4856bcccbd7157113a861e47c44d9f99facaf9fce9f121094b1cb4146376cc01

Sharing

Copy URL Twitter E-mail

General

Target

4856bcccbd7157113a861e47c44d9f99facaf9fce9f121094b1cb4146376cc01
Size

378KB
MD5

43eae44cb9230d82f8805fedd95c803c
SHA1

cf199df849592b222b5a565df56efe4825cb8f90
SHA256

4856bcccbd7157113a861e47c44d9f99facaf9fce9f121094b1cb4146376cc01
SHA512

55c3ae8459bebbd15f8ceeb156851758488db762eef659322d217f1e1f78dcfddeb0004610ceb3fd4ced70d21b79dc0086c3fd17d471bae433c3f50e11184971
SSDEEP

6144:ZINfwhuYmsiV0fl6cYAqlSsuYNV2baEK0L1HSmiAmU3MMO/tAPc/T:KNfot/f/U

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4856bcccbd7157113a861e47c44d9f99facaf9fce9f121094b1cb4146376cc01

Files

4856bcccbd7157113a861e47c44d9f99facaf9fce9f121094b1cb4146376cc01
.dll windows:5 windows x64 arch:x64

57109282f4cd966f0dbe7ae33cae7181

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcp100

?_Xout_of_range@std@@YAXPEBD@Z

mfc100u

ord1248
ord11828
ord12434
ord11830
ord2527
ord2029
ord12756
ord5052
ord285
ord5019
ord2541
ord286
ord4131
ord4317
ord3704
ord266
ord12435
ord2025
ord2023
ord1291
ord1428
ord280
ord1288
ord3261
ord9216
ord4623
ord12068
ord3486
ord12926
ord9747
ord6451
ord10805
ord7870
ord10101
ord2885
ord2884
ord2663
ord5338
ord12251
ord2794
ord2791
ord7088
ord2354
ord13766
ord13768
ord13767
ord13765
ord13769
ord13752
ord13680
ord13681
ord7968
ord10763
ord3282
ord10626
ord13001
ord7803
ord10845
ord5998
ord9734
ord8084
ord11211
ord12359
ord10928
ord10926
ord456
ord12760
ord4620
ord12581
ord5017
ord5994
ord3310
ord2530
ord7596
ord3608
ord2659
ord7957
ord5570
ord908
ord5600
ord948
ord445
ord5083
ord281
ord340
ord906
ord3989
ord3562
ord11860
ord2680
ord984
ord4199
ord1910
ord5987
ord6610
ord4195
ord11175
ord784
ord11674
ord7657
ord7227
ord6737
ord4440
ord11614
ord12570
ord11611
ord12560
ord7727
ord12563
ord12199
ord12503
ord11856
ord11675
ord11683
ord11465
ord11548
ord11192
ord11174
ord12272
ord11832
ord5580
ord362
ord12574
ord923
ord885
ord3277
ord11658
ord2137
ord2138
ord5560
ord4196
ord5562
ord1486
ord1492
ord1490
ord1497
ord4228
ord4265
ord4236
ord4248
ord4244
ord4240
ord4270
ord4261
ord4232
ord4274
ord4253
ord4219
ord4223
ord4256
ord3857
ord13687
ord3850
ord2577
ord13003
ord6837
ord13009
ord5910
ord10414
ord12208
ord5064
ord2286
ord10798
ord3362
ord5834
ord3320
ord997
ord261
ord1424
ord1423
ord11829
ord11826
ord12432
ord1153
ord4348
ord857
ord3998
ord7568
ord5790
ord2019
ord11012
ord13017
ord1263
ord870
ord11035
ord13036
ord11517
ord7222
ord3997
ord11822
ord11363
ord7609
ord12842
ord12836
ord1276
ord1418
ord11254
ord7608
ord7068
ord13012
ord12578
ord11673
ord5899
ord12803
ord1711
ord868
ord2670
ord880
ord1272
ord2141
ord3353
ord7598
ord3613
ord5654
ord8512
ord9476
ord1260
ord6445
ord11483
ord11145
ord1173
ord8770
ord4926
ord9019
ord5568
ord740
ord1911
ord1956
ord4812
ord469
ord1005
ord11018
ord7336
ord4063
ord12877
ord4439
ord4124
ord1274
ord2430
ord6944
ord5300
ord1944
ord7045
ord7358
ord2859
ord2858
ord2759
ord10841
ord4473
ord4737
ord4907
ord8174
ord4715
ord4935
ord4476
ord4612
ord4457
ord6669
ord6670
ord6660
ord4610
ord7096
ord9024
ord8038
ord5582
ord369
ord296
ord1290
ord926
ord6103
ord7102
ord728
ord2149
ord12677
ord412
ord7730
ord836
ord13023
ord5025
ord3375
ord729
ord2218
ord1228
ord5915
ord3471
ord5326
ord776
ord1190
ord7627
ord11618
ord1994
ord2030
ord11168
ord7315
ord4356
ord3854
ord2172
ord8290
ord10098
ord3054
ord7048
ord3812
ord12408
ord5913
ord11918
ord10336
ord6402
ord319
ord2038
ord6293
ord5609
ord336
ord1457
ord5616
ord2657
ord5340
ord12255
ord2355
ord7955
ord10892
ord8037
ord5563
ord904
ord2015
ord1919
ord396
ord2730
ord7663
ord3292
ord12700
ord1953
ord11212
ord998
ord7606
ord1877
ord1900
ord4171
ord6938
ord2591
ord3163
ord4200
ord290
ord7359
ord11248
ord457
ord5299
ord11299
ord1479
ord890
ord1278
ord11736
ord5789
ord710
ord2533
ord2760
ord12830

