5518166e4665c25308a6eba8905f18ab34913392247aa62ff17250eac1209ba2

Sharing

Copy URL Twitter E-mail

General

Target

5518166e4665c25308a6eba8905f18ab34913392247aa62ff17250eac1209ba2
Size

372KB
MD5

5cf0837d57ec9c9fca07bbbc4b64e590
SHA1

acabc5396444f6d8531927dceddc98d59df8f9a3
SHA256

5518166e4665c25308a6eba8905f18ab34913392247aa62ff17250eac1209ba2
SHA512

9c5c36a42feebc096518398d6fa8d5da80486158b79425dceee10b357d24d17f98d1cf2aaceda50200dfb9b51244c88e9ef1510b2d101cd461155455f86ec775
SSDEEP

6144:MEYfbqpHLrDPnASKxuMxhh0YZzn4jKqygTLjS5OGn8db:MEQbqpHPDPnAsShh0YAZTj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5518166e4665c25308a6eba8905f18ab34913392247aa62ff17250eac1209ba2

Files

5518166e4665c25308a6eba8905f18ab34913392247aa62ff17250eac1209ba2
.dll windows:6 windows x64 arch:x64

370382907cb3543ad661ab535f2cebde

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcp110

?_Xlength_error@std@@YAXPEBD@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Winerror_map@std@@YAPEBDH@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ

mfc110u

ord13770
ord12746
ord12073
ord5545
ord4828
ord4795
ord4122
ord1622
ord6371
ord2296
ord2286
ord1480
ord13419
ord1495
ord1492
ord280
ord1632
ord2290
ord2292
ord266
ord7085
ord11651
ord5871
ord13218
ord2643
ord8751
ord11692
ord1082
ord8582
ord10549
ord10922
ord10008
ord3892
ord445
ord3252
ord3253
ord3016
ord6155
ord3157
ord3154
ord9791
ord7758
ord9821
ord9823
ord9822
ord9820
ord9824
ord5327
ord11252
ord11253
ord1661
ord1104
ord6173
ord8670
ord1050
ord3688
ord2851
ord8292
ord4022
ord5543
ord3003
ord6128
ord13588
ord5113
ord13776
ord6586
ord2170
ord5613
ord4664
ord1142
ord3034
ord527
ord1048
ord360
ord3971
ord4438
ord12787
ord281
ord8668
ord1046
ord3001
ord6121
ord7246
ord5873
ord13222
ord2644
ord3655
ord11740
ord2866
ord984
ord8750
ord12578
ord1079
ord7907
ord8354
ord4925
ord12532
ord13574
ord13578
ord12529
ord13563
ord8425
ord13566
ord13166
ord13500
ord12783
ord12595
ord12594
ord12603
ord12378
ord12463
ord437
ord12092
ord12072
ord13240
ord8681
ord11609
ord3660
ord11463
ord14029
ord8507
ord6591
ord10536
ord8797
ord3118
ord13334
ord11779
ord11777
ord1685
ord1694
ord1702
ord1698
ord1707
ord4698
ord4735
ord4706
ord4718
ord4714
ord4710
ord4741
ord4731
ord4702
ord4745
ord4723
ord4687
ord4693
ord4726
ord12756
ord2419
ord4299
ord5456
ord9232
ord4291
ord2912
ord14031
ord7499
ord4660
ord6152
ord6117
ord356
ord6120
ord880
ord6415
ord3698
ord285
ord286
ord5580
ord2848
ord12275
ord4449
ord4450
ord8262
ord13860
ord13854
ord8305
ord12432
ord7902
ord4595
ord11864
ord14045
ord11921
ord14098
ord969
ord12754
ord1434
ord956
ord13418
ord12752
ord1419
ord12159
ord8304
ord7738
ord2854
ord14040
ord13582
ord6482
ord12593
ord1431
ord1957
ord967
ord3023
ord10272
ord9240
ord8294
ord4027
ord13820
ord2425
ord3744
ord6231
ord1443
ord979
ord5447
ord1343
ord9526
ord12398
ord12040
ord835
ord7079
ord9786
ord6126
ord1399
ord3780
ord933
ord4924
ord4587
ord12851
ord3877
ord2507
ord824
ord7714
ord5328
ord2434
ord12066
ord823
ord2220
ord5858
ord491
ord14037
ord13949
ord6493
ord13020
ord11244
ord13175
ord5594
ord5116
ord2575
ord11644
ord3753
ord3223
ord3224
ord3117
ord11688
ord4959
ord5239
ord5427
ord8891
ord5215
ord4962
ord5105
ord4943
ord7310
ord7311
ord2208
ord6726
ord2258
ord1445
ord11160
ord10919
ord9009
ord6496
ord13389
ord4242
ord6498
ord13685
ord12538
ord2732
ord8324
ord7035
ord4296
ord2460
ord1360
ord872
ord8428
ord2297
ord2171
ord5832
ord8049
ord7612
ord5551
ord14051
ord11870
ord1165
ord555
ord8005
ord4524
ord13896
ord8026
ord4836
ord7773
ord7717
ord3427
ord319
ord2303
ord6924
ord7398
ord6183
ord2421
ord4661
ord6190
ord2282
ord2182
ord472
ord2217
ord2136
ord8302
ord8360
ord3541
ord4635
ord3088
ord2160
ord1157
ord12113
ord7606
ord2928
ord13712
ord3670
ord4665
ord261
ord1628
ord8050
ord542
ord1156
ord5831
ord12112
ord12207
ord1627
ord541
ord12753
ord12656
ord1323
ord12153
ord7301
ord5103
ord7767
ord3639
ord1494
ord1027
ord296
ord1482
ord12750
ord13416
ord805
ord6370
ord290
ord13848

