bb3b62caf9970d308dfc592554b7ee14dbedcaf89c52d82d0e0b3423eff94651

Sharing

Copy URL Twitter E-mail

General

Target

bb3b62caf9970d308dfc592554b7ee14dbedcaf89c52d82d0e0b3423eff94651
Size

6.2MB
MD5

94654c2b03fabca3bada34d19d0b38c0
SHA1

96c67412f93fc461b644d59a7b6a749f74bf24b6
SHA256

bb3b62caf9970d308dfc592554b7ee14dbedcaf89c52d82d0e0b3423eff94651
SHA512

fd0b88adb03029eaf533f5fae6b3bb42d5f6a6beedef14b047d3602e2efa5fd9239921044af7759538716e208ebab727621064c4b98feb4bca2f987749c09708
SSDEEP

49152:6PbPReilO6dK56IDv2AISqxqQQgx8LrQsyL1vqvZQ0yhYBPKJtXyoDePCRKoxg8D:ofdKccHg2QQBPKJNgCoofuE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bb3b62caf9970d308dfc592554b7ee14dbedcaf89c52d82d0e0b3423eff94651

Files

bb3b62caf9970d308dfc592554b7ee14dbedcaf89c52d82d0e0b3423eff94651
.dll windows:6 windows x64

617e77798da005e00fd6c28d9a2322ea

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

ffarxlibu2015

??0ArxDbgUiPrPoint@@QEAA@PEB_W0@Z

ffcommarxlibu2015

??0CFRecord@@QEAA@XZ

fastdefentdbxu2015.dbx

?fnGetMindPt@BaseFun@@YA?AVAcGePoint3d@@AEBV?$AcArray@VAcGePoint3d@@V?$AcArrayMemCopyReallocator@VAcGePoint3d@@@@@@@Z

acdb20

?subDeleteSubentPaths@AcDbEntity@@MEAA?AW4ErrorStatus@Acad@@AEBV?$AcArray@VAcDbFullSubentPath@@V?$AcArrayObjectCopyReallocator@VAcDbFullSubentPath@@@@@@@Z

acge20

??0AcGePoint2d@@QEAA@XZ

acad.exe

?acedGetAcadDockCmdLine@@YAPEAVCWnd@@XZ

acui20

??1CAcUiDialog@@UEAA@XZ

adui20

?DoAdUiMessage@CAdUiBaseDialog@@MEAA?AW4ADUI_REPLY@@W4ADUI_NOTIFY@@I_J@Z

accore

?acedGetKword@@YAHPEB_WPEA_W_K@Z

ac1st20

?allocRawMem@AcHeapOperators@@CAPEAX_K@Z

acdrawbridge

?k3DDrawing@AcGsKernelDescriptor@@2PEBVAcUniqueString@@EB

mfc110u

ord8507

msvcr110

wcsstr

kernel32

lstrlenA

user32

DrawEdge

gdi32

TextOutW

advapi32

RegSetValueExA

shell32

ShellExecuteExW

comctl32

ImageList_GetImageInfo

ole32

CLSIDFromProgID

oleaut32

SysAllocStringByteLen

msvcp110

?_Winerror_map@std@@YAPEBDH@Z

fgdutilu2015

?IsCtrlPressed@fgdutil@@YAHXZ

fgbfileu2015

??0CFStdioFile@fgbfile@@QEAA@XZ

fastbaseu2015

?GetEntColor@ent@fast@@YAHVAcDbObjectId@@AEAH@Z

fastcadu2015.arx

??0CStatusBarControl@FastCad@@QEAA@HH@Z

wb_gpcadu2015

?SetDataToDatabase@@YAHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@0H@Z

