703a0ab28f80302a070ce941b77f2dc2d00d14d13bead3484c29ace26566e9c6

Sharing

Copy URL Twitter E-mail

General

Target

703a0ab28f80302a070ce941b77f2dc2d00d14d13bead3484c29ace26566e9c6
Size

492KB
MD5

ab14f8e81590bdc88382053d5f130cac
SHA1

553726c4a7f4e06127ae043fb470a73520acbd85
SHA256

703a0ab28f80302a070ce941b77f2dc2d00d14d13bead3484c29ace26566e9c6
SHA512

32e02edac34e11953e5481e97d4f6cc3dadc7fc88fcab34f55f4c95f99cd2e6660740f44dabcc5680f95955dc3f8fc0fbb747c34bb4309fd913ef72b91cd560f
SSDEEP

3072:dvMuU5k/nt44DdSMCdJ1miUXJBETjVRhpxvoVq1ytM4AgpHfB/S6dLaoht:dE4t44UVdJ1TUZBoNoVpXo+T

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
703a0ab28f80302a070ce941b77f2dc2d00d14d13bead3484c29ace26566e9c6

Files

703a0ab28f80302a070ce941b77f2dc2d00d14d13bead3484c29ace26566e9c6
.dll windows:4 windows x86 arch:x86

63f6cf272002c48983422de19d1bef44

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

c_util

?GetFailedFlag@CParameterBlock@@QAEHXZ
?SetFailedFlag@CParameterBlock@@QAEXH@Z
?SetString@CParameterBlock@@QAEXHPBD@Z
?GetDouble@CParameterBlock@@QAENH@Z
?GetString@CParameterBlock@@QAEXHQAD@Z
?SetDouble@CParameterBlock@@QAEXHN@Z
?GetParameter@CStrExtract@@QAEHIAAVCString@@@Z
??0CStrExtract@@QAE@XZ
?ExtractString@CStrExtract@@QAEXPBD0@Z
?GetParameter@CStrExtract@@QAEHIAAH@Z
?RemoveAll@CStrExtract@@QAEXXZ
??0CStrExtract@@QAE@PBD0@Z
?GetParameter@CStrExtract@@QAEHIAAI@Z
?GetNoOfParameters@CStrExtract@@QAEIXZ
?GetParameter@CStrExtract@@QAEHIAAG@Z
??1CStrExtract@@UAE@XZ
?TimeSinceStart@@YANAAU_timeb@@@Z
?StartElapsedTime@@YAXAAU_timeb@@@Z
?Show@@YAXPADZZ

