f9a90db6b85973cf8ba56058a00c62ccc2a928e90b26087585f084caae77b070

Sharing

Copy URL

Twitter E-mail

General

Target

f9a90db6b85973cf8ba56058a00c62ccc2a928e90b26087585f084caae77b070
Size

3.2MB
MD5

28a511a210663892643b0cf71d386ade
SHA1

7cc08dcd90d6295252262f71d1be8fa577b1a335
SHA256

f9a90db6b85973cf8ba56058a00c62ccc2a928e90b26087585f084caae77b070
SHA512

0b5e130e33ee7833d204f7bca3ad50504f11b4e7096d3382b2dd808945ac4a332480f3df4fc3074529881857f0033474cf7f1a0e08ac5eaf6d0bd617d93fd602
SSDEEP

49152:mN/wVmAgY28MrcawkKxP6H+K9eveUFAzlvSbZ6LJbCQZgqdiSVnWXMXDHnVtgFQc:meVZLMr8kKxP6fLsAzlviZ6d3gq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f9a90db6b85973cf8ba56058a00c62ccc2a928e90b26087585f084caae77b070

Files

f9a90db6b85973cf8ba56058a00c62ccc2a928e90b26087585f084caae77b070
.dll windows x86

9c505ef4bf6319a0d41abd4ebe04c6bf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

datemgr

?setBookType@CDownloadBook@@QAEXH@Z
?setID@CDownloadBook@@QAEXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?setBookName@CDownloadBook@@QAEXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?setClassName@CDownloadBook@@QAEXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?SetSize@CDownloadBook@@QAEXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?setSavePath@CDownloadBook@@QAEXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?SetDownError@CDownloadBook@@QAEXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
??0CDownloadBook@@QAE@XZ
??1CDownloadBook@@QAE@XZ
?setDownTime@CDownloadBook@@QAEXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?GetId@CPreferenceBook@@QAE?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?GetLevel@CPreferenceBook@@QAE?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ

