AfCore[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

AfCore.dll
Size

8.1MB
MD5

14c0f278ffe3b27c4c93b236ab3fde6a
SHA1

162b321a3036c834d8209358bb83e6e990b0c3b4
SHA256

a35d9ec6dbd33257d6e38c1ccf46ebd2ee36691a04cb119c99bea80257ba02b5
SHA512

4731ce7ed54c8f92c1b2cb3fbe6e808a20950de7f5170eb5c34a06c67487a319e660cd8e8d2412002e0cd10c300b34793e69aa3a7a1fdfa68afb4ba90bfaef24
SSDEEP

196608:w7qKf8pT4NHG+QafmZKzONJGBwn9wa01RiDuS1EM7fG6LHtqa9fZ:w79f8mHG+h+04QBY9waYcDu7M1LNzf

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AfCore.dll

Files

AfCore.dll
.dll windows:6 windows x64 arch:x64

Password: pepe

cca995fb98f34b1f6db8b10be9b14278

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

psapi

GetModuleInformation

wininet

InternetErrorDlg

api-ms-win-core-path-l1-1-0

PathCchAppend

dadflib

?GetValue@CXMLNode@DADFCore@@QEBA_NAEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z

netapi32

NetShareEnum

comctl32

ord17

mpr

WNetCloseEnum

ws2_32

gethostbyname

shlwapi

PathIsDirectoryW

libcrypto-3-x64

BIO_push

crypt32

CryptDecodeObjectEx

wintrust

WinVerifyTrust

secur32

GetUserNameExA

kernel32

GetVersionExA
GetVersionExW
GetVersion
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

