12723a64c87dcad3dd1f40850f3185816cd63334e8b80e50828b98fc0aea0c52

Sharing

Copy URL Twitter E-mail

General

Target

12723a64c87dcad3dd1f40850f3185816cd63334e8b80e50828b98fc0aea0c52
Size

2.0MB
MD5

e54270f8703ac0b901e77c5bb0610026
SHA1

2ae8e45151ae8c669c16f165ca3851b66e186bcc
SHA256

12723a64c87dcad3dd1f40850f3185816cd63334e8b80e50828b98fc0aea0c52
SHA512

d89bdda4068b9f042da70a9a9ca57133cf27a8f99e7ecf9c77a82ac1b6bb38d265eabdd5cf523911b56962738f1f35241a1366a5348375d7b0751a42b077b775
SSDEEP

24576:gKzdVYIy5jY/W8hAfyVBMcLWYh/XKt25VOERVvM/OFSYE+e4RE+e4SbcGVbuYfOu:x6pOE8E/cUTnMq6jfsLO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
12723a64c87dcad3dd1f40850f3185816cd63334e8b80e50828b98fc0aea0c52

Files

12723a64c87dcad3dd1f40850f3185816cd63334e8b80e50828b98fc0aea0c52
.exe windows:6 windows x64 arch:x64

5009dee6c333acde0f2e565956ef6a98

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

P:\VMWD\BIMxLabReleaseDesktop.WIN.FULL\Build\VStudio\OutputDir\x64\Release\BIMx.pdb

Imports

common

?GetHeight@CMNRect@@QEBAMXZ
?GetWidth@CMNRect@@QEBAMXZ
?CMNToWide@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@@Z
??0CMNDateTime@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??MCMNDateTime@@QEBA_NAEBV0@@Z
?Create@CMNBase64Converter@@SA?AV?$shared_ptr@VCMNBase64Converter@@@std@@XZ
?Create@CMNJSONObject@@SA?AV?$shared_ptr@VCMNJSONObject@@@std@@XZ
?Create@CMNJSONArray@@SA?AV?$shared_ptr@VCMNJSONArray@@@std@@XZ
?Parse@CMNJSONArray@@SA?AV?$shared_ptr@VCMNJSONArray@@@std@@AEBV?$vector@EV?$allocator@E@std@@@3@@Z
?CMNToUTF8@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEB_W@Z
?Parse@CMNJSONArray@@SA?AV?$shared_ptr@VCMNJSONArray@@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@3@@Z
?SystemTime@CMNDateTime@@SA?AV1@XZ
?ToString@CMNDateTime@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@D@Z
?Create@CMNURIBuilder@@SA?AV?$shared_ptr@VCMNURIBuilder@@@std@@XZ
?ToString@CMNGuid@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_N@Z

storage

?Create@STStreamReader@@SA?AV?$shared_ptr@VSTStreamReader@@@std@@V?$shared_ptr@VSTReadableStream@@@3@@Z
?LocalFileSystemScheme@STStorageModule@@SAPEBDXZ
?ModuleTypeName@STStorageModule@@SA?BV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?ModuleGetRegistrar@STStorageModule@@SAPEAVModuleRegistrar@@XZ

bimxpackage

?ModuleGetRegistrar@BPBIMxPackageModule@@SAPEAVModuleRegistrar@@XZ
?ModuleTypeName@BPBIMxPackageModule@@SA?BV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ

modulebase

?Create@ModuleRegistry@@SA?AV?$shared_ptr@VModuleRegistry@@@std@@XZ

userpreferences

?ModuleGetRegistrar@UPUserPreferencesModule@@SAPEAVModuleRegistrar@@XZ
?GetDeprecatedVersionAlertStartDate@UPTestConfig@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?HasDeprecatedVersionAlertStartDate@UPTestConfig@@QEBA_NXZ
??0UPTestConfig@@QEAA@AEBV?$vector@EV?$allocator@E@std@@@std@@@Z
??1UPTestConfig@@QEAA@XZ

libcef

cef_string_map_free
cef_string_list_size
cef_string_list_value
cef_string_list_append
cef_string_map_size
cef_string_map_key
cef_string_map_value
cef_string_map_append
cef_string_multimap_size
cef_string_multimap_key
cef_string_multimap_value
cef_string_multimap_append
cef_string_multimap_alloc
cef_string_multimap_free
cef_string_list_alloc
cef_string_map_alloc
cef_string_userfree_utf16_free
cef_browser_host_create_browser
cef_api_hash
cef_log
cef_parse_url
cef_quit_message_loop
cef_run_message_loop
cef_shutdown
cef_initialize
cef_execute_process
cef_string_utf16_clear
cef_string_utf8_to_utf16
cef_string_utf16_to_utf8
cef_string_utf8_clear
cef_post_task
cef_currently_on
cef_string_list_free
cef_string_utf16_cmp
cef_string_utf16_set

