309be6b109d0598194d5d3b6f3f518f6119edf4737ad26e3bfa330f105f95a69

Sharing

Copy URL

Twitter E-mail

General

Target

309be6b109d0598194d5d3b6f3f518f6119edf4737ad26e3bfa330f105f95a69
Size

372KB
MD5

bec8c1b10da7d7de14cae9d8f090ed45
SHA1

59e0cc570096058d32f774bdd884f287b03c6fe7
SHA256

309be6b109d0598194d5d3b6f3f518f6119edf4737ad26e3bfa330f105f95a69
SHA512

9fe553b6bc197b3e60ac4751c7bb4feafe8f728e74747caf95b211c2c41949eaf67cd32c3e8e19967dbb9af8560971830254e0d646331a28d9e5c5f35b20db0f
SSDEEP

6144:GbC53ut7z7+gQ6OsZBhz6sNpncjWD552rS3rDGLUXzZKCc:mE6X7+gfBFNpncaDe0rtK3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
309be6b109d0598194d5d3b6f3f518f6119edf4737ad26e3bfa330f105f95a69

Files

309be6b109d0598194d5d3b6f3f518f6119edf4737ad26e3bfa330f105f95a69
.dll windows:6 windows x64 arch:x64

0b248a595fcf9341fbe72197dfef8603

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mfc140u

ord12746
ord1086
ord8063
ord8501
ord5044
ord12700
ord13753
ord13757
ord12697
ord13742
ord8572
ord13745
ord13345
ord13679
ord12963
ord12763
ord12762
ord12771
ord12546
ord12631
ord438
ord12259
ord12239
ord13419
ord12936
ord2473
ord4721
ord6282
ord6247
ord357
ord6250
ord886
ord6549
ord3756
ord2475
ord4722
ord6320
ord2336
ord2234
ord473
ord2270
ord2187
ord8449
ord8507
ord3599
ord4696
ord3143
ord1164
ord12280
ord7759
ord2983
ord13891
ord3728
ord4726
ord261
ord2212
ord1637
ord8206
ord543
ord13513
ord11944
ord11940
ord1700
ord1722
ord1748
ord1734
ord1755
ord4776
ord4843
ord4788
ord4806
ord4800
ord4794
ord4853
ord4837
ord4782
ord4859
ord4814
ord4752
ord4767
ord4828
ord8900
ord5582
ord9384
ord4352
ord2967
ord14211
ord7651
ord14217
ord14128
ord6631
ord1163
ord5960
ord13199
ord11406
ord13354
ord5723
ord5240
ord2629
ord11806
ord12279
ord12375
ord1636
ord542
ord12933
ord12824
ord1332
ord12320
ord990
ord7551
ord11902
ord3713
ord2698
ord13401
ord6002
ord7394
ord6251
ord3056
ord1053
ord8817
ord281
ord12967
ord3173
ord8947
ord10691
ord6729
ord8656
ord14209
ord11625
ord3718
ord11771
ord8830
ord11415
ord11414
ord5451
ord9979
ord9975
ord9977
ord9978
ord9976
ord14360
ord7913
ord9946
ord3209
ord3212
ord6285
ord3071
ord3308
ord3307
ord446
ord3951
ord10163
ord11085
ord10704
ord8731
ord1089
ord11854
ord8901
ord2697
ord13397
ord6000
ord11813
ord7233
ord265
ord266
ord2346
ord2344
ord1641
ord280
ord1501
ord1504
ord13598
ord6505
ord1489
ord2340
ord2350
ord1631
ord4181
ord4913
ord4946
ord5674
ord12240
ord12926
ord13949
ord2921
ord285
ord286
ord14220
ord13761
ord3812
ord3278
ord3279
ord3172
ord11850
ord5080
ord5363
ord5552
ord9041
ord5339
ord5083
ord5229
ord5062
ord7460
ord7461
ord7450
ord5227
ord7922
ord6619
ord12761
ord1440
ord2006
ord973
ord3078
ord10427
ord9392
ord8441
ord4086
ord13999
ord2479
ord3803
ord6361
ord1452
ord985
ord3697
ord1503
ord1033
ord5573
ord1352
ord9681
ord12566
ord12207
ord841
ord7227
ord9941
ord6256
ord1408
ord3839
ord939
ord5043
ord4648
ord13030
ord3936
ord2561
ord830
ord7869
ord5452
ord2488
ord12233
ord829
ord2273
ord5987
ord492
ord2260
ord6866
ord2311
ord1454
ord11322
ord11081
ord9159
ord6634
ord13568
ord4303
ord6636
ord13864
ord12706
ord2786
ord8471
ord7182
ord4357
ord2514
ord1369
ord878
ord8575
ord2351
ord2223
ord5961
ord8205
ord7765
ord12930
ord13595
ord811
ord6504
ord290
ord14027
ord2909
ord7893
ord8451
ord12326
ord1428
ord12932
ord13597
ord962
ord1443
ord12934
ord975
ord14278
ord12087
ord14225
ord12030
ord4656
ord8058
ord12600
ord8452
ord14033
ord14039
ord8409
ord4511
ord4510
ord5680
ord14231
ord12036
ord1172
ord556
ord8161
ord4585
ord14075
ord8182
ord4954
ord7928
ord7872
ord3484
ord320
ord2357
ord7068
ord6313
ord1670
ord1111
ord6303
ord8819
ord1057
ord3746
ord2906
ord8439
ord4081
ord5672
ord3058
ord6258
ord13767
ord5237
ord13955
ord6724
ord2222
ord5742
ord4725
ord1149
ord3089
ord528
ord1055
ord361
ord4030
ord4360
ord4499
ord296
ord1491
ord12443
ord2903
ord5709

