1a927b328802f953ad0c6be51ffebbcc2fcade33b526bec64df3efead40105f8

Sharing

Copy URL

Twitter E-mail

General

Target

1a927b328802f953ad0c6be51ffebbcc2fcade33b526bec64df3efead40105f8
Size

346KB
MD5

76b20b29bd083fc0da590a631272f93c
SHA1

923baecad0bdd692cb22f10631c1427a836ba9dc
SHA256

1a927b328802f953ad0c6be51ffebbcc2fcade33b526bec64df3efead40105f8
SHA512

ad45c2845b81ccf4758063fecdd4cf3bf11df0abb44407aaa173162f784de3e061b8bc447948f9cffbcf848977132788342abd5d29f8b9a0d24eb6895cc14539
SSDEEP

6144:PA7eg6AkIXvRU4EgMDgzNEgHTw6kpTuu8nh040wQ0oH:PPg6AlvRUriLHTwLTDlL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1a927b328802f953ad0c6be51ffebbcc2fcade33b526bec64df3efead40105f8

Files

1a927b328802f953ad0c6be51ffebbcc2fcade33b526bec64df3efead40105f8
.dll windows:6 windows x64 arch:x64

2679b423fb786d0651b26e363c292a71

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

ac1st24

?isEqualTo@AcRxObject@@UEBA_NPEBV1@@Z
?comparedTo@AcRxObject@@UEBA?AW4Ordering@AcRx@@PEBV1@@Z
?subQueryX@AcRxObject@@MEBAPEAV1@PEBVAcRxClass@@@Z
??0AcRxObject@@IEAA@XZ
?clone@AcRxObject@@UEBAPEAV1@XZ
?deleteAcRxClass@@YAXPEAVAcRxClass@@@Z
?acrxBuildClassHierarchy@@YAXXZ
?myParent@AcRxClass@@QEBAPEAV1@XZ
acrxSysRegistry
??1AcRxResourceInstance@@QEAA@XZ
??0AcRxResourceInstance@@QEAA@PEAX@Z
??1AcString@@QEAA@XZ
??0AcString@@QEAA@XZ
?isDerivedFrom@AcRxClass@@SA_NPEBV1@0@Z
?copyFrom@AcRxObject@@UEAA?AW4ErrorStatus@Acad@@PEBV1@@Z
acrx_abort

acge24

?distanceTo@AcGePoint3d@@QEBANAEBV1@@Z
?setToIdentity@AcGeMatrix3d@@QEAAAEAV1@XZ
?rotateBy@AcGePoint3d@@QEAAAEAV1@NAEBVAcGeVector3d@@AEBV1@@Z
??0AcGeScale3d@@QEAA@AEBV0@@Z
??0AcGeScale3d@@QEAA@XZ
??0AcGeMatrix3d@@QEAA@XZ
?setToRotation@AcGeMatrix3d@@QEAAAEAV1@NAEBVAcGeVector3d@@AEBVAcGePoint3d@@@Z
?kZAxis@AcGeVector3d@@2V1@B
?kOrigin@AcGePoint3d@@2V1@B

