1cfb909d2a8c101728133bc700e4ec46be502d5c9b060b7a9331e897852bbd70

Sharing

Copy URL Twitter E-mail

General

Target

1cfb909d2a8c101728133bc700e4ec46be502d5c9b060b7a9331e897852bbd70
Size

6.5MB
MD5

e674705b933771804b180a27f100f714
SHA1

a278f06507c9a39c9d321ada4226571e277e7c41
SHA256

1cfb909d2a8c101728133bc700e4ec46be502d5c9b060b7a9331e897852bbd70
SHA512

ed93d593a97631a554b9f96388a0eadccacf502e6f364db188762ec936ba5d713b59d12dc35ac198a063691622eab741195661d42938f482257187c4ad879745
SSDEEP

49152:DLmVWd9+V3lqHj7BlpVC6dm7tSQVA5BSIH9YHIZrLP/NTM7JkoNZpRG2CIQ+xvZH:2MkcxN9QNZbLXFBJb5b

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1cfb909d2a8c101728133bc700e4ec46be502d5c9b060b7a9331e897852bbd70

Files

1cfb909d2a8c101728133bc700e4ec46be502d5c9b060b7a9331e897852bbd70
.dll windows:6 windows x64

ce0025831c69edb1b858d36856f53920

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

fgdutilu2021

?StrArrFindStr@fgdutil@@YA_NAEAVCStringArray@@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@AEAH@Z

fgbfileu2021

?SetValueF@CIniFile@fgbfile@@QEAA_NV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@0N_N@Z

fgbmfcu2021

?Print@CGridCtrl_2@@QEAAXPEAVCPrintDialog@@@Z

fastbaseu2021

??0CCaptionBtn@fast@@QEAA@XZ

fxdatadealu2021

??1CFDictRecord@ARX_DATA@@QEAA@XZ

wb_gpcadu2021

?GetSysScale@CDrawingSetting@@SANXZ

fastcadu2021.arx

?GetArea@GP_CurveTran@FastCad@@QEAAHAEAN@Z

fastcontourbaseu2021.arx

?GetPolyline@CFReginGen@FConBase@@QEAAHAEAV?$AcArray@VAcDbObjectId@@V?$AcArrayMemCopyReallocator@VAcDbObjectId@@@@@@0@Z

fastdwglibu2021.arx

?FDwglibNew@dwglibapi@@YAHPEB_W00@Z

gpdatau2021

??0CGpcadDrawingInfo@@QEAA@XZ

fentsfgriddingu2021

?fnGetFaceBArea@CFBeTriangle@@QEAANVAcDbObjectId@@@Z

fastcdtu2021

?getPlinePtBulges@RDEnt@RDBase@@YA_NPEAVAcDb2dPolyline@@AEAV?$AcArray@VAcGePoint3d@@V?$AcArrayMemCopyReallocator@VAcGePoint3d@@@@@@AEAV?$AcArray@NV?$AcArrayMemCopyReallocator@N@@@@NN@Z

fastdefentdbxu2021.dbx

??0AcDbDefEnt_Dim@@QEAA@AEBVCDefEntData_DIM@@@Z

fastgptriangleu2021

?InitLandFormData@CGetPtHeightClass@FASTGPTRI@@QEAA_NVAcDbObjectId@@@Z

ffcommarxlibu2021

??0CFRecord@@QEAA@XZ

ffarxlibu2021

?InsertWBlockToCurDwg@CFmAttrBlockOperator@@SA?AW4ErrorStatus@Acad@@PEB_W0AEAVAcDbObjectId@@@Z

wb_ftftpbaseu2021

??1CTPRetData@@QEAA@XZ

acdb24

?readDwgFile@AcDbDatabase@@QEAA?AW4ErrorStatus@Acad@@PEB_WW4OpenMode@1@_N0@Z

acge24

?scaleBy@AcGePoint3d@@QEAAAEAV1@NAEBV1@@Z

acad.exe

?acedGetAcadDwgView@@YAPEAVCView@@XZ

acui24

?InitAcUiDLL@@YAXXZ

adui24

?EnableMultiDocumentActivation@CAdUiBaseDialog@@UEAAHH@Z

accore

?acedGetCurrentSelectionSet@@YA?AW4ErrorStatus@Acad@@AEAV?$AcArray@VAcDbObjectId@@V?$AcArrayMemCopyReallocator@VAcDbObjectId@@@@@@@Z