EnumDisplayDevicesW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW

gdi32

CreateEllipticRgn

comdlg32

GetSaveFileNameW

advapi32

RegSetValueExA

shell32

SHCreateDirectoryExW

ole32

CoMarshalInterThreadInterfaceInStream

oleaut32

SafeArrayAccessData

msvcp140

?_Xbad_function_call@std@@YAXXZ

concrt140

?_Internal_push@_Concurrent_queue_base_v4@details@Concurrency@@IEAAXPEBX@Z

version

GetFileVersionInfoA

iphlpapi

GetAdaptersAddresses

vcruntime140

__intrinsic_setjmp

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

strnlen

api-ms-win-crt-heap-l1-1-0

free

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-environment-l1-1-0

_putenv

api-ms-win-crt-math-l1-1-0

log10

api-ms-win-crt-filesystem-l1-1-0

_unlock_file

api-ms-win-crt-stdio-l1-1-0

ungetc

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

_seh_filter_dll

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-locale-l1-1-0

__initialize_lconv_for_unsigned_char

wtsapi32

WTSSendMessageW

Exports

Exports

??0?$BaseArray@PEAUIConnectionPoint@@@@QEAA@AEBV0@PEAX@Z
??0?$BaseArray@PEAUIConnectionPoint@@@@QEAA@KPEAX@Z
??0?$BaseArray@PEAUIConnectionPoint@@@@QEAA@QEBQEAUIConnectionPoint@@KPEAX@Z
??0?$BaseArray@PEA_W@@QEAA@AEBV0@PEAX@Z
??0?$BaseArray@PEA_W@@QEAA@KPEAX@Z
??0?$BaseArray@PEA_W@@QEAA@QEBQEA_WKPEAX@Z
??0?$BaseArray@UtagCONNECTDATA@@@@QEAA@AEBV0@PEAX@Z
??0?$BaseArray@UtagCONNECTDATA@@@@QEAA@KPEAX@Z
??0?$BaseArray@UtagCONNECTDATA@@@@QEAA@QEBUtagCONNECTDATA@@KPEAX@Z
??0?$Hash@JJPEAUIUnknown@@PEAU1@@@QEAA@J@Z
??0?$Hash@PEAUIUnknown@@PEAU1@JJ@@QEAA@J@Z
??0AccumulateTimer@EventLogTimer@@QEAA@AEAV1@V?$basic_string_view@_WU?$char_traits@_W@std@@@std@@@Z
??0AfAutoLock@@QEAA@AEAVAfCriticalSection@@@Z
??0AfAutoLock@@QEAA@AEAVAfMutex@@@Z
??0AfCrashDumpController@@QEAA@$$QEAV0@@Z
??0AfCrashDumpController@@QEAA@AEBV0@@Z
??0AfCrashDumpController@@QEAA@XZ
??0AfCriticalSection@@QEAA@XZ
??0AfEvent@@QEAA@HHPEB_WPEAU_SECURITY_ATTRIBUTES@@@Z
??0AfEvent@@QEAA@PEB_WHK@Z
??0AfKernel@@IEAA@XZ
??0AfKernelCollection@@QEAA@AEAV0@@Z
??0AfKernelCollection@@QEAA@XZ
??0AfMemoryMappedFile@@QEAA@PEAXKKKPEA_WPEAU_SECURITY_ATTRIBUTES@@@Z
??0AfMemoryMappedFile@@QEAA@PEA_WKH@Z
??0AfMutex@@QEAA@HPEB_WPEAU_SECURITY_ATTRIBUTES@@@Z
??0AfMutex@@QEAA@PEB_WHK@Z
??0AfSemaphore@@QEAA@JJPEB_WPEAU_SECURITY_ATTRIBUTES@@@Z
??0AfSemaphore@@QEAA@PEB_WHK@Z
??0AfSharedMemory@@QEAA@KPEA_WPEAU_SECURITY_ATTRIBUTES@@@Z
??0AfSharedMemory@@QEAA@PEA_W@Z
??0AfSnapTipWnd@@QEAA@AEBV0@@Z
??0AfSnapTipWnd@@QEAA@XZ
??0AfThread@@QEAA@PEAVAfThreadHandler@@IPEAU_SECURITY_ATTRIBUTES@@I@Z
??0AfThreadHandler@@QEAA@AEBV0@@Z
??0AfThreadHandler@@QEAA@XZ
??0AutoSetActiveViewerId@DrawingLog@@QEAA@J@Z
??0AutoSetCacheResponses@@QEAA@AEBV0@@Z
??0AutoSetCacheResponses@@QEAA@PEAUIMessageConnection@@_N@Z
??0AutoSetMessageLoggerShowUI@HttpUtils@@QEAA@AEBV01@@Z
??0AutoSetMessageLoggerShowUI@HttpUtils@@QEAA@_N@Z
??0AutoSetUseInMemoryCache@@QEAA@AEBV0@@Z
??0AutoSetUseInMemoryCache@@QEAA@PEAUIMessageConnection@@_N1@Z
??0AutoSetUseInMemoryCache@@QEAA@PEAUIMessageConnection@@_N@Z
??0AutoTimeout@@QEAA@AEBV0@@Z
??0AutoTimeout@@QEAA@PEAUIMessageConnectionREST@@J@Z
??0AutoTimeout@@QEAA@PEAUIMessageConnectionREST@@V?$duration@_JU?$ratio@$00$00@std@@@chrono@std@@@Z
??0BString@@QEAA@$$QEAV0@@Z
??0BString@@QEAA@AEBU_GUID@@@Z
