ddb39fac147e4b6362d611dca7e7600f939897b39202232f2ce3ffe44d2580f2

Sharing

Copy URL

Twitter E-mail

General

Target

ddb39fac147e4b6362d611dca7e7600f939897b39202232f2ce3ffe44d2580f2
Size

6.5MB
MD5

0db13d1275fbcf419d23e70d20f08d70
SHA1

c12c15f4ca811129b99ef93c7028fc4adef2e6b2
SHA256

ddb39fac147e4b6362d611dca7e7600f939897b39202232f2ce3ffe44d2580f2
SHA512

350687de8524e0766a221288eb8c8a6af451085fa42a858e3929c44a861fbb2d7f194acd239c041c65d6fc04d5bca3196ce099c167430db723d00b8df34cc375
SSDEEP

98304:/Falr45xajFINHVSuHWQ7UVKu1aPuR4oeReU:/Fc3I2XKu1aPuQf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ddb39fac147e4b6362d611dca7e7600f939897b39202232f2ce3ffe44d2580f2

Files

ddb39fac147e4b6362d611dca7e7600f939897b39202232f2ce3ffe44d2580f2
.dll windows:5 windows x64

023d6404afa4d6febb768c355d005e45

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

ffarxlibu2013

?AddColumn@ArxTableHeaderData@@QEAAHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@N@Z

ffcommarxlibu2013

??1CFResizDlg@@UEAA@XZ

fastdefentdbxu2013.dbx

??0AcDbDefEnt_Dim@@QEAA@AEBVCDefEntData_DIM@@@Z

acdb19

?subMoveGripPointsAt@AcDbEntity@@MEAA?AW4ErrorStatus@Acad@@AEBV?$AcArray@PEAXV?$AcArrayMemCopyReallocator@PEAX@@@@AEBVAcGeVector3d@@H@Z

acge19

??0AcGeLineSeg3d@@QEAA@AEBVAcGePoint3d@@0@Z

acad.exe

?acedGetAcadDockCmdLine@@YAPEAVCWnd@@XZ

acui19

?OnCancel@CAcUiDialog@@MEAAXXZ

adui19

?OnCtlColor@CAdUiBaseDialog@@IEAAPEAUHBRUSH__@@PEAVCDC@@PEAVCWnd@@I@Z

accore

acedUsrBrk

ac1st19

?clone@AcRxObject@@UEBAPEAV1@XZ

mfc100u

ord13768

msvcr100

_purecall

kernel32

GetWindowsDirectoryW

user32

SetRect

gdi32

GetDeviceCaps

advapi32

RegSetValueExA

shell32

ShellExecuteExW

comctl32

_TrackMouseEvent

ole32

CLSIDFromProgID

oleaut32

GetActiveObject

msvcp100

?_Swap_all@_Container_base0@std@@QEAAXAEAU12@@Z

fgdutilu2013

?GetLocateMachineName@fgdutil@@YA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ

fgbfileu2013

?GetAppPath@fgbfile@@YA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ

fastbaseu2013

?SetCurLayer@cad@fast@@YAHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@AEAV34@@Z

fastcadu2013.arx

??1CStatusBarControl@FastCad@@QEAA@XZ

wb_gpcadu2013

?SetDataToDatabase@@YAHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@0H@Z

fgbmfcu2013

?IsValid@CGridCtrl_2@@QEBAHAEBVCCellRange2@@@Z

fxdatadealu2013

??0CFDictRecord@ARX_DATA@@QEAA@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@0PEAVAcDbDatabase@@@Z

wibucm64

ord52

gpdatau2013

?GetInfo@CGpcadDrawingInfo@@QEAAHXZ

fastcdtu2013

??1CDTSegment@FASTCDT@@QEAA@XZ

fentsfgriddingu2013

?fnDrawDGX@CDrawDGX@@QEAAHAEBV?$CArray@VCFTrianglePoint@@AEAV1@@@AEAV?$AcArray@VAcDbObjectId@@V?$AcArrayMemCopyReallocator@VAcDbObjectId@@@@@@@Z

fastgptriangleu2013

?GetLsdFromDB@FASTGPTRI@@YAHHAEAV?$AcArray@VAcGePoint3d@@V?$AcArrayMemCopyReallocator@VAcGePoint3d@@@@@@@Z

wb_ftftpbaseu2013

??1CQKData@@QEAA@XZ

fastcontourbaseu2013.arx

?GetPolyline@CFReginGen@FConBase@@QEAAHAEAV?$AcArray@VAcDbObjectId@@V?$AcArrayMemCopyReallocator@VAcDbObjectId@@@@@@0@Z