mfc100u

ord8270
ord11464
ord7077
ord3611
ord2271
ord1189
ord741
ord4724
ord7333
ord1195
ord752
ord13132
ord6661
ord7301
ord2878
ord4709
ord7251
ord12504
ord7095
ord1026
ord479
ord6863
ord7516
ord5164
ord5200
ord5190
ord5193
ord6161
ord1284
ord6650
ord871
ord1272
ord5813
ord3846
ord3703
ord1212
ord788
ord7529
ord7967
ord11998
ord6080
ord337
ord11495
ord306
ord294
ord277
ord1477
ord7210
ord11682
ord4150
ord11801
ord13218
ord7913
ord1440
ord3493
ord13605
ord322
ord14203
ord12296
ord5652
ord5535
ord5564
ord5563
ord903
ord4513
ord310
ord2529
ord11494
ord2062
ord4511
ord420
ord7876
ord11333
ord417
ord5852
ord4888
ord4890
ord11704
ord4909
ord1294
ord892
ord10409
ord11999
ord12182
ord12871
ord919
ord341
ord10122
ord7006
ord6870
ord970
ord5846
ord5468
ord13249
ord7637
ord13448
ord13447
ord13446
ord13449
ord10740
ord9647
ord9230
ord10485
ord14013
ord8178
ord10057
ord3628
ord11163
ord10037
ord5125
ord2407
ord12951
ord12294
ord12948
ord7056
ord3985
ord4805
ord6705
ord980
ord422
ord6367
ord1861
ord265
ord12022
ord10984
ord5056
ord2015
ord12616
ord3413
ord2528
ord13398
ord10960
ord979
ord421
ord7249
ord7929
ord4139
ord4355
ord6858
ord1274
ord897
ord1296
ord6125
ord8393
ord11210
ord8276
ord2418
ord12610
ord5558
ord2847
ord2946
ord7624
ord7548
ord11784
ord13854
ord4744
ord2164
ord11476
ord11477
ord13381
ord7108
ord13387
ord8530
ord3684
ord3625
ord11864
ord7126
ord1739
ord14162
ord10976
ord13267
ord11469
ord7179
ord13570
ord13567
ord13572
ord13569
ord13571
ord13568
ord3416
ord5261
ord11228
ord11236
ord4086
ord7391
ord9498
ord11240
ord11209
ord11960
ord5231
ord12023
ord14207
ord1897
ord1944
ord5227
ord921
ord5809
ord8266
ord2748
ord3749
ord7901
ord2617
ord3436
ord4810
ord12351
ord7347
ord1282
ord13207
ord1474
ord12502
ord7246
ord12510
ord3433
ord13181
ord4359
ord2188
ord3482
ord5900
ord3754
ord7903
ord7241
ord2781
ord3380
ord8043
ord1266
ord6117
ord8273
ord2844
ord3763
ord8550
ord7973
ord4676
ord12170
ord10081
ord6670
ord6346
ord13213
ord1935
ord12808
ord6160
ord6163
ord13047
ord2763
ord4571
ord12228
ord8370
ord12413
ord5185
ord3971
ord5198
ord5161
ord6246
ord2773
ord6759
ord1006
ord457
ord1068
ord542
ord11845
ord5118
ord9328
ord8346
ord6140
ord7176
ord1895
ord5855
ord1292
ord890
ord6869
ord4478
ord4151
ord13214
ord13208
ord11838
ord7524
ord1313
ord7911
ord2532
ord11296
ord11299
ord10990
ord1010
ord462
ord7914
ord2620
ord11123
ord8179
ord10058
ord10412
ord3627
ord2981
ord2980
ord2756
ord5556
ord12606
ord6441
ord13220
ord9493
ord4138
ord1734
ord880
ord13342
ord6294
ord917
ord5802
ord8264
ord2746
ord3746
ord6318
ord9253
ord3750
ord2887
ord2884
ord7385
ord2922
ord2767
ord13067
ord6362
ord535
ord1062
ord8153
ord8111
ord5350
ord1301
ord323
ord1873
ord1945
ord2088
ord8268
ord11151
ord4358
ord9009
ord11997
ord796
ord6754
ord6439
ord1064
ord537
ord6243
ord12512
ord13538
ord8229
ord2417
ord14146
ord14148
ord14147
ord14145
ord14149
ord14132
ord14059
ord14060
ord8277
ord11081
ord3402
ord10937
ord13380
ord8112
ord6247
ord10045
ord8372
ord2853
ord12724
ord11246
ord11244
ord1501
ord1508
ord1514
ord1512
ord1519
ord4388
ord4425
ord4396
ord4408
ord4404
ord4400
ord4430
ord4421
ord4392
ord4434
ord4413
ord4379
ord4383
ord4416
ord3999
ord14067
ord3992
ord2665
ord13382
ord7109
ord13388
ord6156
ord10725
ord12557
ord5276
ord2339
ord11116
ord3491
ord2952
ord2951
ord2852
ord11159
ord4642
ord4923
ord5115
ord8483
ord4901
ord5143
ord4645
ord4794
ord4623
ord6931
ord6932
ord6922
ord4792
ord7393
ord9333
ord8347
ord5830
ord11940
ord13305
ord4802
ord4360
ord11164
ord12186
ord8497
ord3397
ord9149
ord9525
ord6713
ord2509
ord3428
ord11982
ord2184
ord945
ord374
ord4356
ord2185
ord1905
ord5799
ord385
ord950
ord5801
ord5862
ord3446
ord1987
ord948
ord11683
ord7871
ord1479
ord1476
ord290
ord5232
ord5219
ord4694
ord4959
ord4956
ord7353
ord4216
ord4197
ord981
ord423
ord2614
ord7357
ord1934
ord7618
ord286
ord285
ord5264
ord2629
ord2064
ord2068
ord4290
ord1450
ord1312
ord1174
ord721
ord266
ord1298
ord280
ord1310
ord902
ord296
ord1300
ord8734
ord11183
ord4954
ord13219
ord293
ord11516
ord3978
ord12171
ord6711
ord381
ord6344
ord1480
ord3261
ord3994
ord908
ord2091
ord2055

