e23441d815afeb9c077c046dbc9abf9e334e5881672ea82ddcb7c5772f7a953e

Sharing

Copy URL Twitter E-mail

General

Target

e23441d815afeb9c077c046dbc9abf9e334e5881672ea82ddcb7c5772f7a953e
Size

384KB
MD5

e3d9b3b80ccaad475c33c4bed09f0056
SHA1

97d650c65df25154c62d389887b05d7ee0b199c1
SHA256

e23441d815afeb9c077c046dbc9abf9e334e5881672ea82ddcb7c5772f7a953e
SHA512

042b891389e8fc8171753cadd40215c23a32092c5bc45eaacb85aee586391849afcecfd3aae1e43a716fb2c29ef308b64fd923a1a567bf975a9350f187572655
SSDEEP

6144:9eBaHMcGA5Ln29kUuR08aiHU4Ht1RCtrGEfuDrMAxmam2FT4eCvNSh:9Reqn29IUAMAxmam2FT4Rq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e23441d815afeb9c077c046dbc9abf9e334e5881672ea82ddcb7c5772f7a953e

Files

e23441d815afeb9c077c046dbc9abf9e334e5881672ea82ddcb7c5772f7a953e
.dll regsvr32 windows x86

99a273f4906b20bbca64865d7cf47767

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

xqrtd

?XQRTDSetExtFlag@@YAHH@Z

mfc110

ord13097
ord5035
ord10090
ord4152
ord8554
ord8935
ord4873
ord4882
ord4840
ord1699
ord5807
ord7203
ord918
ord3177
ord4041
ord10292
ord1400
ord11998
ord2538
ord9060
ord2994
ord9032
ord7445
ord922
ord13703
ord1401
ord1641
ord4941
ord8289
ord14189
ord1683
ord1687
ord2931
ord2937
ord3781
ord12658
ord14155
ord14149
ord14154
ord14148
ord8570
ord13704
ord13019
ord8629
ord13296
ord6393
ord3111
ord1124
ord11716
ord6433
ord13395
ord13403
ord5698
ord13405
ord5664
ord5524
ord7873
ord4157
ord7878
ord1171
ord8940
ord5831
ord8571
ord13018
ord2414
ord3015
ord7860
ord12417
ord1684
ord8773
ord7471
ord6410
ord3816
ord6634
ord892
ord6333
ord357
ord2464
ord3887
ord449
ord12859
ord12858
ord13050
ord13054
ord13787
ord8623
ord8170
ord1099
ord11688
ord4745
ord3175
ord4780
ord6334
ord3085
ord4151
ord1057
ord8934
ord11997
ord6370
ord3102
ord7473
ord1096
ord6669
ord3193
ord3300
ord6241
ord1431
ord4977
ord12336
ord306
ord12538
ord2384
ord2415
ord7861
ord2189
ord262
ord259
ord1873
ord877
ord878
ord12001
ord6809
ord10795
ord9063
ord3204
ord13619
ord12040
ord12038
ord1702
ord1711
ord1719
ord1715
ord1724
ord4842
ord4879
ord4850
ord4862
ord4858
ord4854
ord4885
ord4875
ord4846
ord11510
ord4867
ord6582
ord4837
ord4870
ord4432
ord5643
ord9495
ord4424
ord2995
ord14330
ord7735
ord14328
ord14242
ord6710
ord4407
ord11501
ord13970
ord12801
ord13869
ord13449
ord5782
ord7630
ord13875
ord3086
ord5277
ord2626
ord11905
ord3874
ord3308
ord3309
ord3203
ord11949
ord4809
ord994
ord3631
ord3731
ord3750
ord4540
ord11925
ord4805
ord1452
ord13020
ord13705
ord979
ord14391
ord12182
ord14338
ord12125
ord8270
ord4746
ord13998
ord8166
ord12695
ord4595
ord4594
ord5769
ord300
ord305
ord2950
ord14059
ord7991
ord4256
ord6590
ord2333
ord2322
ord2327
ord2329
ord1520
ord316
ord5732
ord1652
ord266
ord265
ord2144
ord2145
ord14270
ord12308
ord2245
ord1500
ord1498
ord3783
ord310
ord1038
ord1517
ord8273
ord7470
ord1459
ord8191
ord12028
ord10228
ord12701
ord12638
ord4519
ord8130
ord5212
ord2430
ord12318
ord12317
ord14329
ord7734
ord14327
ord7444
ord10793
ord1397
ord14419
ord11717
ord11718
ord11715
ord10961
ord10364
ord11118
ord8850
ord10814
ord11026
ord8785
ord908
ord7202
ord8936
ord1061
ord3806
ord2933
ord8556
ord4154
ord3087
ord6341
ord8939
ord1170
ord2697
ord14307
ord3808
ord8947
ord11870
ord3772
ord11719
ord9203
ord4084
ord4023
ord12720
ord7753
ord1978
ord11766
ord11765
ord14201
ord12307
ord7811
ord14401
ord6192
ord14403
ord6194
ord14402
ord6193
ord987
ord6694
ord3786
ord5765
ord12020
ord8025
ord12032
ord12000
ord5107
ord5404
ord5614
ord9155
ord5380
ord5617
ord5110
ord5266
ord2934
ord8557
ord4156
ord6856
ord3129
ord6432
ord11912
ord6064
ord13498
ord2704
ord9017
ord11953
ord11180
ord10266
ord4025
ord3340
ord5091
ord7537
ord7538
ord7528
ord5264
ord8027
ord10047
ord9016
ord1043
ord323
ord6337
ord7311
ord1102
ord8848
ord10808
ord457
ord6375
ord1380
ord884
ord1438
ord968
ord14333
ord1336
ord3163
ord7971
ord3164
ord3341
ord3104
ord5975
ord6066
ord13502
ord3243
ord3240
ord10052
ord8018
ord2705
ord1463
ord10082
ord10084
ord10083
ord10081
ord10085
ord5507
ord4831
ord11509
ord4889
ord14322
ord1501
ord324
ord1044
ord2305
ord2352
ord2355
ord2318
ord2354
ord484
ord2211
ord2316
ord2128
ord2242
ord2343
ord3767