fgbmfcu2015

??0CGridCtrl_2@@QEAA@HHHH@Z

fxdatadealu2015

?GetFrom@CFDictRecord@ARX_DATA@@QEAA?AW4ErrorStatus@Acad@@HAEAHVAcDbObjectId@@@Z

wibucm64

ord1

gpdatau2015

??1CGpcadDrawingInfo@@QEAA@XZ

fastcdtu2015

?getPlinePtBulges@RDEnt@RDBase@@YA_NPEAVAcDb3dPolyline@@AEAV?$AcArray@VAcGePoint3d@@V?$AcArrayMemCopyReallocator@VAcGePoint3d@@@@@@AEAV?$AcArray@NV?$AcArrayMemCopyReallocator@N@@@@NN@Z

fentsfgriddingu2015

?fnDelMapInfoByEnt_NotInit@CGrigOpreate@@QEAAHVAcDbObjectId@@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z

fastgptriangleu2015

?getSelPtHeight@FASTGPTRI@@YA_NAEBV?$AcArray@VAcGePoint3d@@V?$AcArrayMemCopyReallocator@VAcGePoint3d@@@@@@AEAVAcGePoint3d@@@Z

wb_ftftpbaseu2015

??1CQKData@@QEAA@XZ

fastcontourbaseu2015.arx

??1CFReginGen@FConBase@@QEAA@XZ

fastdwglibu2015.arx

?FDwglibNew@dwglibapi@@YAHPEB_W00@Z

iphlpapi

GetInterfaceInfo

msvcrt

_wcsnicmp

psapi

GetMappedFileNameW

Exports

Exports

??0ArxDbgAppXdataXList@@QEAA@AEBV0@@Z
??0CTableData@@QEAA@AEBV0@@Z
??0CTableData@@QEAA@XZ
??0CTableItem@@QEAA@AEBV0@@Z
??0CTableItem@@QEAA@XZ
??0CTableRow@@QEAA@AEBV0@@Z
??0CTableRow@@QEAA@H@Z
??0CTableRow@@QEAA@XZ
??0SdStrList@@QEAA@XZ
??0SdStrObjIdNode@@QEAA@AEBV0@@Z
??0SdUnsortedStrList@@QEAA@XZ
??1CTableData@@QEAA@XZ
??1CTableItem@@QEAA@XZ
??1CTableRow@@QEAA@XZ
??1SdSortedStrList@@UEAA@XZ
??1SdStrList@@UEAA@XZ
??1SdStrListIterator@@UEAA@XZ
??1SdStrObjIdListIterator@@UEAA@XZ
??1SdStrObjIdNode@@QEAA@XZ
??1SdUnsortedStrList@@UEAA@XZ
??4ArxDbgAppXdataXList@@QEAAAEAV0@AEBV0@@Z
??4ArxDbgUtils@@QEAAAEAU0@AEBU0@@Z
??4ArxDbgUtilsGe@@QEAAAEAU0@AEBU0@@Z
??4ArxRbOper@@QEAAAEAV0@AEBV0@@Z
??4CFDbUtils@@QEAAAEAV0@AEBV0@@Z
??4CFEntOpertor@@QEAAAEAV0@AEBV0@@Z
??4CFSysVar@@QEAAAEAV0@AEBV0@@Z
??4CFmAttrBlockOperator@@QEAAAEAV0@AEBV0@@Z
??4CTableData@@QEAAAEAV0@AEBV0@@Z
??4CTableItem@@QEAAAEAV0@AEBV0@@Z
??4CTableRow@@QEAAAEAV0@AEBV0@@Z
??4FArx@@QEAAAEAV0@AEBV0@@Z
??4Fgd_Field@@QEAAAEAU0@AEBU0@@Z
??4Layer_Field@@QEAAAEAU0@AEBU0@@Z
??4SdStrObjIdNode@@QEAAAEAV0@AEBV0@@Z
??4TKBZD_Field@@QEAAAEAU0@AEBU0@@Z
??4TW_Field@@QEAAAEAU0@AEBU0@@Z
??4Zkd_Field@@QEAAAEAU0@AEBU0@@Z
??_7ArxDbgAppXdataXList@@6B@
??_7SdStrList@@6B@
??_7SdStrListIterator@@6B@
??_7SdStrObjIdListIterator@@6B@
??_7SdUnsortedStrList@@6B@
??_FArxDrawTable@@QEAAXXZ
??_FSdSortedStrList@@QEAAXXZ
??_FSdStrObjIdList@@QEAAXXZ
?BH@TW_Field@@2PEB_WEB
?Bp@Layer_Field@@2PEB_WEB
?BpSpx@Layer_Field@@2PEB_WEB
?CDBG_BG@Fgd_Field@@2PEB_WEB
?CD_ZZ@Fgd_Field@@2PEB_WEB
?Count@SdStrObjIdList@@QEBAHXZ
?Dm@Layer_Field@@2PEB_WEB
?DmDmx@Layer_Field@@2PEB_WEB
?DmSjx@Layer_Field@@2PEB_WEB
?DmZero@Layer_Field@@2PEB_WEB
?Dmfpx@Layer_Field@@2PEB_WEB
?DrawCADTable@@YAHAEBVCTableData@@AEAVAcDbObjectId@@@Z