??0BString@@QEAA@AEBV0@@Z
??0BString@@QEAA@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
??0BString@@QEAA@AEBVString@@@Z
??0BString@@QEAA@HPEAUHINSTANCE__@@@Z
??0BString@@QEAA@J@Z
??0BString@@QEAA@PEAGJ@Z
??0BString@@QEAA@PEBDH@Z
??0BString@@QEAA@PEB_W@Z
??0BString@@QEAA@XZ
??0Base64@ESRI@@AEAA@XZ
??0BitSet@@QEAA@AEBV0@@Z
??0BitSet@@QEAA@H@Z
??0BitSet@@QEAA@PEAJHHHH@Z
??0BitSet@@QEAA@XZ
??0BlockBitset@@QEAA@AEBU0@@Z
??0BlockBitset@@QEAA@XZ
??0CDownloadManyCallback@@QEAA@$$QEAV0@@Z
??0CDownloadManyCallback@@QEAA@AEBV0@@Z
??0CDownloadManyCallback@@QEAA@XZ
??0CFileDeleter@GeneralUtilities@@QEAA@AEBV01@@Z
??0CFileDeleter@GeneralUtilities@@QEAA@PEA_W@Z
??0CFileDeleter@GeneralUtilities@@QEAA@XZ
??0CHttpStream@@QEAA@AEBV0@@Z
??0CHttpStream@@QEAA@XZ
??0CRefreshTokenCallback@@QEAA@$$QEAV0@@Z
??0CRefreshTokenCallback@@QEAA@AEBV0@@Z
??0CRefreshTokenCallback@@QEAA@XZ
??0CRegKey@@QEAA@XZ
??0CSelectPalette@@AEAA@XZ
??0CSelectPalette@@QEAA@PEAUHDC__@@PEAUHPALETTE__@@@Z
??0CSubclassWnd@@QEAA@AEBV0@@Z
??0CSubclassWnd@@QEAA@XZ
??0CUploadManyCallback@@QEAA@AEBV0@@Z
??0CUploadManyCallback@@QEAA@XZ
??0CWinInetInternetFileCallback@@QEAA@$$QEAV0@@Z
??0CWinInetInternetFileCallback@@QEAA@AEBV0@@Z
??0CWinInetInternetFileCallback@@QEAA@XZ
??0CategoryMgr@@AEAA@XZ
??0CategoryMgr@@QEAA@AEBV0@@Z
??0CategoryMgr@@QEAA@U_GUID@@@Z
??0CertSet@@QEAA@XZ
??0ClipboardFormats@@QEAA@XZ
??0ContentTypeHelper@@QEAA@XZ
??0CrashDumpController@@QEAA@$$QEAV0@@Z
??0CrashDumpController@@QEAA@AEBV0@@Z
??0CrashDumpController@@QEAA@XZ
??0CurrentDirectory@@QEAA@PEB_W@Z
??0DelimitedList@@QEAA@AEBV0@@Z
??0DelimitedList@@QEAA@AEBVString@@_W_N@Z
??0DelimitedList@@QEAA@PEB_W0_N1@Z
??0DirectoryCursor@@QEAA@PEB_W0@Z
??0DirectoryCursor@@QEAA@XZ
??0Double@@QEAA@$$QEAV0@@Z
??0Double@@QEAA@AEBV0@@Z
??0Double@@QEAA@NH@Z
??0DropbackString@@QEAA@$$QEAV0@@Z
??0DropbackString@@QEAA@AEBV0@@Z
??0DropbackString@@QEAA@HPEAUHINSTANCE__@@0@Z
??0DropbackString@@QEAA@XZ
??0ERgn@@QEAA@AEBUtagRECT@@@Z
??0ERgn@@QEAA@AEBV0@@Z
??0ERgn@@QEAA@HHHH@Z
??0ERgn@@QEAA@PEBUtagPOINT@@H@Z
??0ERgn@@QEAA@PEBUtagPOINT@@PEBHH@Z
??0ERgn@@QEAA@XZ
??0Encrypt@@QEAA@XZ
??0ErrorCollectionHelper@@QEAA@AEBV0@@Z
??0ErrorCollectionHelper@@QEAA@VString@@@Z
??0EventLogTimer@@QEAA@AEBV0@@Z
??0EventLogTimer@@QEAA@W4tagEventType@EventLog@@V?$basic_string_view@_WU?$char_traits@_W@std@@@std@@111J@Z
??0EventLogTimer@@QEAA@W4tagEventType@EventLog@@V?$basic_string_view@_WU?$char_traits@_W@std@@@std@@11J@Z
??0EventLogTimer@@QEAA@W4tagEventType@EventLog@@V?$basic_string_view@_WU?$char_traits@_W@std@@@std@@11V?$function@$$A6A?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ@4@J@Z
??0EventLogTimer@@QEAA@W4tagEventType@EventLog@@V?$basic_string_view@_WU?$char_traits@_W@std@@@std@@1V?$function@$$A6A?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ@4@J@Z
??0ExternalSort@@QEAA@XZ
??0File@@AEAA@AEBV0@@Z
??0File@@QEAA@PEB_W@Z
??0FileDialog@@QEAA@$$QEAV0@@Z
??0FileDialog@@QEAA@AEBV0@@Z
??0FileDialog@@QEAA@PEB_W_N00K0VESRI_OLE_HANDLE@@@Z
??0FileIO@@QEAA@AEBV0@@Z
??0FileIO@@QEAA@PEB_W@Z
??0FileNames@@QEAA@PEAUIUnknown@@@Z
??0FileStat@@QEAA@AEBV0@@Z
??0FileStat@@QEAA@PEB_W@Z
??0FileSystemPath@@QEAA@AEBV0@@Z
??0FileSystemPath@@QEAA@AEBVString@@000@Z
??0FileSystemPath@@QEAA@AEBVString@@@Z
??0FileSystemPath@@QEAA@PEB_W@Z