acdb24

?insert@AcDbDatabase@@QEAA?AW4ErrorStatus@Acad@@AEAVAcDbObjectId@@PEB_WPEAV1@_N@Z
?done@AcDbObjectIterator@@QEBA_NXZ
?step@AcDbObjectIterator@@QEAAX_N0@Z
?start@AcDbObjectIterator@@QEAAX_N@Z
?objectId@AcDbObjectIterator@@QEAA?AVAcDbObjectId@@XZ
?desc@AcDbObject@@SAPEAVAcRxClass@@XZ
?objectId@AcDbObject@@QEBA?AVAcDbObjectId@@XZ
?database@AcDbObject@@QEBAPEAVAcDbDatabase@@XZ
?close@AcDbObject@@QEAA?AW4ErrorStatus@Acad@@XZ
?desc@AcDbEntity@@SAPEAVAcRxClass@@XZ
?setPropertiesFrom@AcDbEntity@@QEAA?AW4ErrorStatus@Acad@@PEBV1@_N@Z
?getGeomExtents@AcDbEntity@@UEBA?AW4ErrorStatus@Acad@@AEAVAcDbExtents@@@Z
?transformBy@AcDbEntity@@UEAA?AW4ErrorStatus@Acad@@AEBVAcGeMatrix3d@@@Z
?recordGraphicsModified@AcDbEntity@@QEAAX_N@Z
??0AcDbExtents@@QEAA@XZ
??1AcGiTextStyle@@UEAA@XZ
??0AcGiTextStyle@@QEAA@PEAVAcDbDatabase@@@Z
?setTextSize@AcGiTextStyle@@UEAAXN@Z
?xScale@AcGiTextStyle@@UEBANXZ
?extents@AcGiTextStyle@@UEBA?AVAcGePoint2d@@PEB_W_NH1PEAVAcGiWorldDraw@@@Z
?getName@AcDbSymbolTableRecord@@QEBA?AW4ErrorStatus@Acad@@AEAVAcString@@@Z
?desc@AcDbBlockTableRecord@@SAPEAVAcRxClass@@XZ
?appendAcDbEntity@AcDbBlockTableRecord@@QEAA?AW4ErrorStatus@Acad@@AEAVAcDbObjectId@@PEAVAcDbEntity@@@Z
?newIterator@AcDbBlockTableRecord@@QEBA?AW4ErrorStatus@Acad@@AEAPEAVAcDbBlockTableRecordIterator@@_N1@Z
?setOrigin@AcDbBlockTableRecord@@QEAA?AW4ErrorStatus@Acad@@AEBVAcGePoint3d@@@Z
?getIdAt@AcDbSymbolTable@@QEBA?AW4ErrorStatus@Acad@@PEB_WAEAVAcDbObjectId@@_N@Z
?start@AcDbBlockTableRecordIterator@@QEAAX_N0@Z
?done@AcDbBlockTableRecordIterator@@QEBA_NXZ
?getEntity@AcDbBlockTableRecordIterator@@QEBA?AW4ErrorStatus@Acad@@AEAPEAVAcDbEntity@@W4OpenMode@AcDb@@_N@Z
?step@AcDbBlockTableRecordIterator@@QEAAX_N0@Z
?position@AcDbText@@QEBA?AVAcGePoint3d@@XZ
?setPosition@AcDbText@@QEAA?AW4ErrorStatus@Acad@@AEBVAcGePoint3d@@@Z
?alignmentPoint@AcDbText@@QEBA?AVAcGePoint3d@@XZ
?setAlignmentPoint@AcDbText@@QEAA?AW4ErrorStatus@Acad@@AEBVAcGePoint3d@@@Z
?normal@AcDbText@@QEBA?AVAcGeVector3d@@XZ
?wblock@AcDbDatabase@@QEAA?AW4ErrorStatus@Acad@@AEAPEAV1@@Z
?rotation@AcDbText@@QEBANXZ
?setRotation@AcDbText@@QEAA?AW4ErrorStatus@Acad@@N@Z
?height@AcDbText@@QEBANXZ
?setHeight@AcDbText@@QEAA?AW4ErrorStatus@Acad@@N@Z
?setWidthFactor@AcDbText@@QEAA?AW4ErrorStatus@Acad@@N@Z
?textString@AcDbText@@QEBA?AW4ErrorStatus@Acad@@AEAVAcString@@@Z
?setTextString@AcDbText@@QEAA?AW4ErrorStatus@Acad@@PEB_W@Z
?textStyle@AcDbText@@QEBA?AVAcDbObjectId@@XZ
?setTextStyle@AcDbText@@QEAA?AW4ErrorStatus@Acad@@VAcDbObjectId@@@Z
