NEAS[.]0ab909f4e2070811a2585a5551a00d80[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.0ab909f4e2070811a2585a5551a00d80.exe
Size

180KB
MD5

0ab909f4e2070811a2585a5551a00d80
SHA1

21cc5cde5f919fe035f05d72157e0471b27e0e01
SHA256

d2fed6b49a4500b756e16262585fa65fbc383ce27753aefde50e6c2d46eff89e
SHA512

71e0ebd992acfe0855b8a18a192b7e1ca5dd0b1347f3f10a7adc3dc2482e3529e7a741eb523ca7824bbe0c0649ea50ce401a78b28abcf7081349e2423027b50c
SSDEEP

3072:xEslskVyciGZYI6mqBNuSSPZPco5uAQbwAxSnRPApT3XbwFsVAsLIb5PX9geO+0I:Sslssh8I6FmLPZPco5uAQbwAxSnRPApI

Score

1^/10

Malware Config

Signatures

Files

NEAS.0ab909f4e2070811a2585a5551a00d80.exe
.exe windows:5 windows x64

9051165abaed54afd4ed2e7b6755dcd2

Code Sign

4c:17:06:d5
Certificate

Issuer

CN=Entrust Code Signing Certification Authority - L1D,OU=www.entrust.net/rpa is incorporated by reference+OU=(c) 2009 Entrust\, Inc.,O=Entrust\, Inc.,C=US

Not Before

16/12/2011, 15:51

Not After

16/12/2014, 20:44

Subject

CN=Entrust Time Stamping Authority,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

4c:0e:8c:3a
Certificate

Issuer

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Not Before

11/11/2011, 15:41

Not After

12/11/2021, 08:51

Subject

CN=Entrust Code Signing Certification Authority - L1D,OU=www.entrust.net/rpa is incorporated by reference+OU=(c) 2009 Entrust\, Inc.,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4c:17:6d:de
Certificate

Issuer

CN=Entrust Code Signing Certification Authority - L1D,OU=www.entrust.net/rpa is incorporated by reference+OU=(c) 2009 Entrust\, Inc.,O=Entrust\, Inc.,C=US

Not Before

28/02/2014, 14:24

Not After

28/02/2015, 20:52

Subject

CN=Commvault Systems\, Inc.,O=Commvault Systems\, Inc.,L=Oceanport,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

99:f5:80:c8:05:8a:2a:30:db:86:bf:56:57:74:49:1a:31:ab:5f:70
Signer

Actual PE Digest

99:f5:80:c8:05:8a:2a:30:db:86:bf:56:57:74:49:1a:31:ab:5f:70

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

cvappmgr

?EnableAppMgrClientMessageCache@@YAX_N@Z
??0CVCommCell@@QEAA@AEBV?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@@Z
?getCommCellId@CVCommCell@@UEAAHAEAKPEAX@Z
??1CVCommCell@@UEAA@XZ
??0CVClient@@QEAA@AEBV?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@_NK@Z
?getClientId@CVClient@@UEAAHAEAKPEAX@Z
??1CVClient@@UEAA@XZ
??0ApplicationTypeFS@@QEAA@KK@Z
?isExplorerBasedEndUserRecallEnabled@ApplicationTypeFS@@QEAAHAEA_NPEAX@Z
??_DApplicationTypeFS@@QEAAXXZ