msvcr100

memcpy
__RTDynamicCast
memset
_CxxThrowException
__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
_crt_debugger_hook
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
__CxxFrameHandler3
strcspn
_beginthreadex
_endthreadex
_msize
strncmp
isalnum
strpbrk
strstr
_finite
modf
sprintf_s
_wtoi64
ldiv
atoi
realloc
strchr
wcscpy_s
strcpy_s
wcsrchr
sprintf
ceil
memmove
_time64
_mktime64
??0bad_cast@std@@QAE@ABV01@@Z
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@PBD@Z
_purecall
??0exception@std@@QAE@XZ
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBD@Z
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??8type_info@@QBE_NABV0@@Z
_wtol
_localtime64_s
wcsftime
_wtoi
_wtof
_vsnwprintf_s
memcpy_s
free
malloc
swprintf_s

kernel32

SetFileAttributesW
GlobalFree
SuspendThread
ResumeThread
GetCurrentThreadId
GetFullPathNameW
GetFullPathNameA
HeapReAlloc
CreateFileA
GetFileSize
CreateMutexW
HeapCompact
SetFilePointer
TryEnterCriticalSection
MapViewOfFile
UnmapViewOfFile
SetEndOfFile
FreeLibrary
HeapAlloc
SystemTimeToFileTime
HeapFree
WaitForSingleObject
InterlockedCompareExchange
UnlockFile
FlushViewOfFile
lstrcpynW
WaitForSingleObjectEx
OutputDebugStringW
GetTickCount
UnlockFileEx
GetProcessHeap
GetSystemTimeAsFileTime
FormatMessageA
WriteFile
InitializeCriticalSection
HeapDestroy
GetFileAttributesA
HeapCreate
HeapValidate
GetFileAttributesW
ReadFile
CreateFileW
FlushFileBuffers
GetTempPathW
HeapSize
LockFileEx
GetDiskFreeSpaceW
LoadLibraryA
CreateFileMappingA
CreateFileMappingW
GetDiskFreeSpaceA
GetSystemInfo
GetFileAttributesExW
OutputDebugStringA
GetVersionExA
CloseHandle
GetCurrentProcessId
GetTempPathA
GetSystemTime
AreFileApisANSI
DeleteFileA
EncodePointer
DecodePointer
InterlockedExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
QueryPerformanceCounter
QueryPerformanceFrequency
ActivateActCtx
GetProcAddress
LoadLibraryW
DeactivateActCtx
SetLastError
GlobalUnlock
GlobalLock
GlobalAlloc
GetVersionExW
LeaveCriticalSection
CreateDirectoryW
GetModuleFileNameW
Sleep
EnterCriticalSection
GetCurrentDirectoryW
GetModuleHandleW
GetStdHandle
MoveFileW
DeleteFileW
CopyFileW
WideCharToMultiByte
GetLastError
MultiByteToWideChar
lstrlenA
FormatMessageW
lstrlenW
LocalAlloc
InterlockedDecrement
LocalFree
LockFile
IsProcessorFeaturePresent

user32

GetWindowRect
LoadBitmapW
GetSysColor
FindWindowW
GetClientRect
LockWindowUpdate
SetActiveWindow
ChildWindowFromPoint
GetMonitorInfoW
MonitorFromWindow
RegisterHotKey
SetTimer
KillTimer
CheckMenuItem
DeleteMenu
EnableMenuItem
GetSubMenu
LoadMenuW
DrawIcon
IsIconic
IsWindowVisible
GetAsyncKeyState
TranslateMessage
ShowWindow
IsWindow
SetWindowPos
GetFocus
FrameRect
SetRect
RedrawWindow
DrawIconEx
LoadIconW
TrackMouseEvent
GetWindowLongW
DrawStateW
WindowFromPoint
InflateRect
DrawFocusRect
DrawFrameControl
FindWindowExW
GetClipboardData
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
RegisterClipboardFormatW
OffsetRect
GetKeyState
FillRect
SetWindowLongW
CallWindowProcW
DispatchMessageW
GetMessageW
RegisterClassExW
CreateWindowExW
DefWindowProcW
ReleaseCapture
GetCapture
InvalidateRect
SetCapture
GetParent
PtInRect
GetCursorPos
GetSystemMetrics
CopyRect
ReleaseDC
GetDC
EnableWindow
ScreenToClient
ClientToScreen
GetDlgCtrlID
LoadCursorW
SetCursor
ShowCursor
GetClassNameW
PostMessageW
SendMessageW