??0FileSystemPath@@QEAA@QEAUHINSTANCE__@@@Z
??0FileSystemPath@@QEAA@XZ
??0FixedBlockHeap@@QEAA@KKK@Z
??0FixedBlockHeapBase@@QEAA@AEBV0@@Z
??0FixedBlockHeapBase@@QEAA@K@Z
??0FixedBlockHeapEx@@QEAA@AEBV0@@Z
??0FixedBlockHeapEx@@QEAA@KKK@Z
??0FunctionHook@@QEAA@XZ
??0GCInvokerService@ESRIGC@@AEAA@XZ
??0Guid@@QEAA@$$QEAV0@@Z
??0Guid@@QEAA@AEBV0@@Z
??0Guid@@QEAA@PEAUIUID@@@Z
??0Guid@@QEAA@PEBDJ@Z
??0Guid@@QEAA@U_GUID@@J@Z
??0HashedBString@@QEAA@$$QEAV0@@Z
??0HashedBString@@QEAA@$$QEAVBString@@@Z
??0HashedBString@@QEAA@AEBV0@@Z
??0HashedBString@@QEAA@AEBVBString@@@Z
??0HashedBString@@QEAA@XZ
??0HiResTimer@@QEAA@AEBV0@@Z
??0HiResTimer@@QEAA@XZ
??0HideFloatingWindows@@AEAA@XZ
??0HideFloatingWindows@@QEAA@PEAUHWND__@@@Z
??0HttpConnLogger@@QEAA@AEBV0@@Z
??0HttpConnLogger@@QEAA@XZ
??0HttpConnection@@QEAA@AEBV0@@Z
??0HttpConnection@@QEAA@XZ
??0HttpConnectionWinInetEx@@QEAA@XZ
??0Hyperlink@@QEAA@AEBU0@@Z
??0Hyperlink@@QEAA@PEB_W@Z
??0LicensedComponent@@QEAA@AEBV0@@Z
??0LicensedComponent@@QEAA@W4esriProductCode@@00_N@Z
??0LicensedComponent@@QEAA@W4esriProductCode@@0_N@Z
??0LicensedComponent@@QEAA@W4esriProductCode@@JPEAW41@_N@Z
??0LicensedComponent@@QEAA@W4esriProductCode@@PEB_W_N@Z
??0LicensedComponent@@QEAA@W4esriProductCode@@_N@Z
??0Matrix@@QEAA@AEBV0@PEANH@Z
??0Matrix@@QEAA@HHNPEANH@Z
??0Matrix@@QEAA@HHPEANH@Z
??0Matrix@@QEAA@HPEANH@Z
??0NumberFmt@@QEAA@XZ
??0OsVersionInfo@@QEAA@XZ
??0PKILoginInfo@@QEAA@AEBV0@@Z
??0PKILoginInfo@@QEAA@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0@Z
??0PKILoginInfo@@QEAA@XZ
??0PKILoginInfo@@QEAA@_NV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@1@Z
??0PartInfo@@QEAA@AEAVString@@AEAV?$_com_ptr_t@V?$_com_IIID@UIPropertySet@@$1?_GUID_f0ba6abc_8e9f_11d0_b4ab_0000f8037368@@3U__s_GUID@@B@@@@@Z
??0PartInfo@@QEAA@AEBV0@@Z
??0PartInfos@@QEAA@AEBV0@@Z
??0PartInfos@@QEAA@PEAUIPropertySetArray@@@Z
??0PolygonAreaAndCentroid@@QEAA@_N@Z
??0RESTDispatcher@RESTSupport@@QEAA@AEBV01@@Z
??0RESTDispatcher@RESTSupport@@QEAA@XZ
??0RESTError@RESTSupport@@QEAA@AEBV01@@Z
??0RESTError@RESTSupport@@QEAA@HJQEB_W@Z
??0RESTError@RESTSupport@@QEAA@HQEB_W@Z
??0RESTError@RESTSupport@@QEAA@XZ
??0RESTOperation@RESTSupport@@IEAA@AEBV01@@Z
??0RESTOperation@RESTSupport@@IEAA@QEB_WP6AJPEAX0PEAVRESTResource@1@AEAV?$Hash@VString@@PEB_WV1@PEB_W@@PEA_W0PEAUIJSONObject@@PEAPEAU4@AEAUtagVARIANT@@@ZAEBVStringArray@@90_N@Z
??0RESTOperation@RESTSupport@@IEAA@QEB_WP6AJPEAX0PEAVRESTResource@1@AEAV?$Hash@VString@@PEB_WV1@PEB_W@@PEA_W0PEAUIJSONObject@@PEAPEAU4@AEAUtagVARIANT@@@ZAEBVStringArray@@9_N@Z
??0RESTOperation@RESTSupport@@IEAA@XZ
??0RESTResource@RESTSupport@@IEAA@AEBV01@@Z
??0RESTResource@RESTSupport@@IEAA@QEB_WP6AJPEAX0PEAV01@AEAV?$Hash@VString@@PEB_WV1@PEB_W@@PEA_W0PEAUIJSONObject@@PEAPEAU3@AEAUtagVARIANT@@@Z0_N@Z
??0RESTResource@RESTSupport@@IEAA@QEB_WP6AJPEAX0PEAV01@AEAV?$Hash@VString@@PEB_WV1@PEB_W@@PEA_W0PEAUIJSONObject@@PEAPEAU3@AEAUtagVARIANT@@@Z80_N9@Z
??0RESTResource@RESTSupport@@IEAA@QEB_WP6AJPEAX0PEAV01@AEAV?$Hash@VString@@PEB_WV1@PEB_W@@PEA_W0PEAUIJSONObject@@PEAPEAU3@AEAUtagVARIANT@@@Z8_N9@Z
??0RESTResource@RESTSupport@@IEAA@QEB_WP6AJPEAX0PEAV01@AEAV?$Hash@VString@@PEB_WV1@PEB_W@@PEA_W0PEAUIJSONObject@@PEAPEAU3@AEAUtagVARIANT@@@Z_N@Z
??0RESTResource@RESTSupport@@IEAA@XZ