fastdwglibu2013.arx

?FDwglibNew@dwglibapi@@YAHPEB_W00@Z

iphlpapi

GetInterfaceInfo

msvcrt

_wcsnicmp

psapi

GetMappedFileNameW

Exports

Exports

??0ArxDbgAppXdataXList@@QEAA@AEBV0@@Z
??0CTableData@@QEAA@AEBV0@@Z
??0CTableData@@QEAA@XZ
??0CTableItem@@QEAA@AEBV0@@Z
??0CTableItem@@QEAA@XZ
??0CTableRow@@QEAA@AEBV0@@Z
??0CTableRow@@QEAA@H@Z
??0CTableRow@@QEAA@XZ
??0SdStrList@@QEAA@XZ
??0SdStrObjIdNode@@QEAA@AEBV0@@Z
??0SdUnsortedStrList@@QEAA@XZ
??1CTableData@@QEAA@XZ
??1CTableItem@@QEAA@XZ
??1CTableRow@@QEAA@XZ
??1SdSortedStrList@@UEAA@XZ
??1SdStrList@@UEAA@XZ
??1SdStrListIterator@@UEAA@XZ
??1SdStrObjIdListIterator@@UEAA@XZ
??1SdStrObjIdNode@@QEAA@XZ
??1SdUnsortedStrList@@UEAA@XZ
??4ArxDbgAppXdataXList@@QEAAAEAV0@AEBV0@@Z
??4ArxDbgUtils@@QEAAAEAU0@AEBU0@@Z
??4ArxDbgUtilsGe@@QEAAAEAU0@AEBU0@@Z
??4ArxRbOper@@QEAAAEAV0@AEBV0@@Z
??4CFDbUtils@@QEAAAEAV0@AEBV0@@Z
??4CFEntOpertor@@QEAAAEAV0@AEBV0@@Z
??4CFSysVar@@QEAAAEAV0@AEBV0@@Z
??4CFmAttrBlockOperator@@QEAAAEAV0@AEBV0@@Z
??4CTableData@@QEAAAEAV0@AEBV0@@Z
??4CTableItem@@QEAAAEAV0@AEBV0@@Z
??4CTableRow@@QEAAAEAV0@AEBV0@@Z
??4FArx@@QEAAAEAV0@AEBV0@@Z
??4Fgd_Field@@QEAAAEAU0@AEBU0@@Z
??4Layer_Field@@QEAAAEAU0@AEBU0@@Z
??4SdStrObjIdNode@@QEAAAEAV0@AEBV0@@Z
??4TKBZD_Field@@QEAAAEAU0@AEBU0@@Z
??4TW_Field@@QEAAAEAU0@AEBU0@@Z
??4Zkd_Field@@QEAAAEAU0@AEBU0@@Z
??_7ArxDbgAppXdataXList@@6B@
??_7SdStrList@@6B@
??_7SdStrListIterator@@6B@
??_7SdStrObjIdListIterator@@6B@
??_7SdUnsortedStrList@@6B@
??_FArxDrawTable@@QEAAXXZ
??_FSdSortedStrList@@QEAAXXZ
??_FSdStrObjIdList@@QEAAXXZ
?BH@TW_Field@@2PEB_WEB
?Bp@Layer_Field@@2PEB_WEB
?BpSpx@Layer_Field@@2PEB_WEB
?CDBG_BG@Fgd_Field@@2PEB_WEB
?CD_ZZ@Fgd_Field@@2PEB_WEB
?Count@SdStrObjIdList@@QEBAHXZ
?Dm@Layer_Field@@2PEB_WEB
?DmDmx@Layer_Field@@2PEB_WEB
?DmSjx@Layer_Field@@2PEB_WEB
?DmZero@Layer_Field@@2PEB_WEB
?Dmfpx@Layer_Field@@2PEB_WEB
?DrawCADTable@@YAHAEBVCTableData@@AEAVAcDbObjectId@@@Z
?DrawCADTable@@YAHAEBVCTableData@@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@AEAV?$AcArray@VAcDbObjectId@@V?$AcArrayMemCopyReallocator@VAcDbObjectId@@@@@@@Z
?Fg@Layer_Field@@2PEB_WEB
?FgBH@Layer_Field@@2PEB_WEB
?Fgd@Layer_Field@@2PEB_WEB
?GsFwx@Layer_Field@@2PEB_WEB
?Hdm@Layer_Field@@2PEB_WEB
?Insert@SdUnsortedStrList@@UEAAPEAU__POSITION@@AEBV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?IsHead@CTableRow@@QEAAHXZ
?KmHatch@Layer_Field@@2PEB_WEB
?Ljbp@Layer_Field@@2PEB_WEB
?Pdbz@Layer_Field@@2PEB_WEB
?Qk@Layer_Field@@2PEB_WEB
?Qy@Layer_Field@@2PEB_WEB
?SBG_BG@Fgd_Field@@2PEB_WEB
?SS_CD@Fgd_Field@@2PEB_WEB
?SS_ZZ@Fgd_Field@@2PEB_WEB
?Slbz@Layer_Field@@2PEB_WEB
?TK_BH@TKBZD_Field@@2PEB_WEB
?TK_MJ@TKBZD_Field@@2PEB_WEB
?TK_SBG@TKBZD_Field@@2PEB_WEB
?Table@Layer_Field@@2PEB_WEB
?Tfgcx@Layer_Field@@2PEB_WEB
?Tflx@Layer_Field@@2PEB_WEB
?Tfpm@Layer_Field@@2PEB_WEB
?VQW@TW_Field@@2PEB_WEB
?VST@TW_Field@@2PEB_WEB
?VSW@TW_Field@@2PEB_WEB
?VT@TW_Field@@2PEB_WEB
?VW10@TW_Field@@2PEB_WEB
?VW11@TW_Field@@2PEB_WEB
?VW12@TW_Field@@2PEB_WEB
?VW13@TW_Field@@2PEB_WEB
?VW14@TW_Field@@2PEB_WEB
?VW15@TW_Field@@2PEB_WEB
?VW1@TW_Field@@2PEB_WEB
?VW2@TW_Field@@2PEB_WEB
?VW3@TW_Field@@2PEB_WEB
?VW4@TW_Field@@2PEB_WEB
?VW5@TW_Field@@2PEB_WEB
?VW6@TW_Field@@2PEB_WEB
?VW7@TW_Field@@2PEB_WEB
?VW8@TW_Field@@2PEB_WEB
?VW9@TW_Field@@2PEB_WEB
?VW@TW_Field@@2PEB_WEB
?Wtf@Layer_Field@@2PEB_WEB
?ZBG_BG@Fgd_Field@@2PEB_WEB
?ZK_SBG@Zkd_Field@@2PEB_WEB
?ZK_THD10@Zkd_Field@@2PEB_WEB
?ZK_THD11@Zkd_Field@@2PEB_WEB
?ZK_THD12@Zkd_Field@@2PEB_WEB
?ZK_THD13@Zkd_Field@@2PEB_WEB
?ZK_THD14@Zkd_Field@@2PEB_WEB
?ZK_THD15@Zkd_Field@@2PEB_WEB
?ZK_THD1@Zkd_Field@@2PEB_WEB
?ZK_THD2@Zkd_Field@@2PEB_WEB
?ZK_THD3@Zkd_Field@@2PEB_WEB
?ZK_THD4@Zkd_Field@@2PEB_WEB
?ZK_THD5@Zkd_Field@@2PEB_WEB
?ZK_THD6@Zkd_Field@@2PEB_WEB
?ZK_THD7@Zkd_Field@@2PEB_WEB
?ZK_THD8@Zkd_Field@@2PEB_WEB
?ZK_THD9@Zkd_Field@@2PEB_WEB
?ZK_ZBG@Zkd_Field@@2PEB_WEB
?ZK_ZKSD@Zkd_Field@@2PEB_WEB
?data@ArxDbgRbListZ@@QEAAPEAUresbuf@@XZ
?detachHead@ArxDbgRbListZ@@QEAAPEAUresbuf@@XZ
?detachTail@ArxDbgRbListZ@@QEAAPEAUresbuf@@XZ
?done@SdStrListIterator@@UEBAHXZ
?done@SdStrObjIdListIterator@@UEBAHXZ
?isEmpty@ArxDbgRbListZ@@QEAA_NXZ
?item@SdStrListIterator@@UEBA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?next@SdStrListIterator@@UEAAXXZ
?next@SdStrObjIdListIterator@@UEAAXXZ
?previous@SdStrListIterator@@UEAAXXZ
?previous@SdStrObjIdListIterator@@UEAAXXZ
?removeHead@ArxDbgRbListZ@@QEAAXXZ
?removeTail@ArxDbgRbListZ@@QEAAXXZ
?toFirst@SdStrListIterator@@UEAAXXZ
?toFirst@SdStrObjIdListIterator@@UEAAXXZ
?toLast@SdStrListIterator@@UEAAXXZ
?toLast@SdStrObjIdListIterator@@UEAAXXZ
acrxEntryPoint
acrxGetApiVersion

