5a8f1573d5fc48c1388a4d6b2ed3c9e3091128543508b0a330200c3683e60de3

Sharing

Copy URL Twitter E-mail

General

Target

5a8f1573d5fc48c1388a4d6b2ed3c9e3091128543508b0a330200c3683e60de3
Size

225KB
MD5

89f2c2cf2f5b3ae393888e175c62fa5d
SHA1

b7e94f936acd918ddf6eb1bfeef3aa217e66acb7
SHA256

5a8f1573d5fc48c1388a4d6b2ed3c9e3091128543508b0a330200c3683e60de3
SHA512

96497340b1d66fbc4962bd0dec1f7a7400369be1bdddf80808960c45b0db240de74e83ca8938ef8c6e9b6fa48b5529194c4748da6cd1a02b6260b6da005af400
SSDEEP

3072:PoEvaP+i5zXHn0IB12MFsJrJiw2qEkPmXE/2FirKh8x5dCQ1U7+ZbUdAroSxWBTF:/vc9Xn0ITGZTTE6bq9GWf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5a8f1573d5fc48c1388a4d6b2ed3c9e3091128543508b0a330200c3683e60de3

Files

5a8f1573d5fc48c1388a4d6b2ed3c9e3091128543508b0a330200c3683e60de3
.dll windows x86

a3beba31bd58a6d5b6dc8faa2475151e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

darcfile

?daRcSaveSysTitle@@YAHABV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@AAVCMemFile@@@Z
?daRcLoadTitle@@YAHABV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@AAVCMemFile@@@Z
?daInitSysTitleMap@@YAXXZ
?daRcDoResetSysTitleByName@@YAXABV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z

daui

?SetDP@CDASpinBox@@QAEXH@Z
?SetValue@CDASpinBox@@QAEXH@Z
?GetValue@CDASpinBox@@QAEHAAH@Z
??1CDASpinBox@@UAE@XZ
?DDX_SpinBox@@YAXPAVCDataExchange@@HAAVCDASpinBox@@HHHAAH@Z
?DDV_MinMaxSpinBox@@YAXPAVCDataExchange@@HAAVCDASpinBox@@HHHAAH@Z
??0CDAIconButton@@QAE@XZ
??1CDAIconButton@@UAE@XZ
?SetBitmap@CDAIconButton@@QAEHIHHHK@Z
?DestroyWindow@CSingletonDlg@@UAEHXZ
?WindowProc@CSingletonDlg@@MAEJIIJ@Z
?OnInitDialog@CSingletonDlg@@MAEHXZ
?SetNoFocus@CDAIconButton@@QAEXH@Z
??0CDASpinBox@@QAE@XZ
?GetThisMessageMap@CSingletonDlg@@KGPBUAFX_MSGMAP@@XZ
??1CSingletonDlg@@UAE@XZ
??0CSingletonDlg@@QAE@V?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@IPAVCWnd@@H@Z
?SetRange@CDASpinBox@@QAEXHH@Z

dautil

?IsValidName@CCheckFileName@@SAHPAUHWND__@@PBDH@Z
?Load@CRegConfig@@QAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD00@Z
?ParseXMLFile@CXMLHelper@@SAHABV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@AAV?$_com_ptr_t@V?$_com_IIID@UIXMLDOMDocument2@MSXML2@@$1?_GUID_2933bf95_7b36_11d2_b20e_00c04f983e60@@3U__s_GUID@@B@@@@@Z
?Save@CRegConfig@@QAEHPBD00@Z