c_dlg

GetConfirmation
CentreWindowAbsolute
MAGMAHIntEdit

c_file

?GetLimit@CLimitSet@@QAEPAVCLimitInfo@@PAU__POSITION@@@Z
?GetValue1@CLimitInfo@@QAENXZ
?GetValue2@CLimitInfo@@QAENXZ
?GetType@CLimitInfo@@QAE?AW4LMTTYPE@@XZ
?GetName@CLimitSet@@QAE?AVC_CString@@XZ
?SetValue1@CLimitInfo@@QAEXN@Z
?SetValue2@CLimitInfo@@QAEXN@Z
?FindLimit@CLimitSet@@QAEPAU__POSITION@@VC_CString@@@Z
?SetLimit@CLimitSet@@QAEHPAU__POSITION@@VCLimitInfo@@@Z
?Load@CWindowSet@@QAEHVC_CString@@@Z
?GetStationErrorInfo@@YAXHAAUStationErrInfo@@@Z
?EnumSystemErrors@@YAXP6GXH@ZHH@Z
?InhibitNextNewline@C_CLog@@QAEXXZ
?GetErrorOptions@C_CError@@QAEHPAH@Z
?SetUserAction@C_CError@@QAEXW4ButtonActions@@@Z
??1CWindowSet@@UAE@XZ
?Load@CLimitSet@@QAEHVC_CString@@@Z
?GetErrorNumber@C_CError@@QAEHXZ
??0CLimitInfo@@QAE@AAV0@@Z
?Open@C_CFile@@UAEHPBDI@Z
?SysData@@3USYSDATA@@A
?Display@C_CError@@QAEXPAUHWND__@@H@Z
??1C_CSysAcc@@QAE@XZ
?GetCurrentUser@C_CSysAcc@@QAEHPBDPAH@Z
??0C_CSysAcc@@QAE@XZ
?AccessAllowed@@YAHW4m_eUserAccessFlags@C_CSysAcc@@@Z
??1C_CPrinterParams@@QAE@XZ
??1C_CSpool@@QAE@XZ
?Close@C_CSpool@@QAEXXZ
?SetNormalFont@C_CSpool@@QAEXXZ
?Append@C_CSpool@@QAEXPBDH@Z
?SetBoldFont@C_CSpool@@QAEXH@Z
?LineFeed@C_CSpool@@QAEXH@Z
??0C_CSpool@@QAE@AAVC_CPrinterParams@@PBDHHH@Z
??0C_CPrinterParams@@QAE@XZ
??1C_CError@@QAE@XZ
?Initialise@C_CError@@QAEXH@Z
??9C_CError@@QAEHH@Z
??0C_CError@@QAE@HH@Z
?LogMAGMAHEvent@@YAXW4eEventTypes@@ZZ
?SetValues@C_CError@@QAEXNN@Z
?SetErrorNumber@C_CError@@QAEXH@Z
?SetFile@C_CError@@QAEXPBD@Z
?SetFunction@C_CError@@QAEXPBD@Z
??1C_FieldObjects@@QAE@XZ
??0C_FieldObjects@@QAE@XZ
?SetFieldValue@C_FieldObjects@@QAEHPBXW4DOFieldType@@HAAVC_CError@@I@Z
?GetFieldValue@C_FieldObjects@@QAEHPAXW4DOFieldType@@HAAVC_CError@@I@Z
?AttachField@C_FieldObjects@@QAEHPBDI0AAVC_CError@@@Z
??1C_CFile@@UAE@XZ
?Close@C_CFile@@UAEXXZ
?WriteString@C_CFile@@UAEXPBX@Z
??0C_CFile@@QAE@AAVC_CError@@K@Z
?SetCharSize@C_CSpool@@QAEXH@Z
?SetLandscapeMode@C_CSpool@@QAEXH@Z
?LogEvent@@YAXPBDH@Z
??0CMemDataExchange@@QAE@XZ
??1CMemDataExchange@@UAE@XZ
?DestroyDataExchange@CMemDataExchange@@QAEXXZ
?CreateDataExchange@CMemDataExchange@@QAEHVCString@@AAPAXI@Z
?MAGMAHWindows@@3UMAGMAH_WINDOWS@@A
?ClearDataExchange@CMemDataExchange@@QAEXXZ
?SetTask@C_CError@@QAEXPBD@Z
??0C_DataObjects@@QAE@AAVC_CError@@@Z
??1C_DataObjects@@QAE@XZ
?GetFieldInfo@C_FieldObjects@@QAEHAAW4DOFieldType@@PADAAI2AAVC_CError@@@Z
?GetFieldNames@C_DataObjects@@QAEHPBDIPADH@Z
?GetObjectInfo@C_DataObjects@@QAEHPBDAAI11PAD2AAH@Z
?ReadDataObjectConfiguration@C_DataObjects@@QAEHH@Z
?SetItem@C_CError@@QAEXPBD@Z
?WaitForNoError@C_CError@@QAEXXZ
??8C_CError@@QAEHH@Z
?IsEOF@C_CFile@@UAEHXZ
?IsFileEncrypted@C_CFile@@QAEHXZ
??0CCryptoFile@@QAE@AAVC_CError@@@Z
??1C_CLog@@QAE@XZ
?Append@C_CLog@@QAAXPBDZZ
??0C_CLog@@QAE@PBDAAVC_CError@@HHH@Z
??1C_CCfg@@QAE@XZ
?DoEOFCheck@C_CCfg@@QAEXH@Z
?GetString@C_CCfg@@QAEXPADH@Z
??0C_CCfg@@QAE@HPBDAAVC_CError@@@Z
?GetInt@C_CCfg@@QAEHXZ
?SetLockMode@C_CFile@@QAEXHKI@Z
??0CLimitSet@@QAE@XZ
??1CLimitSet@@UAE@XZ
??0CWindowSet@@QAE@XZ