cvbasiclib

?GetAllInInstances@CVPlatformInfo@@QEAAHAEAV?$vector@V?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@V?$allocator@V?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@@2@@stlp_std@@@Z
??0CVPlatformInfo@@QEAA@AEBV?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@@Z
?debugLvl@EvDebug@@QEAAXHPEBDZZ
??1CvCriticalSectionLock@@QEAA@XZ
?getValue@CVPlatformInfo@@QEAAHAEBV?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@0AEAK@Z
?getValue@CVPlatformInfo@@QEAAHAEBV?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@0AEAV23@PEBD@Z
??0CvCriticalSectionLock@@QEAA@PEAVCvCriticalSection@@@Z
?getDebugLevel@EvDebug@@QEAAHXZ
?setValue@CVPlatformInfo@@QEAAHAEBV?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@00@Z
?getRegValues@CVPlatformInfo@@QEAA_NPEBDPEAV?$map@V?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@V12@U?$less@V?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@V12@@stlp_std@@@2@@stlp_std@@@Z
?getValue@CVPlatformInfo@@QEAAHAEBV?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@0PEADAEAHPEBD@Z
?doWork@CvThreadPool@@QEAAKP6AIPEAX@Z0@Z
?setRegValue@CVPlatformInfo@@QEAA_NPEBD0KPEBXH@Z
?DebugLvl@EvDebug@@QEAAXPEBDH0ZZ
?getRegValue@CVPlatformInfo@@QEAA_NPEBD0PEAKPEAXAEAH@Z
??0CVPlatformInfo@@QEAA@XZ
?initThreadPool@CvThreadPool@@QEAA_NKKKK@Z
??0CvThreadPool@@QEAA@XZ
?getValue@CVPlatformInfo@@QEAAHAEBV?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@AEAV?$vector@V?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@V?$allocator@V?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@@2@@3@@Z
??1CvThreadPool@@QEAA@XZ
??1CvCriticalSection@@QEAA@XZ
?findCommServerClientName@CVPlatformInfo@@QEAAHPEADH@Z
?getNumber@CVPlatformInfo@@QEAAHPEBD0PEAK@Z
?error@EvDebug@@QEAAXPEBDZZ
?debug@EvDebug@@QEAAXPEBDZZ
??0CvCriticalSection@@QEAA@XZ
??1CVPlatformInfo@@QEAA@XZ

cvfocus

?setFocus@CVPI_Focus@@SAXPEBDW4COMMVAULT_PRODUCT_TYPE@@_N@Z
?getFocus@CVPI_Focus@@SAPEBDXZ
?setFocusClientNameFromArgs@CVPI_Focus@@SA_NHPEAPEAD@Z

cvlib

??0EvEvent@@QEAA@XZ
??1EvEvent@@QEAA@XZ

gxhsmfpdm

suspendFPDM
?IsFpdmInitialized@@YA_NXZ
mainFPDM
resumeFPDM
CheckWithCS_ForNewFilersToRegister

gxhsmsessionmanager

?GetInstance@CGXHSMSessionManagerSingleton@@SAAEAV1@XZ
?StopSessionServer@CGXHSMSessionManagerSingleton@@QEAAXXZ
?StartSessionServer@CGXHSMSessionManagerSingleton@@QEAA_NXZ

qiutils

QISLEEP_InTeRnAl

advapi32

StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
SetServiceStatus
RegNotifyChangeKeyValue
RegCloseKey
QueryServiceStatusEx
OpenSCManagerA
OpenServiceA
CloseServiceHandle
StartServiceA

kernel32

RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
DecodePointer
EncodePointer
GetSystemTimeAsFileTime
RaiseException
LoadLibraryA
FreeLibrary
IsDebuggerPresent
FindVolumeClose
FindFirstVolumeW
GetProcAddress
GetModuleHandleW
FindNextVolumeW
FindVolumeMountPointClose
FindFirstVolumeMountPointW
GetVolumeInformationW
GetDriveTypeW
GetLastError
GetVolumeNameForVolumeMountPointW
GetLogicalDriveStringsW
FindNextVolumeMountPointW
FindClose
FindNextFileW
GetFileAttributesExW
FindFirstFileW
GetSystemTime
FileTimeToSystemTime
RtlCaptureContext
WideCharToMultiByte
MultiByteToWideChar
DeleteFileW
CloseHandle
Sleep
ResetEvent
WaitForMultipleObjects
CreateEventA
CreateThread
CreateMutexA
DeviceIoControl
WaitForSingleObject
GetDriveTypeA
GetLogicalDrives
SetEvent
SetWaitableTimer
CreateWaitableTimerA
CreateEventW
LoadLibraryW
CompareFileTime
CopyFileW
ResumeThread
SuspendThread
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
LocalAlloc