?horizontalMode@AcDbText@@QEBA?AW4TextHorzMode@AcDb@@XZ
?setHorizontalMode@AcDbText@@QEAA?AW4ErrorStatus@Acad@@W4TextHorzMode@AcDb@@@Z
??0AcDbAttributeDefinition@@QEAA@XZ
?desc@AcDbAttributeDefinition@@SAPEAVAcRxClass@@XZ
?tag@AcDbAttributeDefinition@@QEBA?AW4ErrorStatus@Acad@@AEAVAcString@@@Z
?setTag@AcDbAttributeDefinition@@QEAA?AW4ErrorStatus@Acad@@PEB_W@Z
?isInvisible@AcDbAttributeDefinition@@QEBA_NXZ
?setInvisible@AcDbAttributeDefinition@@QEAA?AW4ErrorStatus@Acad@@_N@Z
?isConstant@AcDbAttributeDefinition@@QEBA_NXZ
??0AcDbAttribute@@QEAA@XZ
?desc@AcDbAttribute@@SAPEAVAcRxClass@@XZ
?tag@AcDbAttribute@@QEBA?AW4ErrorStatus@Acad@@AEAVAcString@@@Z
?setTag@AcDbAttribute@@QEAA?AW4ErrorStatus@Acad@@PEB_W@Z
?setInvisible@AcDbAttribute@@QEAA?AW4ErrorStatus@Acad@@_N@Z
??0AcDbBlockReference@@QEAA@XZ
?desc@AcDbBlockReference@@SAPEAVAcRxClass@@XZ
?blockTableRecord@AcDbBlockReference@@QEBA?AVAcDbObjectId@@XZ
?scaleFactors@AcDbBlockReference@@QEBA?AVAcGeScale3d@@XZ
?rotation@AcDbBlockReference@@QEBANXZ
?appendAttribute@AcDbBlockReference@@QEAA?AW4ErrorStatus@Acad@@AEAVAcDbObjectId@@PEAVAcDbAttribute@@@Z
?attributeIterator@AcDbBlockReference@@QEBAPEAVAcDbObjectIterator@@XZ
?acdbHostApplicationServices@@YAPEAVAcDbHostApplicationServices@@XZ
?acutDelBuffer@@YAXAEAPEAX@Z
?acadErrorStatusText@@YAPEB_WW4ErrorStatus@Acad@@@Z
?wblock@AcDbDatabase@@QEAA?AW4ErrorStatus@Acad@@AEAPEAV1@AEBV?$AcArray@VAcDbObjectId@@V?$AcArrayMemCopyReallocator@VAcDbObjectId@@@@@@AEBVAcGePoint3d@@@Z
?desc@AcRxDynamicLinker@@SAPEAVAcRxClass@@XZ
?saveAs@AcDbDatabase@@QEAA?AW4ErrorStatus@Acad@@PEB_W_NW4AcDbDwgVersion@AcDb@@PEBUSecurityParams@@@Z
?readDwgFile@AcDbDatabase@@QEAA?AW4ErrorStatus@Acad@@PEB_WW4OpenMode@1@_N0@Z
?getSymbolTable@AcDbDatabase@@QEAA?AW4ErrorStatus@Acad@@AEAPEAVAcDbBlockTable@@W4OpenMode@AcDb@@@Z
??1AcDbDatabase@@UEAA@XZ
??0AcDbDatabase@@QEAA@_N0@Z
?acdbOpenObject@@YA?AW4ErrorStatus@Acad@@AEAPEAVAcDbEntity@@VAcDbObjectId@@W4OpenMode@AcDb@@_N@Z
?acdbOpenObject@@YA?AW4ErrorStatus@Acad@@AEAPEAVAcDbObject@@VAcDbObjectId@@P6APEAVAcRxClass@@XZW4OpenMode@AcDb@@_N@Z
?acdbOpenObject@@YA?AW4ErrorStatus@Acad@@AEAPEAVAcDbObject@@VAcDbObjectId@@W4OpenMode@AcDb@@_NPEBVAcRxClass@@@Z
?acutBuildList@@YAPEAUresbuf@@HZZ
?acutRelRb@@YAHPEAUresbuf@@@Z
?setNormal@AcDbText@@QEAA?AW4ErrorStatus@Acad@@AEBVAcGeVector3d@@@Z
?acutNewString@@YA?AW4ErrorStatus@Acad@@PEB_WAEAPEA_W@Z
?acutPrintf@@YAHPEB_WZZ
?handle@AcDbObjectId@@QEBA?AVAcDbHandle@@XZ