mfc42

ord5277
ord2982
ord3147
ord2124
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
ord4627
ord4425
ord3597
ord800
ord641
ord860
ord540
ord324
ord825
ord2370
ord2291
ord2367
ord4234
ord5981
ord2864
ord6197
ord6380
ord6334
ord6215
ord2642
ord3092
ord5953
ord858
ord2820
ord3811
ord2652
ord1669
ord939
ord535
ord924
ord4278
ord537
ord501
ord1200
ord941
ord2818
ord2614
ord823
ord6378
ord3499
ord2515
ord355
ord1168
ord5856
ord342
ord1182
ord3663
ord2841
ord2448
ord2107
ord5450
ord5440
ord6383
ord6394
ord2044
ord5834
ord4129
ord5683
ord940
ord4160
ord773
ord5621
ord1083
ord922
ord5600
ord2776
ord4277
ord6222
ord668
ord1980
ord3310
ord2781
ord2770
ord356
ord3185
ord3181
ord4058
ord2289
ord2290
ord2360
ord2366
ord2301
ord1199
ord6874
ord6283
ord6282
ord4710
ord3584
ord543
ord803
ord4204
ord2763
ord6307
ord4167
ord521
ord3337
ord5710
ord2764
ord5572
ord2919
ord859
ord6223
ord536
ord2446
ord5261
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord5280
ord4353
ord6374
ord5163
ord2385
ord5241
ord4407
ord1775
ord4078
ord6052
ord2514
ord4998
ord4853
ord4376
ord5265
ord3259

msvcrt

_CItanh
div
tolower
_makepath
_splitpath
vsprintf
isdigit
_except_handler3
__dllonexit
_onexit
?terminate@@YAXXZ
free
_initterm
malloc
_adjust_fdiv
_CIsinh
floor
_CIcosh
ceil
_CIasin
_CIacos
_stricmp
fgets
_strdate
_strtime
remove
rename
fopen
fprintf
fclose
_CIpow
sscanf
toupper
isspace
strchr
_mbsicmp
_mbscmp
strncpy
_ftol
atof
sprintf
__CxxFrameHandler
_access

kernel32

UnmapViewOfFile
MapViewOfFile
GetLastError
CreateFileMappingA
OpenFileMappingA
ReleaseMutex
WaitForSingleObject
CreateMutexA
CreateProcessA
ReadFile
GetFileSize
CreateFileA
OpenFile
Sleep
DeleteFileA
RemoveDirectoryA
CreateDirectoryA
SystemTimeToFileTime
GetSystemTime
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
FindClose
FindFirstFileA
CloseHandle

user32

SetForegroundWindow
GetForegroundWindow
EnableWindow
GetActiveWindow
PostMessageA
WaitForInputIdle
FindWindowA
SendMessageA
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExA
DdeInitializeA
DdeUninitialize
DdeDisconnect
DdeFreeStringHandle
DdeGetLastError
DdeClientTransaction
DdeConnect
DdeCreateStringHandleA
ShowWindow
SetActiveWindow

