aaa1d467afa77b87559769cf919c483ff032e8c54a812843113477dba77bf16d

Sharing

Copy URL

Twitter E-mail

General

Target

aaa1d467afa77b87559769cf919c483ff032e8c54a812843113477dba77bf16d
Size

310KB
MD5

fe67f5292b3dbc2685108a788c49dc6a
SHA1

9a5bfe00aafdb2adee781134e7bb83a4306a6fc7
SHA256

aaa1d467afa77b87559769cf919c483ff032e8c54a812843113477dba77bf16d
SHA512

38fdde9a3fb28cc9b63b92628c51d92f968056292efa2465f5e1d4b207699f239e02bf580cd3680cba5f8d2ab67dae304eacd7de32a0aee2a3340d7c5c940c52
SSDEEP

6144:PbH2pqs+dC/7+2Pk5qNNwsZXmCbrMAxmam2FTyCu:Pob2K+2ascdAxmam2FTy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aaa1d467afa77b87559769cf919c483ff032e8c54a812843113477dba77bf16d

Files

aaa1d467afa77b87559769cf919c483ff032e8c54a812843113477dba77bf16d
.dll windows x86

a0ff9b023aa829da762806947e888e50

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

datitle

?Copy@CDATitle@@UAEXPAV1@@Z
??0CDATitle@@QAE@XZ
?Init@CDATitleMgr@@QAEHXZ
??1CDATitleMgr@@QAE@XZ
??0CDATitleMgr@@QAE@XZ
?GetTitleField@CDATitle@@QAEHHPAUDATitleField@@@Z
?GetCount@CDATitle@@QAEHXZ
?GetFieldGroupContent@CDATitleMgr@@QAEHHPAVCUIntArray@@@Z
?GetFieldGroupNames@CDATitleMgr@@QAEXPAVCUIntArray@@PAVCStringArray@@@Z
?GetFieldName@CDATitleMgr@@QAEHHPAD@Z
?ChangeTitleField@CDATitle@@QAEHV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
??1CDATitle@@UAE@XZ
?GetName@CDATitle@@QAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ

excelsymbol

?GetGroupCount@CDASymbolListMgr@@QAEHHPAX@Z
?UpdateDASymbolList@CDASymbolListMgr@@QAEHXZ
?Init@CDASymbolListMgr@@QAEHPBDHHHPAVCStringArray@@HH@Z
??1CDASymbolListMgr@@QAE@XZ
??0CDASymbolListMgr@@QAE@XZ
?GetSymbolInfo@CDASymbolListMgr@@QAEHPBDPAUExchInfo@@HPAUSymbolInfo@@@Z
?DoSearchUI@CDASymbolListMgr@@SAHPAV1@PAUHWND__@@V?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@AAUSymbolInfo@@HPAVCListID@@@Z
?GetSymbolAndExchID@CDASymbolListMgr@@QAE?AU?$pair@V?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@V12@@std@@ABV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?GetAllSymbolInfos@CDASymbolListMgr@@QAEHPAPAUSymbolInfo@@PAH@Z
?IsDefaultExchange@CDASymbolListMgr@@QAEHH@Z
?GetSymbolList@CDASymbolListMgr@@QAEHAAVCPtrArray@@H@Z
?GetDASymbolListCount@CDASymbolListMgr@@QAEHH@Z
?GetGroupSymbolInfo@CDASymbolListMgr@@QAEHPAXHPAUSymbolInfo@@@Z
?GetGroupSymbolCount@CDASymbolListMgr@@QAEHPAX@Z
?GetGroupHandle@CDASymbolListMgr@@QAEHHPBDPAPAXH@Z
?GetGroupInfo@CDASymbolListMgr@@QAEHHPAXHPAUGroupInfo@@@Z