gdi32

GetTextColor
RoundRect
SetTextColor
SetBkColor
DeleteDC
CreateDIBSection
Rectangle
GetCurrentObject
GetBkMode
GetTextExtentPoint32W
SetDCPenColor
SelectObject
CreatePen
GetDCPenColor
StretchBlt
CreateBitmap
DeleteObject
GetTextMetricsW
CreateSolidBrush
CreateFontW
GetDeviceCaps
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
GetObjectW
GetStockObject

msimg32

AlphaBlend
GradientFill

advapi32

RegQueryValueExW
RegCloseKey
RegOpenKeyExW

shell32

SHGetFileInfoW
SHBrowseForFolderW
ord2
SHGetPathFromIDListW
SHGetFolderLocation
SHGetDesktopFolder
ShellExecuteW
ShellExecuteExW
SHGetSpecialFolderPathW
DragFinish
SHGetMalloc
SHFileOperationA
SHChangeNotify
DragQueryFileW
SHFileOperationW

comctl32

ImageList_GetIconSize
_TrackMouseEvent

shlwapi

StrCmpW

ole32

CoInitializeEx
CoTaskMemAlloc
CoTaskMemFree
OleRun
CoCreateInstance
CLSIDFromProgID
CLSIDFromString
CoUninitialize
CoInitialize

oleaut32

SysAllocStringByteLen
SysStringByteLen
SysFreeString
GetErrorInfo
SysAllocString
VariantInit
VariantCopy
VarBstrFromDate
VariantChangeType
SystemTimeToVariantTime
VariantTimeToSystemTime
SysStringLen
VariantClear

msvcp100

?_Xout_of_range@std@@YAXPBD@Z
??0_Lockit@std@@QAE@H@Z
?_Orphan_all@_Container_base0@std@@QAEXXZ
_Strxfrm
?_Init@locale@std@@CAPAV_Locimp@12@XZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
_Strcoll
?_Xlength_error@std@@YAXPBD@Z
?_Xbad@tr1@std@@YAXW4error_type@regex_constants@12@@Z
??1_Container_base12@std@@QAE@XZ
?id@?$ctype@D@std@@2V0locale@2@A
?_Xmem@tr1@std@@YAXXZ
?id@?$collate@D@std@@2V0locale@2@A
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?tolower@?$ctype@D@std@@QBEPBDPADPBD@Z
?tolower@?$ctype@D@std@@QBEDD@Z
??0facet@locale@std@@IAE@I@Z
??1facet@locale@std@@UAE@XZ
?_Decref@facet@locale@std@@QAEPAV123@XZ
?_Incref@facet@locale@std@@QAEXXZ
??Bid@locale@std@@QAEIXZ
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ
??1_Locinfo@std@@QAE@XZ
??0_Locinfo@std@@QAE@PBD@Z
?_BADOFF@std@@3_JB
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@
?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEGXZ
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAH@Z
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??_D?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z
?seekpos@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE?AV?$fpos@H@2@V32@H@Z
?seekoff@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE?AV?$fpos@H@2@_JHH@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?underflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ
?pbackfail@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGG@Z
?overflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGG@Z
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAN@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?uncaught_exception@std@@YA_NXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??1_Lockit@std@@QAE@XZ

gdiplus

GdipCreateBitmapFromResource
GdipCreateHBITMAPFromBitmap
GdipGetImageThumbnail
GdipDisposeImage
GdipCloneImage
GdipCreateBitmapFromFile
GdipFree
GdipAlloc
GdiplusShutdown