Exports

Exports

??0CIo@@QAE@XZ
??0CPulsedOutputs@@QAE@XZ
??0C_CSPC@@QAE@AAVC_CError@@@Z
??0C_CSPCData@@QAE@AAVC_CError@@@Z
??0C_CSPCGroup@@QAE@AAVC_CError@@@Z
??0C_CSPCMachineData@@QAE@AAVC_CError@@@Z
??0C_CSPCMachineGroup@@QAE@AAVC_CError@@@Z
??0C_CSPCParameter@@QAE@XZ
??0C_CSPCStationData@@QAE@ABIAAVC_CError@@@Z
??0C_CSPCStationGroup@@QAE@ABIAAVC_CError@@@Z
??0C_CSPCSystemData@@QAE@AAVC_CError@@@Z
??0C_CSPCSystemGroup@@QAE@AAVC_CError@@@Z
??0C_CSPCVariantCfg@@QAE@AAVC_CError@@@Z
??0C_CycleTime@@QAE@AAV0@@Z
??0C_CycleTime@@QAE@XZ
??0C_CycleTimes@@QAE@AAVC_CError@@@Z
??0C_EventTimes@@QAE@XZ
??1CPulsedOutputs@@QAE@XZ
??1C_CSPC@@UAE@XZ
??1C_CSPCData@@UAE@XZ
??1C_CSPCGroup@@UAE@XZ
??1C_CSPCParameter@@UAE@XZ
??1C_CSPCVariantCfg@@UAE@XZ
??1C_CycleTime@@UAE@XZ
??1C_CycleTimes@@UAE@XZ
??1C_EventTimes@@UAE@XZ
??4CIo@@QAEAAV0@ABV0@@Z
??4C_CycleTime@@QAEAAV0@AAV0@@Z
??_7C_CycleTime@@6B@
??_7C_CycleTimes@@6B@
??_7C_EventTimes@@6B@
?Add@C_CSPCData@@QAE_NABUSPCData@@ABUSPCVariantConfig@@@Z
?Add@C_CSPCGroup@@QAE_NM@Z
?Add@C_CycleTime@@QAEXN@Z
?Add@C_EventTimes@@QAE_NPBD@Z
?AnalogueState@CIo@@QAENW4ANALOGUEOPTIONS@@PAUDictionaryRecordType@@NAAVC_CError@@H@Z
?AnalogueStatus@CIo@@QAEPAUIoStatusType@@HPAUDictionaryRecordType@@AAVC_CError@@@Z
?Attach@C_CSPCParameter@@QAE_NPBDAAIAAVC_CError@@@Z
?Attach@C_CycleTimes@@QAE_NII@Z
?C2PtEditDialog@@YAHHPBDHNNNNNNH@Z
?Calculate@C_CSPCGroup@@QAE_NAAUSPCData@@@Z
?Calculate@C_CycleTime@@AAE_NXZ
?CheckAnalogueInterlocksOK@@YAHHPAUDictionaryRecordType@@NAAVC_CError@@@Z
?CleanRunField@@YAHHHAAVC_CError@@@Z
?Clear@C_CycleTime@@AAEXXZ
?Clear@C_CycleTimes@@AAEXXZ
?Close@C_CSPCData@@QAEXXZ
?Close@C_CSPCGroup@@QAEXXZ
?Close@C_CSPCVariantCfg@@QAEXXZ
?Configure@CPulsedOutputs@@QAE_NPBDI@Z
?Copy@C_CycleTime@@AAEXAAV1@@Z
?Create@C_CSPCVariantCfg@@QAE_NXZ
?DeleteAll@C_EventTimes@@QAEXXZ
?DeleteDirectory@C_CSPC@@QAE_NPBD@Z
?DeleteVariable@C_CSPC@@QAE_NPBD0@Z
?DeleteVariant@C_CSPC@@QAE_NPBD@Z
?DigitalState@CIo@@QAEHHW4DIGITALOPTIONS@@PAUDigitalRecordType@@AAVC_CError@@H@Z
?DigitalStatus@CIo@@QAEPAUIoStatusType@@HPAUDigitalRecordType@@AAVC_CError@@@Z
?Edit@C_CSPCVariantCfg@@QAE_NXZ
?End@C_CycleTimes@@QAEXXZ
?End@C_EventTimes@@QAE_NXZ
?ErrorNoUserFunction@@YAXFH@Z
?Event@C_CycleTimes@@QAE_NPBD@Z
?FindEvent@C_EventTimes@@AAEPAU__POSITION@@PBD@Z
?GetAnalogueComment@@YAPADPAUDictionaryRecordType@@@Z
?GetAnalogueIoState@CIo@@AAENPAUDictionaryRecordType@@@Z
?GetAnalogueName@@YAPADPAUDictionaryRecordType@@@Z
?GetAnalogueOffset@@YAHHPBDAAHAAVC_CError@@@Z
?GetAnalogueRecord@@YAHHHPAPAUDictionaryRecordType@@AAVC_CError@@@Z
?GetAnalogueRecord@@YAHHPBDPAPAUDictionaryRecordType@@AAVC_CError@@@Z
?GetAnalogueValue@@YANW4AnalogueConversionOptions@@PAUDictionaryRecordType@@AAVC_CError@@@Z
?GetAt@C_EventTimes@@QAEPAVC_CycleTime@@I@Z
?GetAverage@C_CycleTime@@QAENXZ
?GetCalcStats@C_CSPCData@@QAE_NAAUSPCCalc@@@Z
?GetCount@C_CSPCData@@QAEGXZ
?GetCount@C_CSPCGroup@@QAEEXZ
?GetCount@C_CycleTime@@QAEIXZ
?GetCount@C_EventTimes@@QAEIXZ
?GetCycleData@C_CycleTimes@@QAE_NPBDAAVC_CycleTime@@@Z