stlport.5.2

?_M_construct_null@?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@AEBAXPEA_W@Z
?_M_Start@?$_String_base@_WV?$allocator@_W@stlp_std@@@priv@stlp_std@@IEAAPEA_WXZ
?_M_Finish@?$_String_base@_WV?$allocator@_W@stlp_std@@@priv@stlp_std@@IEAAPEA_WXZ
?_M_compute_next_size@?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@AEAA_K_K@Z
?_M_rest@?$_String_base@_WV?$allocator@_W@stlp_std@@@priv@stlp_std@@IEBA_KXZ
??A?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QEAAAEAD_K@Z
?size@?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QEBA_KXZ
?empty@?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QEBA_NXZ
??0?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QEAA@AEBV?$allocator@D@1@@Z
?find_last_of@?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QEBA_KD_K@Z
??4?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QEAAAEAV01@AEBV01@@Z
?substr@?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QEBA?AV12@_K0@Z
??0?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QEAA@AEBV01@@Z
?find@?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QEBA_KPEB_W_K@Z
??A?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QEBAAEBD_K@Z
??4?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QEAAAEAV01@PEBD@Z
??4?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QEAAAEAV01@PEB_W@Z
??1?$_STLP_alloc_proxy@PEADDV?$allocator@D@stlp_std@@@priv@stlp_std@@QEAA@XZ
?allocate@?$_STLP_alloc_proxy@PEADDV?$allocator@D@stlp_std@@@priv@stlp_std@@QEAAPEAD_KAEA_K@Z
??0?$_STLP_alloc_proxy@PEADDV?$allocator@D@stlp_std@@@priv@stlp_std@@QEAA@AEBV?$allocator@D@2@PEAD@Z
?deallocate@?$allocator@D@stlp_std@@QEAAXPEAD_K@Z
?compare@?$char_traits@D@stlp_std@@SAHPEBD0_K@Z
?data@?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QEBAPEBDXZ
?append@?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QEAAAEAV12@AEBV12@@Z
??0?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QEAA@U_String_reserve_t@priv@1@_KAEBV?$allocator@D@1@@Z
?get_allocator@?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QEBA?AV?$allocator@D@2@XZ
?length@?$char_traits@D@stlp_std@@SA_KPEBD@Z
??_D?$basic_ostringstream@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QEAAXXZ
?str@?$basic_ostringstream@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QEBA?AV?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@2@XZ
?_M_put_nowiden@?$basic_ostream@DV?$char_traits@D@stlp_std@@@stlp_std@@QEAAXPEBD@Z
??0?$basic_ostringstream@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QEAA@H@Z
?_M_put_nowiden@?$basic_ostream@_WV?$char_traits@_W@stlp_std@@@stlp_std@@QEAAXPEB_W@Z
??0?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QEAA@V?$__move_source@V?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@@1@@Z
?assign@?$char_traits@D@stlp_std@@SAXAEADAEBD@Z
?_M_reset@?$_String_base@DV?$allocator@D@stlp_std@@@priv@stlp_std@@IEAAXPEAD00@Z
?_M_deallocate_block@?$_String_base@DV?$allocator@D@stlp_std@@@priv@stlp_std@@IEAAXXZ
?_M_construct_null@?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@AEBAXPEAD@Z
?_M_Start@?$_String_base@DV?$allocator@D@stlp_std@@@priv@stlp_std@@IEAAPEADXZ
?_M_Finish@?$_String_base@DV?$allocator@D@stlp_std@@@priv@stlp_std@@IEAAPEADXZ
?_M_compute_next_size@?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@AEAA_K_K@Z
?_M_rest@?$_String_base@DV?$allocator@D@stlp_std@@@priv@stlp_std@@IEBA_KXZ
?_M_deallocate_block@?$_String_base@_WV?$allocator@_W@stlp_std@@@priv@stlp_std@@IEAAXXZ
?_M_reset@?$_String_base@_WV?$allocator@_W@stlp_std@@@priv@stlp_std@@IEAAXPEA_W00@Z
?assign@?$char_traits@_W@stlp_std@@SAXAEA_WAEB_W@Z
?fill@?$basic_ios@_WV?$char_traits@_W@stlp_std@@@stlp_std@@QEBA_WXZ
?eof@?$__char_traits_base@_WG@stlp_std@@SAGXZ
?sputc@?$basic_streambuf@_WV?$char_traits@_W@stlp_std@@@stlp_std@@QEAAG_W@Z
?eq_int_type@?$__char_traits_base@_WG@stlp_std@@SA_NAEBG0@Z
??0?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QEAA@V?$__move_source@V?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@@1@@Z
?max_size@?$allocator@_W@stlp_std@@QEBA_KXZ
?end@?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QEBAPEB_WXZ
