0381a45f50ddf2457c956be1bf2b9891959e7e3f7d5ca55582be53eccb099ae6

Sharing

Copy URL Twitter E-mail

General

Target

0381a45f50ddf2457c956be1bf2b9891959e7e3f7d5ca55582be53eccb099ae6
Size

304KB
MD5

255b1867e1112f62b4de64628bd2744e
SHA1

0a55650974189fad33bb6e0020dee190c49b87af
SHA256

0381a45f50ddf2457c956be1bf2b9891959e7e3f7d5ca55582be53eccb099ae6
SHA512

33c559fd30a73228445158ab17ea83f033557d47f3d10bed5308b9efe57418189bb1d1d3d25e1089cfe41c5645380ffdaab28fac24154a96865045c472972da1
SSDEEP

6144:sv/4qDDdwDzDsKpRUaCtjSku5m0ht1dIJkKSJ2ceOJFY3p4lPEKrMAxmamF1ooJb:a//dwDMKpRgzuuEi54gAxmamFBl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0381a45f50ddf2457c956be1bf2b9891959e7e3f7d5ca55582be53eccb099ae6

Files

0381a45f50ddf2457c956be1bf2b9891959e7e3f7d5ca55582be53eccb099ae6
.dll regsvr32 windows x86

0c493e5cce669b7944f2ef4f85a3920c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42

ord3079
ord4080
ord4622
ord4424
ord3738
ord561
ord815
ord5500
ord1200
ord1132
ord1131
ord6354
ord2725
ord860
ord540
ord1907
ord4219
ord2581
ord5162
ord5160
ord4905
ord4948
ord4358
ord5265
ord4377
ord4854
ord4998
ord2514
ord6052
ord1775
ord4835
ord4425
ord1771
ord6366
ord2413
ord2024
ord4401
ord3639
ord4407
ord6744
ord2411
ord2023
ord4218
ord2578
ord6055
ord4078
ord1776
ord4398
ord5241
ord2385
ord5163
ord6374
ord4353
ord5290
ord3798
ord4837
ord4441
ord2648
ord2055
ord6376
ord3749
ord5065
ord1727
ord5261
ord2446
ord2124
ord5277
ord3402
ord4627
ord3582
ord6520
ord812
ord616
ord692
ord768
ord2614
ord559
ord556
ord567
ord489
ord809
ord656
ord793
ord2370
ord2358
ord2302
ord4258
ord5280
ord4047
ord4976
ord6199
ord858
ord924
ord2764
ord3874
ord6197
ord6379
ord6880
ord6215
ord3092
ord2864
ord4742
ord535
ord922
ord2818
ord4710
ord4160
ord2122
ord2860
ord6334
ord551
ord3337
ord3811
ord2642
ord3803
ord3663
ord5862
ord6144
ord2820
ord5710
ord4129
ord2763
ord6223
ord3825
ord6383
ord5450
ord6394
ord801
ord541
ord4376
ord3597
ord4644
ord4217
ord2576
ord4397
ord3352
ord3577
ord641
ord324
ord4234
ord5890
ord755
ord470
ord2937
ord4853
ord1908
ord1690
ord2528
ord5288
ord4439
ord2054
ord4431
ord497
ord771
ord4259
ord4715
ord500
ord772
ord6142
ord2582
ord4402
ord3370
ord3640
ord5161
ord3610
ord693
ord941
ord6311
ord4171
ord3301
ord3286
ord2089
ord6283
ord5861
ord3996
ord4277
ord6282
ord5981
ord6143
ord4299
ord6007
ord6907
ord3998
ord6648
ord5683
ord6930
ord6928
ord6696
ord6905
ord939
ord4278
ord6781
ord5608
ord1622
ord6883
ord4275
ord2379
ord5148
ord3626
ord2450
ord4133
ord4297
ord5788
ord472
ord5875
ord5787
ord6172
ord2414
ord5873
ord283
ord640
ord1640
ord323
ord1265
ord1168
ord465
ord464
ord1623
ord1601
ord6877
ord926
ord3988
ord2915
ord539
ord5572
ord1008
ord923
ord5933
ord5287
ord3831
ord3830
ord2976
ord3081
ord1116
ord1176
ord1575
ord1577
ord1182
ord342
ord1243
ord1197
ord1570
ord1253
ord1255
ord1578
ord600
ord826
ord269
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5714
ord5289
ord5307
ord4698
ord4079
ord5302
ord5300
ord3346
ord2396
ord5199
ord1089
ord3922
ord5731
ord2512
ord4486
ord2554
ord6375
ord4274
ord6467
ord823
ord2393
ord825
ord800
ord5440
ord537