?GetDescription@C_CycleTime@@QAEPADXZ
?GetDigitalComment@@YAPADPAUDigitalRecordType@@@Z
?GetDigitalIoState@CIo@@AAEHPAUDigitalRecordType@@@Z
?GetDigitalLatchState@CIo@@AAEHPAUDigitalRecordType@@@Z
?GetDigitalName@@YAPADPAUDigitalRecordType@@@Z
?GetDigitalOffset@@YAHHPBDAAHAAVC_CError@@@Z
?GetDigitalPulseState@CIo@@QAEHPAUDigitalRecordType@@@Z
?GetDigitalRecord@@YAHHHPAPAUDigitalRecordType@@AAVC_CError@@@Z
?GetDigitalRecord@@YAHHPBDPAPAUDigitalRecordType@@AAVC_CError@@@Z
?GetFailcodeComment@@YAPADPAUFailcodeRecordType@@@Z
?GetFailcodeIdentity@@YAXPAD0AAJ@Z
?GetFailcodeName@@YAPADPAUFailcodeRecordType@@@Z
?GetFailcodeName@@YAXJPAD@Z
?GetFailcodeOffset@@YAHPBDAAHAAVC_CError@@@Z
?GetFailcodeRecord@@YAHHPAPAUFailcodeRecordType@@AAVC_CError@@@Z
?GetFailcodeRecord@@YAHPBDPAPAUFailcodeRecordType@@AAVC_CError@@@Z
?GetFailcodeString@@YAPADPAUFailcodeRecordType@@@Z
?GetFailcodeString@@YAXJPAD@Z
?GetLine@C_CycleTime@@QAE?AVCString@@H@Z
?GetMax@C_CycleTime@@QAENXZ
?GetMin@C_CycleTime@@QAENXZ
?GetName@C_CSPCVariantCfg@@QAE?AVCString@@XZ
?GetNumberOfAnalogues@@YAHH@Z
?GetNumberOfDigitals@@YAHH@Z
?GetNumberOfFailcodes@@YAHXZ
?GetNumberOfRestypes@@YAHXZ
?GetNumberOfVariables@@YAHXZ
?GetRestypeComment@@YAPADPAURestypeRecordType@@@Z
?GetRestypeName@@YAPADPAURestypeRecordType@@@Z
?GetRestypeOffset@@YAHPBDAAHAAVC_CError@@@Z
?GetRestypeRecord@@YAHHPAPAURestypeRecordType@@AAVC_CError@@@Z
?GetRestypeRecord@@YAHPBDPAPAURestypeRecordType@@AAVC_CError@@@Z
?GetSPCData@C_CSPCData@@QAE_NPAUSPCData@@G@Z
?GetSize@C_CSPCData@@QAEGXZ
?GetSize@C_CSPCGroup@@QAEEXZ
?GetSpread@C_CycleTime@@QAENXZ
?GetStatus@C_CSPCData@@QAEKXZ
?GetValue@C_CycleTime@@QAENH@Z
?GetVariableNumber@@YANHHFAAVC_CError@@@Z
?GetVariableString@@YAPADHHFAAVC_CError@@@Z
?GetVariablesComment@@YAPADPAUVariablesRecordType@@@Z
?GetVariablesName@@YAPADPAUVariablesRecordType@@@Z
?GetVariablesOffset@@YAHPBDAAHAAVC_CError@@@Z
?GetVariablesRecord@@YAHHPAPAUVariablesRecordType@@AAVC_CError@@@Z
?GetVariablesSetName@@YAPADH@Z
?GetVariant@C_CSPC@@QAE?AVCString@@XZ
?GetVariantConfig@C_CSPC@@QAE?AUSPCVariantConfig@@XZ
?GetVariantConfig@C_CSPCVariantCfg@@QAE?AUSPCVariantConfig@@XZ
?GroupFull@C_CSPCGroup@@QAE_NXZ
?IOCLASS@@3VCIo@@A
?IODATA@@3UIoDataType@@A
?KillKeyboard@@YAXH@Z
?KillMouse@@YAXH@Z
?LoadSystemData@@YAHXZ
?Log@C_CSPCData@@QAE_NXZ
?LookupTableEditDialog@@YAXHPBDH@Z
?MoveCycleData@C_CycleTime@@AAE_NXZ
?MoveEventData@C_EventTimes@@QAEXXZ
?Open@C_CSPCData@@UAE_NPBD0@Z
?Open@C_CSPCGroup@@UAE_NPBD0@Z
?Open@C_CSPCMachineData@@UAE_NPBD0@Z
?Open@C_CSPCMachineGroup@@UAE_NPBD0@Z
?Open@C_CSPCStationData@@UAE_NPBD0@Z
?Open@C_CSPCStationGroup@@UAE_NPBD0@Z
?Open@C_CSPCSystemData@@UAE_NPBD0@Z
?Open@C_CSPCSystemGroup@@UAE_NPBD0@Z
?Open@C_CSPCVariantCfg@@QAE_NPBD@Z
?PulseOutput@CIo@@QAEHHPAUDigitalRecordType@@EDAAVC_CError@@@Z
?PulseOutputs@CPulsedOutputs@@QAEXII@Z
?ReadInterlocks@@YAXHAAVC_CError@@@Z
?ReleaseKeyboard@@YAXXZ
?ReleaseMouse@@YAXXZ
?RequestUpdate@C_CycleTimes@@QAEXH@Z
?Reset@C_CSPCData@@QAEXXZ
?Reset@C_CSPCGroup@@QAEXXZ