msvcr100

_itoa
__clean_type_info_names_internal
__crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
__CppXcptFilter
_amsg_exit
_encoded_null
_initterm_e
_initterm
_malloc_crt
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
wcstoul
_time64
_localtime64_s
wcsftime
__C_specific_handler
??0exception@std@@QEAA@AEBV01@@Z
_CxxThrowException
??1exception@std@@UEAA@XZ
?what@exception@std@@UEBAPEBDXZ
??0exception@std@@QEAA@AEBQEBD@Z
_purecall
ldiv
_wtoi
_wcsicmp
memcpy
_wtof
isdigit
_recalloc
calloc
free
memset
memcpy_s
__CxxFrameHandler3

kernel32

LocalFree
WideCharToMultiByte
lstrlenW
GetLastError
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
Sleep
DecodePointer
EncodePointer
GetTickCount
GlobalSize
GlobalLock
GlobalUnlock
MulDiv
GetVersionExW
lstrcpyW
FindResourceW
LoadResource
LockResource
FreeResource
GlobalFree
ActivateActCtx
DeactivateActCtx
SetLastError
GetProcAddress
GetModuleHandleW
LoadLibraryW
GlobalAlloc
GlobalReAlloc
lstrlenA
MultiByteToWideChar

user32

GetDoubleClickTime
WindowFromPoint
IsWindowVisible
ClientToScreen
LoadMenuW
EnableMenuItem
RegisterWindowMessageW
ClipCursor
GetCursorPos
IsClipboardFormatAvailable
GetClassInfoW
DefWindowProcW
GetFocus
SetActiveWindow
KillTimer
SetTimer
InvertRect
IntersectRect
DrawEdge
SetRect
GetDC
ReleaseDC
GetMessagePos
ScreenToClient
LoadCursorW
IsWindow
GetKeyState
PostMessageW
TranslateMessage
DispatchMessageW
DrawFrameControl
IsRectEmpty
GetSystemMetrics
GetMenuItemInfoW
SystemParametersInfoW
ModifyMenuW
GetSubMenu
GetMenuState
GetMenuItemID
GetMenuItemCount
GetTabbedTextExtentW
LoadBitmapW
SetCursor
GetSysColor
ReleaseCapture
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
GetWindowLongW
GetParent
SetCapture
GetCapture
GetActiveWindow
RedrawWindow
InvalidateRect
GetClientRect
DrawFocusRect
FrameRect
FillRect
OffsetRect
InflateRect
PtInRect
CopyRect
DrawStateW
LoadImageW
DestroyCursor
LoadStringW
LoadIconW
SendMessageW
MessageBeep
EnableWindow
GetWindowRect

gdi32

CreateCompatibleDC
CreateCompatibleBitmap
ExtTextOutW
SelectObject
PatBlt
GetObjectW
CreateFontW
CreatePen
GetCurrentObject
GetTextMetricsW
GetDeviceCaps
GetTextExtentPoint32W
CreateFontIndirectW
Escape
BitBlt
TextOutW
RectVisible
PtVisible
DeleteObject