kernel32

LocalFree
WideCharToMultiByte
OutputDebugStringW
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
LeaveCriticalSection
EnterCriticalSection
CloseHandle
MultiByteToWideChar
GetTickCount
MulDiv
GlobalLock
GlobalUnlock
GlobalSize
GetProcAddress
GetModuleHandleW
GetVersionExW
lstrcpyW
GlobalFree
GlobalReAlloc
GlobalAlloc
FindResourceW
LockResource
LoadResource
FreeResource
lstrlenW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError

user32

WindowFromPoint
ClientToScreen
IsWindowVisible
GetDoubleClickTime
EnableMenuItem
LoadMenuW
IntersectRect
InvertRect
ClipCursor
GetCursorPos
SetActiveWindow
KillTimer
SetTimer
GetFocus
IsClipboardFormatAvailable
GetClassInfoW
DefWindowProcW
RegisterWindowMessageW
SetRect
DrawEdge
ReleaseDC
GetDC
LoadCursorW
ScreenToClient
GetMessagePos
GetKeyState
IsWindow
PostMessageW
DispatchMessageW
TranslateMessage
IsRectEmpty
GetSystemMetrics
DrawFrameControl
SystemParametersInfoW
LoadBitmapW
GetTabbedTextExtentW
GetMenuItemInfoW
ModifyMenuW
GetMenuItemCount
GetMenuItemID
GetSubMenu
GetMenuState
LoadImageW
DestroyCursor
GetParent
GetWindowLongW
PtInRect
OffsetRect
InflateRect
CopyRect
FrameRect
FillRect
DrawFocusRect
GetSysColor
SetCursor
GetClientRect
RedrawWindow
InvalidateRect
TabbedTextOutW
DrawStateW
GrayStringW
DrawTextExW
DrawTextW
ReleaseCapture
SetCapture
GetCapture
GetActiveWindow
LoadStringW
LoadIconW
MessageBeep
GetWindowRect
SendMessageW
EnableWindow

gdi32

CreateCompatibleDC
CreateCompatibleBitmap
DeleteObject
BitBlt
PatBlt
GetObjectW
CreatePen
CreateFontW
GetTextMetricsW
GetDeviceCaps
GetCurrentObject
GetTextExtentPoint32W
CreateFontIndirectW
ExtTextOutW
TextOutW
SelectObject
RectVisible
PtVisible
Escape

advapi32

RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegCloseKey

comctl32

ImageList_GetImageInfo
ord8
ImageList_GetIcon
ImageList_AddMasked
ImageList_SetBkColor
ImageList_Draw

oleaut32

SystemTimeToVariantTime
VariantTimeToSystemTime
VarUdateFromDate
SysAllocString
SysFreeString

