d4c55b0b33d4cf26c47a7846bac77f456bc4a847c2329d3fa6a130f423a6448b

Sharing

Copy URL Twitter E-mail

General

Target

d4c55b0b33d4cf26c47a7846bac77f456bc4a847c2329d3fa6a130f423a6448b
Size

6.9MB
MD5

80b26088317bdd0d72c6810f1e068ac1
SHA1

c3111ac93eae110628956535812300c0c78caeb6
SHA256

d4c55b0b33d4cf26c47a7846bac77f456bc4a847c2329d3fa6a130f423a6448b
SHA512

87f1a58c51fb54ddc2de0e8c5d4e358e45d4d54d4a5ccf6445f6579dcbfc94cd12cc8d15cb465df97bd81e04b7cb4f31aa3de5728fc94ae33b8147a44a84c1ba
SSDEEP

98304:EKCXo3eN0glrQBaMce0H+SHUnbuqH5JQG:EKCYgmBaMc70nbRZGG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d4c55b0b33d4cf26c47a7846bac77f456bc4a847c2329d3fa6a130f423a6448b

Files

d4c55b0b33d4cf26c47a7846bac77f456bc4a847c2329d3fa6a130f423a6448b
.dll windows:6 windows x64

afbb3795889d347b46126889a38df730

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

fgdutilu2017

?GetLocateMachineName@fgdutil@@YA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ

fgbfileu2017

?GetUpPath@fgbfile@@YA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@V23@@Z

fgbmfcu2017

?InsertRow@CGridCtrl_2@@QEAAHPEB_WH@Z

fastbaseu2017

??0CFEntLengthen@fast@@QEAA@XZ

fxdatadealu2017

?FindEnts@CFSimpleXData@ARX_DATA@@SAHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@AEAV?$AcArray@VAcDbObjectId@@V?$AcArrayMemCopyReallocator@VAcDbObjectId@@@@@@@Z

wb_gpcadu2017

?GetSysScale@CDrawingSetting@@SANXZ

fastcadu2017.arx

?GetDistAtPoint@GP_CurveTran@FastCad@@QEBAHVAcGePoint3d@@AEAN@Z

fastcontourbaseu2017.arx

??0CFReginGen@FConBase@@QEAA@XZ

fastdwglibu2017.arx

?FSelDwgBlkName@@YA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PEB_W0HH@Z

gpdatau2017

?GetInfo@CGpcadDrawingInfo@@QEAAHXZ

fentsfgriddingu2017

?fnGetPtsWitiOutArc@CFBeTriangle@@QEAAHAEAVAcDbObjectId@@AEAV?$AcArray@VAcGePoint3d@@V?$AcArrayMemCopyReallocator@VAcGePoint3d@@@@@@AEAV?$AcArray@NV?$AcArrayMemCopyReallocator@N@@@@@Z

fastcdtu2017

??0CRbList@RDCad@RDBase@@QEAA@XZ

fastdefentdbxu2017.dbx

??1CTextInfo@@QEAA@XZ

fastgptriangleu2017

?getScPtHeight@CGetGpPtHeightClass@FASTGPTRI@@QEBA_NAEAVAcGePoint3d@@@Z

ffcommarxlibu2017

?RemoveAll@CFRecord@@QEAAXXZ

ffarxlibu2017

??1ArxDrawTable@@UEAA@XZ

wb_ftftpbaseu2017

??0CTPRetData@@QEAA@AEAV0@@Z

acdb21

?add@AcDbLayerTable@@QEAA?AW4ErrorStatus@Acad@@AEAVAcDbObjectId@@PEAVAcDbLayerTableRecord@@@Z

acge21

?set@AcGePoint2d@@QEAAAEAV1@NN@Z

acad.exe

?acedGetAcadDockCmdLine@@YAPEAVCWnd@@XZ

acui21

?InitAcUiDLL@@YAXXZ

adui21

?EnableFloatingWindows@CAdUiBaseDialog@@UEAAXH@Z

accore

?acedGetSym@@YAHPEB_WPEAPEAUresbuf@@@Z

ac1st21

?isDerivedFrom@AcRxClass@@QEBA_NPEBV1@@Z

acdrawbridge

?acquireGraphicsKernel@AcGsManager@@SAPEAVAcGsGraphicsKernel@@AEBVAcGsKernelDescriptor@@@Z

