7381eb731f8c4638e555bde5901ad5838ca798f5c495bec006fa683a3da31034

Sharing

Copy URL

Twitter E-mail

General

Target

7381eb731f8c4638e555bde5901ad5838ca798f5c495bec006fa683a3da31034
Size

6.9MB
MD5

75815980805d7b5a487d04f672262794
SHA1

2af71bca51c7026c3198cdfed994777c8671cabf
SHA256

7381eb731f8c4638e555bde5901ad5838ca798f5c495bec006fa683a3da31034
SHA512

7e12dd7f0efaf584f1c8fa4e28f6b2e49445062c6c7d198d6ce87948b666ad260b182a9170362c92a35d6632dfdffffc8879ae4b7d9dbdbb1cdacf9e8ce64a49
SSDEEP

49152:oAUOqquTzdseuDZ+/Aq9Oqipb34u43kJjP3xsJjt3o+VaIXUv1opO3uE47t7VRYP:9uDXco7Bq7f1KBbQoVHze

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7381eb731f8c4638e555bde5901ad5838ca798f5c495bec006fa683a3da31034

Files

7381eb731f8c4638e555bde5901ad5838ca798f5c495bec006fa683a3da31034
.dll windows:6 windows x64

9fc012f02aa31e97813c140c62391747

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

fgdutilu2018

?GetLocateMachineName@fgdutil@@YA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ

fgbfileu2018

?GetUpPath@fgbfile@@YA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@V23@@Z

fgbmfcu2018

?InsertRow@CGridCtrl_2@@QEAAHPEB_WH@Z

fastbaseu2018

??0CFEntLengthen@fast@@QEAA@XZ

fxdatadealu2018

?FindEnts@CFSimpleXData@ARX_DATA@@SAHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@AEAV?$AcArray@VAcDbObjectId@@V?$AcArrayMemCopyReallocator@VAcDbObjectId@@@@@@@Z

wb_gpcadu2018

?GetSysScale@CDrawingSetting@@SANXZ

fastcadu2018.arx

?GetDistAtPoint@GP_CurveTran@FastCad@@QEBAHVAcGePoint3d@@AEAN@Z

fastcontourbaseu2018.arx

??0CFReginGen@FConBase@@QEAA@XZ

fastdwglibu2018.arx

?FSelDwgBlkName@@YA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PEB_W0HH@Z

gpdatau2018

?GetInfo@CGpcadDrawingInfo@@QEAAHXZ

fentsfgriddingu2018

?fnGetPtsWitiOutArc@CFBeTriangle@@QEAAHAEAVAcDbObjectId@@AEAV?$AcArray@VAcGePoint3d@@V?$AcArrayMemCopyReallocator@VAcGePoint3d@@@@@@AEAV?$AcArray@NV?$AcArrayMemCopyReallocator@N@@@@@Z

fastcdtu2018

??0CRbList@RDCad@RDBase@@QEAA@XZ

fastdefentdbxu2018.dbx

??1CTextInfo@@QEAA@XZ

fastgptriangleu2018

?getScPtHeight@CGetGpPtHeightClass@FASTGPTRI@@QEBA_NAEAVAcGePoint3d@@@Z

ffcommarxlibu2018

?RemoveAll@CFRecord@@QEAAXXZ

ffarxlibu2018

??1ArxDrawTable@@UEAA@XZ

wb_ftftpbaseu2018

??0CTPRetData@@QEAA@AEAV0@@Z

acdb22

?setObliquingAngle@AcDbTextStyleTableRecord@@QEAA?AW4ErrorStatus@Acad@@N@Z

acge22

?set@AcGePoint2d@@QEAAAEAV1@NN@Z

acad.exe

?acedGetAcadDockCmdLine@@YAPEAVCWnd@@XZ

acui22

?InitAcUiDLL@@YAXXZ

adui22

?EnableFloatingWindows@CAdUiBaseDialog@@UEAAXH@Z

accore

?acedGetSym@@YAHPEB_WPEAPEAUresbuf@@@Z

ac1st22

?isDerivedFrom@AcRxClass@@SA_NPEBV1@0@Z

acdrawbridge

?acquireGraphicsKernel@AcGsManager@@SAPEAVAcGsGraphicsKernel@@AEBVAcGsKernelDescriptor@@@Z