msvcrt

free
__CxxFrameHandler
atoi
_EH_prolog
__dllonexit
strtok
??1type_info@@UAE@XZ
_initterm
_adjust_fdiv
_mbscmp
_CxxThrowException
wcslen
strncmp
isspace
toupper
sprintf
_mbsrchr
_onexit
realloc
malloc
_stricmp
ispunct
qsort
strncpy
memmove
_mbsicmp

kernel32

GlobalMemoryStatusEx
LocalAlloc
IsDBCSLeadByte
InterlockedDecrement
lstrlenA
FormatMessageA
InterlockedIncrement
LocalFree
LockResource
SizeofResource
LoadResource
GetModuleFileNameA
lstrlenW
GetLastError
MultiByteToWideChar
WideCharToMultiByte
FindResourceA

user32

SendMessageA
GetFocus
DrawFocusRect
FillRect
SetRectEmpty
GetSysColor
CopyRect
BringWindowToTop
FindWindowA
wsprintfA
RegisterWindowMessageA
LoadCursorA
SetCursor
KillTimer
UpdateWindow
EnableWindow
IsWindowVisible
GetParent
PostMessageA
GetWindowRect

gdi32

GetTextMetricsA
GetTextExtentPoint32A

ole32

OleRun
CLSIDFromProgID
CoCreateInstance
CoUninitialize
CoInitialize

oleaut32

CreateErrorInfo
VariantInit
VariantClear
SysFreeString
SysAllocString
VariantChangeType
VariantCopy
SysStringByteLen
GetErrorInfo
SysAllocStringByteLen

dalog

??1CDALog@@QAE@XZ
?Write@CDALog@@QAAXPBDZZ
??RCDALog@@QAEAAV0@W4Lvl@0@@Z
?storage@CDALog@@QAEXPBD00_N1@Z
??0CDALog@@QAE@XZ