??0RandomGenerator@@QEAA@IW4RandomGeneratorType@0@@Z
??0RandomGeneratorBase@@QEAA@AEBV0@@Z
??0RandomGeneratorBase@@QEAA@XZ
??0RequestCounter@Thread@@QEAA@XZ
??0RequestCounter@Thread@@QEAA@_N@Z
??0Response@@QEAA@AEBV0@@Z
??0Response@@QEAA@XZ
??0ServerLogger@@QEAA@$$QEAV0@@Z
??0ServerLogger@@QEAA@AEBV0@@Z
??0ServerLogger@@QEAA@XZ
??0ServerObjectBase@@QEAA@$$QEAV0@@Z
??0ServerObjectBase@@QEAA@AEBV0@@Z
??0ServerObjectBase@@QEAA@PEB_W0@Z
??0SmartCopy@@QEAA@AEBV0@@Z
??0SmartCopy@@QEAA@_NPEAUIPersistStream@@@Z
??0StackWalker@@QEAA@AEBV0@@Z
??0StackWalker@@QEAA@HPEBDKPEAX@Z
??0StackWalker@@QEAA@KPEAX@Z
??0Statistics@@QEAA@$$QEAV0@@Z
??0Statistics@@QEAA@AEBV0@@Z
??0Statistics@@QEAA@_N0@Z
??0Statistics@@QEAA@_N@Z
??0StepTimer@EventLogTimer@@QEAA@AEAV1@V?$basic_string_view@_WU?$char_traits@_W@std@@@std@@@Z
??0String@@QEAA@$$QEAV0@@Z
??0String@@QEAA@AEAUtagVARIANT@@@Z
??0String@@QEAA@AEBV0@@Z
??0String@@QEAA@HPEAUHINSTANCE__@@@Z
??0String@@QEAA@PEB_WK@Z
??0String@@QEAA@XZ
??0String@@QEAA@_W@Z
??0StringArray@@QEAA@AEBV0@@Z
??0StringArray@@QEAA@XZ
??0Tip@@QEAA@AEBV0@@Z
??0Tip@@QEAA@PEAUHINSTANCE__@@@Z
??0TypeMapperBase@@QEAA@AEBV0@@Z
??0TypeMapperBase@@QEAA@XZ
??0UnitParser@@QEAA@AEBV0@@Z
??0UnitParser@@QEAA@XZ
??0Variant@@QEAA@$$QEAV0@@Z
??0Variant@@QEAA@AEAUtagVARIANT@@W4OwnershipControl@0@@Z
??0Variant@@QEAA@AEAVSafeArray@@@Z
??0Variant@@QEAA@AEBTtagCY@@@Z
??0Variant@@QEAA@AEBUtagDEC@@@Z
??0Variant@@QEAA@AEBUtagVARIANT@@@Z
??0Variant@@QEAA@AEBV0@@Z
??0Variant@@QEAA@E@Z
??0Variant@@QEAA@FG@Z
??0Variant@@QEAA@JG@Z
??0Variant@@QEAA@M@Z
??0Variant@@QEAA@NG@Z
??0Variant@@QEAA@PEAUIDispatch@@@Z
??0Variant@@QEAA@PEAUIUnknown@@@Z
??0Variant@@QEAA@PEBD@Z
??0Variant@@QEAA@PEB_W@Z
??0Variant@@QEAA@XZ
??0Variant@@QEAA@_J@Z
??0Variant@@QEAA@_N@Z
??0VariantStream@@QEAA@PEAUIStream@@@Z
??0Vector@@QEAA@AEAVMatrix@@H@Z
??0Vector@@QEAA@AEBV0@PEANH@Z
??0Vector@@QEAA@HNPEANH@Z
??0Vector@@QEAA@HPEANH@Z
??0WKSEnvelope@@QEAA@$$QEAU0@@Z
??0WKSEnvelope@@QEAA@AEBU0@@Z
??0WKSEnvelope@@QEAA@AEBUWKSEnvelopeZ@@@Z
??0WKSEnvelope@@QEAA@AEBUWKSPoint@@0@Z
??0WKSEnvelope@@QEAA@AEBUWKSPoint@@@Z
??0WKSEnvelope@@QEAA@AEBUWKSPoint@@N@Z
??0WKSEnvelope@@QEAA@AEBUWKSPoint@@NN@Z
??0WKSEnvelope@@QEAA@JQEAU0@@Z
??0WKSEnvelope@@QEAA@JQEBUWKSPoint@@@Z
??0WKSEnvelope@@QEAA@N@Z
??0WKSEnvelope@@QEAA@NN@Z
??0WKSEnvelope@@QEAA@NNNN@Z
??0WKSEnvelope@@QEAA@XZ
??0WKSEnvelopeZ@@QEAA@AEBU0@@Z
??0WKSEnvelopeZ@@QEAA@AEBUWKSEnvelope@@@Z
??0WKSEnvelopeZ@@QEAA@AEBUWKSPointZ@@0@Z
??0WKSEnvelopeZ@@QEAA@AEBUWKSPointZ@@@Z
??0WKSEnvelopeZ@@QEAA@NNNNNN@Z
??0WKSEnvelopeZ@@QEAA@XZ
??0Win32Clipboard@@QEAA@AEBV0@@Z
??0Win32Clipboard@@QEAA@PEAUHWND__@@@Z
??0mutex@Thread@@QEAA@XZ
??0recursive_mutex@Thread@@QEAA@XZ
??0recursive_mutex@Thread@@QEAA@_N@Z
??0recursive_shared_mutex@Thread@@QEAA@XZ
??0seq_lock@Thread@@QEAA@XZ
??0shared_mutex@Detail@Thread@@QEAA@XZ
??0shared_mutex@Thread@@QEAA@XZ
??1?$BaseArray@PEAUIConnectionPoint@@@@QEAA@XZ
??1?$BaseArray@PEA_W@@QEAA@XZ
??1?$BaseArray@UtagCONNECTDATA@@@@QEAA@XZ
??1?$Hash@JJPEAUIUnknown@@PEAU1@@@QEAA@XZ
??1?$Hash@PEAUIUnknown@@PEAU1@JJ@@QEAA@XZ
??1AccumulateTimer@EventLogTimer@@QEAA@XZ
??1AfAutoLock@@QEAA@XZ
??1AfCriticalSection@@QEAA@XZ
??1AfEvent@@UEAA@XZ
??1AfKernel@@UEAA@XZ
??1AfKernelCollection@@UEAA@XZ
??1AfMemoryMappedFile@@QEAA@XZ
??1AfMutex@@UEAA@XZ
??1AfSemaphore@@UEAA@XZ
