05de1e43521a974d39cd10cccf7c80b0

Sharing

Copy URL Twitter E-mail

General

Target

05de1e43521a974d39cd10cccf7c80b0
Size

44KB
MD5

05de1e43521a974d39cd10cccf7c80b0
SHA1

a76bf800faeebf8255e29beef27e0e7c32ad5f20
SHA256

e53090312d52a694a94672e3a6b553f93793eaff9ee9b41a8f1647e9babfbe92
SHA512

4be1b6463c51dacbef4c515c3471fe7bcfbcfd20025d0000ad9c37f1e07b9c304c61d4704f0ba5a961b02932e7ada723c141859fdfaaef1b2191c4d3c7fec6f8
SSDEEP

768:Hh+nBAopxMdCNQ/q+yqbVGVOUPR5vq6Qj0s:QBACxMsNQi+yYGVOSzv7Qj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
05de1e43521a974d39cd10cccf7c80b0

Files

05de1e43521a974d39cd10cccf7c80b0
.dll windows:4 windows x86 arch:x86

a27cf4a1cdf4136694948fffd4ad8f34

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

cdelib

cde_sslength
cde_defun
cde_load_dialog
cde_printf
cde_ssget
cde_command
cde_ssname
cde_ssfree
cde_entget
cde_retstr
cde_entlast
cde_retvoid
cde_entmod
cde_entsel
cde_undef
cde_new_dialog
cde_action_tile
?cdei_getdraggenmatrix@@YAXXZ
cde_start_dialog
cde_unload_dialog
cde_fail
cde_malloc
cde_get_tile
cde_done_dialog
cde_getvar
cde_free
cde_get_attr_string
cde_getfuncode
cde_set_tile
?RetBuffer@@3PAUresbuf@@A
cde_end_list
cde_start_image
?cdei_unregister@@YAXXZ
cde_mode_tile
cde_fill_image
cde_dimensions_tile
cde_slide_image
cde_start_list
cde_add_list
?VarPack@@3PAUVARPACK@@A
?cdei_register@@YAXXZ
cde_vector_image
cde_end_image
cde_alert
cde_setvar
?CDE_grelease@@YAHXZ
cde_relrb

icadfunc

GH_ConvertLayerWhenSave
GH_preparation
GH_SupportFileName
GH_LoginForMaintain
GH_LogoffFromMaintain
GH_CheckPassword
GH_ConvertPassword
GH_AutoCheckPassword
UserDict
GH_MeasureDimAndGetText
GH_MeasureDim
GH_GroupCode
GH_StringToReal
GH_XDataGet
GH_StartXList
GH_AppendXList
GH_EndXList
GH_SetVar
GH_help
DupString
LookupDictString
GH_GetVar
GH_DecryptString
GH_GetPassword
GH_GetDimscale
GH_update_dxf_string

shbuf

?SB_GetBuf@@YAPAUresbuf@@XZ
?FSMS_SetRetStat@@YAHH@Z
?SB_PutBuf@@YAHPAUresbuf@@H@Z
?FSMS_GetRetStat@@YAHXZ

mfc42

ord1182
ord537
ord342
ord1253
ord1168
ord823
ord4160
ord860
ord5683
ord5710
ord858
ord800
ord4129
ord540

msvcrt

_strcmpi
_itoa
_stricmp
__CxxFrameHandler
fgets
strstr
fread
fseek
ftell
fclose
fopen
_ftol
atoi
strtok
strchr
sprintf
atof
strncpy
_initterm
malloc
free
_adjust_fdiv

kernel32

GetModuleFileNameA

Exports

Exports

CDEEntry

Sections

.text
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a27cf4a1cdf4136694948fffd4ad8f34

Headers

File Characteristics

Imports

cdelib

icadfunc

shbuf

mfc42

msvcrt

kernel32

Exports

Exports

Sections

.text Size: 24KB - Virtual size: 22KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 4KB - Virtual size: 2KB

.rsrc Size: 4KB - Virtual size: 936B

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 24KB - Virtual size: 22KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 4KB - Virtual size: 936B

.reloc
Size: 4KB - Virtual size: 3KB