dasymbol

?GetGroupHandle@CDASymbolListMgr@@QAEHHPBDPAPAXH@Z
?GetDefExchOrder@CDASymbolListMgr@@QAEXAAVCUIntArray@@@Z
?GetGroupSymbolInfo@CDASymbolListMgr@@QAEHPAXHPAUSymbolInfo@@@Z
?GetGroupSymbolCount@CDASymbolListMgr@@QAEHPAX@Z
?LookUpSymbolGetString@CSymbolTableMgr@@QAEHHVCString@@0AAV2@@Z
?GetSymbolList@CDASymbolListMgr@@QAEHAAVCPtrArray@@H@Z
??1CDASymbolListMgr@@QAE@XZ
?RebuildSymbolTable@CSymbolTableMgr@@QAEHABVCString@@H@Z
?UpdateExchSymbolChange@CDASymbolListMgr@@QAEHHPBDFW4ExchSymbolUpdateType@@@Z
?UpdateSymbols@CSymbolTableMgr@@QAEHHPBDH@Z
?AddSymbols@CSymbolTableMgr@@QAEHHPBDH@Z
?RemoveSymbols@CSymbolTableMgr@@QAEHHPBDH@Z
?InitAuthorizedExch@CSymbolTableMgr@@QAEHXZ
?ReLoadDefaultExch@CDASymbolListMgr@@QAEXH@Z
?UpdateGroupType@CDASymbolListMgr@@QAEHH@Z
?UpdateGroup@CDASymbolListMgr@@QAEHHPBD@Z
?UpdateDASymbolList@CDASymbolListMgr@@QAEHXZ
??0CDASymbolListMgr@@QAE@XZ
?GetDASymbolListCount@CDASymbolListMgr@@QAEHH@Z
?GetGroupCount@CDASymbolListMgr@@QAEHHPAX@Z
?GetGroupInfo@CDASymbolListMgr@@QAEHHPAXHPAUGroupInfo@@@Z
?GetAllSymbolInfos@CDASymbolListMgr@@QAEHPAPAUSymbolInfo@@PAH@Z
?DoSearchUI@CDASymbolListMgr@@SAHPAV1@PAVCSymbolTableMgr@@PAUHWND__@@VCString@@AAUSymbolInfo@@HPAVCListID@@@Z
?LookUpNameGetSymbolID@CSymbolTableMgr@@QAEHABVCString@@AAV2@@Z
?GetSymbolTableMgr@CDASymbolListMgr@@QAEPAVCSymbolTableMgr@@XZ
?GetSymbolInfo@CDASymbolListMgr@@QAEHPBDPAUExchInfo@@HPAUSymbolInfo@@@Z
?Init@CDASymbolListMgr@@QAEHPBDHHHPAVCStringArray@@HH@Z
?IsDefaultExchange@CDASymbolListMgr@@QAEHH@Z

dacommon

IsTraditionChinese
daShowMessageStr
daShowDllMessage

msvcp60

??1ios_base@std@@UAE@XZ
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Xran@std@@YAXXZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Xlen@std@@YAXXZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
??_D?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UAE@XZ
?getline@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@1@AAV21@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@D@Z
??_7?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@6B@
??0?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@H@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@
??0ios_base@std@@IAE@XZ
??_8?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@7B?$basic_ostream@DU?$char_traits@D@std@@@1@@
??_8?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@7B?$basic_istream@DU?$char_traits@D@std@@@1@@
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

datitle

??1CDATitle@@UAE@XZ
?GetName@CDATitle@@QAE?AVCString@@XZ
?ChangeTitleField@CDATitle@@QAEHVCString@@@Z
?GetFieldGroupNames@CDATitleMgr@@QAEXPAVCUIntArray@@PAVCStringArray@@@Z
?GetFieldName@CDATitleMgr@@QAEHHPAD@Z
?GetFieldGroupContent@CDATitleMgr@@QAEHHPAVCUIntArray@@@Z
??0CDATitle@@QAE@XZ
?GetFieldList@CDATitle@@QAE?AVCString@@XZ
?InitVersion@CDATitleMgr@@QAEXH@Z
??1CDATitleMgr@@QAE@XZ
?GetTitleField@CDATitle@@QAEHHPAUDATitleField@@@Z
?GetCount@CDATitle@@QAEHXZ
??0CDATitleMgr@@QAE@XZ
?Init@CDATitleMgr@@QAEHXZ
?Copy@CDATitle@@UAEXPAV1@@Z

jdproxy

JDEX2XQID2
JDGetSymbolInfos
JDFindSymbol
JDFindSymbol2
JDGetSymbolInfo
JDGetNotify

dautil

?IsMin@CFrequencyUtility@@SA_NW4FrequencyType@@@Z
?IsValid@CFrequencyUtility@@SA_NW4FrequencyType@@@Z
?LoadResourceString@CStrUtil@@SA?AVCString@@I@Z
?IsTick@CFrequencyUtility@@SA_NW4FrequencyType@@@Z