?DrawCADTable@@YAHAEBVCTableData@@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@AEAV?$AcArray@VAcDbObjectId@@V?$AcArrayMemCopyReallocator@VAcDbObjectId@@@@@@@Z
?Fg@Layer_Field@@2PEB_WEB
?FgBH@Layer_Field@@2PEB_WEB
?Fgd@Layer_Field@@2PEB_WEB
?GsFwx@Layer_Field@@2PEB_WEB
?Hdm@Layer_Field@@2PEB_WEB
?Insert@SdUnsortedStrList@@UEAAPEAU__POSITION@@AEBV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?IsHead@CTableRow@@QEAAHXZ
?KmHatch@Layer_Field@@2PEB_WEB
?Ljbp@Layer_Field@@2PEB_WEB
?Pdbz@Layer_Field@@2PEB_WEB
?Qk@Layer_Field@@2PEB_WEB
?Qy@Layer_Field@@2PEB_WEB
?SBG_BG@Fgd_Field@@2PEB_WEB
?SS_CD@Fgd_Field@@2PEB_WEB
?SS_ZZ@Fgd_Field@@2PEB_WEB
?Slbz@Layer_Field@@2PEB_WEB
?TK_BH@TKBZD_Field@@2PEB_WEB
?TK_MJ@TKBZD_Field@@2PEB_WEB
?TK_SBG@TKBZD_Field@@2PEB_WEB
?Table@Layer_Field@@2PEB_WEB
?Tfgcx@Layer_Field@@2PEB_WEB
?Tflx@Layer_Field@@2PEB_WEB
?Tfpm@Layer_Field@@2PEB_WEB
?VQW@TW_Field@@2PEB_WEB
?VST@TW_Field@@2PEB_WEB
?VSW@TW_Field@@2PEB_WEB
?VT@TW_Field@@2PEB_WEB
?VW10@TW_Field@@2PEB_WEB
?VW11@TW_Field@@2PEB_WEB
?VW12@TW_Field@@2PEB_WEB
?VW13@TW_Field@@2PEB_WEB
?VW14@TW_Field@@2PEB_WEB
?VW15@TW_Field@@2PEB_WEB
?VW1@TW_Field@@2PEB_WEB
?VW2@TW_Field@@2PEB_WEB
?VW3@TW_Field@@2PEB_WEB
?VW4@TW_Field@@2PEB_WEB
?VW5@TW_Field@@2PEB_WEB
?VW6@TW_Field@@2PEB_WEB
?VW7@TW_Field@@2PEB_WEB
?VW8@TW_Field@@2PEB_WEB
?VW9@TW_Field@@2PEB_WEB
?VW@TW_Field@@2PEB_WEB
?Wtf@Layer_Field@@2PEB_WEB
?ZBG_BG@Fgd_Field@@2PEB_WEB
?ZK_SBG@Zkd_Field@@2PEB_WEB
?ZK_THD10@Zkd_Field@@2PEB_WEB
?ZK_THD11@Zkd_Field@@2PEB_WEB
?ZK_THD12@Zkd_Field@@2PEB_WEB
?ZK_THD13@Zkd_Field@@2PEB_WEB
?ZK_THD14@Zkd_Field@@2PEB_WEB
?ZK_THD15@Zkd_Field@@2PEB_WEB
?ZK_THD1@Zkd_Field@@2PEB_WEB
?ZK_THD2@Zkd_Field@@2PEB_WEB
?ZK_THD3@Zkd_Field@@2PEB_WEB
?ZK_THD4@Zkd_Field@@2PEB_WEB
?ZK_THD5@Zkd_Field@@2PEB_WEB
?ZK_THD6@Zkd_Field@@2PEB_WEB
?ZK_THD7@Zkd_Field@@2PEB_WEB
?ZK_THD8@Zkd_Field@@2PEB_WEB
?ZK_THD9@Zkd_Field@@2PEB_WEB
?ZK_ZBG@Zkd_Field@@2PEB_WEB
?ZK_ZKSD@Zkd_Field@@2PEB_WEB
?data@ArxDbgRbListZ@@QEAAPEAUresbuf@@XZ
?detachHead@ArxDbgRbListZ@@QEAAPEAUresbuf@@XZ
?detachTail@ArxDbgRbListZ@@QEAAPEAUresbuf@@XZ
?done@SdStrListIterator@@UEBAHXZ
?done@SdStrObjIdListIterator@@UEBAHXZ
?isEmpty@ArxDbgRbListZ@@QEAA_NXZ
?item@SdStrListIterator@@UEBA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?next@SdStrListIterator@@UEAAXXZ
?next@SdStrObjIdListIterator@@UEAAXXZ
?previous@SdStrListIterator@@UEAAXXZ
?previous@SdStrObjIdListIterator@@UEAAXXZ
?removeHead@ArxDbgRbListZ@@QEAAXXZ
?removeTail@ArxDbgRbListZ@@QEAAXXZ
?toFirst@SdStrListIterator@@UEAAXXZ
?toFirst@SdStrObjIdListIterator@@UEAAXXZ
?toLast@SdStrListIterator@@UEAAXXZ
?toLast@SdStrObjIdListIterator@@UEAAXXZ
acrxEntryPoint
acrxGetApiVersion