acdb22

?height@AcDbText@@QEBANXZ
?setRotation@AcDbText@@QEAA?AW4ErrorStatus@Acad@@N@Z
?rotation@AcDbText@@QEBANXZ
?setNormal@AcDbText@@QEAA?AW4ErrorStatus@Acad@@AEBVAcGeVector3d@@@Z
?normal@AcDbText@@QEBA?AVAcGeVector3d@@XZ
?setAlignmentPoint@AcDbText@@QEAA?AW4ErrorStatus@Acad@@AEBVAcGePoint3d@@@Z
?alignmentPoint@AcDbText@@QEBA?AVAcGePoint3d@@XZ
?setPosition@AcDbText@@QEAA?AW4ErrorStatus@Acad@@AEBVAcGePoint3d@@@Z
?position@AcDbText@@QEBA?AVAcGePoint3d@@XZ
?step@AcDbBlockTableRecordIterator@@QEAAX_N0@Z
?getEntity@AcDbBlockTableRecordIterator@@QEBA?AW4ErrorStatus@Acad@@AEAPEAVAcDbEntity@@W4OpenMode@AcDb@@_N@Z
?done@AcDbBlockTableRecordIterator@@QEBA_NXZ
?start@AcDbBlockTableRecordIterator@@QEAAX_N0@Z
?setHeight@AcDbText@@QEAA?AW4ErrorStatus@Acad@@N@Z
?setWidthFactor@AcDbText@@QEAA?AW4ErrorStatus@Acad@@N@Z
?textString@AcDbText@@QEBAPEA_WXZ
?setTextString@AcDbText@@QEAA?AW4ErrorStatus@Acad@@PEB_W@Z
?getIdAt@AcDbSymbolTable@@QEBA?AW4ErrorStatus@Acad@@PEB_WAEAVAcDbObjectId@@_N@Z
?setTextStyle@AcDbText@@QEAA?AW4ErrorStatus@Acad@@VAcDbObjectId@@@Z
?horizontalMode@AcDbText@@QEBA?AW4TextHorzMode@AcDb@@XZ
?setHorizontalMode@AcDbText@@QEAA?AW4ErrorStatus@Acad@@W4TextHorzMode@AcDb@@@Z
??0AcDbAttributeDefinition@@QEAA@XZ
?desc@AcDbAttributeDefinition@@SAPEAVAcRxClass@@XZ
?tag@AcDbAttributeDefinition@@QEBAPEA_WXZ
?setTag@AcDbAttributeDefinition@@QEAA?AW4ErrorStatus@Acad@@PEB_W@Z
?isInvisible@AcDbAttributeDefinition@@QEBA_NXZ
?setInvisible@AcDbAttributeDefinition@@QEAA?AW4ErrorStatus@Acad@@_N@Z
?isConstant@AcDbAttributeDefinition@@QEBA_NXZ
??0AcDbAttribute@@QEAA@XZ
?desc@AcDbAttribute@@SAPEAVAcRxClass@@XZ
?tag@AcDbAttribute@@QEBAPEA_WXZ
?setTag@AcDbAttribute@@QEAA?AW4ErrorStatus@Acad@@PEB_W@Z
?setInvisible@AcDbAttribute@@QEAA?AW4ErrorStatus@Acad@@_N@Z
??0AcDbBlockReference@@QEAA@XZ
?desc@AcDbBlockReference@@SAPEAVAcRxClass@@XZ
?blockTableRecord@AcDbBlockReference@@QEBA?AVAcDbObjectId@@XZ
?scaleFactors@AcDbBlockReference@@QEBA?AVAcGeScale3d@@XZ
?rotation@AcDbBlockReference@@QEBANXZ
?appendAttribute@AcDbBlockReference@@QEAA?AW4ErrorStatus@Acad@@AEAVAcDbObjectId@@PEAVAcDbAttribute@@@Z
?attributeIterator@AcDbBlockReference@@QEBAPEAVAcDbObjectIterator@@XZ
?acdbHostApplicationServices@@YAPEAVAcDbHostApplicationServices@@XZ
?acutDelBuffer@@YAXAEAPEAX@Z
?acadErrorStatusText@@YAPEB_WW4ErrorStatus@Acad@@@Z
?desc@AcRxDynamicLinker@@SAPEAVAcRxClass@@XZ
?acutBuildList@@YAPEAUresbuf@@HZZ