mfc110

ord6375
ord3104
ord3341
ord3340
ord4025
ord10266
ord11180
ord10808
ord8848
ord11953
ord9017
ord2704
ord13498
ord6064
ord11912
ord6334
ord3085
ord4151
ord1057
ord8934
ord6432
ord3129
ord6856
ord4156
ord8557
ord2934
ord3808
ord14307
ord2697
ord1170
ord8939
ord6341
ord3087
ord4154
ord8556
ord2933
ord3806
ord1061
ord8936
ord6393
ord1124
ord6687
ord977
ord3201
ord3306
ord1449
ord5967
ord2322
ord6590
ord12125
ord14338
ord12182
ord14391
ord13020
ord13704
ord13018
ord323
ord1043
ord3175
ord4780
ord2329
ord2330
ord2333
ord493
ord3783
ord5367
ord12557
ord4256
ord2931
ord6399
ord5369
ord967
ord14412
ord12207
ord1437
ord11755
ord2840
ord13705
ord7863
ord12419
ord6589
ord817
ord13702
ord13016
ord7857
ord12413
ord1343
ord12921
ord554
ord1177
ord2334
ord6410
ord2466
ord3816
ord6634
ord892
ord2327
ord357
ord6403
ord6330
ord6372
ord4804
ord2464
ord3887
ord13022
ord13520
ord12334
ord12354
ord449
ord12726
ord12640
ord12868
ord12859
ord12860
ord13050
ord13054
ord13787
ord13440
ord13853
ord8691
ord13850
ord12792
ord13865
ord8694
ord13861
ord12795
ord5073
ord8623
ord8170
ord4579
ord1099
ord12843
ord884
ord1380
ord11922
ord2506
ord4429
ord7260
ord14064
ord5274
ord7630
ord6715
ord12815
ord13677
ord13675
ord6713
ord11418
ord11248
ord3767
ord2482
ord7471
ord2286
ord1102
ord2245
ord6343
ord10807
ord8847
ord5809
ord900
ord4039
ord902
ord1392
ord989
ord1461
ord8629
ord3111
ord361
ord1059
ord6804
ord14063
ord13970
ord11688
ord4977
ord12336
ord2937
ord922
ord13703
ord5975
ord12415
ord1401
ord2149
ord8571
ord13875
ord499
ord11745
ord14340
ord2826
ord1133
ord566
ord1185
ord12131
ord14344
ord5737
ord7860
ord6699
ord13869
ord2806
ord12801
ord14333
ord4594
ord1519
ord2384
ord2159
ord8273
ord7470
ord1459
ord8191
ord12028
ord10228
ord12701
ord12638
ord4519
ord7808
ord8130
ord5212
ord2430
ord12318
ord12317
ord14329
ord7734
ord14327
ord9203
ord4084
ord4023
ord12720
ord7753
ord1978
ord11766
ord11765
ord14201
ord12307
ord7811
ord14401
ord6192
ord14403
ord6194
ord14402
ord6193
ord987
ord6694
ord3786
ord5765
ord12020
ord8025
ord12032
ord12000
ord5617
ord10047
ord6066
ord13502
ord3243
ord3240
ord10052
ord8018
ord2705
ord10082
ord10084
ord10083
ord10081
ord10085
ord5507
ord11509
ord11510
ord8947
ord11870
ord3772
ord11719
ord14322
ord8773
ord12001
ord6809
ord10795
ord9063
ord3204
ord13619
ord12040
ord12038
ord1702
ord1711
ord1719
ord1715
ord1724
ord4842
ord4879
ord4850
ord4862
ord4858
ord4854
ord4885
ord4875
ord4846
ord4889
ord4867
ord4831
ord4837
ord4870
ord4432
ord5643
ord9495
ord4424
ord2995
ord14330
ord7735
ord14328
ord6710
ord11501
ord13449
ord5782
ord2626
ord11905
ord3874
ord3308
ord3309
ord3203
ord5107
ord5404
ord5614
ord9155
ord5380
ord5110
ord5266
ord5091
ord7537
ord7538
ord7528
ord5264
ord8027
ord9016
ord1646
ord8312
ord1438
ord13019
ord968
ord8166
ord5769
ord1687
ord1683
ord1520
ord7971
ord5277
ord11949
ord4809
ord1517
ord1038
ord310
ord305
ord316
ord2950
ord14059
ord5732
ord1652
ord266
ord265
ord1498
ord1500
ord1463
ord14242
ord13296
ord13017
ord4407
ord994
ord3631
ord3750
ord4805
ord2189
ord1452
ord979
ord8270
ord4746
ord14149
ord1501
ord324
ord1044
ord2305
ord2352
ord2355
ord2318
ord2354
ord484
ord2211
ord2316
ord2128
ord2242
ord2343
ord14155
ord4595
ord300
ord12695
ord7991
ord6333

msvcr110

_itoa
malloc
_stricmp
memmove
strlen
_localtime64_s
strftime
strtoul
_time64
memcpy_s
atoi
strncpy
wcslen
_mbsnbcpy
wcstol
??1type_info@@UAE@XZ
_lock
_purecall
_calloc_crt
__dllonexit
_onexit
?terminate@@YAXXZ
__CppXcptFilter
_amsg_exit
memcpy
_malloc_crt
_initterm
__CxxFrameHandler3
_initterm_e
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
_except_handler4_common
__clean_type_info_names_internal
ldiv
strcpy
memset
_CxxThrowException
_unlock
free