Sections

.text
Size: 4.8MB - Virtual size: 4.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sedata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.sedata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

617e77798da005e00fd6c28d9a2322ea

Headers

DLL Characteristics

File Characteristics

Imports

ffarxlibu2015

ffcommarxlibu2015

fastdefentdbxu2015.dbx

acdb20

acge20

acad.exe

acui20

adui20

accore

ac1st20

acdrawbridge

mfc110u

msvcr110

kernel32

user32

gdi32

advapi32

shell32

comctl32

ole32

oleaut32

msvcp110

fgdutilu2015

fgbfileu2015

fastbaseu2015

fastcadu2015.arx

wb_gpcadu2015

fgbmfcu2015

fxdatadealu2015

wibucm64

gpdatau2015

fastcdtu2015

fentsfgriddingu2015

fastgptriangleu2015

wb_ftftpbaseu2015

fastcontourbaseu2015.arx

fastdwglibu2015.arx

iphlpapi

msvcrt

psapi

Exports

Exports

Sections

.text Size: 4.8MB - Virtual size: 4.8MB

.sedata Size: 1.3MB - Virtual size: 1.3MB

.idata Size: 4KB - Virtual size: 8KB

.reloc Size: 512B - Virtual size: 4KB

.sedata Size: 4KB - Virtual size: 4KB

.text
Size: 4.8MB - Virtual size: 4.8MB

.sedata
Size: 1.3MB - Virtual size: 1.3MB

.idata
Size: 4KB - Virtual size: 8KB

.reloc
Size: 512B - Virtual size: 4KB

.sedata
Size: 4KB - Virtual size: 4KB