??1AfSharedMemory@@QEAA@XZ
??1AfSnapTipWnd@@QEAA@XZ
??1AfThread@@UEAA@XZ
??1AfThreadHandler@@UEAA@XZ
??1AutoSetActiveViewerId@DrawingLog@@QEAA@XZ
??1AutoSetCacheResponses@@QEAA@XZ
??1AutoSetMessageLoggerShowUI@HttpUtils@@QEAA@XZ
??1AutoSetUseInMemoryCache@@QEAA@XZ
??1AutoTimeout@@QEAA@XZ
??1BString@@QEAA@XZ
??1BitSet@@QEAA@XZ
??1BlockBitset@@QEAA@XZ
??1CFileDeleter@GeneralUtilities@@QEAA@XZ
??1CHttpStream@@UEAA@XZ
??1CRegKey@@QEAA@XZ
??1CSelectPalette@@QEAA@XZ
??1CSubclassWnd@@UEAA@XZ
??1CUploadManyCallback@@UEAA@XZ
??1CancelMonitor@@QEAA@XZ
??1CategoryMgr@@UEAA@XZ
??1CertSet@@QEAA@XZ
??1CurrentDirectory@@QEAA@XZ
??1DelimitedList@@UEAA@XZ
??1DirectoryCursor@@QEAA@XZ
??1DropbackString@@QEAA@XZ
??1ERgn@@UEAA@XZ
??1Encrypt@@QEAA@XZ
??1ErrorCollectionHelper@@QEAA@XZ
??1EventLogTimer@@QEAA@XZ
??1ExternalSort@@QEAA@XZ
??1File@@QEAA@XZ
??1FileDialog@@QEAA@XZ
??1FileIO@@QEAA@XZ
??1FileNames@@UEAA@XZ
??1FileStat@@QEAA@XZ
??1FileSystemPath@@QEAA@XZ
??1FixedBlockHeap@@QEAA@XZ
??1FixedBlockHeapBase@@IEAA@XZ
??1FixedBlockHeapEx@@QEAA@XZ
??1GCInvokerService@ESRIGC@@QEAA@XZ
??1Guid@@QEAA@XZ
??1HashedBString@@QEAA@XZ
??1HideFloatingWindows@@QEAA@XZ
??1HttpConnLogger@@QEAA@XZ
??1HttpConnection@@UEAA@XZ
??1HttpConnectionWinInetEx@@UEAA@XZ
??1Hyperlink@@QEAA@XZ
??1LicensedComponent@@UEAA@XZ
??1Matrix@@QEAA@XZ
??1NumberFmt@@QEAA@XZ
??1PKILoginInfo@@QEAA@XZ
??1PartInfo@@QEAA@XZ
??1PartInfos@@QEAA@XZ
??1RESTDispatcher@RESTSupport@@QEAA@XZ
??1RESTError@RESTSupport@@QEAA@XZ
??1RESTOperation@RESTSupport@@IEAA@XZ
??1RESTResource@RESTSupport@@IEAA@XZ
??1RandomGenerator@@QEAA@XZ
??1RandomGeneratorBase@@QEAA@XZ
??1RequestCounter@Thread@@QEAA@XZ
??1Response@@QEAA@XZ
??1ServerLogger@@QEAA@XZ
??1ServerObjectBase@@QEAA@XZ
??1SharingMemoryManager@Sharing@@QEAA@XZ
??1SmartCopy@@QEAA@XZ
??1StackWalker@@UEAA@XZ
??1Statistics@@QEAA@XZ
??1StepTimer@EventLogTimer@@QEAA@XZ
??1String@@QEAA@XZ
??1StringArray@@QEAA@XZ
??1Tip@@QEAA@XZ
??1TypeMapperBase@@UEAA@XZ
??1UnitParser@@QEAA@XZ
??1Variant@@QEAA@XZ
??1VariantStream@@UEAA@XZ
??1Vector@@QEAA@XZ
??1Win32Clipboard@@UEAA@XZ
??1mutex@Thread@@QEAA@XZ
??1recursive_mutex@Thread@@QEAA@XZ
??1recursive_shared_mutex@Thread@@QEAA@XZ
??1seq_lock@Thread@@QEAA@XZ
??1shared_mutex@Detail@Thread@@QEAA@XZ
??1shared_mutex@Thread@@QEAA@XZ
??4?$BaseArray@PEAUIConnectionPoint@@@@QEAAAEAV0@AEBV0@@Z
??4?$BaseArray@PEA_W@@QEAAAEAV0@AEBV0@@Z
??4?$BaseArray@UtagCONNECTDATA@@@@QEAAAEAV0@AEBV0@@Z
??4?$Hash@JJPEAUIUnknown@@PEAU1@@@QEAAAEAV0@AEBV0@@Z
??4?$Hash@PEAUIUnknown@@PEAU1@JJ@@QEAAAEAV0@AEBV0@@Z
??4AfAutoLock@@QEAAAEAV0@AEBV0@@Z
??4AfCrashDumpController@@QEAAAEAV0@$$QEAV0@@Z
??4AfCrashDumpController@@QEAAAEAV0@AEBV0@@Z
??4AfKernelCollection@@QEAAAEAV0@AEAV0@@Z
??4AfMemoryMappedFile@@QEAAAEAV0@AEBV0@@Z
??4AfSharedMemory@@QEAAAEAV0@AEBV0@@Z
??4AfSnapTipWnd@@QEAAAEAV0@AEBV0@@Z
??4AfThreadHandler@@QEAAAEAV0@AEBV0@@Z
??4AutoSetCacheResponses@@QEAAAEAV0@AEBV0@@Z
??4AutoSetMessageLoggerShowUI@HttpUtils@@QEAAAEAV01@AEBV01@@Z
??4AutoSetUseInMemoryCache@@QEAAAEAV0@AEBV0@@Z
??4AutoTimeout@@QEAAAEAV0@AEBV0@@Z
??4BString@@QEAAAEAV0@$$QEAV0@@Z
??4BString@@QEAAAEBV0@AEBV0@@Z
??4BString@@QEAAAEBV0@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
??4BString@@QEAAAEBV0@AEBVString@@@Z
??4BString@@QEAAAEBV0@PEBD@Z