Sections

.text
Size: 5.2MB - Virtual size: 5.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sedata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.sedata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

023d6404afa4d6febb768c355d005e45

Headers

DLL Characteristics

File Characteristics

Imports

ffarxlibu2013

ffcommarxlibu2013

fastdefentdbxu2013.dbx

acdb19

acge19

acad.exe

acui19

adui19

accore

ac1st19

mfc100u

msvcr100

kernel32

user32

gdi32

advapi32

shell32

comctl32

ole32

oleaut32

msvcp100

fgdutilu2013

fgbfileu2013

fastbaseu2013

fastcadu2013.arx

wb_gpcadu2013

fgbmfcu2013

fxdatadealu2013

wibucm64

gpdatau2013

fastcdtu2013

fentsfgriddingu2013

fastgptriangleu2013

wb_ftftpbaseu2013

fastcontourbaseu2013.arx

fastdwglibu2013.arx

iphlpapi

msvcrt

psapi

Exports

Exports

Sections

.text Size: 5.2MB - Virtual size: 5.2MB

.sedata Size: 1.3MB - Virtual size: 1.3MB

.idata Size: 4KB - Virtual size: 8KB

.reloc Size: 512B - Virtual size: 4KB

.sedata Size: 4KB - Virtual size: 4KB

.text
Size: 5.2MB - Virtual size: 5.2MB

.sedata
Size: 1.3MB - Virtual size: 1.3MB

.idata
Size: 4KB - Virtual size: 8KB

.reloc
Size: 512B - Virtual size: 4KB

.sedata
Size: 4KB - Virtual size: 4KB