advapi32

RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey

oleaut32

SysFreeString
SysAllocString
VarUdateFromDate
SystemTimeToVariantTime
VariantTimeToSystemTime

acdb19

?rotation@AcDbText@@QEBANXZ
?rotation@AcDbBlockReference@@QEBANXZ
?alignmentPoint@AcDbText@@QEBA?AVAcGePoint3d@@XZ
?position@AcDbText@@QEBA?AVAcGePoint3d@@XZ
?extents@AcGiTextStyle@@UEBA?AVAcGePoint2d@@PEB_WHHHPEAVAcGiWorldDraw@@@Z
?textString@AcDbText@@QEBAPEA_WXZ
?setTextSize@AcGiTextStyle@@UEAAXN@Z
?setRotation@AcDbText@@QEAA?AW4ErrorStatus@Acad@@N@Z
??0AcGiTextStyle@@QEAA@PEAVAcDbDatabase@@@Z
?textStyle@AcDbText@@QEBA?AVAcDbObjectId@@XZ
?step@AcDbObjectIterator@@QEAAX_N0@Z
?step@AcDbBlockTableRecordIterator@@QEAAX_N0@Z
?recordGraphicsModified@AcDbEntity@@QEAAXH@Z
??0AcDbExtents@@QEAA@XZ
acutRelRb
?setHorizontalMode@AcDbText@@QEAA?AW4ErrorStatus@Acad@@W4TextHorzMode@AcDb@@@Z
?setPosition@AcDbText@@QEAA?AW4ErrorStatus@Acad@@AEBVAcGePoint3d@@@Z
?setAlignmentPoint@AcDbText@@QEAA?AW4ErrorStatus@Acad@@AEBVAcGePoint3d@@@Z
??1AcGiTextStyle@@UEAA@XZ
??0AcDbBlockReference@@QEAA@XZ
?close@AcDbObject@@QEAA?AW4ErrorStatus@Acad@@XZ
?acdbHostApplicationServices@@YAPEAVAcDbHostApplicationServices@@XZ
?getSymbolTable@AcDbDatabase@@QEAA?AW4ErrorStatus@Acad@@AEAPEAVAcDbBlockTable@@W4OpenMode@AcDb@@@Z
?getAt@AcDbBlockTable@@QEBA?AW4ErrorStatus@Acad@@PEB_WAEAPEAVAcDbBlockTableRecord@@W4OpenMode@AcDb@@_N@Z
?appendAcDbEntity@AcDbBlockTableRecord@@QEAA?AW4ErrorStatus@Acad@@AEAVAcDbObjectId@@PEAVAcDbEntity@@@Z
?acutDelBuffer@@YAXAEAPEAX@Z
?desc@AcDbAttribute@@SAPEAVAcRxClass@@XZ
?desc@AcDbAttributeDefinition@@SAPEAVAcRxClass@@XZ
?desc@AcDbEntity@@SAPEAVAcRxClass@@XZ
?desc@AcDbObject@@SAPEAVAcRxClass@@XZ
?saveAs@AcDbDatabase@@QEAA?AW4ErrorStatus@Acad@@PEB_W_NW4AcDbDwgVersion@AcDb@@PEBUSecurityParams@@@Z
?acdbOpenAcDbEntity@@YA?AW4ErrorStatus@Acad@@AEAPEAVAcDbEntity@@VAcDbObjectId@@W4OpenMode@AcDb@@_N@Z
?acdbOpenAcDbObject@@YA?AW4ErrorStatus@Acad@@AEAPEAVAcDbObject@@VAcDbObjectId@@W4OpenMode@AcDb@@_N@Z
?c5ObjIdIsEqualTo@@YA_NPEBVAcDbStub@@0@Z
?desc@AcDbBlockReference@@SAPEAVAcRxClass@@XZ
?desc@AcDbBlockTableRecord@@SAPEAVAcRxClass@@XZ
?height@AcDbText@@QEBANXZ
?isConstant@AcDbAttributeDefinition@@QEBAHXZ
acutBuildList
?desc@AcRxDynamicLinker@@SAPEAVAcRxClass@@XZ
acutPrintf
?wblock@AcDbDatabase@@QEAA?AW4ErrorStatus@Acad@@AEAPEAV1@AEBV?$AcArray@VAcDbObjectId@@V?$AcArrayMemCopyReallocator@VAcDbObjectId@@@@@@AEBVAcGePoint3d@@@Z