msvcr110

memmove
memcpy
_itoa
__clean_type_info_names_internal
__crtCapturePreviousContext
__crtTerminateProcess
__crtUnhandledException
__crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
_initterm_e
_initterm
_malloc_crt
_amsg_exit
__CppXcptFilter
_onexit
__dllonexit
_calloc_crt
_unlock
_lock
?terminate@@YAXXZ
__C_specific_handler
wcstoul
_time64
_localtime64_s
wcsftime
_CxxThrowException
_purecall
ldiv
_wcsicmp
_wtoi
isdigit
_wtof
_recalloc
free
calloc
memset
memcpy_s
__CxxFrameHandler3

kernel32

GlobalReAlloc
GlobalAlloc
LockResource
LoadResource
FreeResource
lstrlenW
LocalFree
MultiByteToWideChar
WideCharToMultiByte
GetLastError
GetTickCount64
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
IsProcessorFeaturePresent
IsDebuggerPresent
DecodePointer
EncodePointer
GetTickCount
MulDiv
GlobalUnlock
GlobalLock
GlobalSize
GetProcAddress
GetModuleHandleW
GetVersionExW
FindResourceW
lstrcpyW
GlobalFree

user32

WindowFromPoint
ClientToScreen
IsWindowVisible
GetDoubleClickTime
EnableMenuItem
LoadMenuW
IntersectRect
InvertRect
ClipCursor
GetCursorPos
SetActiveWindow
KillTimer
SetTimer
GetFocus
IsClipboardFormatAvailable
GetClassInfoW
DefWindowProcW
RegisterWindowMessageW
SetRect
DrawEdge
ReleaseDC
GetDC
LoadCursorW
ScreenToClient
GetMessagePos
GetKeyState
IsWindow
PostMessageW
DispatchMessageW
TranslateMessage
IsRectEmpty
GetSystemMetrics
DrawFrameControl
SystemParametersInfoW
LoadBitmapW
GetTabbedTextExtentW
GetMenuItemInfoW
ModifyMenuW
GetMenuItemCount
GetMenuItemID
GetSubMenu
GetMenuState
LoadImageW
DestroyCursor
GetParent
GetWindowLongW
PtInRect
OffsetRect
InflateRect
CopyRect
FrameRect
FillRect
DrawFocusRect
GetSysColor
SetCursor
GetClientRect
RedrawWindow
InvalidateRect
TabbedTextOutW
DrawStateW
GrayStringW
DrawTextExW
DrawTextW
ReleaseCapture
SetCapture
GetCapture
GetActiveWindow
LoadStringW
LoadIconW
MessageBeep
GetWindowRect
SendMessageW
EnableWindow

gdi32

PtVisible
RectVisible
SelectObject
TextOutW
ExtTextOutW
Escape
DeleteObject
CreateCompatibleDC
CreateCompatibleBitmap
PatBlt
GetObjectW
CreateFontIndirectW
CreatePen
CreateFontW
GetTextMetricsW
GetDeviceCaps
GetCurrentObject
GetTextExtentPoint32W
BitBlt