kernel32

InterlockedDecrement
LocalFree
WideCharToMultiByte
InitializeCriticalSectionAndSpinCount
LoadResource
SizeofResource
FindResourceA
LockResource
GetTempPathA
LocalAlloc
EncodePointer
DecodePointer
GetLastError
lstrlenA
MultiByteToWideChar
lstrlenW
IsDebuggerPresent
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
MulDiv

user32

PostMessageA
SendMessageA
EnableWindow
GetWindowRect
CopyRect
GetParent
DefWindowProcA
GetClassInfoA
IsWindow
GetFocus
GetKeyState
GetCapture
SetCapture
ReleaseCapture
SetTimer
KillTimer
DrawTextA
DrawTextExA
GrayStringA
TabbedTextOutA
GetDC
ReleaseDC
InvalidateRect
GetClientRect
SetCursor
GetCursorPos
ClipCursor
ScreenToClient
GetSysColor
FillRect
InflateRect
IntersectRect
OffsetRect
LoadCursorA
TranslateMessage
DispatchMessageA
GetSystemMetrics
IsWindowVisible
DrawFocusRect
LoadIconA
DrawIconEx
GetIconInfo
RegisterWindowMessageA
LoadStringA
ClientToScreen
WindowFromPoint
IsRectEmpty
PtInRect
SetRect

gdi32

TextOutA
AbortDoc
EndPage
StartPage
EndDoc
StartDocA
Rectangle
ExtTextOutA
GetTextExtentPoint32A
RectVisible
PtVisible
GetDeviceCaps
GetCurrentObject
Escape
CreatePen
CreateFontA
CreateFontIndirectA
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
GetTextMetricsA
GetObjectA

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey

ole32

CoCreateInstance
CoCreateGuid
OleRun

oleaut32

CreateErrorInfo
SysAllocStringByteLen
SysStringByteLen
VariantChangeType
VariantCopy
VariantClear
GetErrorInfo
SetErrorInfo
VariantInit
SysFreeString
SysAllocString
VariantTimeToSystemTime
SystemTimeToVariantTime

dacommon

daShowMessageStr
_daSetErrCode
_daSetErrException
IsTraditionChinese
daDoModal
daShowDllMessage

msvcp110

?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Syserror_map@std@@YAPBDH@Z
?_Winerror_map@std@@YAPBDH@Z