?setOrigin@AcDbBlockTableRecord@@QEAA?AW4ErrorStatus@Acad@@AEBVAcGePoint3d@@@Z
??0AcDbAttributeDefinition@@QEAA@XZ
?setInvisible@AcDbAttributeDefinition@@QEAA?AW4ErrorStatus@Acad@@H@Z
?setTag@AcDbAttributeDefinition@@QEAA?AW4ErrorStatus@Acad@@PEB_W@Z
?scaleFactors@AcDbBlockReference@@QEBA?AVAcGeScale3d@@XZ
?normal@AcDbText@@QEBA?AVAcGeVector3d@@XZ
?getName@AcDbSymbolTableRecord@@QEBA?AW4ErrorStatus@Acad@@AEAPEA_W@Z
?acdbOpenAcDbObject@@YA?AW4ErrorStatus@Acad@@AEAPEAVAcDbObject@@VAcDbObjectId@@W4OpenMode@AcDb@@PEBVAcRxClass@@_N@Z
??0AcDbAttribute@@QEAA@XZ
?setPropertiesFrom@AcDbEntity@@QEAA?AW4ErrorStatus@Acad@@PEBV1@H@Z
?setTag@AcDbAttribute@@QEAA?AW4ErrorStatus@Acad@@PEB_W@Z
?isInvisible@AcDbAttributeDefinition@@QEBAHXZ
?setInvisible@AcDbAttribute@@QEAA?AW4ErrorStatus@Acad@@H@Z
?setHeight@AcDbText@@QEAA?AW4ErrorStatus@Acad@@N@Z
?setNormal@AcDbText@@QEAA?AW4ErrorStatus@Acad@@AEBVAcGeVector3d@@@Z
?acadErrorStatusText@@YAPEB_WW4ErrorStatus@Acad@@@Z
?setTextStyle@AcDbText@@QEAA?AW4ErrorStatus@Acad@@VAcDbObjectId@@@Z
?xScale@AcGiTextStyle@@UEBANXZ
?setWidthFactor@AcDbText@@QEAA?AW4ErrorStatus@Acad@@N@Z
?horizontalMode@AcDbText@@QEBA?AW4TextHorzMode@AcDb@@XZ
?appendAttribute@AcDbBlockReference@@QEAA?AW4ErrorStatus@Acad@@AEAVAcDbObjectId@@PEAVAcDbAttribute@@@Z
?setTextString@AcDbText@@QEAA?AW4ErrorStatus@Acad@@PEB_W@Z
?getAt@AcDbBlockTable@@QEBA?AW4ErrorStatus@Acad@@PEB_WAEAVAcDbObjectId@@_N@Z
??0AcDbDatabase@@QEAA@_N0@Z
?readDwgFile@AcDbDatabase@@QEAA?AW4ErrorStatus@Acad@@PEB_WW4OpenMode@1@_N0@Z
??1AcDbDatabase@@UEAA@XZ
?wblock@AcDbDatabase@@QEAA?AW4ErrorStatus@Acad@@AEAPEAV1@@Z
?insert@AcDbDatabase@@QEAA?AW4ErrorStatus@Acad@@AEAVAcDbObjectId@@PEB_WPEAV1@_N@Z
?blockTableRecord@AcDbBlockReference@@QEBA?AVAcDbObjectId@@XZ
?newIterator@AcDbBlockTableRecord@@QEBA?AW4ErrorStatus@Acad@@AEAPEAVAcDbBlockTableRecordIterator@@_N1@Z
?attributeIterator@AcDbBlockReference@@QEBAPEAVAcDbObjectIterator@@XZ
?start@AcDbObjectIterator@@QEAAX_N@Z
?done@AcDbObjectIterator@@QEBA_NXZ
?objectId@AcDbObjectIterator@@QEAA?AVAcDbObjectId@@XZ
?start@AcDbBlockTableRecordIterator@@QEAAX_N0@Z
?done@AcDbBlockTableRecordIterator@@QEBA_NXZ
?getEntity@AcDbBlockTableRecordIterator@@QEBA?AW4ErrorStatus@Acad@@AEAPEAVAcDbEntity@@W4OpenMode@AcDb@@_N@Z
?tag@AcDbAttribute@@QEBAPEA_WXZ
?tag@AcDbAttributeDefinition@@QEBAPEA_WXZ
?database@AcDbObject@@QEBAPEAVAcDbDatabase@@XZ
?objectId@AcDbObject@@QEBA?AVAcDbObjectId@@XZ
?handle@AcDbObjectId@@QEBA?AVAcDbHandle@@XZ