?setOrigin@AcDbBlockTableRecord@@QEAA?AW4ErrorStatus@Acad@@AEBVAcGePoint3d@@@Z
?newIterator@AcDbBlockTableRecord@@QEBA?AW4ErrorStatus@Acad@@AEAPEAVAcDbBlockTableRecordIterator@@_N1@Z
?appendAcDbEntity@AcDbBlockTableRecord@@QEAA?AW4ErrorStatus@Acad@@AEAVAcDbObjectId@@PEAVAcDbEntity@@@Z
?desc@AcDbBlockTableRecord@@SAPEAVAcRxClass@@XZ
?getName@AcDbSymbolTableRecord@@QEBA?AW4ErrorStatus@Acad@@AEAPEA_W@Z
?extents@AcGiTextStyle@@UEBA?AVAcGePoint2d@@PEB_W_NH1PEAVAcGiWorldDraw@@@Z
?xScale@AcGiTextStyle@@UEBANXZ
?setTextSize@AcGiTextStyle@@UEAAXN@Z
??0AcGiTextStyle@@QEAA@PEAVAcDbDatabase@@@Z
??1AcGiTextStyle@@UEAA@XZ
??0AcDbExtents@@QEAA@XZ
?recordGraphicsModified@AcDbEntity@@QEAAX_N@Z
?transformBy@AcDbEntity@@UEAA?AW4ErrorStatus@Acad@@AEBVAcGeMatrix3d@@@Z
?getGeomExtents@AcDbEntity@@UEBA?AW4ErrorStatus@Acad@@AEAVAcDbExtents@@@Z
?setPropertiesFrom@AcDbEntity@@QEAA?AW4ErrorStatus@Acad@@PEBV1@_N@Z
?desc@AcDbEntity@@SAPEAVAcRxClass@@XZ
?handle@AcDbObjectId@@QEBA?AVAcDbHandle@@XZ
?close@AcDbObject@@QEAA?AW4ErrorStatus@Acad@@XZ
?database@AcDbObject@@QEBAPEAVAcDbDatabase@@XZ
?objectId@AcDbObject@@QEBA?AVAcDbObjectId@@XZ
?desc@AcDbObject@@SAPEAVAcRxClass@@XZ
?objectId@AcDbObjectIterator@@QEAA?AVAcDbObjectId@@XZ
?start@AcDbObjectIterator@@QEAAX_N@Z
?step@AcDbObjectIterator@@QEAAX_N0@Z
?done@AcDbObjectIterator@@QEBA_NXZ
?insert@AcDbDatabase@@QEAA?AW4ErrorStatus@Acad@@AEAVAcDbObjectId@@PEB_WPEAV1@_N@Z
?wblock@AcDbDatabase@@QEAA?AW4ErrorStatus@Acad@@AEAPEAV1@@Z
?wblock@AcDbDatabase@@QEAA?AW4ErrorStatus@Acad@@AEAPEAV1@AEBV?$AcArray@VAcDbObjectId@@V?$AcArrayMemCopyReallocator@VAcDbObjectId@@@@@@AEBVAcGePoint3d@@@Z
?saveAs@AcDbDatabase@@QEAA?AW4ErrorStatus@Acad@@PEB_W_NW4AcDbDwgVersion@AcDb@@PEBUSecurityParams@@@Z
?readDwgFile@AcDbDatabase@@QEAA?AW4ErrorStatus@Acad@@PEB_WW4OpenMode@1@_N0@Z
?getSymbolTable@AcDbDatabase@@QEAA?AW4ErrorStatus@Acad@@AEAPEAVAcDbBlockTable@@W4OpenMode@AcDb@@@Z
??1AcDbDatabase@@UEAA@XZ
??0AcDbDatabase@@QEAA@_N0@Z
?acdbOpenObject@@YA?AW4ErrorStatus@Acad@@AEAPEAVAcDbEntity@@VAcDbObjectId@@W4OpenMode@AcDb@@_N@Z
?acdbOpenObject@@YA?AW4ErrorStatus@Acad@@AEAPEAVAcDbObject@@VAcDbObjectId@@P6APEAVAcRxClass@@XZW4OpenMode@AcDb@@_N@Z
?acdbOpenObject@@YA?AW4ErrorStatus@Acad@@AEAPEAVAcDbObject@@VAcDbObjectId@@W4OpenMode@AcDb@@_NPEBVAcRxClass@@@Z
?acutRelRb@@YAHPEAUresbuf@@@Z
?acutPrintf@@YAHPEB_WZZ
?textStyle@AcDbText@@QEBA?AVAcDbObjectId@@XZ