mfc140u

ord12932

kernel32

GlobalAlloc

user32

GetSystemMetrics

gdi32

CreateDCW

advapi32

RegEnumKeyW

shell32

SHGetPathFromIDListW

comctl32

ImageList_SetBkColor

ole32

CLSIDFromString

oleaut32

SysStringLen

msvcp140

?_Xbad_alloc@std@@YAXXZ

acpal

?acHeapFree@@YAXPEAX0@Z

wibucm64

ord50

gdiplus

GdiplusShutdown

vcruntime140

__std_type_info_destroy_list

api-ms-win-crt-runtime-l1-1-0

_crt_at_quick_exit

api-ms-win-crt-heap-l1-1-0

free

api-ms-win-crt-convert-l1-1-0

_wtol

api-ms-win-crt-math-l1-1-0

asin

api-ms-win-crt-string-l1-1-0

isalpha

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf

api-ms-win-crt-utility-l1-1-0

ldiv

api-ms-win-crt-time-l1-1-0

_mktime64

api-ms-win-crt-filesystem-l1-1-0

_wsplitpath

iphlpapi

GetInterfaceInfo

msvcrt

_wcsnicmp

psapi

GetMappedFileNameW

Exports

Exports

??0ArxDbgAppXdataXList@@QEAA@AEBV0@@Z
??0CTableData@@QEAA@AEBV0@@Z
??0CTableData@@QEAA@XZ
??0CTableItem@@QEAA@AEBV0@@Z
??0CTableItem@@QEAA@XZ
??0CTableRow@@QEAA@AEBV0@@Z
??0CTableRow@@QEAA@H@Z
??0CTableRow@@QEAA@XZ
??0SdStrList@@QEAA@XZ
??0SdUnsortedStrList@@QEAA@XZ
??1CTableData@@QEAA@XZ
??1CTableItem@@QEAA@XZ
??1CTableRow@@QEAA@XZ
??1SdSortedStrList@@UEAA@XZ
??1SdStrList@@UEAA@XZ
??1SdStrListIterator@@UEAA@XZ
??1SdStrObjIdListIterator@@UEAA@XZ
??1SdStrObjIdNode@@QEAA@XZ
??1SdUnsortedStrList@@UEAA@XZ
??4ArxDbgAppXdataXList@@QEAAAEAV0@AEBV0@@Z
??4ArxDbgUtils@@QEAAAEAU0@$$QEAU0@@Z
??4ArxDbgUtils@@QEAAAEAU0@AEBU0@@Z
??4ArxDbgUtilsGe@@QEAAAEAU0@$$QEAU0@@Z
??4ArxDbgUtilsGe@@QEAAAEAU0@AEBU0@@Z
??4ArxRbOper@@QEAAAEAV0@$$QEAV0@@Z
??4ArxRbOper@@QEAAAEAV0@AEBV0@@Z
??4CFDbUtils@@QEAAAEAV0@$$QEAV0@@Z
??4CFDbUtils@@QEAAAEAV0@AEBV0@@Z
??4CFEntOpertor@@QEAAAEAV0@$$QEAV0@@Z
??4CFEntOpertor@@QEAAAEAV0@AEBV0@@Z
??4CFSysVar@@QEAAAEAV0@$$QEAV0@@Z
??4CFSysVar@@QEAAAEAV0@AEBV0@@Z
??4CFmAttrBlockOperator@@QEAAAEAV0@$$QEAV0@@Z
??4CFmAttrBlockOperator@@QEAAAEAV0@AEBV0@@Z
??4CTableData@@QEAAAEAV0@AEBV0@@Z
??4CTableItem@@QEAAAEAV0@AEBV0@@Z
??4CTableRow@@QEAAAEAV0@AEBV0@@Z
??4FArx@@QEAAAEAV0@$$QEAV0@@Z
??4FArx@@QEAAAEAV0@AEBV0@@Z
??4Fgd_Field@@QEAAAEAU0@$$QEAU0@@Z
??4Fgd_Field@@QEAAAEAU0@AEBU0@@Z
??4Layer_Field@@QEAAAEAU0@$$QEAU0@@Z
??4Layer_Field@@QEAAAEAU0@AEBU0@@Z
??4TKBZD_Field@@QEAAAEAU0@$$QEAU0@@Z
??4TKBZD_Field@@QEAAAEAU0@AEBU0@@Z
??4TW_Field@@QEAAAEAU0@$$QEAU0@@Z
??4TW_Field@@QEAAAEAU0@AEBU0@@Z
??4Zkd_Field@@QEAAAEAU0@$$QEAU0@@Z
??4Zkd_Field@@QEAAAEAU0@AEBU0@@Z
??_7ArxDbgAppXdataXList@@6B@
??_7SdStrList@@6B@
??_7SdStrListIterator@@6B@
??_7SdStrObjIdListIterator@@6B@
??_7SdUnsortedStrList@@6B@
??_FArxDrawTable@@QEAAXXZ
??_FSdSortedStrList@@QEAAXXZ
??_FSdStrObjIdList@@QEAAXXZ
?BH@TW_Field@@2PEB_WEB
?Bp@Layer_Field@@2PEB_WEB
?BpSpx@Layer_Field@@2PEB_WEB
?CDBG_BG@Fgd_Field@@2PEB_WEB
?CD_ZZ@Fgd_Field@@2PEB_WEB
?Count@SdStrObjIdList@@QEBAHXZ
?Dm@Layer_Field@@2PEB_WEB
?DmDmx@Layer_Field@@2PEB_WEB
?DmSjx@Layer_Field@@2PEB_WEB
?DmZero@Layer_Field@@2PEB_WEB
?Dmfpx@Layer_Field@@2PEB_WEB