daui

?SetDP@CDASpinBox@@QAEXH@Z
?SetUseInnerMinMax@CDASpinBox@@QAEXH@Z
?AddWindowTool@CDAToolTip@@QAEHPAVCWnd@@PBD@Z
?SetBitmap@CDAIconButton@@QAEHIHHHK@Z
?GetValue@CDASpinBox@@QAEHAAH@Z
?daSelectDate@@YAHPAVCTime@@@Z
??1CCharEdit@@UAE@XZ
??_7CCharEdit@@6B@
??1CDAIconButton@@UAE@XZ
?SetValue@CDASpinBox@@QAEXH@Z
?DDX_SpinBox@@YAXPAVCDataExchange@@HAAVCDASpinBox@@HHHAAH@Z
?DDV_MinMaxSpinBox@@YAXPAVCDataExchange@@HAAVCDASpinBox@@HHHAAH@Z
??0CDAIconButton@@QAE@XZ
??_7CDAToolTip@@6B@
??0CDASpinBox@@QAE@XZ
??1CDAToolTip@@UAE@XZ
??1CDASpinBox@@UAE@XZ
?SetRange@CDASpinBox@@QAEXHH@Z

Exports

Exports

?CallHistDataHelper@@YAHXZ
?CallHistDataWizard@@YAHXZ
?CallKDataHelper@@YAHXZ
?CallQuoteSeltitle@@YAHPAVCWnd@@PBD11H@Z
?CallQuoteWizard@@YAHXZ
?DDEHist@@YAHPBD@Z
?DDEKLine@@YAHPBD@Z
?DDEQuote@@YAHPBD@Z
?DDETA@@YAHPBD0ABVCOleSafeArray@@HH@Z
?FiniExcelServer@@YAXXZ
?InitExcelServer@@YAHHH@Z
?OnExcelAddInNotify@@YAJIJ@Z
?ddeHist@@YAHPBD0W4FrequencyType@@HHH0@Z
?ddeK@@YAHPBD0W4FrequencyType@@H@Z
?ddeQuote@@YAHPBD00H@Z
?ddeQuoteSeltitle@@YAHPAVCWnd@@PBD11H@Z
?fnGetHistData@@YAHAAVCString@@AAW4FrequencyType@@AAHPAVCUIntArray@@@Z
?fnGetHistDataWizardData@@YAHPAVCStringArray@@AAW4FrequencyType@@AAJ2AAHPAVCUIntArray@@@Z
?fnGetHistFieldName@@YAHPBVCUIntArray@@PAVCStringArray@@1@Z
?fnGetKData@@YAHAAVCString@@AAW4FrequencyType@@AAH@Z
?fnGetQuoteSelTitle@@YAHAAVCString@@AAH@Z
?fnGetQuoteWizardData@@YAHPAVCStringArray@@PAVCUIntArray@@@Z
?fnGetQuoteWizardData@@YAHPAVCStringArray@@PAVCUIntArray@@PAH@Z
?fnGetSymbolDisplayText@@YAHPBVCStringArray@@PAV1@@Z
?fnGetTitleName@@YAHPBVCUIntArray@@PAVCStringArray@@@Z
?fnUpdateSymbolList@@YAHXZ
DllCanUnloadNow
DllGetClassObject
DllRegisterServer

Sections

.text
Size: 168KB - Virtual size: 166KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 68KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0c493e5cce669b7944f2ef4f85a3920c

Headers

File Characteristics

Imports

mfc42

msvcrt

kernel32

user32

gdi32

ole32

oleaut32

dalog

dasymbol

dacommon

msvcp60

datitle

jdproxy

dautil

daui

Exports

Exports

Sections

.text Size: 168KB - Virtual size: 166KB

.rdata Size: 40KB - Virtual size: 36KB

.data Size: 4KB - Virtual size: 8KB

.rsrc Size: 68KB - Virtual size: 65KB

.reloc Size: 20KB - Virtual size: 16KB

.text
Size: 168KB - Virtual size: 166KB

.rdata
Size: 40KB - Virtual size: 36KB

.data
Size: 4KB - Virtual size: 8KB

.rsrc
Size: 68KB - Virtual size: 65KB

.reloc
Size: 20KB - Virtual size: 16KB