mfc110

ord10266
ord11180
ord11953
ord9017
ord2704
ord13498
ord6064
ord11912
ord6432
ord3129
ord6856
ord4156
ord8557
ord2934
ord3808
ord14307
ord2697
ord1170
ord8939
ord6341
ord3087
ord4154
ord8556
ord2933
ord3806
ord1061
ord8936
ord7202
ord908
ord8785
ord11026
ord10814
ord8850
ord11118
ord10364
ord10961
ord11715
ord11718
ord11717
ord14419
ord1397
ord10793
ord7444
ord6582
ord3164
ord3163
ord1336
ord14333
ord968
ord1438
ord3783
ord323
ord1043
ord2937
ord10047
ord5617
ord12000
ord12032
ord8025
ord12020
ord5765
ord3786
ord6694
ord987
ord6193
ord14402
ord6194
ord14403
ord6192
ord14401
ord7811
ord12307
ord14201
ord11765
ord11766
ord1978
ord7753
ord12720
ord4023
ord4084
ord9203
ord14327
ord7734
ord14329
ord12317
ord12318
ord2430
ord5212
ord8130
ord7808
ord14322
ord12638
ord12701
ord10228
ord12028
ord8191
ord1459
ord7470
ord8273
ord7203
ord916
ord918
ord3177
ord4041
ord10292
ord1400
ord11998
ord2538
ord9060
ord2994
ord9032
ord7445
ord922
ord13703
ord13017
ord1401
ord4941
ord8289
ord14189
ord1687
ord2931
ord3781
ord12658
ord14155
ord14149
ord14154
ord14148
ord8570
ord13704
ord13019
ord8629
ord13296
ord6393
ord3111
ord1124
ord11716
ord6433
ord13395
ord13403
ord5698
ord13405
ord5664
ord5524
ord7873
ord4157
ord7878
ord1171
ord8940
ord5831
ord8571
ord6375
ord457
ord4025
ord8848
ord1102
ord7311
ord1683
ord13018
ord2414
ord3015
ord7860
ord12417
ord3767
ord7471
ord6410
ord3816
ord6634
ord892
ord6333
ord357
ord2464
ord3887
ord449
ord12859
ord12858
ord13050
ord13054
ord13787
ord8623
ord8170
ord1099
ord11688
ord2245
ord4977
ord12336
ord12538
ord2189
ord1873
ord11997
ord1519
ord2384
ord8773
ord12001
ord6809
ord10795
ord9063
ord3204
ord13619
ord12040
ord12038
ord1702
ord1711
ord1719
ord1715
ord1724
ord4842
ord4879
ord4850
ord4862
ord4858
ord4854
ord4885
ord4875
ord4846
ord4889
ord4867
ord4831
ord4837
ord4870
ord4432
ord5643
ord9495
ord4424
ord2995
ord14330
ord7735
ord14328
ord14242
ord6710
ord4407
ord11501
ord13970
ord12801
ord13869
ord13449
ord5782
ord7630
ord13875
ord7971
ord5277
ord2626
ord11905
ord3874
ord3308
ord3309
ord3203
ord11949
ord4809
ord994
ord5107
ord5404
ord5614
ord9155
ord5380
ord5110
ord5266
ord5091
ord7537
ord7538
ord7528
ord5264
ord8027
ord9016
ord3631
ord3731
ord3750
ord4540
ord11925
ord4805
ord1452
ord13020
ord13705
ord979
ord1500
ord1498
ord265
ord266
ord14391
ord12182
ord14338
ord12125
ord8270
ord4746
ord13998
ord8166
ord12695
ord4595
ord4594
ord5769
ord1517
ord300
ord305
ord2950
ord14059
ord7991
ord4256
ord6590
ord2333
ord2322
ord2327
ord2329
ord1520
ord1038
ord310
ord3340
ord3341
ord3104
ord5975
ord13502
ord6066
ord3243
ord3240
ord10052
ord8018
ord2705
ord1463
ord10082
ord10084
ord10083
ord10081
ord10085
ord5507
ord11509
ord11510
ord8947
ord11870
ord3772
ord10808
ord11719
ord1501
ord324
ord1044
ord2305
ord2352
ord2355
ord2318
ord2354
ord484
ord2211
ord2316
ord2128
ord2242
ord2343
ord485
ord316
ord5732
ord1652
ord4519

msvcr110

_mbsnbcpy
_lock
_unlock
qsort
strncpy
_stricmp
??1type_info@@UAE@XZ
wcstol
strncmp
malloc
ispunct
isspace
_CxxThrowException
_time64
_mktime64
_localtime64_s
strftime
atoi
_calloc_crt
__dllonexit
_onexit
__CppXcptFilter
_amsg_exit
memmove
free
_malloc_crt
_initterm
_initterm_e
?terminate@@YAXXZ
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
_except_handler4_common
__clean_type_info_names_internal
_purecall
memset
memcpy
__CxxFrameHandler3
strtok
memcpy_s

kernel32

QueryPerformanceCounter
IsProcessorFeaturePresent
IsDebuggerPresent
DecodePointer
EncodePointer
GetCurrentProcessId
InterlockedDecrement
IsDBCSLeadByte
GetSystemTimeAsFileTime
GetModuleFileNameA
InitializeCriticalSectionAndSpinCount
LockResource
lstrlenW
MultiByteToWideChar
lstrlenA
GetLastError
LocalAlloc
WideCharToMultiByte
FindResourceA
SizeofResource
LoadResource
LocalFree
GetCurrentThreadId

user32

SendMessageA
PostMessageA
EnableWindow
GetWindowRect
GetParent
IsWindowVisible
GetFocus
KillTimer
UpdateWindow
SetCursor
LoadCursorA
GetSysColor
DrawFocusRect
SetRectEmpty
CopyRect
RegisterWindowMessageA
SetTimer
FillRect