msvcr110

isspace
strncmp
_malloc_crt
strtok
_stricmp
strncpy
qsort
sscanf
ldiv
ceil
free
malloc
realloc
_CxxThrowException
_time64
_mktime64
_localtime64_s
strftime
atoi
memmove
_purecall
memset
memcpy
_amsg_exit
__CppXcptFilter
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_onexit
__dllonexit
_calloc_crt
_lock
sprintf
ispunct
sprintf_s
_mbsrchr
memcpy_s
_unlock
__CxxFrameHandler3
__clean_type_info_names_internal
__crtTerminateProcess
__crtUnhandledException
_crt_debugger_hook
_except_handler4_common
_initterm_e
_initterm
toupper

kernel32

FormatMessageA
lstrlenA
GetModuleFileNameA
Sleep
LocalAlloc
WideCharToMultiByte
LockResource
LocalFree
LoadResource
SizeofResource
FindResourceA
EncodePointer
DecodePointer
IsDebuggerPresent
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetLastError
GetModuleHandleA
MultiByteToWideChar
IsDBCSLeadByte
lstrlenW
GlobalMemoryStatus
GetProcAddress
InterlockedIncrement
InterlockedDecrement

user32

SendMessageA
PostMessageA
EnableWindow
GetWindowRect
GetParent
IsWindowVisible
GetFocus
KillTimer
UpdateWindow
SetCursor
GetSysColor
DrawFocusRect
FillRect
SetRectEmpty
CopyRect
InvalidateRect
OffsetRect
wsprintfA
BringWindowToTop
FindWindowA
RegisterWindowMessageA
LoadCursorA

gdi32

GetTextExtentPoint32A
GetTextMetricsA

ole32

CLSIDFromProgID
CoCreateInstance
CoUninitialize
CoInitialize
OleRun

oleaut32

SysAllocString
SysFreeString
VariantInit
VariantClear
VariantCopy
VariantChangeType
SysStringByteLen
SysAllocStringByteLen
VariantTimeToSystemTime
SystemTimeToVariantTime
GetErrorInfo
CreateErrorInfo

dalog

??0CDALog@@QAE@XZ
?Write@CDALog@@QAAXPBDZZ
??RCDALog@@QAEAAV0@W4Lvl@0@@Z
?storage@CDALog@@QAEXPBD00_N1@Z
??1CDALog@@QAE@XZ