jdproxy

JDGetFieldInfo

dasproxy

?DASCall@@YAHPBDJJ0@Z

Exports

Exports

??0CDATitle@@QAE@XZ
??0CDATitleMgr@@QAE@XZ
??1CDATitle@@UAE@XZ
??1CDATitleMgr@@QAE@XZ
??9CDATitle@@QAEHPAV0@@Z
??_7CDATitle@@6B@
?AddDATitle@CDATitleMgr@@QAEHPAVCDATitle@@@Z
?AddNewTitle@CDATitleMgr@@QAEHABV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@0H0@Z
?ChangeName@CDATitle@@QAEXV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?ChangeTitleField@CDATitle@@QAEHV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?CheckGUIDExist@CDATitleMgr@@QAEHABV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?CheckNameExist@CDATitleMgr@@QAEHABV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@HH@Z
?ClearFieldList@CDATitleMgr@@IAEXXZ
?ClearTitleList@CDATitleMgr@@IAEXXZ
?Copy@CDATitle@@UAEXPAV1@@Z
?DoTitleEditUI@CDATitleMgr@@QAEHV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@H@Z
?DoTitleListUI@CDATitleMgr@@QAEHPAUHWND__@@@Z
?DoTitleNewUI@CDATitleMgr@@QAEHXZ
?GetCount@CDATitle@@QAEHXZ
?GetCount@CDATitleMgr@@QAEHXZ
?GetCountExclusiveIDName@CDATitle@@QAEHXZ
?GetCycleTime@CDATitle@@QAEHXZ
?GetDefault@CDATitleMgr@@QAEHPAPAVCDATitle@@@Z
?GetDefault@CDATitleMgr@@QAEPAVCDATitle@@XZ
?GetDefaultIndex@CDATitleMgr@@QAEHXZ
?GetDefaultSysTitle@CDATitleMgr@@QAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@H@Z
?GetDefaultSysTitleCnt@CDATitleMgr@@QAEHXZ
?GetDispName@CDATitle@@QAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?GetFieldCount@CDATitleMgr@@QAEHXZ
?GetFieldGroupContent@CDATitleMgr@@QAEHHPAVCUIntArray@@@Z
?GetFieldGroupCount@CDATitleMgr@@QAEHXZ
?GetFieldGroupNames@CDATitleMgr@@QAEXPAVCUIntArray@@PAVCStringArray@@@Z
?GetFieldList@CDATitle@@QAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?GetFieldList@CDATitleMgr@@QAEPAUFieldInfo@@AAH@Z
?GetFieldName@CDATitle@@UAEHHPAD@Z
?GetFieldName@CDATitleMgr@@QAEHHPAD@Z
?GetID@CDATitle@@QAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?GetMiniTradeTitle@CDATitleMgr@@QAEPAVCDATitle@@XZ
?GetName@CDATitle@@QAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?GetTempFolder@CDATitleMgr@@QAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?GetTitle@CDATitleMgr@@QAEHABV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PAPAVCDATitle@@H@Z
?GetTitle@CDATitleMgr@@QAEHHPAPAVCDATitle@@@Z
?GetTitle@CDATitleMgr@@QAEPAVCDATitle@@ABV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?GetTitle@CDATitleMgr@@QAEPAVCDATitle@@H@Z
?GetTitleField@CDATitle@@QAEHHPAUDATitleField@@@Z
?GetTitleList@CDATitleMgr@@QAEHAAVCPtrArray@@@Z
?Init@CDATitleMgr@@QAEHPBD@Z
?Init@CDATitleMgr@@QAEHXZ
?InitVersion@CDATitleMgr@@QAEXH@Z
?IsSystemTitle@CDATitle@@QAEHXZ
?LoadFieldList@CDATitleMgr@@IAEHXZ
?LoadMiniTradeTitle@CDATitleMgr@@QAEHABV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?LoadTitleList@CDATitleMgr@@IAEHPAVCXMLDOMParser@@ABV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@H@Z
?ParserRcSysTitle@CDATitleMgr@@IAEXABV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@AAV23@AAH@Z
?RemoveAllDefaultSysTitle@CDATitleMgr@@QAEXXZ
?SaveMiniTradeTitle@CDATitleMgr@@QAEHABV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?SaveSysTitleList@CDATitleMgr@@QAEHPAVCDATitle@@@Z
?SaveTitleList@CDATitleMgr@@QAEHAAVCPtrArray@@H@Z
?SaveTitleListInFile@CDATitleMgr@@QAEHAAVCFile@@PAVCDATitle@@@Z
?SaveTitleListInRC@CDATitleMgr@@QAEHAAVCFile@@@Z
?SetCycleTime@CDATitle@@QAEXH@Z
?SetDefaultID@CDATitleMgr@@QAEXABV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?SetDefaultIndex@CDATitleMgr@@QAEXH@Z
?SetDefaultMiniTradeTitle@CDATitleMgr@@QAEXXZ
?SetDefaultSysTitle@CDATitleMgr@@QAEXHABV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?SetID@CDATitle@@QAEXV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?SetMiniTradeTitle@CDATitleMgr@@QAEXPAVCDATitle@@@Z
?SetSystemTitle@CDATitle@@QAEXH@Z
?Update@CDATitle@@MAEHABV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?Update@CDATitleMgr@@QAEHXZ
?UpdateSysTitleList@CDATitleMgr@@QAEHHV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z

Sections

.text
Size: 119KB - Virtual size: 119KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a3beba31bd58a6d5b6dc8faa2475151e

Headers

DLL Characteristics

File Characteristics

Imports

darcfile

daui

dautil

mfc110

msvcr110

kernel32

user32

gdi32

advapi32

ole32

oleaut32

dacommon

msvcp110

jdproxy

dasproxy

Exports

Exports

Sections

.text Size: 119KB - Virtual size: 119KB

.rdata Size: 56KB - Virtual size: 55KB

.data Size: 4KB - Virtual size: 5KB

.rsrc Size: 29KB - Virtual size: 29KB

.reloc Size: 15KB - Virtual size: 14KB

.text
Size: 119KB - Virtual size: 119KB

.rdata
Size: 56KB - Virtual size: 55KB

.data
Size: 4KB - Virtual size: 5KB

.rsrc
Size: 29KB - Virtual size: 29KB

.reloc
Size: 15KB - Virtual size: 14KB