accore

?acedInvoke@@YAHPEBUresbuf@@PEAPEAU1@@Z
?acDocManagerPtr@@YAPEAVAcApDocManager@@XZ
??1AcApDocManagerReactor@@UEAA@XZ
?isA@AcApDocManagerReactor@@UEBAPEAVAcRxClass@@XZ
?desc@AcEdCommandStack@@SAPEAVAcRxClass@@XZ
?acedGetFunCode@@YAHXZ
?acedUndef@@YAHPEB_WH@Z
?acedDefun@@YAHPEB_WH@Z
?acedRegFunc@@YAHP6AHXZH@Z
?adsw_acadMainWnd@@YAPEAUHWND__@@XZ

adui24

?PostNcDestroy@CAdUiBaseDialog@@MEAAXXZ
?DoAdUiMessage@CAdUiBaseDialog@@MEAA?AW4ADUI_REPLY@@W4ADUI_NOTIFY@@I_J@Z
?BeginEditorCommand@CAdUiBaseDialog@@IEAAXXZ
?CompleteEditorCommand@CAdUiBaseDialog@@IEAAXH@Z
?OnNotifyControlChange@CAdUiBaseDialog@@MEAA?AW4ADUI_REPLY@@I_J@Z
?OnNotifyControlValid@CAdUiBaseDialog@@MEAA?AW4ADUI_REPLY@@IH@Z
?OnNotifyGeneric@CAdUiBaseDialog@@MEAA?AW4ADUI_REPLY@@I_J@Z
?OnNotifyUpdateTip@CAdUiBaseDialog@@MEAA?AW4ADUI_REPLY@@PEAVCWnd@@@Z
?Create@CAdUiBaseDialog@@UEAAHPEB_WPEAVCWnd@@@Z
?OnSize@CAdUiDialog@@IEAAXIHH@Z
?DoDialogHelp@CAdUiDialog@@UEAAHXZ
?OnInitDialogFinish@CAdUiDialog@@MEAAXXZ
?OnInitDialogBegin@CAdUiDialog@@MEAAXXZ
?PreCreateWindow@CAdUiBaseDialog@@MEAAHAEAUtagCREATESTRUCTW@@@Z
?DoModal@CAdUiBaseDialog@@UEAA_JXZ
?PreTranslateMessage@CAdUiBaseDialog@@UEAAHPEAUtagMSG@@@Z
?ExchangeData@CAdUiBaseDialog@@UEAAHH@Z
?Create@CAdUiBaseDialog@@UEAAHIPEAVCWnd@@@Z

acui24

?FindContextHelpFullPath@CAcUiDialog@@MEAAHPEB_WAEAV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?AppResourceInstance@CAcUiDialog@@UEAAPEAUHINSTANCE__@@XZ
?GetThisMessageMap@CAcUiDialog@@KAPEBUAFX_MSGMAP@@XZ
?AppMainWindow@CAcUiDialog@@UEAAPEAVCWnd@@XZ
??1CAcUiDialog@@UEAA@XZ
?OnInitDialog@CAcUiDialog@@UEAAHXZ
??0CAcUiDialog@@QEAA@IPEAVCWnd@@PEAUHINSTANCE__@@@Z
?GetThisClass@CAcUiDialog@@SAPEAUCRuntimeClass@@XZ
?AppRootKey@CAcUiDialog@@UEAAPEB_WXZ
?EnableFloatingWindows@CAcUiDialog@@UEAAXH@Z
?IsMultiDocumentActivationEnabled@CAcUiDialog@@UEAAHXZ
?EnableMultiDocumentActivation@CAcUiDialog@@UEAAHH@Z
?InitAcUiDLL@@YAXXZ
?DoDataExchange@CAcUiDialog@@MEAAXPEAVCDataExchange@@@Z
?OnCancel@CAcUiDialog@@MEAAXXZ
?OnOK@CAcUiDialog@@MEAAXXZ
?OnDialogHelp@CAcUiDialog@@UEAAXXZ