shlwapi

UrlUnescapeA
PathFindFileNameW

dwmapi

DwmGetWindowAttribute

api-ms-win-core-path-l1-1-0

PathCchCanonicalizeEx

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

kernel32

AreFileApisANSI
CloseHandle
InterlockedPushEntrySList
FreeLibrary
HeapAlloc
LoadLibraryW
HeapFree
GetProcessHeap
GetSystemTimeAsFileTime
GetCommandLineW
LocalFree
GetModuleFileNameW
FormatMessageW
GetLastError
GetUserPreferredUILanguages
GetNativeSystemInfo
VerSetConditionMask
GlobalMemoryStatusEx
VerifyVersionInfoW
GetModuleFileNameA
SetLastError
FormatMessageA
GetFileInformationByHandleEx
MultiByteToWideChar
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
GetProcAddress
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetFileAttributesExW
CreateFileW
GetCurrentDirectoryW
InitializeSListHead

user32

GetWindowLongW
DefWindowProcW
ModifyMenuW
LoadMenuW
CallWindowProcW
MonitorFromWindow
GetWindowRect
SendMessageW
EndDialog
SetWindowTextW
GetWindowLongPtrW
SetWindowPos
GetSubMenu
DestroyIcon
GetMonitorInfoW
DestroyAcceleratorTable
SetDlgItemTextW
SendDlgItemMessageW
SetMenu
TranslateAcceleratorW
LoadIconW
SetWindowLongW
RemoveMenu
EnableMenuItem
DialogBoxParamW
EnumDisplayDevicesA
LoadStringW
SetWindowTextA
LoadAcceleratorsW
GetMenu
SetWindowLongPtrW
InsertMenuItemW

advapi32

RegEnumKeyExW
RegGetValueA
RegCloseKey
RegDeleteKeyW
RegCreateKeyExW
RegQueryValueExW
RegEnumValueW
RegDeleteValueW
RegOpenKeyExW
RegSetValueExW

shell32

CommandLineToArgvW

ole32

CoUninitialize
CoCreateInstance
CoTaskMemFree
CoInitializeEx
CoCreateFreeThreadedMarshaler

msvcp140

??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ
?_Throw_C_error@std@@YAXH@Z
?_Xlength_error@std@@YAXPEBD@Z
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_init_in_situ
_Mtx_unlock
?uncaught_exception@std@@YA_NXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Xinvalid_argument@std@@YAXPEBD@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@F@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?_Xbad_alloc@std@@YAXXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPEBDH@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memchr
__C_specific_handler
__current_exception
__current_exception_context
_CxxThrowException
memset
memmove
memcpy
_purecall
__std_exception_copy
__std_exception_destroy
__std_terminate
memcmp

api-ms-win-crt-runtime-l1-1-0

_configure_wide_argv
_initialize_wide_environment
_get_wide_winmain_command_line
_initterm
_initterm_e
exit
_exit
_c_exit
_invalid_parameter_noinfo_noreturn
_seh_filter_exe
_register_thread_local_exe_atexit_callback
terminate
_set_app_type
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_errno
_invalid_parameter_noinfo
_cexit
abort

api-ms-win-crt-string-l1-1-0

strncpy
tolower
iswspace
strcmp

api-ms-win-crt-convert-l1-1-0

strtoul
wcstol

api-ms-win-crt-stdio-l1-1-0

_get_stream_buffer_pointers
fread
setvbuf
fgetpos
fwrite
ungetc
_fseeki64
__stdio_common_vfwprintf
__p__commode
__stdio_common_vfprintf
fgetc
fclose
fflush
__acrt_iob_func
fputc
_set_fmode
fsetpos

api-ms-win-crt-filesystem-l1-1-0

_lock_file
_unlock_file

api-ms-win-crt-heap-l1-1-0

malloc
_set_new_mode
free
_callnewh

api-ms-win-crt-locale-l1-1-0

_configthreadlocale
___lc_codepage_func

api-ms-win-crt-math-l1-1-0

__setusermatherr

oleaut32

GetErrorInfo
SysStringLen
SysFreeString
SetErrorInfo
SysAllocString

Sections

.text
Size: 414KB - Virtual size: 413KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 105KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 901KB - Virtual size: 900KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 572KB - Virtual size: 576KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

5009dee6c333acde0f2e565956ef6a98

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

common

storage

bimxpackage

modulebase

userpreferences

libcef

shlwapi

dwmapi

api-ms-win-core-path-l1-1-0

version

kernel32

user32

advapi32

shell32

ole32

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

oleaut32

Sections

.text Size: 414KB - Virtual size: 413KB

.rdata Size: 105KB - Virtual size: 104KB

.data Size: 21KB - Virtual size: 23KB

.pdata Size: 22KB - Virtual size: 21KB

.rsrc Size: 901KB - Virtual size: 900KB

.reloc Size: 572KB - Virtual size: 576KB

.text
Size: 414KB - Virtual size: 413KB

.rdata
Size: 105KB - Virtual size: 104KB

.data
Size: 21KB - Virtual size: 23KB

.pdata
Size: 22KB - Virtual size: 21KB

.rsrc
Size: 901KB - Virtual size: 900KB

.reloc
Size: 572KB - Virtual size: 576KB