acge19

??0AcGeScale3d@@QEAA@XZ
?kOrigin@AcGePoint3d@@2V1@B
?kZAxis@AcGeVector3d@@2V1@B
??0AcGeMatrix3d@@QEAA@XZ
?setToIdentity@AcGeMatrix3d@@QEAAAEAV1@XZ
?setToRotation@AcGeMatrix3d@@QEAAAEAV1@NAEBVAcGeVector3d@@AEBVAcGePoint3d@@@Z
?rotateBy@AcGePoint3d@@QEAAAEAV1@NAEBVAcGeVector3d@@AEBV1@@Z
?distanceTo@AcGePoint3d@@QEBANAEBV1@@Z
??0AcGeScale3d@@QEAA@AEBV0@@Z

ac1st19

?subQueryX@AcRxObject@@MEBAPEAV1@PEBVAcRxClass@@@Z
?comparedTo@AcRxObject@@UEBA?AW4Ordering@AcRx@@PEBV1@@Z
?isEqualTo@AcRxObject@@UEBAHPEBV1@@Z
?copyFrom@AcRxObject@@UEAA?AW4ErrorStatus@Acad@@PEBV1@@Z
?clone@AcRxObject@@UEBAPEAV1@XZ
??0AcRxObject@@IEAA@XZ
?myParent@AcRxClass@@QEBAPEAV1@XZ
?deleteAcRxClass@@YAXPEAVAcRxClass@@@Z
acrxSysRegistry
?acrxBuildClassHierarchy@@YAXXZ
acrx_abort
?freeRawMem@AcHeapOperators@@CAXPEAX@Z
?isDerivedFrom@AcRxClass@@QEBA_NPEBV1@@Z
?allocRawMem@AcHeapOperators@@CAPEAX_K@Z

accore

?acDocManagerPtr@@YAPEAVAcApDocManager@@XZ
?desc@AcEdCommandStack@@SAPEAVAcRxClass@@XZ
acedRegFunc
acedDefun
acedUndef
acedGetFunCode
?isA@AcApDocManagerReactor@@UEBAPEAVAcRxClass@@XZ
?documentCreateStarted@AcApDocManagerReactor@@UEAAXPEAVAcApDocument@@@Z
?documentCreated@AcApDocManagerReactor@@UEAAXPEAVAcApDocument@@@Z
?documentDestroyed@AcApDocManagerReactor@@UEAAXPEB_W@Z
?documentCreateCanceled@AcApDocManagerReactor@@UEAAXPEAVAcApDocument@@@Z
?documentLockModeWillChange@AcApDocManagerReactor@@UEAAXPEAVAcApDocument@@W4DocLockMode@AcAp@@11PEB_W@Z
?documentLockModeChangeVetoed@AcApDocManagerReactor@@UEAAXPEAVAcApDocument@@PEB_W@Z
?documentLockModeChanged@AcApDocManagerReactor@@UEAAXPEAVAcApDocument@@W4DocLockMode@AcAp@@11PEB_W@Z
?documentBecameCurrent@AcApDocManagerReactor@@UEAAXPEAVAcApDocument@@@Z
?documentToBeActivated@AcApDocManagerReactor@@UEAAXPEAVAcApDocument@@@Z
?documentToBeDeactivated@AcApDocManagerReactor@@UEAAXPEAVAcApDocument@@@Z
?documentActivationModified@AcApDocManagerReactor@@UEAAX_N@Z
?documentActivated@AcApDocManagerReactor@@UEAAXPEAVAcApDocument@@@Z
acedInvoke
adsw_acadMainWnd