?DrawCADTable@@YAHAEBVCTableData@@AEAVAcDbObjectId@@@Z
?DrawCADTable@@YAHAEBVCTableData@@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@AEAV?$AcArray@VAcDbObjectId@@V?$AcArrayMemCopyReallocator@VAcDbObjectId@@@@@@@Z
?Fg@Layer_Field@@2PEB_WEB
?FgBH@Layer_Field@@2PEB_WEB
?Fgd@Layer_Field@@2PEB_WEB
?GsFwx@Layer_Field@@2PEB_WEB
?Hdm@Layer_Field@@2PEB_WEB
?Insert@SdUnsortedStrList@@UEAAPEAU__POSITION@@AEBV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?IsHead@CTableRow@@QEAAHXZ
?KmHatch@Layer_Field@@2PEB_WEB
?Ljbp@Layer_Field@@2PEB_WEB
?Pdbz@Layer_Field@@2PEB_WEB
?Qk@Layer_Field@@2PEB_WEB
?Qy@Layer_Field@@2PEB_WEB
?SBG_BG@Fgd_Field@@2PEB_WEB
?SS_CD@Fgd_Field@@2PEB_WEB
?SS_ZZ@Fgd_Field@@2PEB_WEB
?Slbz@Layer_Field@@2PEB_WEB
?TK_BH@TKBZD_Field@@2PEB_WEB
?TK_MJ@TKBZD_Field@@2PEB_WEB
?TK_SBG@TKBZD_Field@@2PEB_WEB
?Table@Layer_Field@@2PEB_WEB
?Tfgcx@Layer_Field@@2PEB_WEB
?Tflx@Layer_Field@@2PEB_WEB
?Tfpm@Layer_Field@@2PEB_WEB
?VQW@TW_Field@@2PEB_WEB
?VST@TW_Field@@2PEB_WEB
?VSW@TW_Field@@2PEB_WEB
?VT@TW_Field@@2PEB_WEB
?VW10@TW_Field@@2PEB_WEB
?VW11@TW_Field@@2PEB_WEB
?VW12@TW_Field@@2PEB_WEB
?VW13@TW_Field@@2PEB_WEB
?VW14@TW_Field@@2PEB_WEB
?VW15@TW_Field@@2PEB_WEB
?VW1@TW_Field@@2PEB_WEB
?VW2@TW_Field@@2PEB_WEB
?VW3@TW_Field@@2PEB_WEB
?VW4@TW_Field@@2PEB_WEB
?VW5@TW_Field@@2PEB_WEB
?VW6@TW_Field@@2PEB_WEB
?VW7@TW_Field@@2PEB_WEB
?VW8@TW_Field@@2PEB_WEB
?VW9@TW_Field@@2PEB_WEB
?VW@TW_Field@@2PEB_WEB
?Wtf@Layer_Field@@2PEB_WEB
?ZBG_BG@Fgd_Field@@2PEB_WEB
?ZK_SBG@Zkd_Field@@2PEB_WEB
?ZK_THD10@Zkd_Field@@2PEB_WEB
?ZK_THD11@Zkd_Field@@2PEB_WEB
?ZK_THD12@Zkd_Field@@2PEB_WEB
?ZK_THD13@Zkd_Field@@2PEB_WEB
?ZK_THD14@Zkd_Field@@2PEB_WEB
?ZK_THD15@Zkd_Field@@2PEB_WEB
?ZK_THD1@Zkd_Field@@2PEB_WEB
?ZK_THD2@Zkd_Field@@2PEB_WEB
?ZK_THD3@Zkd_Field@@2PEB_WEB
?ZK_THD4@Zkd_Field@@2PEB_WEB
?ZK_THD5@Zkd_Field@@2PEB_WEB
?ZK_THD6@Zkd_Field@@2PEB_WEB
?ZK_THD7@Zkd_Field@@2PEB_WEB
?ZK_THD8@Zkd_Field@@2PEB_WEB
?ZK_THD9@Zkd_Field@@2PEB_WEB
?ZK_ZBG@Zkd_Field@@2PEB_WEB
?ZK_ZKSD@Zkd_Field@@2PEB_WEB
?data@ArxDbgRbList@@QEAAPEAUresbuf@@XZ
?data@ArxDbgRbListZ@@QEAAPEAUresbuf@@XZ
?detachHead@ArxDbgRbList@@QEAAPEAUresbuf@@XZ
?detachHead@ArxDbgRbListZ@@QEAAPEAUresbuf@@XZ
?detachTail@ArxDbgRbList@@QEAAPEAUresbuf@@XZ
?detachTail@ArxDbgRbListZ@@QEAAPEAUresbuf@@XZ
?done@SdStrListIterator@@UEBAHXZ
?done@SdStrObjIdListIterator@@UEBAHXZ
?isEmpty@ArxDbgRbList@@QEAA_NXZ
?isEmpty@ArxDbgRbListZ@@QEAA_NXZ
?item@SdStrListIterator@@UEBA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?next@SdStrListIterator@@UEAAXXZ
?next@SdStrObjIdListIterator@@UEAAXXZ
?previous@SdStrListIterator@@UEAAXXZ
?previous@SdStrObjIdListIterator@@UEAAXXZ
?removeHead@ArxDbgRbList@@QEAAXXZ
?removeHead@ArxDbgRbListZ@@QEAAXXZ
?removeTail@ArxDbgRbList@@QEAAXXZ
?removeTail@ArxDbgRbListZ@@QEAAXXZ
?toFirst@SdStrListIterator@@UEAAXXZ
?toFirst@SdStrObjIdListIterator@@UEAAXXZ
?toLast@SdStrListIterator@@UEAAXXZ
?toLast@SdStrObjIdListIterator@@UEAAXXZ
acrxEntryPoint
acrxGetApiVersion