??4BString@@QEAAAEBV0@PEB_W@Z
??4Base64@ESRI@@QEAAAEAV01@$$QEAV01@@Z
??4Base64@ESRI@@QEAAAEAV01@AEBV01@@Z
??4BitSet@@QEAAAEAV0@AEBV0@@Z
??4CDownloadManyCallback@@QEAAAEAV0@$$QEAV0@@Z
??4CDownloadManyCallback@@QEAAAEAV0@AEBV0@@Z
??4CFileDeleter@GeneralUtilities@@QEAAAEAV01@AEBV01@@Z
??4CHttpStream@@QEAAAEAV0@AEBV0@@Z
??4CRefreshTokenCallback@@QEAAAEAV0@$$QEAV0@@Z
??4CRefreshTokenCallback@@QEAAAEAV0@AEBV0@@Z
??4CRegKey@@QEAAAEAV0@AEBV0@@Z
??4CSelectPalette@@QEAAAEAV0@AEBV0@@Z
??4CSubclassWnd@@QEAAAEAV0@AEBV0@@Z
??4CSystemTimeHelper@@QEAAAEAV0@$$QEAV0@@Z
??4CSystemTimeHelper@@QEAAAEAV0@AEBV0@@Z
??4CUploadManyCallback@@QEAAAEAV0@AEBV0@@Z
??4CWinInetInternetFileCallback@@QEAAAEAV0@$$QEAV0@@Z
??4CWinInetInternetFileCallback@@QEAAAEAV0@AEBV0@@Z
??4CategoryMgr@@QEAAAEAV0@AEBV0@@Z
??4CertSet@@QEAAAEAV0@AEBV0@@Z
??4ClipboardFormats@@QEAAAEAV0@$$QEAV0@@Z
??4ClipboardFormats@@QEAAAEAV0@AEBV0@@Z
??4ContentTypeHelper@@QEAAAEAV0@$$QEAV0@@Z
??4ContentTypeHelper@@QEAAAEAV0@AEBV0@@Z
??4CrashDumpController@@QEAAAEAV0@$$QEAV0@@Z
??4CrashDumpController@@QEAAAEAV0@AEBV0@@Z
??4CurrentDirectory@@QEAAAEAV0@AEBV0@@Z
??4DelimitedList@@QEAAAEAV0@AEBV0@@Z
??4DirectoryCursor@@QEAAAEAV0@AEBV0@@Z
??4Double@@QEAAAEAV0@$$QEAV0@@Z
??4Double@@QEAAAEAV0@AEBV0@@Z
??4Double@@UEAANAEBN@Z
??4DropbackString@@QEAAAEAV0@$$QEAV0@@Z
??4DropbackString@@QEAAAEAV0@AEBV0@@Z
??4ERgn@@UEAAAEAV0@AEBV0@@Z
??4Encrypt@@QEAAAEAV0@AEBV0@@Z
??4ErrorCollectionHelper@@QEAAAEAV0@AEBV0@@Z
??4EventLogTimer@@QEAAAEAV0@AEBV0@@Z
??4ExternalSort@@QEAAAEAV0@AEBV0@@Z
??4File@@AEAAAEAV0@AEBV0@@Z
??4FileDialog@@QEAAAEAV0@$$QEAV0@@Z
??4FileDialog@@QEAAAEAV0@AEBV0@@Z
??4FileIO@@QEAAAEAV0@AEBV0@@Z
??4FileStat@@QEAAAEAV0@AEBV0@@Z
??4FileSystemPath@@QEAAAEAV0@AEBV0@@Z
??4FixedBlockHeap@@QEAAAEAV0@AEBV0@@Z
??4FunctionHook@@QEAAAEAV0@$$QEAV0@@Z
??4FunctionHook@@QEAAAEAV0@AEBV0@@Z
??4Guid@@QEAAAEAV0@$$QEAV0@@Z
??4Guid@@QEAAAEAV0@AEBV0@@Z
??4HashedBString@@QEAAAEAV0@$$QEAV0@@Z
??4HashedBString@@QEAAAEAV0@AEBV0@@Z
??4HiResTimer@@QEAAAEAV0@AEBV0@@Z
??4HideFloatingWindows@@QEAAAEAV0@AEBV0@@Z
??4HttpConnLogger@@QEAAAEAV0@AEBV0@@Z
??4HttpConnection@@QEAAAEAV0@AEBV0@@Z
??4Hyperlink@@QEAAAEAU0@AEBU0@@Z
??4LicensedComponent@@QEAAAEAV0@AEBV0@@Z
??4Matrix@@QEAAAEBV0@AEBV0@@Z
??4NumberFmt@@QEAAAEAV0@AEBV0@@Z
??4OsVersionInfo@@QEAAAEAV0@$$QEAV0@@Z
??4OsVersionInfo@@QEAAAEAV0@AEBV0@@Z
??4PKILoginInfo@@QEAAAEAV0@AEBV0@@Z
??4PartInfo@@QEAAAEAV0@AEBV0@@Z
??4PartInfos@@QEAAAEAV0@AEBV0@@Z
??4PolygonAreaAndCentroid@@QEAAAEAU0@$$QEAU0@@Z
??4PolygonAreaAndCentroid@@QEAAAEAU0@AEBU0@@Z
??4RESTDispatcher@RESTSupport@@QEAAAEAV01@AEBV01@@Z
??4RESTError@RESTSupport@@QEAAAEAV01@AEBV01@@Z
??4RESTOperation@RESTSupport@@QEAAAEAV01@AEBV01@@Z
??4RESTResource@RESTSupport@@QEAAAEAV01@AEBV01@@Z
??4RandomGenerator@@QEAAAEAV0@AEBV0@@Z
??4RandomGeneratorBase@@QEAAAEAV0@AEBV0@@Z
??4Response@@QEAAAEAV0@AEBV0@@Z
??4ServerLogger@@QEAAAEAV0@$$QEAV0@@Z
??4ServerLogger@@QEAAAEAV0@AEBV0@@Z
??4ServerObjectBase@@QEAAAEAV0@$$QEAV0@@Z
??4ServerObjectBase@@QEAAAEAV0@AEBV0@@Z
??4SmartCopy@@QEAAAEAV0@AEBV0@@Z
??4StackWalker@@QEAAAEAV0@AEBV0@@Z
??4Statistics@@QEAAAEAV0@$$QEAV0@@Z
??4Statistics@@QEAAAEAV0@AEBV0@@Z
??4String@@QEAAAEAV0@$$QEAV0@@Z
??4String@@QEAAAEBV0@AEBV0@@Z
??4String@@QEAAAEBV0@PEBD@Z
??4String@@QEAAAEBV0@PEB_W@Z
??4String@@QEAAAEBV0@_W@Z