mfc140u

ord556
ord1172
ord12036
ord14231
ord5680
ord7765
ord8205
ord5961
ord2223
ord2351
ord8575
ord878
ord1369
ord2514
ord4357
ord7182
ord8471
ord2786
ord12706
ord13864
ord6636
ord4303
ord13568
ord6634
ord9159
ord11081
ord11322
ord1454
ord2311
ord6866
ord2260
ord492
ord5987
ord2273
ord829
ord12233
ord2488
ord5452
ord7869
ord830
ord2561
ord3936
ord13030
ord4648
ord5043
ord939
ord3839
ord1408
ord6256
ord9941
ord7227
ord841
ord12207
ord12566
ord9681
ord1352
ord5573
ord985
ord1452
ord6361
ord3803
ord2479
ord13999
ord4086
ord8441
ord9392
ord10427
ord3078
ord973
ord2006
ord1440
ord12761
ord6619
ord13761
ord14220
ord12239
ord1489
ord6505
ord13598
ord1504
ord1501
ord280
ord2344
ord2346
ord13419
ord265
ord7233
ord11813
ord6000
ord13397
ord2697
ord8901
ord11854
ord1089
ord8731
ord10704
ord11085
ord10163
ord3951
ord446
ord3307
ord3308
ord3071
ord6285
ord3212
ord3209
ord9946
ord7913
ord14360
ord9976
ord9978
ord9977
ord9975
ord9979
ord5451
ord11414
ord11415
ord8830
ord11771
ord3718
ord11625
ord14209
ord8656
ord6729
ord10691
ord8947
ord3173
ord13513
ord11944
ord11940
ord1722
ord1748
ord1734
ord1755
ord4776
ord4843
ord4788
ord4806
ord4800
ord4794
ord4853
ord4837
ord4782
ord4859
ord4814
ord4752
ord4767
ord4828
ord4360
ord5582
ord9384
ord4352
ord2967
ord14211
ord7651
ord14217
ord14128
ord6631
ord13199
ord11406
ord13354
ord5723
ord5240
ord2629
ord11806
ord3812
ord3278
ord3279
ord3172
ord11850
ord5080
ord5363
ord5552
ord9041
ord5339
ord5083
ord5229
ord5062
ord7460
ord7461
ord7450
ord5227
ord7922
ord3697
ord1503
ord1033
ord296
ord1491
ord8161
ord12936
ord4585
ord2473
ord14075
ord8182
ord4954
ord7928
ord7872
ord4721
ord6282
ord6247
ord357
ord6250
ord886
ord6549
ord3756
ord2475
ord4722
ord6320
ord3484
ord320
ord2357
ord7068
ord6313
ord1670
ord1111
ord6303
ord8819
ord1057
ord3746
ord2906
ord8439
ord4081
ord5672
ord3058
ord2340
ord13767
ord5237
ord13955
ord6724
ord2222
ord2336
ord2234
ord473
ord2270
ord2187
ord8449
ord8507
ord3599
ord4696
ord3143
ord1164
ord12280
ord7759
ord2983
ord13891
ord3728
ord4726
ord261
ord2212
ord1637
ord8206
ord543
ord1163
ord5960
ord12279
ord12375
ord1636
ord542
ord12933
ord12824
ord1332
ord12320
ord12930
ord13595
ord811
ord6504
ord290
ord14027
ord2909
ord8451
ord12326
ord1428
ord12932
ord13597
ord962
ord1443
ord12934
ord975
ord14278
ord12087
ord14225
ord12030
ord4656
ord8058
ord12600
ord8452
ord14033
ord14039
ord8409
ord4511
ord4510
ord12443
ord2903
ord5709
ord286
ord285
ord2921
ord12926
ord12240
ord5742
ord4725
ord1149
ord3089
ord528
ord1055
ord361
ord4030
ord4499
ord12967
ord281
ord8817
ord1053
ord3056
ord6251
ord7394
ord6002
ord13401
ord2698
ord3713
ord11902
ord7551
ord990
ord8900
ord12746
ord1086
ord8063
ord8501
ord5044
ord12700
ord13753
ord13757
ord12697
ord13742
ord8572
ord13745
ord13345
ord13679
ord12963
ord12763
ord12762
ord12771
ord12546
ord12631
ord438
ord1700
ord12259
ord4946
ord4913
ord4181
ord1631
ord266
ord2350
ord6258

kernel32

CloseHandle
EnterCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
GetTickCount
MulDiv
GlobalLock
GlobalUnlock
GlobalSize
GetProcAddress
GetModuleHandleW
GetVersionExW
lstrcpyW
IsProcessorFeaturePresent
GetCurrentProcess
GlobalFree
GlobalReAlloc
GlobalAlloc
FindResourceW
LockResource
LoadResource
lstrlenW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
OutputDebugStringW
LocalFree
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
MultiByteToWideChar
InitializeSListHead
WideCharToMultiByte
LeaveCriticalSection
GetLastError