advapi32

RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegCloseKey

comctl32

ImageList_AddMasked
ImageList_Draw
ImageList_SetBkColor
ImageList_GetImageInfo
ImageList_GetIcon
ord8

oleaut32

SystemTimeToVariantTime
VariantTimeToSystemTime
VarUdateFromDate
SysAllocString
SysFreeString

acdb20

?desc@AcDbEntity@@SAPEAVAcRxClass@@XZ
?setPropertiesFrom@AcDbEntity@@QEAA?AW4ErrorStatus@Acad@@PEBV1@H@Z
?getGeomExtents@AcDbEntity@@UEBA?AW4ErrorStatus@Acad@@AEAVAcDbExtents@@@Z
?transformBy@AcDbEntity@@UEAA?AW4ErrorStatus@Acad@@AEBVAcGeMatrix3d@@@Z
?recordGraphicsModified@AcDbEntity@@QEAAXH@Z
??0AcDbExtents@@QEAA@XZ
??1AcGiTextStyle@@UEAA@XZ
?close@AcDbObject@@QEAA?AW4ErrorStatus@Acad@@XZ
?setTextSize@AcGiTextStyle@@UEAAXN@Z
?xScale@AcGiTextStyle@@UEBANXZ
?extents@AcGiTextStyle@@UEBA?AVAcGePoint2d@@PEB_WHHHPEAVAcGiWorldDraw@@@Z
?getAt@AcDbBlockTable@@QEBA?AW4ErrorStatus@Acad@@PEB_WAEAPEAVAcDbBlockTableRecord@@W4OpenMode@AcDb@@_N@Z
?getAt@AcDbBlockTable@@QEBA?AW4ErrorStatus@Acad@@PEB_WAEAVAcDbObjectId@@_N@Z
?getName@AcDbSymbolTableRecord@@QEBA?AW4ErrorStatus@Acad@@AEAPEA_W@Z
?start@AcDbBlockTableRecordIterator@@QEAAX_N0@Z
?database@AcDbObject@@QEBAPEAVAcDbDatabase@@XZ
?objectId@AcDbObject@@QEBA?AVAcDbObjectId@@XZ
?desc@AcDbObject@@SAPEAVAcRxClass@@XZ
?objectId@AcDbObjectIterator@@QEAA?AVAcDbObjectId@@XZ
?start@AcDbObjectIterator@@QEAAX_N@Z
?step@AcDbObjectIterator@@QEAAX_N0@Z
?done@AcDbObjectIterator@@QEBA_NXZ
?insert@AcDbDatabase@@QEAA?AW4ErrorStatus@Acad@@AEAVAcDbObjectId@@PEB_WPEAV1@_N@Z
?wblock@AcDbDatabase@@QEAA?AW4ErrorStatus@Acad@@AEAPEAV1@@Z
?wblock@AcDbDatabase@@QEAA?AW4ErrorStatus@Acad@@AEAPEAV1@AEBV?$AcArray@VAcDbObjectId@@V?$AcArrayMemCopyReallocator@VAcDbObjectId@@@@@@AEBVAcGePoint3d@@@Z
?saveAs@AcDbDatabase@@QEAA?AW4ErrorStatus@Acad@@PEB_W_NW4AcDbDwgVersion@AcDb@@PEBUSecurityParams@@@Z
?readDwgFile@AcDbDatabase@@QEAA?AW4ErrorStatus@Acad@@PEB_WW4OpenMode@1@_N0@Z
?getSymbolTable@AcDbDatabase@@QEAA?AW4ErrorStatus@Acad@@AEAPEAVAcDbBlockTable@@W4OpenMode@AcDb@@@Z
??1AcDbDatabase@@UEAA@XZ
??0AcDbDatabase@@QEAA@_N0@Z
?acdbOpenAcDbEntity@@YA?AW4ErrorStatus@Acad@@AEAPEAVAcDbEntity@@VAcDbObjectId@@W4OpenMode@AcDb@@_N@Z
?acdbOpenAcDbObject@@YA?AW4ErrorStatus@Acad@@AEAPEAVAcDbObject@@VAcDbObjectId@@W4OpenMode@AcDb@@PEBVAcRxClass@@_N@Z
?acdbOpenAcDbObject@@YA?AW4ErrorStatus@Acad@@AEAPEAVAcDbObject@@VAcDbObjectId@@W4OpenMode@AcDb@@_N@Z
?acutRelRb@@YAHPEAUresbuf@@@Z
?acutPrintf@@YAHPEB_WZZ
?c5ObjIdIsEqualTo@@YA_NPEBVAcDbStub@@0@Z
??0AcGiTextStyle@@QEAA@PEAVAcDbDatabase@@@Z
?setInvisible@AcDbAttribute@@QEAA?AW4ErrorStatus@Acad@@H@Z
?acutBuildList@@YAPEAUresbuf@@HZZ