acge22

??0AcGePoint3d@@QEAA@AEBV0@@Z
??0AcGeVector3d@@QEAA@XZ
?kOrigin@AcGePoint3d@@2V1@B
?kZAxis@AcGeVector3d@@2V1@B
?setToRotation@AcGeMatrix3d@@QEAAAEAV1@NAEBVAcGeVector3d@@AEBVAcGePoint3d@@@Z
?setToIdentity@AcGeMatrix3d@@QEAAAEAV1@XZ
??0AcGeMatrix3d@@QEAA@XZ
??0AcGeScale3d@@QEAA@AEBV0@@Z
??0AcGeScale3d@@QEAA@XZ
??0AcGePoint2d@@QEAA@XZ
?distanceTo@AcGePoint3d@@QEBANAEBV1@@Z
?asVector@AcGePoint3d@@QEBA?AVAcGeVector3d@@XZ
??0AcGeVector3d@@QEAA@AEBV0@@Z
?rotateBy@AcGePoint3d@@QEAAAEAV1@NAEBVAcGeVector3d@@AEBV1@@Z
??0AcGePoint3d@@QEAA@NNN@Z
??YAcGePoint3d@@QEAAAEAV0@AEBVAcGeVector3d@@@Z
??0AcGePoint3d@@QEAA@XZ

ac1st22

??0AcRxObject@@IEAA@XZ
?clone@AcRxObject@@UEBAPEAV1@XZ
?copyFrom@AcRxObject@@UEAA?AW4ErrorStatus@Acad@@PEBV1@@Z
?isEqualTo@AcRxObject@@UEBA_NPEBV1@@Z
?comparedTo@AcRxObject@@UEBA?AW4Ordering@AcRx@@PEBV1@@Z
?subQueryX@AcRxObject@@MEBAPEAV1@PEBVAcRxClass@@@Z
??1AcRxResourceInstance@@QEAA@XZ
acrx_abort
?isDerivedFrom@AcRxClass@@SA_NPEBV1@0@Z
acrxSysRegistry
?myParent@AcRxClass@@QEBAPEAV1@XZ
??0AcRxResourceInstance@@QEAA@PEAX@Z
?acrxBuildClassHierarchy@@YAXXZ
?deleteAcRxClass@@YAXPEAVAcRxClass@@@Z

acpal

?acHeapAlloc@@YAPEAXPEAX_K@Z
?acHeapFree@@YAXPEAX0@Z

accore

?acDocManagerPtr@@YAPEAVAcApDocManager@@XZ
?acedInvoke@@YAHPEBUresbuf@@PEAPEAU1@@Z
?documentActivated@AcApDocManagerReactor@@UEAAXPEAVAcApDocument@@@Z
?documentActivationModified@AcApDocManagerReactor@@UEAAX_N@Z
?documentToBeActivated@AcApDocManagerReactor@@UEAAXPEAVAcApDocument@@@Z
?documentBecameCurrent@AcApDocManagerReactor@@UEAAXPEAVAcApDocument@@@Z
?documentLockModeChanged@AcApDocManagerReactor@@UEAAXPEAVAcApDocument@@W4DocLockMode@AcAp@@11PEB_W@Z
?documentLockModeWillChange@AcApDocManagerReactor@@UEAAXPEAVAcApDocument@@W4DocLockMode@AcAp@@11PEB_W@Z
?documentLockModeChangeVetoed@AcApDocManagerReactor@@UEAAXPEAVAcApDocument@@PEB_W@Z
?documentCreateCanceled@AcApDocManagerReactor@@UEAAXPEAVAcApDocument@@@Z
?documentDestroyed@AcApDocManagerReactor@@UEAAXPEB_W@Z
?documentCreated@AcApDocManagerReactor@@UEAAXPEAVAcApDocument@@@Z
?documentCreateStarted@AcApDocManagerReactor@@UEAAXPEAVAcApDocument@@@Z
?isA@AcApDocManagerReactor@@UEBAPEAVAcRxClass@@XZ
?desc@AcEdCommandStack@@SAPEAVAcRxClass@@XZ
?acedGetFunCode@@YAHXZ
?acedUndef@@YAHPEB_WH@Z
?acedDefun@@YAHPEB_WH@Z
?acedRegFunc@@YAHP6AHXZH@Z
?adsw_acadMainWnd@@YAPEAUHWND__@@XZ
?documentToBeDeactivated@AcApDocManagerReactor@@UEAAXPEAVAcApDocument@@@Z