dasymbol

?LookUpSymbolGetString@CSymbolTableMgr@@QAEHHV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@0AAV23@@Z
?GetSymbolAndExchID@CSymbolTableMgr@@QAE?AU?$pair@V?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@V12@@std@@ABV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?GetGroupHandle@CDASymbolListMgr@@QAEHHPBDPAPAXH@Z
?GetGroupCount@CDASymbolListMgr@@QAEHHPAX@Z
?GetGroupInfo@CDASymbolListMgr@@QAEHHPAXHPAUGroupInfo@@@Z
?GetGroupSymbolCount@CDASymbolListMgr@@QAEHPAX@Z
?GetGroupSymbolInfo@CDASymbolListMgr@@QAEHPAXHPAUSymbolInfo@@@Z
?GetDASymbolListCount@CDASymbolListMgr@@QAEHH@Z
?GetDefExchOrder@CDASymbolListMgr@@QAEXAAVCUIntArray@@@Z
?GetSymbolList@CDASymbolListMgr@@QAEHAAVCPtrArray@@H@Z
?IsDefaultExchange@CDASymbolListMgr@@QAEHH@Z
?GetAllSymbolInfos@CDASymbolListMgr@@QAEHPAPAUSymbolInfo@@PAH@Z
?LookUpNameGetSymbolID@CSymbolTableMgr@@QAEHABV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@AAV23@@Z
?DoSearchUI@CDASymbolListMgr@@SAHPAV1@PAVCSymbolTableMgr@@PAUHWND__@@V?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@AAUSymbolInfo@@HPAVCListID@@@Z
?GetSymbolInfo@CDASymbolListMgr@@QAEHPBDPAUExchInfo@@HPAUSymbolInfo@@@Z
?RebuildSymbolTable@CSymbolTableMgr@@QAEHABV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@H@Z
?UpdateSymbols@CSymbolTableMgr@@QAEHHPBDH@Z
?AddSymbols@CSymbolTableMgr@@QAEHHPBDH@Z
?InitAuthorizedExch@CSymbolTableMgr@@QAEHXZ
??0CDASymbolListMgr@@QAE@XZ
??1CDASymbolListMgr@@QAE@XZ
?Init@CDASymbolListMgr@@QAEHPBDHHHPAVCStringArray@@HH@Z
?RemoveSymbols@CSymbolTableMgr@@QAEHHPBDH@Z
?ReLoadDefaultExch@CDASymbolListMgr@@QAEXH@Z
?UpdateDASymbolList@CDASymbolListMgr@@QAEHXZ
?UpdateGroupType@CDASymbolListMgr@@QAEHH@Z
?UpdateGroup@CDASymbolListMgr@@QAEHHPBD@Z
?UpdateExchSymbolChange@CDASymbolListMgr@@QAEHHPBDFW4ExchSymbolUpdateType@@@Z

dacommon

daShowMessageStr
IsTraditionChinese
daShowDllMessage

msvcp110

?_Xlength_error@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Syserror_map@std@@YAPBDH@Z
?_Winerror_map@std@@YAPBDH@Z
??1ios_base@std@@UAE@XZ
?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@
??_7ios_base@std@@6B@
?_BADOFF@std@@3_JB
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?_Add_vtordisp1@?$basic_istream@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Add_vtordisp2@?$basic_ostream@DU?$char_traits@D@std@@@std@@UAEXXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ

datitle

?GetFieldGroupContent@CDATitleMgr@@QAEHHPAVCUIntArray@@@Z
?GetFieldGroupNames@CDATitleMgr@@QAEXPAVCUIntArray@@PAVCStringArray@@@Z
?GetFieldName@CDATitleMgr@@QAEHHPAD@Z
?ChangeTitleField@CDATitle@@QAEHV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?GetName@CDATitle@@QAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?GetCount@CDATitle@@QAEHXZ
?GetTitleField@CDATitle@@QAEHHPAUDATitleField@@@Z
?GetFieldList@CDATitle@@QAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
??0CDATitleMgr@@QAE@XZ
??1CDATitleMgr@@QAE@XZ
?Init@CDATitleMgr@@QAEHXZ
??0CDATitle@@QAE@XZ
??1CDATitle@@UAE@XZ
?Copy@CDATitle@@UAEXPAV1@@Z
?InitVersion@CDATitleMgr@@QAEXH@Z

jdproxy

JDGetNotify
JDGetInfoData
JDEX2XQID2
JDGetSymbolInfos
JDGetSymbolInfo
JDFindSymbol2
JDFindSymbol

dautil

?LoadResourceString@CStrUtil@@SA?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@I@Z
?LoadStringA@CXmlHelperMgr@@SAHPBDAAVCXmlTreeNode@@@Z
?Uninitialize@CXmlHelperMgr@@SAXXZ
?Initialize@CXmlHelperMgr@@SAHXZ
?GetChildNodeSize@CXmlTreeNode@@QBEHXZ
?GetChildNode@CXmlTreeNode@@QBEPAV1@H@Z
?GetAttribute@CXmlTreeNode@@QBEHPBDAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?GetNodeName@CXmlTreeNode@@QBE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
??1CXmlTreeNode@@UAE@XZ
??0CXmlTreeNode@@QAE@XZ
?IsMin@CFrequencyUtility@@SA_NW4FrequencyType@@@Z
?IsTick@CFrequencyUtility@@SA_NW4FrequencyType@@@Z
?IsValid@CFrequencyUtility@@SA_NW4FrequencyType@@@Z

