combine@Path@UnBCL@@SAPEAVString@2@PEBV32@0@Z
??1OutOfMemoryException@UnBCL@@UEAA@XZ
??0?$SmartPtr@V?$ArrayList@PEAVString@UnBCL@@@UnBCL@@@UnBCL@@QEAA@PEAV?$ArrayList@PEAVString@UnBCL@@@1@@Z
?Split@String@UnBCL@@QEBAPEAV?$ArrayList@PEAVString@UnBCL@@@2@PEBG@Z
??1?$SmartPtr@V?$ArrayList@PEAVString@UnBCL@@@UnBCL@@@UnBCL@@UEAA@XZ
??C?$SmartPtr@V?$ArrayList@PEAVString@UnBCL@@@UnBCL@@@UnBCL@@QEBAPEAV?$ArrayList@PEAVString@UnBCL@@@1@XZ
??1ArgumentNullException@UnBCL@@UEAA@XZ
??1ArgumentException@UnBCL@@UEAA@XZ
??1ArgumentOutOfRangeException@UnBCL@@UEAA@XZ
??_D?$Array@H@UnBCL@@QEAAXXZ
??1?$ICollection@H@UnBCL@@UEAA@XZ
??1?$IList@H@UnBCL@@UEAA@XZ
??1ISerializable@UnBCL@@UEAA@XZ
??1NotSupportedException@UnBCL@@UEAA@XZ
??0ArgumentOutOfRangeException@UnBCL@@QEAA@PEBG@Z
?MemAllocFailed@Allocator@UnBCL@@SAHXZ
??C?$SmartPtr@VString@UnBCL@@@UnBCL@@QEBAPEAVString@1@XZ
??D?$SmartPtr@VString@UnBCL@@@UnBCL@@QEBAAEAVString@1@XZ
??4?$SmartPtr@VString@UnBCL@@@UnBCL@@QEAAAEAV01@AEBV01@@Z
??1?$SmartPtr@VString@UnBCL@@@UnBCL@@UEAA@XZ
??0?$SmartPtr@VString@UnBCL@@@UnBCL@@QEAA@PEAVString@1@@Z
??0InvalidCastException@UnBCL@@QEAA@XZ
?SanitizeTypeName@SerializationStream@UnBCL@@SAPEAVString@2@AEBV32@@Z
?GetCallingModule@SerializationStream@UnBCL@@SAPEAUHINSTANCE__@@XZ
?CanRegister@SerializationStream@UnBCL@@SAHXZ
?UnregisterType@SerializationStream@UnBCL@@SAXPEBVString@2@HPEAUHINSTANCE__@@@Z
?RegisterType@SerializationStream@UnBCL@@SAXPEBVString@2@HPEAUHINSTANCE__@@PEAUIInstanceFactory@2@@Z
??5SerializationStream@UnBCL@@QEAAAEAV01@AEAH@Z
??5SerializationStream@UnBCL@@QEAAAEAV01@AEAI@Z
??5SerializationStream@UnBCL@@QEAAAEAV01@AEAE@Z
??5SerializationStream@UnBCL@@QEAAAEAV01@AEAPEAVString@1@@Z
??5SerializationStream@UnBCL@@QEAAAEAV01@AEAPEAUISerializable@1@@Z
??6SerializationStream@UnBCL@@QEAAAEAV01@H@Z
??6SerializationStream@UnBCL@@QEAAAEAV01@I@Z
??6SerializationStream@UnBCL@@QEAAAEAV01@E@Z
??6SerializationStream@UnBCL@@QEAAAEAV01@PEBVString@1@@Z
??6SerializationStream@UnBCL@@QEAAAEAV01@PEBUISerializable@1@@Z
?ReadBytes@SerializationStream@UnBCL@@QEAAXPEAEH@Z
?WriteBytes@SerializationStream@UnBCL@@QEAAXPEBEH@Z
??0ArgumentException@UnBCL@@QEAA@PEBG@Z
?SetMessage@Exception@UnBCL@@MEAAXPEAVString@2@@Z
?set_HResult@Exception@UnBCL@@MEAAXJ@Z