user32

GetSystemMetrics
DrawFrameControl
SystemParametersInfoW
LoadBitmapW
GetTabbedTextExtentW
GetMenuItemInfoW
ModifyMenuW
GetMenuItemCount
GetMenuItemID
GetSubMenu
GetMenuState
LoadImageW
DestroyCursor
GetParent
GetWindowLongW
PtInRect
OffsetRect
InflateRect
GetKeyState
FrameRect
FillRect
DrawFocusRect
GetSysColor
SetCursor
GetClientRect
RedrawWindow
IsRectEmpty
TabbedTextOutW
DrawStateW
GrayStringW
DrawTextExW
DrawTextW
ReleaseCapture
SetCapture
GetCapture
GetMessagePos
LoadStringW
LoadIconW
MessageBeep
GetWindowRect
SendMessageW
EnableWindow
ClientToScreen
ScreenToClient
LoadCursorW
GetDC
WindowFromPoint
ReleaseDC
DrawEdge
SetRect
RegisterWindowMessageW
TranslateMessage
DispatchMessageW
PostMessageW
InvalidateRect
DefWindowProcW
GetClassInfoW
IsClipboardFormatAvailable
GetFocus
SetTimer
KillTimer
SetActiveWindow
GetCursorPos
ClipCursor
IsWindow
InvertRect
IntersectRect
LoadMenuW
EnableMenuItem
GetDoubleClickTime
IsWindowVisible
CopyRect
GetActiveWindow

gdi32

GetDeviceCaps
GetCurrentObject
GetTextExtentPoint32W
CreateFontIndirectW
PatBlt
CreateFontW
CreatePen
GetObjectW
ExtTextOutW
TextOutW
GetTextMetricsW
PtVisible
Escape
DeleteObject
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
RectVisible
SelectObject
GetBkColor

advapi32

RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegCloseKey

comctl32

ImageList_GetImageInfo
ord8
ImageList_GetIcon
ImageList_AddMasked
ImageList_Draw
ImageList_SetBkColor

oleaut32

VarUdateFromDate
SysAllocString
SysFreeString
VariantTimeToSystemTime
SystemTimeToVariantTime

acpal

?acHeapFree@@YAXPEAX0@Z
?acHeapAlloc@@YAPEAXPEAX_K@Z

th_uibase.arx

?setTransParency@@YAXPEAVCWnd@@@Z
?SdShowMsg@@YAXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@0HH@Z

th_arxbase.arx

?asArray@TH_ARXSelectSet@@QEAAXAEAV?$AcArray@VAcDbObjectId@@V?$AcArrayMemCopyReallocator@VAcDbObjectId@@@@@@@Z
??1TH_ARXSelectSet@@UEAA@XZ
??0TH_ARXSelectSet@@QEAA@XZ
?setXdata@TH_ARXAppXdata@@QEAA?AW4ErrorStatus@Acad@@PEAVAcDbObject@@@Z
?getXdata@TH_ARXAppXdata@@QEAAXPEAVAcDbObject@@@Z
?setHandle@TH_ARXAppXdata@@QEAAXHAEBVAcDbHandle@@@Z
?setString@TH_ARXAppXdata@@QEAAXHPEB_W@Z
?getHandle@TH_ARXAppXdata@@QEAA_NHAEAVAcDbHandle@@_N@Z
?getString@TH_ARXAppXdata@@QEAA_NHAEAV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@_N@Z
??1TH_ARXAppXdata@@UEAA@XZ
??0TH_ARXAppXdata@@QEAA@PEB_WPEAVAcDbDatabase@@@Z
?userSelect@TH_ARXSelectSet@@QEAA?AW4SelSetStatus@1@PEB_W0PEBUresbuf@@@Z

pccadbase.arx

?GetPccadPath@@YA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?rx_getTextStyle@@YA?AW4ErrorStatus@Acad@@AEAVAcGiTextStyle@@VAcDbObjectId@@@Z