gdi32

GetTextMetricsA
GetTextExtentPoint32A

ole32

CoCreateInstance
CoCreateGuid
OleRun

oleaut32

SysAllocString
SysFreeString
VariantInit
VariantClear
VariantCopy
VariantChangeType
SystemTimeToVariantTime
VariantTimeToSystemTime
SysStringByteLen
SysAllocStringByteLen
GetErrorInfo
SetErrorInfo
CreateErrorInfo

daexceldb

EDBGetSymbolInfos
EDBGetSubGroup
EDBGetSymbolInfo
EDBGetGroupSymbol
EDBFindSymbol

dacommon

daShowMessageStr
IsTraditionChinese
daShowDllMessage

msvcp110

?_Xbad_alloc@std@@YAXXZ
?_Syserror_map@std@@YAPBDH@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Winerror_map@std@@YAPBDH@Z

dautil

?Save@CRegConfig@@QAEHPBD00@Z
?IsMin@CFrequencyUtility@@SA_NW4FrequencyType@@@Z
?IsTick@CFrequencyUtility@@SA_NW4FrequencyType@@@Z
?IsValid@CFrequencyUtility@@SA_NW4FrequencyType@@@Z
?Load@CRegConfig@@QAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD00@Z

daui

??1CCharEdit@@UAE@XZ
?SetBitmap@CDAIconButton@@QAEHIHHHK@Z
??1CDAIconButton@@UAE@XZ
??0CDAIconButton@@QAE@XZ
?DDV_MinMaxSpinBox@@YAXPAVCDataExchange@@HAAVCDASpinBox@@HHHAAH@Z
?DDX_SpinBox@@YAXPAVCDataExchange@@HAAVCDASpinBox@@HHHAAH@Z
??1CDASpinBox@@UAE@XZ
?SetUseInnerMinMax@CDASpinBox@@QAEXH@Z
?GetValue@CDASpinBox@@QAEHAAH@Z
?SetValue@CDASpinBox@@QAEXH@Z
?SetRange@CDASpinBox@@QAEXHH@Z
?SetDP@CDASpinBox@@QAEXH@Z
??0CDASpinBox@@QAE@XZ
?daSelectDate@@YAHPAVCTime@ATL@@@Z
??1CDAToolTip@@UAE@XZ
??0CDAToolTip@@QAE@XZ
?AddWindowTool@CDAToolTip@@QAEHPAVCWnd@@PBD@Z
??0CCharEdit@@QAE@XZ

Exports

Exports

?CallHistDataHelper@@YAHXZ
?CallHistDataWizard@@YAHXZ
?CallKDataHelper@@YAHXZ
?CallQuoteWizard@@YAHXZ
?FiniExcelAddInServer@@YAXXZ
?InitExcelAddInServer@@YAHV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?fnGetHistData@@YAHAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@AAW4FrequencyType@@AAHPAVCUIntArray@@@Z
?fnGetHistDataWizardData@@YAHPAVCStringArray@@AAW4FrequencyType@@AAJ2AAHPAVCUIntArray@@@Z
?fnGetHistFieldName@@YAHPBVCUIntArray@@PAVCStringArray@@1@Z
?fnGetKData@@YAHAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@AAW4FrequencyType@@AAH@Z
?fnGetQuoteWizardData@@YAHPAVCStringArray@@PAVCUIntArray@@@Z
?fnGetQuoteWizardData@@YAHPAVCStringArray@@PAVCUIntArray@@PAH2@Z
?fnGetSymbolDisplayText@@YAHPBVCStringArray@@PAV1@@Z
?fnGetTitleName@@YAHPBVCUIntArray@@PAVCStringArray@@@Z
?fnUpdateSymbolList@@YAHXZ

Sections

.text
Size: 161KB - Virtual size: 161KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a0ff9b023aa829da762806947e888e50

Headers

DLL Characteristics

File Characteristics

Imports

datitle

excelsymbol

mfc110

msvcr110

kernel32

user32

gdi32

ole32

oleaut32

daexceldb

dacommon

msvcp110

dautil

daui

Exports

Exports

Sections

.text Size: 161KB - Virtual size: 161KB

.rdata Size: 56KB - Virtual size: 55KB

.data Size: 2KB - Virtual size: 3KB

.rsrc Size: 69KB - Virtual size: 68KB

.reloc Size: 20KB - Virtual size: 20KB

.text
Size: 161KB - Virtual size: 161KB

.rdata
Size: 56KB - Virtual size: 55KB

.data
Size: 2KB - Virtual size: 3KB

.rsrc
Size: 69KB - Virtual size: 68KB

.reloc
Size: 20KB - Virtual size: 20KB