?begin@?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QEBAPEB_WXZ
?_M_compare@?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@SAHPEB_W000@Z
?__stl_throw_length_error@stlp_std@@YAXPEBD@Z
??0?$_Osentry@_WV?$char_traits@_W@stlp_std@@@stlp_std@@QEAA@AEAV?$basic_ostream@_WV?$char_traits@_W@stlp_std@@@1@@Z
??B?$_Osentry@_WV?$char_traits@_W@stlp_std@@@stlp_std@@QEBA_NXZ
?flags@ios_base@stlp_std@@QEBAHXZ
?width@ios_base@stlp_std@@QEAA_J_J@Z
?rdbuf@?$basic_ios@_WV?$char_traits@_W@stlp_std@@@stlp_std@@QEBAPEAV?$basic_streambuf@_WV?$char_traits@_W@stlp_std@@@2@XZ
?sputn@?$basic_streambuf@_WV?$char_traits@_W@stlp_std@@@stlp_std@@QEAA_JPEB_W_J@Z
?setstate@?$basic_ios@_WV?$char_traits@_W@stlp_std@@@stlp_std@@QEAAXH@Z
??1?$_Osentry@_WV?$char_traits@_W@stlp_std@@@stlp_std@@QEAA@XZ
?id@?$ctype@_W@stlp_std@@2V0locale@2@A
?_M_use_facet@locale@stlp_std@@QEBAPEAVfacet@12@AEBVid@12@@Z
?tolower@?$ctype@_W@stlp_std@@QEBA_W_W@Z
?_M_increment@?$_Rb_global@_N@priv@stlp_std@@SAPEAU_Rb_tree_node_base@23@PEAU423@@Z
?_Rebalance@?$_Rb_global@_N@priv@stlp_std@@SAXPEAU_Rb_tree_node_base@23@AEAPEAU423@@Z
?allocate@__node_alloc@stlp_std@@SAPEAXAEA_K@Z
??0?$basic_ostringstream@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QEAA@H@Z
?str@?$basic_ostringstream@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QEBA?AV?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@2@XZ
??_D?$basic_ostringstream@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QEAAXXZ
?data@?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QEBAPEB_WXZ
?compare@?$char_traits@_W@stlp_std@@SAHPEB_W0_K@Z
?length@?$char_traits@_W@stlp_std@@SA_KPEB_W@Z
?get_allocator@?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QEBA?AV?$allocator@_W@2@XZ
??0?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QEAA@U_String_reserve_t@priv@1@_KAEBV?$allocator@_W@1@@Z
?append@?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QEAAAEAV12@AEBV12@@Z
?c_str@?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QEBAPEBDXZ
??0locale@stlp_std@@QEAA@PEBD@Z
?begin@?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QEAAPEA_WXZ
?end@?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QEAAPEA_WXZ
??1locale@stlp_std@@QEAA@XZ
?_M_decrement@?$_Rb_global@_N@priv@stlp_std@@SAPEAU_Rb_tree_node_base@23@PEAU423@@Z
?deallocate@?$allocator@_W@stlp_std@@QEAAXPEA_W_K@Z
?allocate@?$_STLP_alloc_proxy@PEA_W_WV?$allocator@_W@stlp_std@@@priv@stlp_std@@QEAAPEA_W_KAEA_K@Z
??1?$_STLP_alloc_proxy@PEA_W_WV?$allocator@_W@stlp_std@@@priv@stlp_std@@QEAA@XZ
?deallocate@__node_alloc@stlp_std@@SAXPEAX_K@Z
?size@?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QEBA_KXZ
??0?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QEAA@PEB_W_KAEBV?$allocator@_W@1@@Z
??0?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QEAA@AEBV?$allocator@_W@1@@Z
??A?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QEAAAEA_W_K@Z
?empty@?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QEBA_NXZ
?clear@?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QEAAXXZ
??Y?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QEAAAEAV01@_W@Z
?c_str@?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QEBAPEB_WXZ
??0?$allocator@_W@stlp_std@@QEAA@XZ
??0?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QEAA@PEB_WAEBV?$allocator@_W@1@@Z
??1?$allocator@_W@stlp_std@@QEAA@XZ
??0?$allocator@D@stlp_std@@QEAA@XZ
??0?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QEAA@PEBDAEBV?$allocator@D@1@@Z
??1?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QEAA@XZ
??1?$allocator@D@stlp_std@@QEAA@XZ
??0?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QEAA@AEBV01@@Z
?find_last_not_of@?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QEBA_KAEBV12@_K@Z
?substr@?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QEBA?AV12@_K0@Z
??4?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QEAAAEAV01@AEBV01@@Z
??Y?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QEAAAEAV01@AEBV01@@Z
??1?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QEAA@XZ
??0?$_STLP_alloc_proxy@PEA_W_WV?$allocator@_W@stlp_std@@@priv@stlp_std@@QEAA@AEBV?$allocator@_W@2@PEA_W@Z