?Reset@C_CSPCVariantCfg@@QAEXXZ
?Reset@C_CycleTimes@@QAEXXZ
?ResetStatus@C_CSPCData@@QAEXXZ
?ResetVariable@C_CSPC@@QAE_NPBD0@Z
?ResetVariant@C_CSPC@@QAE_NPBD@Z
?RunData@@3PAY0BE@URUNSCREEN_DATA@@A
?RunFieldRange@@YAHHHAAVC_CError@@@Z
?SetAnalogueIoState@CIo@@AAEXPAUDictionaryRecordType@@NAAVC_CError@@@Z
?SetAnalogueValue@@YAHHW4AnalogueConversionOptions@@PAUDictionaryRecordType@@NAAVC_CError@@H@Z
?SetDigitalIoState@CIo@@AAEXHPAUDigitalRecordType@@HAAVC_CError@@@Z
?SetDigitalLatchState@CIo@@AAEXPAUDigitalRecordType@@H@Z
?SetSize@C_CSPCData@@QAE_NABG@Z
?SetSize@C_CSPCGroup@@QAE_NABE@Z
?SetVariableNumber@@YAHHHFNAAVC_CError@@H@Z
?SetVariableString@@YAHHHFPBDAAVC_CError@@H@Z
?SetVariant@C_CSPC@@QAE_NPBD@Z
?Start@C_CycleTimes@@QAEXXZ
?Start@C_EventTimes@@QAE_NXZ
?TestInterlockSyntax@@YAXPBDAAVC_CError@@@Z
?Update@C_CSPCParameter@@QAE_NABUSPCVariantConfig@@ABMAAK22AAVC_CError@@@Z
?UpdateLUTableCalData@@YAHHPBDHPAN1H@Z
?UpdatePulseCounts@CPulsedOutputs@@QAEXXZ
?UpdateRunFieldDouble@@YAHHHNAAVC_CError@@@Z
?UpdateRunFieldString@@YAHHHPBDAAVC_CError@@@Z
?UpdateViewData@C_CycleTimes@@QAE_NXZ
?VariantSet@C_CSPC@@QAE_NXZ
?hLslDLLInstance@@3PAUHINSTANCE__@@A
?iSystemReady@@3HA
GetDllVersion
UserFunction_1001
UserFunction_1002
UserFunction_1003
UserFunction_1004
UserFunction_1005
UserFunction_1006
UserFunction_1007
UserFunction_1008
UserFunction_1009
UserFunction_1010
UserFunction_1011
UserFunction_1012
UserFunction_1013
UserFunction_1014
UserFunction_1015
UserFunction_1016
UserFunction_1017
UserFunction_1018
UserFunction_1019
UserFunction_1020
UserFunction_1021
UserFunction_1022
UserFunction_1023
UserFunction_1024
UserFunction_1025
UserFunction_1026
UserFunction_1027
UserFunction_1028
UserFunction_1029
UserFunction_1030
UserFunction_1031
UserFunction_1032
UserFunction_1033
UserFunction_1034
UserFunction_1035
UserFunction_1036
UserFunction_1037
UserFunction_1038
UserFunction_1039
UserFunction_1040
UserFunction_1041
UserFunction_1042
UserFunction_1043
UserFunction_1044
UserFunction_1045
UserFunction_1046
UserFunction_1047
UserFunction_1048
UserFunction_1049
UserFunction_1050
UserFunction_1051
UserFunction_1052
UserFunction_1053
UserFunction_1054
UserFunction_1055
UserFunction_1056
UserFunction_1057
UserFunction_1058
UserFunction_1059
UserFunction_1060
UserFunction_1061
UserFunction_1062
UserFunction_1063
UserFunction_1064
UserFunction_1065
UserFunction_1066
UserFunction_1067
UserFunction_1068
UserFunction_1069
UserFunction_1070
UserFunction_1071
UserFunction_1072
UserFunction_1073
UserFunction_1074
UserFunction_1075
UserFunction_1076
UserFunction_1077
UserFunction_1078
UserFunction_1079
UserFunction_1080
UserFunction_1081
UserFunction_1082
UserFunction_1083
UserFunction_1084
UserFunction_1085
UserFunction_1086
UserFunction_1087
UserFunction_1088
UserFunction_1089
UserFunction_1090
UserFunction_1091
UserFunction_1092
UserFunction_1093
UserFunction_1094
UserFunction_1095
UserFunction_1096
UserFunction_1097
UserFunction_1098
UserFunction_1099
UserFunction_1100