acui22

?FindContextHelpFullPath@CAcUiDialog@@MEAAHPEB_WAEAV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?AppMainWindow@CAcUiDialog@@UEAAPEAVCWnd@@XZ
?AppResourceInstance@CAcUiDialog@@UEAAPEAUHINSTANCE__@@XZ
?AppRootKey@CAcUiDialog@@UEAAPEB_WXZ
?EnableFloatingWindows@CAcUiDialog@@UEAAXH@Z
?IsMultiDocumentActivationEnabled@CAcUiDialog@@UEAAHXZ
?EnableMultiDocumentActivation@CAcUiDialog@@UEAAHH@Z
?OnDialogHelp@CAcUiDialog@@UEAAXXZ
?OnInitDialog@CAcUiDialog@@UEAAHXZ
?OnOK@CAcUiDialog@@MEAAXXZ
?OnCancel@CAcUiDialog@@MEAAXXZ
?DoDataExchange@CAcUiDialog@@MEAAXPEAVCDataExchange@@@Z
?InitAcUiDLL@@YAXXZ
?GetThisClass@CAcUiDialog@@SAPEAUCRuntimeClass@@XZ
??0CAcUiDialog@@QEAA@IPEAVCWnd@@PEAUHINSTANCE__@@@Z
??1CAcUiDialog@@UEAA@XZ
?GetThisMessageMap@CAcUiDialog@@KAPEBUAFX_MSGMAP@@XZ

adui22

?DoModal@CAdUiBaseDialog@@UEAA_JXZ
?DoAdUiMessage@CAdUiBaseDialog@@MEAA?AW4ADUI_REPLY@@W4ADUI_NOTIFY@@I_J@Z
?OnNotifyControlChange@CAdUiBaseDialog@@MEAA?AW4ADUI_REPLY@@I_J@Z
?OnNotifyControlValid@CAdUiBaseDialog@@MEAA?AW4ADUI_REPLY@@IH@Z
?OnNotifyGeneric@CAdUiBaseDialog@@MEAA?AW4ADUI_REPLY@@I_J@Z
?OnNotifyUpdateTip@CAdUiBaseDialog@@MEAA?AW4ADUI_REPLY@@PEAVCWnd@@@Z
?Create@CAdUiBaseDialog@@UEAAHPEB_WPEAVCWnd@@@Z
?Create@CAdUiBaseDialog@@UEAAHIPEAVCWnd@@@Z
?ExchangeData@CAdUiBaseDialog@@UEAAHH@Z
?PreTranslateMessage@CAdUiBaseDialog@@UEAAHPEAUtagMSG@@@Z
?PostNcDestroy@CAdUiBaseDialog@@MEAAXXZ
?PreCreateWindow@CAdUiBaseDialog@@MEAAHAEAUtagCREATESTRUCTW@@@Z
?OnInitDialogBegin@CAdUiDialog@@MEAAXXZ
?OnInitDialogFinish@CAdUiDialog@@MEAAXXZ
?DoDialogHelp@CAdUiDialog@@UEAAHXZ
?OnSize@CAdUiDialog@@IEAAXIHH@Z
?BeginEditorCommand@CAdUiBaseDialog@@IEAAXXZ
?CompleteEditorCommand@CAdUiBaseDialog@@IEAAXH@Z

th_uibase.arx

?setTransParency@@YAXPEAVCWnd@@@Z
?SdShowMsg@@YAXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@0HH@Z

th_arxbase.arx

??1TH_ARXAppXdata@@UEAA@XZ
?userSelect@TH_ARXSelectSet@@QEAA?AW4SelSetStatus@1@PEB_W0PEBUresbuf@@@Z
??1TH_ARXSelectSet@@UEAA@XZ
??0TH_ARXSelectSet@@QEAA@XZ
?setXdata@TH_ARXAppXdata@@QEAA?AW4ErrorStatus@Acad@@PEAVAcDbObject@@@Z
?getXdata@TH_ARXAppXdata@@QEAAXPEAVAcDbObject@@@Z
?setHandle@TH_ARXAppXdata@@QEAAXHAEBVAcDbHandle@@@Z
?setString@TH_ARXAppXdata@@QEAAXHPEB_W@Z
?getHandle@TH_ARXAppXdata@@QEAA_NHAEAVAcDbHandle@@_N@Z
?getString@TH_ARXAppXdata@@QEAA_NHAEAV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@_N@Z
?asArray@TH_ARXSelectSet@@QEAAXAEAV?$AcArray@VAcDbObjectId@@V?$AcArrayMemCopyReallocator@VAcDbObjectId@@@@@@@Z
??0TH_ARXAppXdata@@QEAA@PEB_WPEAVAcDbDatabase@@@Z

pccadbase.arx

?GetPccadPath@@YA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?rx_getTextStyle@@YA?AW4ErrorStatus@Acad@@AEAVAcGiTextStyle@@VAcDbObjectId@@@Z