acui19

?DoDataExchange@CAcUiDialog@@MEAAXPEAVCDataExchange@@@Z
?OnCancel@CAcUiDialog@@MEAAXXZ
?FindContextHelpFullPath@CAcUiDialog@@MEAAHPEB_WAEAV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?AppMainWindow@CAcUiDialog@@UEAAPEAVCWnd@@XZ
?AppResourceInstance@CAcUiDialog@@UEAAPEAUHINSTANCE__@@XZ
?AppRootKey@CAcUiDialog@@UEAAPEB_WXZ
?EnableFloatingWindows@CAcUiDialog@@UEAAXH@Z
?IsMultiDocumentActivationEnabled@CAcUiDialog@@UEAAHXZ
?EnableMultiDocumentActivation@CAcUiDialog@@UEAAHH@Z
?OnDialogHelp@CAcUiDialog@@UEAAXXZ
?OnOK@CAcUiDialog@@MEAAXXZ
?OnInitDialog@CAcUiDialog@@UEAAHXZ
?InitAcUiDLL@@YAXXZ
?GetThisClass@CAcUiDialog@@SAPEAUCRuntimeClass@@XZ
??0CAcUiDialog@@QEAA@IPEAVCWnd@@PEAUHINSTANCE__@@@Z
??1CAcUiDialog@@UEAA@XZ
?GetThisMessageMap@CAcUiDialog@@KAPEBUAFX_MSGMAP@@XZ

adui19

?DoModal@CAdUiBaseDialog@@UEAA_JXZ
?OnSize@CAdUiDialog@@IEAAXIHH@Z
?PreCreateWindow@CAdUiBaseDialog@@MEAAHAEAUtagCREATESTRUCTW@@@Z
?PreTranslateMessage@CAdUiBaseDialog@@UEAAHPEAUtagMSG@@@Z
?PostNcDestroy@CAdUiBaseDialog@@MEAAXXZ
?Create@CAdUiBaseDialog@@UEAAHIPEAVCWnd@@@Z
?Create@CAdUiBaseDialog@@UEAAHPEB_WPEAVCWnd@@@Z
?DoAdUiMessage@CAdUiBaseDialog@@MEAA?AW4ADUI_REPLY@@W4ADUI_NOTIFY@@I_J@Z
?OnNotifyControlChange@CAdUiBaseDialog@@MEAA?AW4ADUI_REPLY@@I_J@Z
?OnNotifyControlValid@CAdUiBaseDialog@@MEAA?AW4ADUI_REPLY@@IH@Z
?OnNotifyGeneric@CAdUiBaseDialog@@MEAA?AW4ADUI_REPLY@@I_J@Z
?OnNotifyUpdateTip@CAdUiBaseDialog@@MEAA?AW4ADUI_REPLY@@PEAVCWnd@@@Z
?OnInitDialogBegin@CAdUiDialog@@MEAAXXZ
?OnInitDialogFinish@CAdUiDialog@@MEAAXXZ
?DoDialogHelp@CAdUiDialog@@UEAAHXZ
?ExchangeData@CAdUiBaseDialog@@UEAAHH@Z
?BeginEditorCommand@CAdUiBaseDialog@@IEAAXXZ
?CompleteEditorCommand@CAdUiBaseDialog@@IEAAXH@Z

th_uibase.arx

?SdShowMsg@@YAXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@0HH@Z
?setTransParency@@YAXPEAVCWnd@@@Z

th_arxbase.arx

?setString@TH_ARXAppXdata@@QEAAXHPEB_W@Z
?getString@TH_ARXAppXdata@@QEAA_NHAEAV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@_N@Z
??1TH_ARXAppXdata@@UEAA@XZ
?getHandle@TH_ARXAppXdata@@QEAA_NHAEAVAcDbHandle@@_N@Z
?getXdata@TH_ARXAppXdata@@QEAAXPEAVAcDbObject@@@Z
??0TH_ARXAppXdata@@QEAA@PEB_WPEAVAcDbDatabase@@@Z
?setHandle@TH_ARXAppXdata@@QEAAXHAEBVAcDbHandle@@@Z
?setXdata@TH_ARXAppXdata@@QEAA?AW4ErrorStatus@Acad@@PEAVAcDbObject@@@Z
??0TH_ARXSelectSet@@QEAA@XZ
?userSelect@TH_ARXSelectSet@@QEAA?AW4SelSetStatus@1@PEB_W0PEBUresbuf@@@Z
??1TH_ARXSelectSet@@UEAA@XZ
?asArray@TH_ARXSelectSet@@QEAAXAEAV?$AcArray@VAcDbObjectId@@V?$AcArrayMemCopyReallocator@VAcDbObjectId@@@@@@@Z