?desc@AcRxDynamicLinker@@SAPEAVAcRxClass@@XZ
?acadErrorStatusText@@YAPEB_WW4ErrorStatus@Acad@@@Z
?acutDelBuffer@@YAXAEAPEAX@Z
?acdbHostApplicationServices@@YAPEAVAcDbHostApplicationServices@@XZ
?attributeIterator@AcDbBlockReference@@QEBAPEAVAcDbObjectIterator@@XZ
?appendAttribute@AcDbBlockReference@@QEAA?AW4ErrorStatus@Acad@@AEAVAcDbObjectId@@PEAVAcDbAttribute@@@Z
?rotation@AcDbBlockReference@@QEBANXZ
?scaleFactors@AcDbBlockReference@@QEBA?AVAcGeScale3d@@XZ
?blockTableRecord@AcDbBlockReference@@QEBA?AVAcDbObjectId@@XZ
?desc@AcDbBlockReference@@SAPEAVAcRxClass@@XZ
??0AcDbBlockReference@@QEAA@XZ
?handle@AcDbObjectId@@QEBA?AVAcDbHandle@@XZ
?setTag@AcDbAttribute@@QEAA?AW4ErrorStatus@Acad@@PEB_W@Z
?tag@AcDbAttribute@@QEBAPEA_WXZ
?desc@AcDbAttribute@@SAPEAVAcRxClass@@XZ
??0AcDbAttribute@@QEAA@XZ
?isConstant@AcDbAttributeDefinition@@QEBAHXZ
?setInvisible@AcDbAttributeDefinition@@QEAA?AW4ErrorStatus@Acad@@H@Z
?isInvisible@AcDbAttributeDefinition@@QEBAHXZ
?setTag@AcDbAttributeDefinition@@QEAA?AW4ErrorStatus@Acad@@PEB_W@Z
?tag@AcDbAttributeDefinition@@QEBAPEA_WXZ
?desc@AcDbAttributeDefinition@@SAPEAVAcRxClass@@XZ
??0AcDbAttributeDefinition@@QEAA@XZ
?setHorizontalMode@AcDbText@@QEAA?AW4ErrorStatus@Acad@@W4TextHorzMode@AcDb@@@Z
?horizontalMode@AcDbText@@QEBA?AW4TextHorzMode@AcDb@@XZ
?setTextStyle@AcDbText@@QEAA?AW4ErrorStatus@Acad@@VAcDbObjectId@@@Z
?textStyle@AcDbText@@QEBA?AVAcDbObjectId@@XZ
?setTextString@AcDbText@@QEAA?AW4ErrorStatus@Acad@@PEB_W@Z
?textString@AcDbText@@QEBAPEA_WXZ
?setWidthFactor@AcDbText@@QEAA?AW4ErrorStatus@Acad@@N@Z
?setHeight@AcDbText@@QEAA?AW4ErrorStatus@Acad@@N@Z
?height@AcDbText@@QEBANXZ
?setRotation@AcDbText@@QEAA?AW4ErrorStatus@Acad@@N@Z
?rotation@AcDbText@@QEBANXZ
?setNormal@AcDbText@@QEAA?AW4ErrorStatus@Acad@@AEBVAcGeVector3d@@@Z
?normal@AcDbText@@QEBA?AVAcGeVector3d@@XZ
?setAlignmentPoint@AcDbText@@QEAA?AW4ErrorStatus@Acad@@AEBVAcGePoint3d@@@Z
?alignmentPoint@AcDbText@@QEBA?AVAcGePoint3d@@XZ
?setPosition@AcDbText@@QEAA?AW4ErrorStatus@Acad@@AEBVAcGePoint3d@@@Z
?position@AcDbText@@QEBA?AVAcGePoint3d@@XZ
?setOrigin@AcDbBlockTableRecord@@QEAA?AW4ErrorStatus@Acad@@AEBVAcGePoint3d@@@Z
?newIterator@AcDbBlockTableRecord@@QEBA?AW4ErrorStatus@Acad@@AEAPEAVAcDbBlockTableRecordIterator@@_N1@Z
?appendAcDbEntity@AcDbBlockTableRecord@@QEAA?AW4ErrorStatus@Acad@@AEAVAcDbObjectId@@PEAVAcDbEntity@@@Z
?desc@AcDbBlockTableRecord@@SAPEAVAcRxClass@@XZ
?step@AcDbBlockTableRecordIterator@@QEAAX_N0@Z
?getEntity@AcDbBlockTableRecordIterator@@QEBA?AW4ErrorStatus@Acad@@AEAPEAVAcDbEntity@@W4OpenMode@AcDb@@_N@Z
?done@AcDbBlockTableRecordIterator@@QEBA_NXZ