th_calcoper

?ValidateCheck@THCalcOperate@@QEAAHXZ
?clear@THCalcOperate@@QEAAXXZ
?getExpVarMap@THCalcOperate@@QEAAHAEAVCMapStringToString@@@Z
??1THCalcOperate@@UEAA@XZ
?setValMap@THCalcOperate@@QEAAXAEBVCMapStringToString@@@Z
?setExpName@THCalcOperate@@QEAAXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?setExpress@THCalcOperate@@QEAAXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
??0THCalcOperate@@QEAA@XZ
?Initialize@THCalcOperate@@QEAAHXZ

thtabledatapickup.arx

?GetData@THTablePickUpEngine@@QEAAXAEAV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?DoPickUp@THTablePickUpEngine@@QEAA_NH@Z
??1THTablePickUpEngine@@UEAA@XZ
??0THTablePickUpEngine@@QEAA@XZ

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_type_info_destroy_list
__current_exception_context
__current_exception
__C_specific_handler
_CxxThrowException
_purecall
__std_terminate
memset
memcpy

api-ms-win-crt-runtime-l1-1-0

_errno
_initterm_e
_initterm
_cexit
_invalid_parameter_noinfo
_crt_atexit
terminate
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table

api-ms-win-crt-convert-l1-1-0

wcstoul
_wtoi
_wtof
_itoa

api-ms-win-crt-heap-l1-1-0

_recalloc
free
calloc

api-ms-win-crt-string-l1-1-0

isdigit
_wcsicmp

api-ms-win-crt-time-l1-1-0

_localtime64_s
_time64
wcsftime

Exports

Exports

??0TH_HAttBlockData@@QEAA@VAcDbObjectId@@@Z
??0TH_HAttBlockData@@QEAA@XZ
??1TH_HAttBlockData@@QEAA@XZ
?AddMapArray@TH_HAttBlockData@@AEAAXAEAV?$CArray@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@V12@@@0H@Z
?GetBasePoint@TH_HAttBlockData@@QEBA?AVAcGePoint3d@@XZ
?GetCode@TH_HAttBlockData@@AEAA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@V23@@Z
?GetFileName@TH_HAttBlockData@@QEBA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?GetHBlockPath@TH_HAttBlockData@@QEBA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?GetKeyByCode@TH_HAttBlockData@@QEAA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@V23@@Z
?GetNormal@TH_HAttBlockData@@QEBA?AVAcGeVector3d@@XZ
?GetPosition@TH_HAttBlockData@@QEBA?AVAcGePoint3d@@XZ
?GetRotation@TH_HAttBlockData@@QEBANXZ
?GetScaleFactors@TH_HAttBlockData@@QEBA?AVAcGeScale3d@@XZ
?GetTextHeight@TH_HAttBlockData@@QEBANXZ
?GetTextStyle@TH_HAttBlockData@@QEBA?AVAcDbObjectId@@XZ
?GetValueByCode@TH_HAttBlockData@@QEAA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@V23@@Z
?HBlockDefinition@TH_HAttBlockData@@QEAAHXZ
?HBlockEditForGetAtt@TH_HAttBlockData@@QEAAHVAcDbObjectId@@@Z
?HBlockEditForSetAtt@TH_HAttBlockData@@QEAAHVAcDbObjectId@@@Z
?HBlockReference@TH_HAttBlockData@@QEAA?AVAcDbObjectId@@V2@@Z
?HBlockReference@TH_HAttBlockData@@QEAA?AVAcDbObjectId@@XZ
?InitComboMapArray@TH_HAttBlockData@@AEAAXPEAVCMapStringToPtr@@@Z
?ReturnValueByMap@TH_HAttBlockData@@AEAAXAEAV?$CTypedPtrArray@VCObArray@@PEAVCMapStringToString@@@@@Z
?SetBasePoint@TH_HAttBlockData@@QEAAXAEBVAcGePoint3d@@@Z
?SetFileName@TH_HAttBlockData@@QEAAXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?SetHBlockPath@TH_HAttBlockData@@QEAAXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?SetNormal@TH_HAttBlockData@@QEAAXAEBVAcGeVector3d@@@Z
?SetPosition@TH_HAttBlockData@@QEAAXAEBVAcGePoint3d@@@Z
?SetRotation@TH_HAttBlockData@@QEAAXN@Z
?SetScaleFactors@TH_HAttBlockData@@QEAAXAEBVAcGeScale3d@@@Z
?SetTextHeight@TH_HAttBlockData@@QEAAXN@Z
?SetTextStyle@TH_HAttBlockData@@QEAAXVAcDbObjectId@@@Z
?SetValueByCode@TH_HAttBlockData@@QEAA_NV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@0@Z
?ToAddXData@TH_HAttBlockData@@AEAAHV?$AcArray@VAcDbObjectId@@V?$AcArrayMemCopyReallocator@VAcDbObjectId@@@@@@@Z
?ToEditAttDef@TH_HAttBlockData@@AEAAHV?$AcArray@VAcDbObjectId@@V?$AcArrayMemCopyReallocator@VAcDbObjectId@@@@@@@Z
?ToFindFileName@TH_HAttBlockData@@AEAAHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@AEAVAcDbObjectId@@@Z
?ToGetBlockName@TH_HAttBlockData@@AEAA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@V23@@Z
?ToGetHBlockName@TH_HAttBlockData@@QEAA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?ToInitAttValue@TH_HAttBlockData@@AEAAHVAcDbObjectId@@@Z
?ToMakeEditMap@TH_HAttBlockData@@AEAAHVAcDbObjectId@@@Z
?ToMakeEditMapOrder@TH_HAttBlockData@@AEAAXAEAV?$CTypedPtrArray@VCObArray@@PEAVCMapStringToString@@@@@Z
?ToMakeXData@TH_HAttBlockData@@AEAAHPEAVAcDbDatabase@@AEAPEAVAcDbEntity@@J@Z
?ToRefBlock@TH_HAttBlockData@@AEAA?AVAcDbObjectId@@V2@@Z
?ToSelectSSet@TH_HAttBlockData@@AEAAHV?$AcArray@VAcDbObjectId@@V?$AcArrayMemCopyReallocator@VAcDbObjectId@@@@@@@Z
?ToSetAttAigVal@TH_HAttBlockData@@AEAA_NPEAVAcDbAttribute@@PEAVAcDbAttributeDefinition@@PEAVAcDbBlockReference@@@Z
?ToSetAttNumVal@TH_HAttBlockData@@AEAAXPEAVAcDbAttribute@@PEAVAcDbAttributeDefinition@@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?ToShowAttRef@TH_HAttBlockData@@AEAAHVAcDbObjectId@@@Z
?UpdateEdValueByMap@TH_HAttBlockData@@QEAAXAEBVCMapStringToString@@@Z
?UpdateValueByMap@TH_HAttBlockData@@QEAAXAEBVCMapStringToString@@@Z
?alignmentAttribute@TH_HAttBlockData@@QEAA_NVAcDbObjectId@@@Z
acrxEntryPoint
acrxGetApiVersion