ac1st24

??0AcString@@QEAA@XZ

acdrawbridge

?k3DDrawing@AcGsKernelDescriptor@@2PEBVAcUniqueString@@EB

acgeomentobj.dbx

??0AcDbRegion@@QEAA@XZ

mfc140u

ord13864

kernel32

CloseHandle

user32

GetMenuState

gdi32

CreateCompatibleBitmap

advapi32

RegSetValueExA

shell32

SHGetPathFromIDListW

comctl32

_TrackMouseEvent

ole32

CoCreateInstance

oleaut32

VarUdateFromDate

acpal

?acHeapAlloc@@YAPEAXPEAX_K@Z

msvcp140

?_Xout_of_range@std@@YAXPEBD@Z

wibucm64

ord52

gdiplus

GdiplusShutdown

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo

api-ms-win-crt-heap-l1-1-0

calloc

api-ms-win-crt-convert-l1-1-0

wcstoul

api-ms-win-crt-math-l1-1-0

sqrt

api-ms-win-crt-string-l1-1-0

isalpha

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-time-l1-1-0

wcsftime

api-ms-win-crt-filesystem-l1-1-0

_wsplitpath

iphlpapi

GetInterfaceInfo

msvcrt

_wcsnicmp

psapi

GetMappedFileNameW

Exports

Exports

??0ArxDbgAppXdataXList@@QEAA@AEBV0@@Z
??0CTableData@@QEAA@AEBV0@@Z
??0CTableData@@QEAA@XZ
??0CTableItem@@QEAA@AEBV0@@Z
??0CTableItem@@QEAA@XZ
??0CTableRow@@QEAA@AEBV0@@Z
??0CTableRow@@QEAA@H@Z
??0CTableRow@@QEAA@XZ
??0SdStrList@@QEAA@XZ
??0SdUnsortedStrList@@QEAA@XZ
??1CTableData@@QEAA@XZ
??1CTableItem@@QEAA@XZ
??1CTableRow@@QEAA@XZ
??1SdSortedStrList@@UEAA@XZ
??1SdStrList@@UEAA@XZ
??1SdStrListIterator@@UEAA@XZ
??1SdStrObjIdListIterator@@UEAA@XZ
??1SdStrObjIdNode@@QEAA@XZ
??1SdUnsortedStrList@@UEAA@XZ
??4ArxDbgAppXdataXList@@QEAAAEAV0@AEBV0@@Z
??4ArxDbgUtils@@QEAAAEAU0@$$QEAU0@@Z
??4ArxDbgUtils@@QEAAAEAU0@AEBU0@@Z
??4ArxDbgUtilsGe@@QEAAAEAU0@$$QEAU0@@Z
??4ArxDbgUtilsGe@@QEAAAEAU0@AEBU0@@Z
??4ArxRbOper@@QEAAAEAV0@$$QEAV0@@Z
??4ArxRbOper@@QEAAAEAV0@AEBV0@@Z
??4CFDbUtils@@QEAAAEAV0@$$QEAV0@@Z
??4CFDbUtils@@QEAAAEAV0@AEBV0@@Z
??4CFEntOpertor@@QEAAAEAV0@$$QEAV0@@Z
??4CFEntOpertor@@QEAAAEAV0@AEBV0@@Z
??4CFSysVar@@QEAAAEAV0@$$QEAV0@@Z
??4CFSysVar@@QEAAAEAV0@AEBV0@@Z
??4CFmAttrBlockOperator@@QEAAAEAV0@$$QEAV0@@Z
??4CFmAttrBlockOperator@@QEAAAEAV0@AEBV0@@Z
??4CTableData@@QEAAAEAV0@AEBV0@@Z
??4CTableItem@@QEAAAEAV0@AEBV0@@Z
??4CTableRow@@QEAAAEAV0@AEBV0@@Z
??4FArx@@QEAAAEAV0@$$QEAV0@@Z
??4FArx@@QEAAAEAV0@AEBV0@@Z
??4Fgd_Field@@QEAAAEAU0@$$QEAU0@@Z
??4Fgd_Field@@QEAAAEAU0@AEBU0@@Z
??4Layer_Field@@QEAAAEAU0@$$QEAU0@@Z
??4Layer_Field@@QEAAAEAU0@AEBU0@@Z
??4TKBZD_Field@@QEAAAEAU0@$$QEAU0@@Z
??4TKBZD_Field@@QEAAAEAU0@AEBU0@@Z
??4TW_Field@@QEAAAEAU0@$$QEAU0@@Z
??4TW_Field@@QEAAAEAU0@AEBU0@@Z
??4Zkd_Field@@QEAAAEAU0@$$QEAU0@@Z
??4Zkd_Field@@QEAAAEAU0@AEBU0@@Z
??_7ArxDbgAppXdataXList@@6B@
??_7SdStrList@@6B@
??_7SdStrListIterator@@6B@
??_7SdStrObjIdListIterator@@6B@
??_7SdUnsortedStrList@@6B@
??_FArxDrawTable@@QEAAXXZ
??_FSdSortedStrList@@QEAAXXZ
??_FSdStrObjIdList@@QEAAXXZ
?BH@TW_Field@@2PEB_WEB
?Bp@Layer_Field@@2PEB_WEB
?BpSpx@Layer_Field@@2PEB_WEB
?CDBG_BG@Fgd_Field@@2PEB_WEB
?CD_ZZ@Fgd_Field@@2PEB_WEB
?Count@SdStrObjIdList@@QEBAHXZ
?Dm@Layer_Field@@2PEB_WEB
?DmDmx@Layer_Field@@2PEB_WEB
?DmSjx@Layer_Field@@2PEB_WEB
?DmZero@Layer_Field@@2PEB_WEB