daui

?AddWindowTool@CDAToolTip@@QAEHPAVCWnd@@PBD@Z
??0CDAToolTip@@QAE@XZ
??1CDAToolTip@@UAE@XZ
?daSelectDate@@YAHPAVCTime@ATL@@@Z
??0CDASpinBox@@QAE@XZ
?SetDP@CDASpinBox@@QAEXH@Z
?SetRange@CDASpinBox@@QAEXHH@Z
?SetValue@CDASpinBox@@QAEXH@Z
?GetValue@CDASpinBox@@QAEHAAH@Z
?SetUseInnerMinMax@CDASpinBox@@QAEXH@Z
??1CDASpinBox@@UAE@XZ
?DDX_SpinBox@@YAXPAVCDataExchange@@HAAVCDASpinBox@@HHHAAH@Z
?DDV_MinMaxSpinBox@@YAXPAVCDataExchange@@HAAVCDASpinBox@@HHHAAH@Z
??0CDAIconButton@@QAE@XZ
??1CDAIconButton@@UAE@XZ
?SetBitmap@CDAIconButton@@QAEHIHHHK@Z
??1CCharEdit@@UAE@XZ
??0CCharEdit@@QAE@XZ

dastock

?AddInfoData@CStockKey@@SAHW4InfoType@@@Z

Exports

Exports

?CallHistDataHelper@@YAHXZ
?CallHistDataWizard@@YAHXZ
?CallKDataHelper@@YAHXZ
?CallQuoteSeltitle@@YAHPAVCWnd@@PBD11H@Z
?CallQuoteWizard@@YAHXZ
?DDEHist@@YAHPBD0@Z
?DDEKLine@@YAHPBD0@Z
?DDEMacroIndustry@@YAHPBD0@Z
?DDEQuote@@YAHPBD00@Z
?DDETA@@YAHPBD0ABVCOleSafeArray@@HH@Z
?FiniExcelServer@@YAXXZ
?InitExcelServer@@YAHHH@Z
?OnExcelAddInNotify@@YAJIJ@Z
?ddeHist@@YAHPBD00W4FrequencyType@@HHH0@Z
?ddeK@@YAHPBD00W4FrequencyType@@H@Z
?ddeQuote@@YAHPBD000H@Z
?ddeQuoteSeltitle@@YAHPAVCWnd@@PBD111H@Z
?fnGetHistData@@YAHAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@AAW4FrequencyType@@AAHPAVCUIntArray@@@Z
?fnGetHistDataWizardData@@YAHPAVCStringArray@@AAW4FrequencyType@@AAJ2AAHPAVCUIntArray@@@Z
?fnGetHistFieldName@@YAHPBVCUIntArray@@PAVCStringArray@@1@Z
?fnGetKData@@YAHAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@AAW4FrequencyType@@AAH@Z
?fnGetQuoteSelTitle@@YAHAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@AAH@Z
?fnGetQuoteWizardData@@YAHPAVCStringArray@@PAVCUIntArray@@@Z
?fnGetQuoteWizardData@@YAHPAVCStringArray@@PAVCUIntArray@@PAH@Z
?fnGetSymbolDisplayText@@YAHPBVCStringArray@@PAV1@@Z
?fnGetTitleName@@YAHPBVCUIntArray@@PAVCStringArray@@@Z
?fnUpdateSymbolList@@YAHXZ
DllCanUnloadNow
DllGetClassObject
DllRegisterServer

Sections

.text
Size: 211KB - Virtual size: 211KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 75KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

99a273f4906b20bbca64865d7cf47767

Headers

DLL Characteristics

File Characteristics

Imports

xqrtd

mfc110

msvcr110

kernel32

user32

gdi32

ole32

oleaut32

dalog

dasymbol

dacommon

msvcp110

datitle

jdproxy

dautil

daui

dastock

Exports

Exports

Sections

.text Size: 211KB - Virtual size: 211KB

.rdata Size: 59KB - Virtual size: 59KB

.data Size: 3KB - Virtual size: 5KB

.rsrc Size: 75KB - Virtual size: 75KB

.reloc Size: 33KB - Virtual size: 33KB

.text
Size: 211KB - Virtual size: 211KB

.rdata
Size: 59KB - Virtual size: 59KB

.data
Size: 3KB - Virtual size: 5KB

.rsrc
Size: 75KB - Virtual size: 75KB

.reloc
Size: 33KB - Virtual size: 33KB