?get_HResult@Exception@UnBCL@@UEBAJXZ
?GetBaseException@Exception@UnBCL@@UEBAPEBV12@XZ
?AddStackTrace@Exception@UnBCL@@QEAAXPEBD@Z
?set_Source@Exception@UnBCL@@UEAAXPEBVString@2@@Z
?get_Source@Exception@UnBCL@@UEBAPEBVString@2@XZ
?get_Message@Exception@UnBCL@@UEBAPEBVString@2@XZ
?get_InnerException@Exception@UnBCL@@UEBAPEBV12@XZ
?ToString@Exception@UnBCL@@UEBAPEAVString@2@XZ
??1Exception@UnBCL@@UEAA@XZ
??0Exception@UnBCL@@QEAA@PEBG@Z
?EnqueueSbRegistration@SbRegistrationList@UnBCL@@SAXPEBDHPEAUHINSTANCE__@@PEAUIInstanceFactory@2@@Z
?FromASCII@String@UnBCL@@SAPEAV12@PEBD@Z
?Concat@String@UnBCL@@SAPEAV12@PEBG0@Z
?get_CString@String@UnBCL@@QEBAPEBGXZ
?CompareTo@String@UnBCL@@UEBAHPEBVObject@2@@Z
?Clone@String@UnBCL@@UEBAPEAVObject@2@XZ
?ToString@String@UnBCL@@UEBAPEAV12@XZ
?GetHashCode@String@UnBCL@@UEBAHXZ
?Equals@String@UnBCL@@UEBAHPEBVObject@2@@Z
??1String@UnBCL@@UEAA@XZ
??0String@UnBCL@@QEAA@PEBG@Z
??0String@UnBCL@@QEAA@AEBV01@@Z
?SetLiteralStorage@_@UnBCL@@YAXPEAPEBVString@2@PEBG@Z
??0ArgumentNullException@UnBCL@@QEAA@PEBG@Z
?DecRef@Object@UnBCL@@QEAAHXZ
?AddRef@Object@UnBCL@@QEAAXXZ
??3Object@UnBCL@@SAXPEAX@Z
??2Object@UnBCL@@SAPEAX_K@Z
??2Object@UnBCL@@SAPEAX_KI@Z
?Clone@Object@UnBCL@@UEBAPEAV12@XZ
?CompareTo@Object@UnBCL@@UEBAHPEBV12@@Z
?GetObjectID@Object@UnBCL@@UEBAIXZ
?ToString@Object@UnBCL@@UEBAPEAVString@2@XZ
?GetType@Object@UnBCL@@UEBAPEAVType@2@XZ
?GetHashCode@Object@UnBCL@@UEBAHXZ
?Equals@Object@UnBCL@@UEBAHPEBV12@@Z
??1Object@UnBCL@@UEAA@XZ
??0Object@UnBCL@@QEAA@XZ
??0Object@UnBCL@@QEAA@AEBV01@@Z
?Clone@?$Array@H@UnBCL@@UEBAPEAVObject@2@XZ
?Equals@?$Array@H@UnBCL@@UEBAHPEBVObject@2@@Z
??0?$Array@H@UnBCL@@QEAA@PEBU?$ICollection@H@1@@Z
??0NotSupportedException@UnBCL@@QEAA@PEBG@Z
?IsEnvironmentVarSetTrue@Environment@UnBCL@@SAHPEBVString@2@H@Z
??0InvalidOperationException@UnBCL@@QEAA@PEBVString@1@@Z
??0InvalidOperationException@UnBCL@@QEAA@PEBG@Z
??0InvalidOperationException@UnBCL@@QEAA@PEBVString@1@PEAVException@1@@Z
??1InvalidCastException@UnBCL@@UEAA@XZ
??0?$IEnumerator@PEAVString@UnBCL@@@UnBCL@@QEAA@XZ
??0?$IList@H@UnBCL@@QEAA@XZ
??0?$ICollection@E@UnBCL@@QEAA@XZ
??0?$ICollection@H@UnBCL@@QEAA@XZ
??0ISerializable@UnBCL@@QEAA@XZ
??0?$ICollection@PEAVString@UnBCL@@@UnBCL@@QEAA@XZ
??1InvalidOperationException@UnBCL@@UEAA@XZ