mfc140u

ord12932

kernel32

GlobalAlloc

user32

GetSystemMetrics

gdi32

CreateDCW

advapi32

RegEnumKeyW

shell32

SHGetPathFromIDListW

comctl32

ImageList_SetBkColor

ole32

CLSIDFromString

oleaut32

SysStringLen

msvcp140

?_Xbad_alloc@std@@YAXXZ

acpal

?acHeapFree@@YAXPEAX0@Z

wibucm64

ord52

gdiplus

GdiplusShutdown

vcruntime140

__std_type_info_destroy_list

api-ms-win-crt-runtime-l1-1-0

_crt_at_quick_exit

api-ms-win-crt-heap-l1-1-0

free

api-ms-win-crt-convert-l1-1-0

_wtol

api-ms-win-crt-math-l1-1-0

asin

api-ms-win-crt-string-l1-1-0

isalpha

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf

api-ms-win-crt-utility-l1-1-0

ldiv

api-ms-win-crt-time-l1-1-0

_mktime64

api-ms-win-crt-filesystem-l1-1-0

_wsplitpath

iphlpapi

GetInterfaceInfo

msvcrt

_wcsnicmp

psapi

GetMappedFileNameW

Exports

Exports

??0ArxDbgAppXdataXList@@QEAA@AEBV0@@Z
??0CTableData@@QEAA@AEBV0@@Z
??0CTableData@@QEAA@XZ
??0CTableItem@@QEAA@AEBV0@@Z
??0CTableItem@@QEAA@XZ
??0CTableRow@@QEAA@AEBV0@@Z
??0CTableRow@@QEAA@H@Z
??0CTableRow@@QEAA@XZ
??0SdStrList@@QEAA@XZ
??0SdUnsortedStrList@@QEAA@XZ
??1CTableData@@QEAA@XZ
??1CTableItem@@QEAA@XZ
??1CTableRow@@QEAA@XZ
??1SdSortedStrList@@UEAA@XZ
??1SdStrList@@UEAA@XZ
??1SdStrListIterator@@UEAA@XZ
??1SdStrObjIdListIterator@@UEAA@XZ
??1SdStrObjIdNode@@QEAA@XZ
??1SdUnsortedStrList@@UEAA@XZ
??4ArxDbgAppXdataXList@@QEAAAEAV0@AEBV0@@Z
??4ArxDbgUtils@@QEAAAEAU0@$$QEAU0@@Z
??4ArxDbgUtils@@QEAAAEAU0@AEBU0@@Z
??4ArxDbgUtilsGe@@QEAAAEAU0@$$QEAU0@@Z
??4ArxDbgUtilsGe@@QEAAAEAU0@AEBU0@@Z
??4ArxRbOper@@QEAAAEAV0@$$QEAV0@@Z
??4ArxRbOper@@QEAAAEAV0@AEBV0@@Z
??4CFDbUtils@@QEAAAEAV0@$$QEAV0@@Z
??4CFDbUtils@@QEAAAEAV0@AEBV0@@Z
??4CFEntOpertor@@QEAAAEAV0@$$QEAV0@@Z
??4CFEntOpertor@@QEAAAEAV0@AEBV0@@Z
??4CFSysVar@@QEAAAEAV0@$$QEAV0@@Z
??4CFSysVar@@QEAAAEAV0@AEBV0@@Z
??4CFmAttrBlockOperator@@QEAAAEAV0@$$QEAV0@@Z
??4CFmAttrBlockOperator@@QEAAAEAV0@AEBV0@@Z
??4CTableData@@QEAAAEAV0@AEBV0@@Z
??4CTableItem@@QEAAAEAV0@AEBV0@@Z
??4CTableRow@@QEAAAEAV0@AEBV0@@Z
??4FArx@@QEAAAEAV0@$$QEAV0@@Z
??4FArx@@QEAAAEAV0@AEBV0@@Z
??4Fgd_Field@@QEAAAEAU0@$$QEAU0@@Z
??4Fgd_Field@@QEAAAEAU0@AEBU0@@Z
??4Layer_Field@@QEAAAEAU0@$$QEAU0@@Z
??4Layer_Field@@QEAAAEAU0@AEBU0@@Z
??4TKBZD_Field@@QEAAAEAU0@$$QEAU0@@Z
??4TKBZD_Field@@QEAAAEAU0@AEBU0@@Z
??4TW_Field@@QEAAAEAU0@$$QEAU0@@Z
??4TW_Field@@QEAAAEAU0@AEBU0@@Z
??4Zkd_Field@@QEAAAEAU0@$$QEAU0@@Z
??4Zkd_Field@@QEAAAEAU0@AEBU0@@Z
??_7ArxDbgAppXdataXList@@6B@
??_7SdStrList@@6B@
??_7SdStrListIterator@@6B@
??_7SdStrObjIdListIterator@@6B@
??_7SdUnsortedStrList@@6B@
??_FArxDrawTable@@QEAAXXZ
??_FSdSortedStrList@@QEAAXXZ
??_FSdStrObjIdList@@QEAAXXZ
?BH@TW_Field@@2PEB_WEB
?Bp@Layer_Field@@2PEB_WEB
?BpSpx@Layer_Field@@2PEB_WEB
?CDBG_BG@Fgd_Field@@2PEB_WEB
?CD_ZZ@Fgd_Field@@2PEB_WEB
?Count@SdStrObjIdList@@QEBAHXZ
?Dm@Layer_Field@@2PEB_WEB
?DmDmx@Layer_Field@@2PEB_WEB
?DmSjx@Layer_Field@@2PEB_WEB
?DmZero@Layer_Field@@2PEB_WEB
?Dmfpx@Layer_Field@@2PEB_WEB