acge20

?distanceTo@AcGePoint3d@@QEBANAEBV1@@Z
??0AcGeScale3d@@QEAA@XZ
??0AcGeScale3d@@QEAA@AEBV0@@Z
??0AcGeMatrix3d@@QEAA@XZ
?setToIdentity@AcGeMatrix3d@@QEAAAEAV1@XZ
?setToRotation@AcGeMatrix3d@@QEAAAEAV1@NAEBVAcGeVector3d@@AEBVAcGePoint3d@@@Z
?kOrigin@AcGePoint3d@@2V1@B
?kZAxis@AcGeVector3d@@2V1@B
?rotateBy@AcGePoint3d@@QEAAAEAV1@NAEBVAcGeVector3d@@AEBV1@@Z

ac1st20

acrx_abort
?isDerivedFrom@AcRxClass@@QEBA_NPEBV1@@Z
?allocRawMem@AcHeapOperators@@CAPEAX_K@Z
?freeRawMem@AcHeapOperators@@CAXPEAX@Z
acrxSysRegistry
?myParent@AcRxClass@@QEBAPEAV1@XZ
?subQueryX@AcRxObject@@MEBAPEAV1@PEBVAcRxClass@@@Z
?isEqualTo@AcRxObject@@UEBAHPEBV1@@Z
?copyFrom@AcRxObject@@UEAA?AW4ErrorStatus@Acad@@PEBV1@@Z
?comparedTo@AcRxObject@@UEBA?AW4Ordering@AcRx@@PEBV1@@Z
?clone@AcRxObject@@UEBAPEAV1@XZ
??0AcRxObject@@IEAA@XZ
?deleteAcRxClass@@YAXPEAVAcRxClass@@@Z
?acrxBuildClassHierarchy@@YAXXZ

accore

?adsw_acadMainWnd@@YAPEAUHWND__@@XZ
?acedRegFunc@@YAHP6AHXZH@Z
?acedDefun@@YAHPEB_WH@Z
?acedUndef@@YAHPEB_WH@Z
?acedGetFunCode@@YAHXZ
?desc@AcEdCommandStack@@SAPEAVAcRxClass@@XZ
?isA@AcApDocManagerReactor@@UEBAPEAVAcRxClass@@XZ
?documentCreateStarted@AcApDocManagerReactor@@UEAAXPEAVAcApDocument@@@Z
?documentCreated@AcApDocManagerReactor@@UEAAXPEAVAcApDocument@@@Z
?documentDestroyed@AcApDocManagerReactor@@UEAAXPEB_W@Z
?documentCreateCanceled@AcApDocManagerReactor@@UEAAXPEAVAcApDocument@@@Z
?documentLockModeWillChange@AcApDocManagerReactor@@UEAAXPEAVAcApDocument@@W4DocLockMode@AcAp@@11PEB_W@Z
?documentLockModeChangeVetoed@AcApDocManagerReactor@@UEAAXPEAVAcApDocument@@PEB_W@Z
?documentLockModeChanged@AcApDocManagerReactor@@UEAAXPEAVAcApDocument@@W4DocLockMode@AcAp@@11PEB_W@Z
?documentBecameCurrent@AcApDocManagerReactor@@UEAAXPEAVAcApDocument@@@Z
?documentToBeActivated@AcApDocManagerReactor@@UEAAXPEAVAcApDocument@@@Z
?documentToBeDeactivated@AcApDocManagerReactor@@UEAAXPEAVAcApDocument@@@Z
?documentActivationModified@AcApDocManagerReactor@@UEAAX_N@Z
?documentActivated@AcApDocManagerReactor@@UEAAXPEAVAcApDocument@@@Z
?acedInvoke@@YAHPEBUresbuf@@PEAPEAU1@@Z
?acDocManagerPtr@@YAPEAVAcApDocManager@@XZ