msvcr100

_access
strncmp
printf
??1exception@std@@UEAA@XZ
??0exception@std@@QEAA@AEBV01@@Z
?what@exception@std@@UEBAPEBDXZ
??0exception@std@@QEAA@AEBQEBDH@Z
_CxxThrowException
memmove
??_V@YAXPEAX@Z
??2@YAPEAX_K@Z
??3@YAXPEAX@Z
_stricmp
__crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
?terminate@@YAXXZ
__set_app_type
fclose
_fmode
_commode
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
__initenv
exit
_cexit
_exit
_XcptFilter
__getmainargs
_amsg_exit
_onexit
_lock
__dllonexit
_unlock
__C_specific_handler
_snwprintf
strncpy
_vswprintf
wcsncpy
_snprintf
_wtoi64
_mktime64
_difftime64
atoi
fopen
__CxxFrameHandler3

Exports

Exports

??4MDEvent@@QEAAAEAV0@AEBV0@@Z
??4MDMutex@@QEAAAEAV0@AEBV0@@Z
?getLastTimeAcquired@MDEvent@@QEAA_JXZ
?getLastTimeAcquired@MDLock@@QEAA_JXZ
?getLastTimeAcquired@MDMutex@@QEAA_JXZ

Sections

.text
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9051165abaed54afd4ed2e7b6755dcd2

Code Sign

4c:17:06:d5Certificate

Extended Key Usages

Key Usages

4c:0e:8c:3aCertificate

Key Usages

4c:17:6d:deCertificate

Extended Key Usages

Key Usages

99:f5:80:c8:05:8a:2a:30:db:86:bf:56:57:74:49:1a:31:ab:5f:70Signer

Headers

DLL Characteristics

File Characteristics

Imports

cvappmgr

cvbasiclib

cvfocus

cvlib

gxhsmfpdm

gxhsmsessionmanager

qiutils

advapi32

kernel32

stlport.5.2

msvcr100

Exports

Exports

Sections

.text Size: 96KB - Virtual size: 95KB

.rdata Size: 60KB - Virtual size: 60KB

.data Size: 7KB - Virtual size: 15KB

.pdata Size: 7KB - Virtual size: 7KB

.rsrc Size: 3KB - Virtual size: 3KB

4c:17:06:d5
Certificate

4c:0e:8c:3a
Certificate

4c:17:6d:de
Certificate

99:f5:80:c8:05:8a:2a:30:db:86:bf:56:57:74:49:1a:31:ab:5f:70
Signer

.text
Size: 96KB - Virtual size: 95KB

.rdata
Size: 60KB - Virtual size: 60KB

.data
Size: 7KB - Virtual size: 15KB

.pdata
Size: 7KB - Virtual size: 7KB

.rsrc
Size: 3KB - Virtual size: 3KB