Exports

Exports

??0CClientInfo@@QAE@XZ
??1CClientInfo@@QAE@XZ
??4CClientInfo@@QAEAAV0@ABV0@@Z
?BeginShine@@YAXXZ
?BeginTimer@@YAXXZ
?ClearInfo@CClientInfo@@QAEXXZ
?ClickLocalRc@@YAXXZ
?ClickOnlineRc@@YAXXZ
?CloseDBFunction@@YAXXZ
?ContinueDownloadCloudAttachment@@YAXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@0@Z
?CreateGlobalSharedSearchDlg@@YAPAVCWnd@@PAUHWND__@@@Z
?CreateMySharedWnd@@YAPAVCWnd@@PAV1@@Z
?CreateOtherCloudWnd@@YAPAVCWnd@@PAV1@@Z
?CreatePersonalSpaceWnd@@YAPAVCWnd@@PAV1@@Z
?CreatePersonalSpaceWndS@@YAPAVCWnd@@PAV1@@Z
?CreateSharedRcWnd@@YAPAVCWnd@@PAV1@@Z
?DelDownloadCloudAttachment@@YAXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@0@Z
?DownloadCloudAttachment@@YAXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@0000_N@Z
?DownloadCloudTaskExist@@YA_NV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@00@Z
?FreeGlobalSharedSearchDlg@@YAXXZ
?FreshFxlbFun@@YA_NXZ
?FreshGlobalSharedSearchSize@@YAXXZ
?GetCurClassID@@YA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?GetLastCloudDowning@@YA?AV?$vector@V?$shared_ptr@VCDownloadBook@@@tr1@std@@V?$allocator@V?$shared_ptr@VCDownloadBook@@@tr1@std@@@3@@std@@XZ
?GetLocalCloudResourceNum@@YAHXZ
?GetOnlineCtgHeadFun@@YA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?GetOnlineLoadState@@YA_NXZ
?GetPanelRcSharedDlg@@YAPAVCWnd@@XZ
?GetPsUserInfo@@YAAAVCClientInfo@@XZ
?GetTaskNum_PS@@YAHXZ
?InitLocalFolderTree@@YAXXZ
?InitOnlineFolderTree@@YAXXZ
?InitPs@@YAXXZ
?IsRcSharedLoadComplete@@YA_NXZ
?IsSearchGlobalSharedEmpty@@YA_NXZ
?LoadFxlbFun@@YAIPAX@Z
?LoadMyFxlbFun@@YAIPAX@Z
?LoadPSFrameBtn@@YAXXZ
?LoadPersonalSpaceData@@YAXXZ
?LocateOnlineBook_Cloud@@YA_NV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@000@Z
?LoginOutPersonalSpace@@YAXXZ
?LoginPersonalSpace@@YAXXZ
?OnExitPs@@YAHXZ
?OnlineCanGoOn@@YA_NXZ
?OnlineCtgIsEmptyFun@@YA_NXZ
?PauseDownloadCloudAttachment@@YAXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@0@Z
?ReadCloudDownloadingRecord@@YAXXZ
?ResetPersonalSpaceUserInfo@@YAXXZ
?SaveCloudLeftFGWidth@@YA_NXZ
?SaveGlobalSharedSearchListWidth@@YAXXZ
?SaveListWidthInfo@@YA_NXZ
?SetBtnExplorerFun@@YAXP6AXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@00000I@Z@Z
?SetChangerUrl@@YAXP6AXAAV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z@Z
?SetCreateCurWndFunPtr@@YAXP6AXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z@Z
?SetCurClassFun@@YAXP6AXAAV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z@Z
?SetCurClassID@@YAXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?SetDidFun@@YAXP6A?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ@Z
?SetExplorerFun@@YAXP6AXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z@Z
?SetListExplorerFun@@YAXP6AXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@0@Z@Z
?SetOnlineLoadState@@YAX_N@Z
?SetOperNotifyFun@@YAXP6AXH@Z@Z
?SetPC_OS@@YAXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?SetPanelTipInfo@@YAXXZ
?SetPersonalSpaceUserInfo@@YAXAAVCClientInfo@@@Z
?SetPsSizeInfo@CClientInfo@@QAEXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@0@Z
?SetRootURL_PS@@YAXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?SetShowMgrWndFun@@YAXP6AXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@000V?$vector@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@V?$allocator@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@std@@@std@@@Z@Z
?SetTipFunPtr@@YAXP6AXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z@Z
?SetUserHaveMgrDomainFun@@YAXP6A_NV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@000V?$map@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@V12@U?$less@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@std@@V?$allocator@U?$pair@$$CBV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@V12@@std@@@4@@std@@@Z@Z