Sections

.text
Size: 136KB - Virtual size: 132KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

SHARESEC
Size: 4KB - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

IODATA
Size: 104KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

RUNDATA
Size: 56KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

VARSDATA
Size: 128KB - Virtual size: 125KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

63f6cf272002c48983422de19d1bef44

Headers

File Characteristics

Imports

c_util

c_dlg

c_file

mfc42

msvcrt

kernel32

user32

Exports

Exports

Sections

.text Size: 136KB - Virtual size: 132KB

.rdata Size: 32KB - Virtual size: 30KB

.data Size: 12KB - Virtual size: 16KB

SHARESEC Size: 4KB - Virtual size: 24B

.tls Size: 4KB - Virtual size: 12B

IODATA Size: 104KB - Virtual size: 100KB

RUNDATA Size: 56KB - Virtual size: 54KB

VARSDATA Size: 128KB - Virtual size: 125KB

.reloc Size: 12KB - Virtual size: 11KB

.text
Size: 136KB - Virtual size: 132KB

.rdata
Size: 32KB - Virtual size: 30KB

.data
Size: 12KB - Virtual size: 16KB

SHARESEC
Size: 4KB - Virtual size: 24B

.tls
Size: 4KB - Virtual size: 12B

IODATA
Size: 104KB - Virtual size: 100KB

RUNDATA
Size: 56KB - Virtual size: 54KB

VARSDATA
Size: 128KB - Virtual size: 125KB

.reloc
Size: 12KB - Virtual size: 11KB