?Dmfpx@Layer_Field@@2PEB_WEB
?DrawCADTable@@YAHAEBVCTableData@@AEAVAcDbObjectId@@@Z
?DrawCADTable@@YAHAEBVCTableData@@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@AEAV?$AcArray@VAcDbObjectId@@V?$AcArrayMemCopyReallocator@VAcDbObjectId@@@@@@@Z
?Fg@Layer_Field@@2PEB_WEB
?FgBH@Layer_Field@@2PEB_WEB
?Fgd@Layer_Field@@2PEB_WEB
?GsFwx@Layer_Field@@2PEB_WEB
?Hdm@Layer_Field@@2PEB_WEB
?Insert@SdUnsortedStrList@@UEAAPEAU__POSITION@@AEBV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?IsHead@CTableRow@@QEAAHXZ
?KmHatch@Layer_Field@@2PEB_WEB
?Ljbp@Layer_Field@@2PEB_WEB
?Pdbz@Layer_Field@@2PEB_WEB
?Qk@Layer_Field@@2PEB_WEB
?Qy@Layer_Field@@2PEB_WEB
?SBG_BG@Fgd_Field@@2PEB_WEB
?SS_CD@Fgd_Field@@2PEB_WEB
?SS_ZZ@Fgd_Field@@2PEB_WEB
?Slbz@Layer_Field@@2PEB_WEB
?TK_BH@TKBZD_Field@@2PEB_WEB
?TK_MJ@TKBZD_Field@@2PEB_WEB
?TK_SBG@TKBZD_Field@@2PEB_WEB
?Table@Layer_Field@@2PEB_WEB
?Tfgcx@Layer_Field@@2PEB_WEB
?Tflx@Layer_Field@@2PEB_WEB
?Tfpm@Layer_Field@@2PEB_WEB
?VQW@TW_Field@@2PEB_WEB
?VST@TW_Field@@2PEB_WEB
?VSW@TW_Field@@2PEB_WEB
?VT@TW_Field@@2PEB_WEB
?VW10@TW_Field@@2PEB_WEB
?VW11@TW_Field@@2PEB_WEB
?VW12@TW_Field@@2PEB_WEB
?VW13@TW_Field@@2PEB_WEB
?VW14@TW_Field@@2PEB_WEB
?VW15@TW_Field@@2PEB_WEB
?VW1@TW_Field@@2PEB_WEB
?VW2@TW_Field@@2PEB_WEB
?VW3@TW_Field@@2PEB_WEB
?VW4@TW_Field@@2PEB_WEB
?VW5@TW_Field@@2PEB_WEB
?VW6@TW_Field@@2PEB_WEB
?VW7@TW_Field@@2PEB_WEB
?VW8@TW_Field@@2PEB_WEB
?VW9@TW_Field@@2PEB_WEB
?VW@TW_Field@@2PEB_WEB
?Wtf@Layer_Field@@2PEB_WEB
?ZBG_BG@Fgd_Field@@2PEB_WEB
?ZK_SBG@Zkd_Field@@2PEB_WEB
?ZK_THD10@Zkd_Field@@2PEB_WEB
?ZK_THD11@Zkd_Field@@2PEB_WEB
?ZK_THD12@Zkd_Field@@2PEB_WEB
?ZK_THD13@Zkd_Field@@2PEB_WEB
?ZK_THD14@Zkd_Field@@2PEB_WEB
?ZK_THD15@Zkd_Field@@2PEB_WEB
?ZK_THD1@Zkd_Field@@2PEB_WEB
?ZK_THD2@Zkd_Field@@2PEB_WEB
?ZK_THD3@Zkd_Field@@2PEB_WEB
?ZK_THD4@Zkd_Field@@2PEB_WEB
?ZK_THD5@Zkd_Field@@2PEB_WEB
?ZK_THD6@Zkd_Field@@2PEB_WEB
?ZK_THD7@Zkd_Field@@2PEB_WEB
?ZK_THD8@Zkd_Field@@2PEB_WEB
?ZK_THD9@Zkd_Field@@2PEB_WEB
?ZK_ZBG@Zkd_Field@@2PEB_WEB
?ZK_ZKSD@Zkd_Field@@2PEB_WEB
?data@ArxDbgRbList@@QEAAPEAUresbuf@@XZ
?data@ArxDbgRbListZ@@QEAAPEAUresbuf@@XZ
?detachHead@ArxDbgRbList@@QEAAPEAUresbuf@@XZ
?detachHead@ArxDbgRbListZ@@QEAAPEAUresbuf@@XZ
?detachTail@ArxDbgRbList@@QEAAPEAUresbuf@@XZ
?detachTail@ArxDbgRbListZ@@QEAAPEAUresbuf@@XZ
?done@SdStrListIterator@@UEBAHXZ
?done@SdStrObjIdListIterator@@UEBAHXZ
?isEmpty@ArxDbgRbList@@QEAA_NXZ
?isEmpty@ArxDbgRbListZ@@QEAA_NXZ
?item@SdStrListIterator@@UEBA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?next@SdStrListIterator@@UEAAXXZ
?next@SdStrObjIdListIterator@@UEAAXXZ
?previous@SdStrListIterator@@UEAAXXZ
?previous@SdStrObjIdListIterator@@UEAAXXZ
?removeHead@ArxDbgRbList@@QEAAXXZ
?removeHead@ArxDbgRbListZ@@QEAAXXZ
?removeTail@ArxDbgRbList@@QEAAXXZ
?removeTail@ArxDbgRbListZ@@QEAAXXZ
?toFirst@SdStrListIterator@@UEAAXXZ
?toFirst@SdStrObjIdListIterator@@UEAAXXZ
?toLast@SdStrListIterator@@UEAAXXZ
?toLast@SdStrObjIdListIterator@@UEAAXXZ
acrxEntryPoint
acrxGetApiVersion