Sections

.text
Size: - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.textidx
Size: - Virtual size: 688KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 730KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 208KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.fnp_dir
Size: - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.fnp_mar
Size: - Virtual size: 1B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 4.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 8.1MB - Virtual size: 8.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 200B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: pepe

cca995fb98f34b1f6db8b10be9b14278

Headers

DLL Characteristics

File Characteristics

Imports

psapi

wininet

api-ms-win-core-path-l1-1-0

dadflib

netapi32

comctl32

mpr

ws2_32

shlwapi

libcrypto-3-x64

crypt32

wintrust

secur32

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

msvcp140

concrt140

version

iphlpapi

vcruntime140

vcruntime140_1

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-locale-l1-1-0

wtsapi32

Exports

Exports

Sections

.text Size: - Virtual size: 3.1MB

.textidx Size: - Virtual size: 688KB

.rdata Size: - Virtual size: 730KB

.data Size: - Virtual size: 208KB

.pdata Size: - Virtual size: 108KB

.fnp_dir Size: - Virtual size: 120B

.fnp_mar Size: - Virtual size: 1B

.vmp0 Size: - Virtual size: 4.9MB

.vmp1 Size: 8.1MB - Virtual size: 8.1MB

.reloc Size: 512B - Virtual size: 200B

.rsrc Size: 1KB - Virtual size: 1KB

.text
Size: - Virtual size: 3.1MB

.textidx
Size: - Virtual size: 688KB

.rdata
Size: - Virtual size: 730KB

.data
Size: - Virtual size: 208KB

.pdata
Size: - Virtual size: 108KB

.fnp_dir
Size: - Virtual size: 120B

.fnp_mar
Size: - Virtual size: 1B

.vmp0
Size: - Virtual size: 4.9MB

.vmp1
Size: 8.1MB - Virtual size: 8.1MB

.reloc
Size: 512B - Virtual size: 200B

.rsrc
Size: 1KB - Virtual size: 1KB