wdscore

CurrentIP
ConstructPartialMsgVW
WdsSetupLogMessageW

Exports

Exports

??0CGrowBuffer@Mig@@QEAA@AEBV01@@Z
??0CGrowBuffer@Mig@@QEAA@_K@Z
??1CGrowBuffer@Mig@@UEAA@XZ
??4CGrowBuffer@Mig@@QEAAAEAV01@AEBV01@@Z
??4CStringPatternUtil@Mig@@QEAAAEAV01@AEBV01@@Z
??_7CGrowBuffer@Mig@@6B@
??_FCGrowBuffer@Mig@@QEAAXXZ
?AppendCString@CGrowBuffer@Mig@@QEAAXPEBG@Z
?AppendCStringN@CGrowBuffer@Mig@@QEAAXPEBGI@Z
?AppendString@CGrowBuffer@Mig@@QEAAXPEAVString@UnBCL@@@Z
?AppendStringN@CGrowBuffer@Mig@@QEAAXPEAVString@UnBCL@@I@Z
?CheckVersionLimit@CStringPatternUtil@Mig@@CAHPEAVString@UnBCL@@0HPEAH@Z
?ComparePatterns@CStringPatternUtil@Mig@@SAHPEAVString@UnBCL@@0H@Z
?Copy@CGrowBuffer@Mig@@QEAAXPEBE_K@Z
?EscapeSpecialChars@CStringPatternUtil@Mig@@SAPEAVString@UnBCL@@PEAV34@0G@Z
?EscapeSpecialChars@CStringPatternUtil@Mig@@SAPEAVString@UnBCL@@PEAV34@@Z
?EscapeSpecialCharsInternal@CStringPatternUtil@Mig@@CAPEAVString@UnBCL@@PEAV34@PEBGG@Z
?GetLiteralPrefix@CStringPatternUtil@Mig@@SAPEAVString@UnBCL@@PEAV34@@Z
?Grow@CGrowBuffer@Mig@@QEAAPEAE_K@Z
?HasWildCards@CStringPatternUtil@Mig@@SAHPEAVString@UnBCL@@@Z
?IsFullPattern@CStringPatternUtil@Mig@@SAHPEAVString@UnBCL@@@Z
?IsNumeric@CStringPatternUtil@Mig@@CAHPEAVString@UnBCL@@H@Z
?IsPatternStringValid@CStringPatternUtil@Mig@@CAHPEBGH@Z
?IsPatternStringValid@CStringPatternUtil@Mig@@SAHPEAVString@UnBCL@@@Z
?IsVersionGreater@CStringPatternUtil@Mig@@SAHPEAVString@UnBCL@@0@Z
?IsVersionGreaterOrEqual@CStringPatternUtil@Mig@@SAHPEAVString@UnBCL@@0@Z
?IsVersionNumeric@CStringPatternUtil@Mig@@SAHPEAVString@UnBCL@@H@Z
?IsVersionNumericWorker@CStringPatternUtil@Mig@@CAHPEAVString@UnBCL@@HH@Z
?IsVersionRangeNumeric@CStringPatternUtil@Mig@@SAHPEAVString@UnBCL@@H@Z
?Match@CStringPatternUtil@Mig@@SAHPEAVString@UnBCL@@0@Z
?MatchCI@CStringPatternUtil@Mig@@SAHPEAVString@UnBCL@@0@Z
?MatchCI@CStringPatternUtil@Mig@@SAHPEBG0@Z
?MatchHelper@CStringPatternUtil@Mig@@CAHPEBGHH0HH@Z
?MatchHelperCI@CStringPatternUtil@Mig@@CAHPEBGHH0HH@Z
?MatchListOfPatterns@CStringPatternUtil@Mig@@SAHPEBG00H@Z
?MatchPath@CStringPatternUtil@Mig@@SAHPEAVString@UnBCL@@0@Z
?MatchPath@CStringPatternUtil@Mig@@SAHPEBG0@Z
?MatchPathHelper@CStringPatternUtil@Mig@@CAHPEBGII0II@Z
?MatchVersion@CStringPatternUtil@Mig@@SAHPEAVString@UnBCL@@0@Z
?MatchVersionRange@CStringPatternUtil@Mig@@CAHPEAVString@UnBCL@@0@Z
?MatchVersionSegment@CStringPatternUtil@Mig@@CAHPEAVString@UnBCL@@0@Z
?Reset@CGrowBuffer@Mig@@QEAAXXZ
?Resize@CGrowBuffer@Mig@@AEAAX_K@Z
?Unescape@CStringPatternUtil@Mig@@SAPEAVString@UnBCL@@PEAV34@G@Z
?get_Buffer@CGrowBuffer@Mig@@UEBAPEBEXZ
?get_Length@CGrowBuffer@Mig@@UEBA_KXZ

Sections

.text
Size: 396KB - Virtual size: 396KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 93KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

37d3bf940a97a015a14d0e76805fee2d

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

mfc42u

msvcrt

shell32

comctl32

gdiplus

wet

unbcl

wdscore

Exports

Exports

Sections

.text Size: 396KB - Virtual size: 396KB

.data Size: 24KB - Virtual size: 26KB

.pdata Size: 10KB - Virtual size: 10KB

.rsrc Size: 93KB - Virtual size: 92KB

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 396KB - Virtual size: 396KB

.data
Size: 24KB - Virtual size: 26KB

.pdata
Size: 10KB - Virtual size: 10KB

.rsrc
Size: 93KB - Virtual size: 92KB

.reloc
Size: 6KB - Virtual size: 6KB