Sections

.text
Size: 5.2MB - Virtual size: 5.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sedata
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.sedata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ce0025831c69edb1b858d36856f53920

Headers

DLL Characteristics

File Characteristics

Imports

fgdutilu2021

fgbfileu2021

fgbmfcu2021

fastbaseu2021

fxdatadealu2021

wb_gpcadu2021

fastcadu2021.arx

fastcontourbaseu2021.arx

fastdwglibu2021.arx

gpdatau2021

fentsfgriddingu2021

fastcdtu2021

fastdefentdbxu2021.dbx

fastgptriangleu2021

ffcommarxlibu2021

ffarxlibu2021

wb_ftftpbaseu2021

acdb24

acge24

acad.exe

acui24

adui24

accore

ac1st24

acdrawbridge

acgeomentobj.dbx

mfc140u

kernel32

user32

gdi32

advapi32

shell32

comctl32

ole32

oleaut32

acpal

msvcp140

wibucm64

gdiplus

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

iphlpapi

msvcrt

psapi

Exports

Exports

Sections

.text Size: 5.2MB - Virtual size: 5.2MB

.sedata Size: 1.4MB - Virtual size: 1.4MB

.idata Size: 5KB - Virtual size: 8KB

.reloc Size: 512B - Virtual size: 4KB

.sedata Size: 4KB - Virtual size: 4KB

.text
Size: 5.2MB - Virtual size: 5.2MB

.sedata
Size: 1.4MB - Virtual size: 1.4MB

.idata
Size: 5KB - Virtual size: 8KB

.reloc
Size: 512B - Virtual size: 4KB

.sedata
Size: 4KB - Virtual size: 4KB