?DrawCADTable@@YAHAEBVCTableData@@AEAVAcDbObjectId@@@Z
?DrawCADTable@@YAHAEBVCTableData@@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@AEAV?$AcArray@VAcDbObjectId@@V?$AcArrayMemCopyReallocator@VAcDbObjectId@@@@@@@Z
?Fg@Layer_Field@@2PEB_WEB
?FgBH@Layer_Field@@2PEB_WEB
?Fgd@Layer_Field@@2PEB_WEB
?GsFwx@Layer_Field@@2PEB_WEB
?Hdm@Layer_Field@@2PEB_WEB
?Insert@SdUnsortedStrList@@UEAAPEAU__POSITION@@AEBV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?IsHead@CTableRow@@QEAAHXZ
?KmHatch@Layer_Field@@2PEB_WEB
?Ljbp@Layer_Field@@2PEB_WEB
?Pdbz@Layer_Field@@2PEB_WEB
?Qk@Layer_Field@@2PEB_WEB
?Qy@Layer_Field@@2PEB_WEB
?SBG_BG@Fgd_Field@@2PEB_WEB
?SS_CD@Fgd_Field@@2PEB_WEB
?SS_ZZ@Fgd_Field@@2PEB_WEB
?Slbz@Layer_Field@@2PEB_WEB
?TK_BH@TKBZD_Field@@2PEB_WEB
?TK_MJ@TKBZD_Field@@2PEB_WEB
?TK_SBG@TKBZD_Field@@2PEB_WEB
?Table@Layer_Field@@2PEB_WEB
?Tfgcx@Layer_Field@@2PEB_WEB
?Tflx@Layer_Field@@2PEB_WEB
?Tfpm@Layer_Field@@2PEB_WEB
?VQW@TW_Field@@2PEB_WEB
?VST@TW_Field@@2PEB_WEB
?VSW@TW_Field@@2PEB_WEB
?VT@TW_Field@@2PEB_WEB
?VW10@TW_Field@@2PEB_WEB
?VW11@TW_Field@@2PEB_WEB
?VW12@TW_Field@@2PEB_WEB
?VW13@TW_Field@@2PEB_WEB
?VW14@TW_Field@@2PEB_WEB
?VW15@TW_Field@@2PEB_WEB
?VW1@TW_Field@@2PEB_WEB
?VW2@TW_Field@@2PEB_WEB
?VW3@TW_Field@@2PEB_WEB
?VW4@TW_Field@@2PEB_WEB
?VW5@TW_Field@@2PEB_WEB
?VW6@TW_Field@@2PEB_WEB
?VW7@TW_Field@@2PEB_WEB
?VW8@TW_Field@@2PEB_WEB
?VW9@TW_Field@@2PEB_WEB
?VW@TW_Field@@2PEB_WEB
?Wtf@Layer_Field@@2PEB_WEB
?ZBG_BG@Fgd_Field@@2PEB_WEB
?ZK_SBG@Zkd_Field@@2PEB_WEB
?ZK_THD10@Zkd_Field@@2PEB_WEB
?ZK_THD11@Zkd_Field@@2PEB_WEB
?ZK_THD12@Zkd_Field@@2PEB_WEB
?ZK_THD13@Zkd_Field@@2PEB_WEB
?ZK_THD14@Zkd_Field@@2PEB_WEB
?ZK_THD15@Zkd_Field@@2PEB_WEB
?ZK_THD1@Zkd_Field@@2PEB_WEB
?ZK_THD2@Zkd_Field@@2PEB_WEB
?ZK_THD3@Zkd_Field@@2PEB_WEB
?ZK_THD4@Zkd_Field@@2PEB_WEB
?ZK_THD5@Zkd_Field@@2PEB_WEB
?ZK_THD6@Zkd_Field@@2PEB_WEB
?ZK_THD7@Zkd_Field@@2PEB_WEB
?ZK_THD8@Zkd_Field@@2PEB_WEB
?ZK_THD9@Zkd_Field@@2PEB_WEB
?ZK_ZBG@Zkd_Field@@2PEB_WEB
?ZK_ZKSD@Zkd_Field@@2PEB_WEB
?data@ArxDbgRbList@@QEAAPEAUresbuf@@XZ
?data@ArxDbgRbListZ@@QEAAPEAUresbuf@@XZ
?detachHead@ArxDbgRbList@@QEAAPEAUresbuf@@XZ
?detachHead@ArxDbgRbListZ@@QEAAPEAUresbuf@@XZ
?detachTail@ArxDbgRbList@@QEAAPEAUresbuf@@XZ
?detachTail@ArxDbgRbListZ@@QEAAPEAUresbuf@@XZ
?done@SdStrListIterator@@UEBAHXZ
?done@SdStrObjIdListIterator@@UEBAHXZ
?isEmpty@ArxDbgRbList@@QEAA_NXZ
?isEmpty@ArxDbgRbListZ@@QEAA_NXZ
?item@SdStrListIterator@@UEBA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?next@SdStrListIterator@@UEAAXXZ
?next@SdStrObjIdListIterator@@UEAAXXZ
?previous@SdStrListIterator@@UEAAXXZ
?previous@SdStrObjIdListIterator@@UEAAXXZ
?removeHead@ArxDbgRbList@@QEAAXXZ
?removeHead@ArxDbgRbListZ@@QEAAXXZ
?removeTail@ArxDbgRbList@@QEAAXXZ
?removeTail@ArxDbgRbListZ@@QEAAXXZ
?toFirst@SdStrListIterator@@UEAAXXZ
?toFirst@SdStrObjIdListIterator@@UEAAXXZ
?toLast@SdStrListIterator@@UEAAXXZ
?toLast@SdStrObjIdListIterator@@UEAAXXZ
acrxEntryPoint
acrxGetApiVersion