th_calcoper

?Initialize@THCalcOperate@@QEAAHXZ
?clear@THCalcOperate@@QEAAXXZ
?getExpVarMap@THCalcOperate@@QEAAHAEAVCMapStringToString@@@Z
?setExpress@THCalcOperate@@QEAAXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
??0THCalcOperate@@QEAA@XZ
??1THCalcOperate@@UEAA@XZ
?ValidateCheck@THCalcOperate@@QEAAHXZ
?setExpName@THCalcOperate@@QEAAXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?setValMap@THCalcOperate@@QEAAXAEBVCMapStringToString@@@Z

thtabledatapickup.arx

?GetData@THTablePickUpEngine@@QEAAXAEAV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?DoPickUp@THTablePickUpEngine@@QEAA_NH@Z
??1THTablePickUpEngine@@UEAA@XZ
??0THTablePickUpEngine@@QEAA@XZ

vcruntime140

memcpy
memset
__std_terminate
_purecall
_CxxThrowException
__C_specific_handler
__vcrt_InitializeCriticalSectionEx
__std_type_info_destroy_list
__CxxFrameHandler3

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn
_errno
_initterm_e
_invalid_parameter_noinfo
_initterm
_cexit
terminate
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit

api-ms-win-crt-heap-l1-1-0

free
calloc
_recalloc

api-ms-win-crt-convert-l1-1-0

_itoa
wcstoul
_wtoi
_wtof

api-ms-win-crt-string-l1-1-0

_wcsicmp
isdigit

api-ms-win-crt-utility-l1-1-0

ldiv

api-ms-win-crt-time-l1-1-0

_localtime64_s
wcsftime
_time64

Exports

Exports

??0TH_HAttBlockData@@QEAA@VAcDbObjectId@@@Z
??0TH_HAttBlockData@@QEAA@XZ
??1TH_HAttBlockData@@QEAA@XZ
?AddMapArray@TH_HAttBlockData@@AEAAXAEAV?$CArray@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@V12@@@0H@Z
?GetBasePoint@TH_HAttBlockData@@QEBA?AVAcGePoint3d@@XZ
?GetCode@TH_HAttBlockData@@AEAA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@V23@@Z
?GetFileName@TH_HAttBlockData@@QEBA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?GetHBlockPath@TH_HAttBlockData@@QEBA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?GetKeyByCode@TH_HAttBlockData@@QEAA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@V23@@Z
?GetNormal@TH_HAttBlockData@@QEBA?AVAcGeVector3d@@XZ
?GetPosition@TH_HAttBlockData@@QEBA?AVAcGePoint3d@@XZ
?GetRotation@TH_HAttBlockData@@QEBANXZ
?GetScaleFactors@TH_HAttBlockData@@QEBA?AVAcGeScale3d@@XZ
?GetTextHeight@TH_HAttBlockData@@QEBANXZ
?GetTextStyle@TH_HAttBlockData@@QEBA?AVAcDbObjectId@@XZ
?GetValueByCode@TH_HAttBlockData@@QEAA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@V23@@Z
?HBlockDefinition@TH_HAttBlockData@@QEAAHXZ
?HBlockEditForGetAtt@TH_HAttBlockData@@QEAAHVAcDbObjectId@@@Z
?HBlockEditForSetAtt@TH_HAttBlockData@@QEAAHVAcDbObjectId@@@Z
?HBlockReference@TH_HAttBlockData@@QEAA?AVAcDbObjectId@@V2@@Z
?HBlockReference@TH_HAttBlockData@@QEAA?AVAcDbObjectId@@XZ
?InitComboMapArray@TH_HAttBlockData@@AEAAXPEAVCMapStringToPtr@@@Z
?ReturnValueByMap@TH_HAttBlockData@@AEAAXAEAV?$CTypedPtrArray@VCObArray@@PEAVCMapStringToString@@@@@Z
?SetBasePoint@TH_HAttBlockData@@QEAAXAEBVAcGePoint3d@@@Z
?SetFileName@TH_HAttBlockData@@QEAAXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?SetHBlockPath@TH_HAttBlockData@@QEAAXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?SetNormal@TH_HAttBlockData@@QEAAXAEBVAcGeVector3d@@@Z
?SetPosition@TH_HAttBlockData@@QEAAXAEBVAcGePoint3d@@@Z
?SetRotation@TH_HAttBlockData@@QEAAXN@Z
?SetScaleFactors@TH_HAttBlockData@@QEAAXAEBVAcGeScale3d@@@Z
?SetTextHeight@TH_HAttBlockData@@QEAAXN@Z