pccadbase.arx

?GetPccadPath@@YA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?rx_getTextStyle@@YA?AW4ErrorStatus@Acad@@AEAVAcGiTextStyle@@VAcDbObjectId@@@Z

th_calcoper

??0THCalcOperate@@QEAA@XZ
?Initialize@THCalcOperate@@QEAAHXZ
??1THCalcOperate@@UEAA@XZ
?clear@THCalcOperate@@QEAAXXZ
?getExpVarMap@THCalcOperate@@QEAAHAEAVCMapStringToString@@@Z
?ValidateCheck@THCalcOperate@@QEAAHXZ
?setValMap@THCalcOperate@@QEAAXAEBVCMapStringToString@@@Z
?setExpress@THCalcOperate@@QEAAXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?setExpName@THCalcOperate@@QEAAXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z

thtabledatapickup.arx

?DoPickUp@THTablePickUpEngine@@QEAA_NH@Z
??0THTablePickUpEngine@@QEAA@XZ
?GetData@THTablePickUpEngine@@QEAAXAEAV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
??1THTablePickUpEngine@@UEAA@XZ

Exports

Exports

??0TH_HAttBlockData@@QEAA@VAcDbObjectId@@@Z
??0TH_HAttBlockData@@QEAA@XZ
??1TH_HAttBlockData@@QEAA@XZ
?AddMapArray@TH_HAttBlockData@@AEAAXAEAV?$CArray@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@V12@@@0H@Z
?GetBasePoint@TH_HAttBlockData@@QEBA?AVAcGePoint3d@@XZ
?GetCode@TH_HAttBlockData@@AEAA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@V23@@Z
?GetFileName@TH_HAttBlockData@@QEBA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?GetHBlockPath@TH_HAttBlockData@@QEBA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?GetKeyByCode@TH_HAttBlockData@@QEAA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@V23@@Z
?GetNormal@TH_HAttBlockData@@QEBA?AVAcGeVector3d@@XZ
?GetPosition@TH_HAttBlockData@@QEBA?AVAcGePoint3d@@XZ
?GetRotation@TH_HAttBlockData@@QEBANXZ
?GetScaleFactors@TH_HAttBlockData@@QEBA?AVAcGeScale3d@@XZ
?GetTextHeight@TH_HAttBlockData@@QEBANXZ
?GetTextStyle@TH_HAttBlockData@@QEBA?AVAcDbObjectId@@XZ
?GetValueByCode@TH_HAttBlockData@@QEAA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@V23@@Z
?HBlockDefinition@TH_HAttBlockData@@QEAAHXZ
?HBlockEditForGetAtt@TH_HAttBlockData@@QEAAHVAcDbObjectId@@@Z
?HBlockEditForSetAtt@TH_HAttBlockData@@QEAAHVAcDbObjectId@@@Z
?HBlockReference@TH_HAttBlockData@@QEAA?AVAcDbObjectId@@V2@@Z
?HBlockReference@TH_HAttBlockData@@QEAA?AVAcDbObjectId@@XZ
?InitComboMapArray@TH_HAttBlockData@@AEAAXPEAVCMapStringToPtr@@@Z
?ReturnValueByMap@TH_HAttBlockData@@AEAAXAEAV?$CTypedPtrArray@VCObArray@@PEAVCMapStringToString@@@@@Z
?SetBasePoint@TH_HAttBlockData@@QEAAXAEBVAcGePoint3d@@@Z
?SetFileName@TH_HAttBlockData@@QEAAXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?SetHBlockPath@TH_HAttBlockData@@QEAAXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?SetNormal@TH_HAttBlockData@@QEAAXAEBVAcGeVector3d@@@Z
?SetPosition@TH_HAttBlockData@@QEAAXAEBVAcGePoint3d@@@Z
?SetRotation@TH_HAttBlockData@@QEAAXN@Z
?SetScaleFactors@TH_HAttBlockData@@QEAAXAEBVAcGeScale3d@@@Z
?SetTextHeight@TH_HAttBlockData@@QEAAXN@Z
?SetTextStyle@TH_HAttBlockData@@QEAAXVAcDbObjectId@@@Z
?SetValueByCode@TH_HAttBlockData@@QEAA_NV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@0@Z
?ToAddXData@TH_HAttBlockData@@AEAAHV?$AcArray@VAcDbObjectId@@V?$AcArrayMemCopyReallocator@VAcDbObjectId@@@@@@@Z
?ToEditAttDef@TH_HAttBlockData@@AEAAHV?$AcArray@VAcDbObjectId@@V?$AcArrayMemCopyReallocator@VAcDbObjectId@@@@@@@Z
?ToFindFileName@TH_HAttBlockData@@AEAAHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@AEAVAcDbObjectId@@@Z
?ToGetBlockName@TH_HAttBlockData@@AEAA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@V23@@Z
?ToGetHBlockName@TH_HAttBlockData@@QEAA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?ToInitAttValue@TH_HAttBlockData@@AEAAHVAcDbObjectId@@@Z
?ToMakeEditMap@TH_HAttBlockData@@AEAAHVAcDbObjectId@@@Z
?ToMakeEditMapOrder@TH_HAttBlockData@@AEAAXAEAV?$CTypedPtrArray@VCObArray@@PEAVCMapStringToString@@@@@Z
?ToMakeXData@TH_HAttBlockData@@AEAAHPEAVAcDbDatabase@@AEAPEAVAcDbEntity@@J@Z
?ToRefBlock@TH_HAttBlockData@@AEAA?AVAcDbObjectId@@V2@@Z
?ToSelectSSet@TH_HAttBlockData@@AEAAHV?$AcArray@VAcDbObjectId@@V?$AcArrayMemCopyReallocator@VAcDbObjectId@@@@@@@Z
?ToSetAttAigVal@TH_HAttBlockData@@AEAA_NPEAVAcDbAttribute@@PEAVAcDbAttributeDefinition@@PEAVAcDbBlockReference@@@Z
?ToSetAttNumVal@TH_HAttBlockData@@AEAAXPEAVAcDbAttribute@@PEAVAcDbAttributeDefinition@@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?ToShowAttRef@TH_HAttBlockData@@AEAAHVAcDbObjectId@@@Z
?UpdateEdValueByMap@TH_HAttBlockData@@QEAAXAEBVCMapStringToString@@@Z
?UpdateValueByMap@TH_HAttBlockData@@QEAAXAEBVCMapStringToString@@@Z
?alignmentAttribute@TH_HAttBlockData@@QEAA_NVAcDbObjectId@@@Z
acrxEntryPoint
acrxGetApiVersion