Sections

.text
Size: 5.5MB - Virtual size: 5.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sedata
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.sedata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

afbb3795889d347b46126889a38df730

Headers

DLL Characteristics

File Characteristics

Imports

fgdutilu2017

fgbfileu2017

fgbmfcu2017

fastbaseu2017

fxdatadealu2017

wb_gpcadu2017

fastcadu2017.arx

fastcontourbaseu2017.arx

fastdwglibu2017.arx

gpdatau2017

fentsfgriddingu2017

fastcdtu2017

fastdefentdbxu2017.dbx

fastgptriangleu2017

ffcommarxlibu2017

ffarxlibu2017

wb_ftftpbaseu2017

acdb21

acge21

acad.exe

acui21

adui21

accore

ac1st21

acdrawbridge

mfc140u

kernel32

user32

gdi32

advapi32

shell32

comctl32

ole32

oleaut32

msvcp140

acpal

wibucm64

gdiplus

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

iphlpapi

msvcrt

psapi

Exports

Exports

Sections

.text Size: 5.5MB - Virtual size: 5.5MB

.sedata Size: 1.4MB - Virtual size: 1.4MB

.idata Size: 5KB - Virtual size: 8KB

.reloc Size: 512B - Virtual size: 4KB

.sedata Size: 4KB - Virtual size: 4KB

.text
Size: 5.5MB - Virtual size: 5.5MB

.sedata
Size: 1.4MB - Virtual size: 1.4MB

.idata
Size: 5KB - Virtual size: 8KB

.reloc
Size: 512B - Virtual size: 4KB

.sedata
Size: 4KB - Virtual size: 4KB