?SetTextStyle@TH_HAttBlockData@@QEAAXVAcDbObjectId@@@Z
?SetValueByCode@TH_HAttBlockData@@QEAA_NV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@0@Z
?ToAddXData@TH_HAttBlockData@@AEAAHV?$AcArray@VAcDbObjectId@@V?$AcArrayMemCopyReallocator@VAcDbObjectId@@@@@@@Z
?ToEditAttDef@TH_HAttBlockData@@AEAAHV?$AcArray@VAcDbObjectId@@V?$AcArrayMemCopyReallocator@VAcDbObjectId@@@@@@@Z
?ToFindFileName@TH_HAttBlockData@@AEAAHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@AEAVAcDbObjectId@@@Z
?ToGetBlockName@TH_HAttBlockData@@AEAA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@V23@@Z
?ToGetHBlockName@TH_HAttBlockData@@QEAA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?ToInitAttValue@TH_HAttBlockData@@AEAAHVAcDbObjectId@@@Z
?ToMakeEditMap@TH_HAttBlockData@@AEAAHVAcDbObjectId@@@Z
?ToMakeEditMapOrder@TH_HAttBlockData@@AEAAXAEAV?$CTypedPtrArray@VCObArray@@PEAVCMapStringToString@@@@@Z
?ToMakeXData@TH_HAttBlockData@@AEAAHPEAVAcDbDatabase@@AEAPEAVAcDbEntity@@J@Z
?ToRefBlock@TH_HAttBlockData@@AEAA?AVAcDbObjectId@@V2@@Z
?ToSelectSSet@TH_HAttBlockData@@AEAAHV?$AcArray@VAcDbObjectId@@V?$AcArrayMemCopyReallocator@VAcDbObjectId@@@@@@@Z
?ToSetAttAigVal@TH_HAttBlockData@@AEAA_NPEAVAcDbAttribute@@PEAVAcDbAttributeDefinition@@PEAVAcDbBlockReference@@@Z
?ToSetAttNumVal@TH_HAttBlockData@@AEAAXPEAVAcDbAttribute@@PEAVAcDbAttributeDefinition@@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?ToShowAttRef@TH_HAttBlockData@@AEAAHVAcDbObjectId@@@Z
?UpdateEdValueByMap@TH_HAttBlockData@@QEAAXAEBVCMapStringToString@@@Z
?UpdateValueByMap@TH_HAttBlockData@@QEAAXAEBVCMapStringToString@@@Z
?alignmentAttribute@TH_HAttBlockData@@QEAA_NVAcDbObjectId@@@Z
acrxEntryPoint
acrxGetApiVersion

Sections

.text
Size: 189KB - Virtual size: 189KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 97KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

DBXCUSTO
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

ARXCOMMA
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

ADSSYMBO
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0b248a595fcf9341fbe72197dfef8603

Headers

DLL Characteristics

File Characteristics

Imports

mfc140u

kernel32

user32

gdi32

advapi32

comctl32

oleaut32

acdb22

acge22

ac1st22

acpal

accore

acui22

adui22

th_uibase.arx

th_arxbase.arx

pccadbase.arx

th_calcoper

thtabledatapickup.arx

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

Exports

Exports

Sections

.text Size: 189KB - Virtual size: 189KB

.rdata Size: 97KB - Virtual size: 97KB

.data Size: 28KB - Virtual size: 29KB

.pdata Size: 9KB - Virtual size: 9KB

DBXCUSTO Size: 512B - Virtual size: 16B

ARXCOMMA Size: 512B - Virtual size: 16B

ADSSYMBO Size: 512B - Virtual size: 16B

.gfids Size: 512B - Virtual size: 44B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 41KB - Virtual size: 41KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 189KB - Virtual size: 189KB

.rdata
Size: 97KB - Virtual size: 97KB

.data
Size: 28KB - Virtual size: 29KB

.pdata
Size: 9KB - Virtual size: 9KB

DBXCUSTO
Size: 512B - Virtual size: 16B

ARXCOMMA
Size: 512B - Virtual size: 16B

ADSSYMBO
Size: 512B - Virtual size: 16B

.gfids
Size: 512B - Virtual size: 44B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 41KB - Virtual size: 41KB

.reloc
Size: 3KB - Virtual size: 3KB