?SetUserKey@@YAXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?SetUserSID@@YAXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?SetVersionFun@@YAXP6AXAAV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@0@Z@Z
?SetWriteLogFunPtr@@YAXP6AXABV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@ABH1@Z@Z
?Set_AddCloudDownloadRecord@@YAXP6AXAAV?$vector@V?$shared_ptr@VCDownloadBook@@@tr1@std@@V?$allocator@V?$shared_ptr@VCDownloadBook@@@tr1@std@@@3@@std@@@Z@Z
?Set_AddCloudDownloadRecordToDB@@YAXP6AXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@AAV?$shared_ptr@VCDownloadBook@@@tr1@std@@@Z@Z
?Set_AddSharedSearchRecordToDB@@YAXP6AXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z@Z
?Set_CloseGlobalSearch@@YAXP6AXXZ@Z
?Set_DelOtherPreferenceBook@@YAXP6A_NV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@0ABV?$map@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@V?$map@KHU?$less@K@std@@V?$allocator@U?$pair@$$CBKH@std@@@2@@std@@U?$less@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@4@V?$allocator@U?$pair@$$CBV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@V?$map@KHU?$less@K@std@@V?$allocator@U?$pair@$$CBKH@std@@@2@@std@@@std@@@4@@std@@0@Z@Z
?Set_FreshCloudAttachmentState@@YAXP6AXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@IH@Z@Z
?Set_FreshCloudInterfaceAct@@YAXP6AXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@IH@Z@Z
?Set_GetCloudPositionTaskBookId@@YAXP6A?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@V12@@Z@Z
?Set_GetCloudPreferenceBookId@@YAXP6A?AV?$vector@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@V?$allocator@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@std@@@std@@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@H@Z@Z
?Set_GetDHIdbyFVId_FHIdFun@@YAXP6A?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@V12@0@Z@Z
?Set_GetMainTopMost_Fun@@YAXP6A_NXZ@Z
?Set_GetPreferenceBook@@YAXP6A_NV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@AAV?$vector@V?$shared_ptr@VCPreferenceBook@@@tr1@std@@V?$allocator@V?$shared_ptr@VCPreferenceBook@@@tr1@std@@@3@@std@@H@Z@Z
?Set_GotoUIbyFVId_FHIdFun@@YAXP6A_NV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@0@Z@Z
?Set_IsChatroomAvailable@@YAXP6A_NXZ@Z
?Set_SetCloudProgress@@YAXP6AXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@IN@Z@Z
?Set_SetMainTopMost_Fun@@YAXP6AX_N@Z@Z
?Set_SetStartToDownloadCloud@@YAXP6AXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@I@Z@Z
?Set_ShowSearchLoadTip@@YAXP6AXH@Z@Z
?ShowFrameBtnAfterLoad@@YAXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?StartDownloadOtherCloud@@YAXXZ
?StartToSearchGlobalShared@@YAXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?SwitchModule@@YAXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?g_pAddSharedSearchRecord@@3P6AXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@ZA
?g_pCloseGlobalSearchFun@@3P6AXXZA
?g_pShowSearchLoadtipFun@@3P6AXH@ZA
?g_ptrAddDownloadCloudRecordFun@@3P6AXAAV?$vector@V?$shared_ptr@VCDownloadBook@@@tr1@std@@V?$allocator@V?$shared_ptr@VCDownloadBook@@@tr1@std@@@3@@std@@@ZA
?g_ptrAddDownloadRecordToDBFun@@3P6AXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@AAV?$shared_ptr@VCDownloadBook@@@tr1@std@@@ZA
?g_ptrBtnExplorerFun@@3P6AXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@00000I@ZA
?g_ptrChangerUrl@@3P6AXAAV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@ZA
?g_ptrChatroomAvailableFun@@3P6A_NXZA
?g_ptrCreateCurWndFun@@3P6AXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@ZA