Sections

.text
Size: 185KB - Virtual size: 184KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 78KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

ARXCOMMA
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

ADSSYMBO
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

DBXCUSTO
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2679b423fb786d0651b26e363c292a71

Headers

DLL Characteristics

File Characteristics

Imports

ac1st24

acge24

acdb24

accore

adui24

acui24

mfc140u

kernel32

user32

gdi32

advapi32

comctl32

oleaut32

acpal

th_uibase.arx

th_arxbase.arx

pccadbase.arx

th_calcoper

thtabledatapickup.arx

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

Exports

Exports

Sections

.text Size: 185KB - Virtual size: 184KB

.rdata Size: 78KB - Virtual size: 77KB

.data Size: 28KB - Virtual size: 29KB

.pdata Size: 8KB - Virtual size: 7KB

ARXCOMMA Size: 512B - Virtual size: 16B

ADSSYMBO Size: 512B - Virtual size: 16B

DBXCUSTO Size: 512B - Virtual size: 16B

.rsrc Size: 41KB - Virtual size: 41KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 185KB - Virtual size: 184KB

.rdata
Size: 78KB - Virtual size: 77KB

.data
Size: 28KB - Virtual size: 29KB

.pdata
Size: 8KB - Virtual size: 7KB

ARXCOMMA
Size: 512B - Virtual size: 16B

ADSSYMBO
Size: 512B - Virtual size: 16B

DBXCUSTO
Size: 512B - Virtual size: 16B

.rsrc
Size: 41KB - Virtual size: 41KB

.reloc
Size: 3KB - Virtual size: 3KB