Sections

.text
Size: 196KB - Virtual size: 195KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 95KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

DBXCUSTO
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

ARXCOMMA
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

ADSSYMBO
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

57109282f4cd966f0dbe7ae33cae7181

Headers

DLL Characteristics

File Characteristics

Imports

msvcp100

mfc100u

msvcr100

kernel32

user32

gdi32

advapi32

oleaut32

acdb19

acge19

ac1st19

accore

acui19

adui19

th_uibase.arx

th_arxbase.arx

pccadbase.arx

th_calcoper

thtabledatapickup.arx

Exports

Exports

Sections

.text Size: 196KB - Virtual size: 195KB

.rdata Size: 95KB - Virtual size: 95KB

.data Size: 28KB - Virtual size: 29KB

.pdata Size: 8KB - Virtual size: 8KB

DBXCUSTO Size: 512B - Virtual size: 16B

ARXCOMMA Size: 512B - Virtual size: 16B

ADSSYMBO Size: 512B - Virtual size: 16B

.rsrc Size: 41KB - Virtual size: 41KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 196KB - Virtual size: 195KB

.rdata
Size: 95KB - Virtual size: 95KB

.data
Size: 28KB - Virtual size: 29KB

.pdata
Size: 8KB - Virtual size: 8KB

DBXCUSTO
Size: 512B - Virtual size: 16B

ARXCOMMA
Size: 512B - Virtual size: 16B

ADSSYMBO
Size: 512B - Virtual size: 16B

.rsrc
Size: 41KB - Virtual size: 41KB

.reloc
Size: 6KB - Virtual size: 5KB