Sections

.text
Size: 5.5MB - Virtual size: 5.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sedata
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.sedata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9fc012f02aa31e97813c140c62391747

Headers

DLL Characteristics

File Characteristics

Imports

fgdutilu2018

fgbfileu2018

fgbmfcu2018

fastbaseu2018

fxdatadealu2018

wb_gpcadu2018

fastcadu2018.arx

fastcontourbaseu2018.arx

fastdwglibu2018.arx

gpdatau2018

fentsfgriddingu2018

fastcdtu2018

fastdefentdbxu2018.dbx

fastgptriangleu2018

ffcommarxlibu2018

ffarxlibu2018

wb_ftftpbaseu2018

acdb22

acge22

acad.exe

acui22

adui22

accore

ac1st22

acdrawbridge

mfc140u

kernel32

user32

gdi32

advapi32

shell32

comctl32

ole32

oleaut32

msvcp140

acpal

wibucm64

gdiplus

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

iphlpapi

msvcrt

psapi

Exports

Exports

Sections

.text Size: 5.5MB - Virtual size: 5.5MB

.sedata Size: 1.4MB - Virtual size: 1.4MB

.idata Size: 5KB - Virtual size: 8KB

.reloc Size: 512B - Virtual size: 4KB

.sedata Size: 4KB - Virtual size: 4KB

.text
Size: 5.5MB - Virtual size: 5.5MB

.sedata
Size: 1.4MB - Virtual size: 1.4MB

.idata
Size: 5KB - Virtual size: 8KB

.reloc
Size: 512B - Virtual size: 4KB

.sedata
Size: 4KB - Virtual size: 4KB