?g_ptrDelOtherPrefBookFun@@3P6A_NV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@0ABV?$map@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@V?$map@KHU?$less@K@std@@V?$allocator@U?$pair@$$CBKH@std@@@2@@std@@U?$less@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@4@V?$allocator@U?$pair@$$CBV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@V?$map@KHU?$less@K@std@@V?$allocator@U?$pair@$$CBKH@std@@@2@@std@@@std@@@4@@std@@0@ZA
?g_ptrDidFun@@3P6A?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZA
?g_ptrExplorerFun@@3P6AXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@ZA
?g_ptrFreshCloudIStateFun@@3P6AXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@IH@ZA
?g_ptrFreshCloudInterfaceActFun@@3P6AXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@IH@ZA
?g_ptrGetCloudPositionTaskFun@@3P6A?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@V12@@ZA
?g_ptrGetCloudPreferenceBookFun@@3P6A?AV?$vector@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@V?$allocator@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@std@@@std@@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@H@ZA
?g_ptrGetCurKey@@3P6AXAAV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@ZA
?g_ptrGetDHIdbyFVId_FHIdFun@@3P6A?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@V12@0@ZA
?g_ptrGetPreferenceBookFun@@3P6A_NV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@AAV?$vector@V?$shared_ptr@VCPreferenceBook@@@tr1@std@@V?$allocator@V?$shared_ptr@VCPreferenceBook@@@tr1@std@@@3@@std@@H@ZA
?g_ptrGetTopMost@@3P6A_NXZA
?g_ptrGetVersion@@3P6AXAAV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@0@ZA
?g_ptrGotoUiFun@@3P6A_NV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@0@ZA
?g_ptrListExplorerFun@@3P6AXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@0@ZA
?g_ptrOperNotifyFun@@3P6AXH@ZA
?g_ptrSetCloudProgressFun@@3P6AXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@IN@ZA
?g_ptrSetTip@@3P6AXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@ZA
?g_ptrSetTopMost@@3P6AX_N@ZA
?g_ptrShowMgrWndFun@@3P6AXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@000V?$vector@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@V?$allocator@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@std@@@std@@@ZA
?g_ptrStartToDownloadCloudFun@@3P6AXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@I@ZA
?g_ptrUserHaveMgrDomainFun@@3P6A_NV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@000V?$map@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@V12@U?$less@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@std@@V?$allocator@U?$pair@$$CBV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@V12@@std@@@4@@std@@@ZA
?g_ptrWriteLogFun@@3P6AXABV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@ABH1@ZA
?md5_append@@YAXPAUmd5_state_s@@PBEH@Z
?md5_finish@@YAXPAUmd5_state_s@@QAE@Z
?md5_init@@YAXPAUmd5_state_s@@@Z

Sections

.text
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 319KB - Virtual size: 318KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 33KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 527KB - Virtual size: 526KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 210KB - Virtual size: 209KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9c505ef4bf6319a0d41abd4ebe04c6bf

Headers

DLL Characteristics

File Characteristics

Imports

datemgr

mfc100u

msvcr100

kernel32

user32

gdi32

msimg32

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

msvcp100

gdiplus

Exports

Exports

Sections

.text Size: 2.1MB - Virtual size: 2.1MB

.rdata Size: 319KB - Virtual size: 318KB

.data Size: 33KB - Virtual size: 73KB

.rsrc Size: 527KB - Virtual size: 526KB

.reloc Size: 210KB - Virtual size: 209KB

.text
Size: 2.1MB - Virtual size: 2.1MB

.rdata
Size: 319KB - Virtual size: 318KB

.data
Size: 33KB - Virtual size: 73KB

.rsrc
Size: 527KB - Virtual size: 526KB

.reloc
Size: 210KB - Virtual size: 209KB