53040a64b7e81e58850a7864d064351bfe8c0f76bfa0963b229363cc0bd11743

Sharing

Copy URL Twitter E-mail

General

Target

53040a64b7e81e58850a7864d064351bfe8c0f76bfa0963b229363cc0bd11743
Size

51KB
MD5

5b17bf8c70b8eadc4577f59db9c44cdb
SHA1

27b6b5d4454a8d8035fe64f43f705392830df803
SHA256

53040a64b7e81e58850a7864d064351bfe8c0f76bfa0963b229363cc0bd11743
SHA512

a1b277a0b63ac2672f148d820b12ab2f4830af242d1aff40a23055945c64f510d7a9d266794efcf68668980f02bcd2417c783cc8d3ad75d4ba4922a10322e68e
SSDEEP

1536:V+u8nqYoWir8NY+3cK+/hZ2lXKNj8S1iLOteAApbW:V+u8nqQir82+3cbZtj8S16OteAAp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
53040a64b7e81e58850a7864d064351bfe8c0f76bfa0963b229363cc0bd11743

Files

53040a64b7e81e58850a7864d064351bfe8c0f76bfa0963b229363cc0bd11743
.dll windows x86

8ef28c0d020ec870d030e11b2c046c2e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryExW
GetLastError
GetSystemTimeAsFileTime
GetCurrentProcess
GetModuleHandleW
GetCurrentProcessId
MultiByteToWideChar
GetModuleFileNameW
LoadLibraryW
GetPrivateProfileStringW
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
InitializeCriticalSection
DeleteCriticalSection
InterlockedExchange
Sleep
InterlockedCompareExchange
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetProcAddress

user32

LoadStringW

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey

msvcp90

??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@I_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?resize@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
?begin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?end@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z

acdb18

?clone@AcRxObject@@UBEPAV1@XZ
?copyFrom@AcRxObject@@UAE?AW4ErrorStatus@Acad@@PBV1@@Z
?isEqualTo@AcRxObject@@UBEHPBV1@@Z
?comparedTo@AcRxObject@@UBE?AW4Ordering@AcRx@@PBV1@@Z
?xrefSubCommandStart@AcRxEventReactor@@UAEXPAVAcDbDatabase@@W4AcXrefSubCommand@@ABV?$AcArray@VAcDbObjectId@@V?$AcArrayMemCopyReallocator@VAcDbObjectId@@@@@@PBQB_W3AA_N@Z
?xrefSubCommandAborted@AcRxEventReactor@@UAEXPAVAcDbDatabase@@W4AcXrefSubCommand@@ABV?$AcArray@VAcDbObjectId@@V?$AcArrayMemCopyReallocator@VAcDbObjectId@@@@@@PBQB_W3@Z
?preXrefLockFile@AcRxEventReactor@@UAEXPAVAcDbDatabase@@VAcDbObjectId@@@Z
?desc@AcRxDynamicLinker@@SAPAVAcRxClass@@XZ
?acrxBuildClassHierarchy@@YAXXZ
?deleteAcRxClass@@YAXPAVAcRxClass@@@Z
acrxSysRegistry
??0AcRxObject@@IAE@XZ
acutPrintf

acad.exe

acedUndef
acedRegFunc
acedDefun
?acDocManagerPtr@@YAPAVAcApDocManager@@XZ
acedGetFunCode

msvcr90

__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
_except_handler4_common
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
_CxxThrowException
memset
free
swprintf_s
swscanf_s
towupper
wcsnlen
_invalid_parameter_noinfo
??_V@YAXPAX@Z
??0exception@std@@QAE@XZ
??0exception@std@@QAE@ABQBD@Z
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABV01@@Z
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
__CxxFrameHandler3
?terminate@@YAXXZ
??3@YAXPAX@Z
wcsrchr
??2@YAPAXI@Z
wcsncpy_s
memcpy_s
memmove_s

Exports

Exports

acrxEntryPoint
acrxGetApiVersion

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DBXCUSTO
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

ARXCOMMA
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

ADSSYMBO
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8ef28c0d020ec870d030e11b2c046c2e

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

msvcp90

acdb18

acad.exe

msvcr90

Exports

Exports

Sections

.text Size: 25KB - Virtual size: 24KB

.rdata Size: 14KB - Virtual size: 13KB

.data Size: 2KB - Virtual size: 3KB

DBXCUSTO Size: 512B - Virtual size: 8B

ARXCOMMA Size: 512B - Virtual size: 8B

ADSSYMBO Size: 512B - Virtual size: 8B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 25KB - Virtual size: 24KB

.rdata
Size: 14KB - Virtual size: 13KB

.data
Size: 2KB - Virtual size: 3KB

DBXCUSTO
Size: 512B - Virtual size: 8B

ARXCOMMA
Size: 512B - Virtual size: 8B

ADSSYMBO
Size: 512B - Virtual size: 8B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 5KB - Virtual size: 4KB