acui20

?FindContextHelpFullPath@CAcUiDialog@@MEAAHPEB_WAEAV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?AppMainWindow@CAcUiDialog@@UEAAPEAVCWnd@@XZ
?AppResourceInstance@CAcUiDialog@@UEAAPEAUHINSTANCE__@@XZ
?AppRootKey@CAcUiDialog@@UEAAPEB_WXZ
?EnableFloatingWindows@CAcUiDialog@@UEAAXH@Z
?IsMultiDocumentActivationEnabled@CAcUiDialog@@UEAAHXZ
?EnableMultiDocumentActivation@CAcUiDialog@@UEAAHH@Z
?OnDialogHelp@CAcUiDialog@@UEAAXXZ
?OnInitDialog@CAcUiDialog@@UEAAHXZ
?OnOK@CAcUiDialog@@MEAAXXZ
?OnCancel@CAcUiDialog@@MEAAXXZ
?DoDataExchange@CAcUiDialog@@MEAAXPEAVCDataExchange@@@Z
?InitAcUiDLL@@YAXXZ
?GetThisClass@CAcUiDialog@@SAPEAUCRuntimeClass@@XZ
??0CAcUiDialog@@QEAA@IPEAVCWnd@@PEAUHINSTANCE__@@@Z
??1CAcUiDialog@@UEAA@XZ
?GetThisMessageMap@CAcUiDialog@@KAPEBUAFX_MSGMAP@@XZ

adui20

?DoModal@CAdUiBaseDialog@@UEAA_JXZ
?DoAdUiMessage@CAdUiBaseDialog@@MEAA?AW4ADUI_REPLY@@W4ADUI_NOTIFY@@I_J@Z
?OnNotifyControlChange@CAdUiBaseDialog@@MEAA?AW4ADUI_REPLY@@I_J@Z
?OnNotifyControlValid@CAdUiBaseDialog@@MEAA?AW4ADUI_REPLY@@IH@Z
?OnNotifyGeneric@CAdUiBaseDialog@@MEAA?AW4ADUI_REPLY@@I_J@Z
?OnNotifyUpdateTip@CAdUiBaseDialog@@MEAA?AW4ADUI_REPLY@@PEAVCWnd@@@Z
?Create@CAdUiBaseDialog@@UEAAHPEB_WPEAVCWnd@@@Z
?Create@CAdUiBaseDialog@@UEAAHIPEAVCWnd@@@Z
?ExchangeData@CAdUiBaseDialog@@UEAAHH@Z
?PreTranslateMessage@CAdUiBaseDialog@@UEAAHPEAUtagMSG@@@Z
?PostNcDestroy@CAdUiBaseDialog@@MEAAXXZ
?PreCreateWindow@CAdUiBaseDialog@@MEAAHAEAUtagCREATESTRUCTW@@@Z
?OnInitDialogBegin@CAdUiDialog@@MEAAXXZ
?OnInitDialogFinish@CAdUiDialog@@MEAAXXZ
?DoDialogHelp@CAdUiDialog@@UEAAHXZ
?OnSize@CAdUiDialog@@IEAAXIHH@Z
?BeginEditorCommand@CAdUiBaseDialog@@IEAAXXZ
?CompleteEditorCommand@CAdUiBaseDialog@@IEAAXH@Z

th_uibase.arx

?setTransParency@@YAXPEAVCWnd@@@Z
?SdShowMsg@@YAXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@0HH@Z

th_arxbase.arx

??1TH_ARXAppXdata@@UEAA@XZ
?userSelect@TH_ARXSelectSet@@QEAA?AW4SelSetStatus@1@PEB_W0PEBUresbuf@@@Z
??1TH_ARXSelectSet@@UEAA@XZ
??0TH_ARXSelectSet@@QEAA@XZ
?setXdata@TH_ARXAppXdata@@QEAA?AW4ErrorStatus@Acad@@PEAVAcDbObject@@@Z
?getXdata@TH_ARXAppXdata@@QEAAXPEAVAcDbObject@@@Z
?setHandle@TH_ARXAppXdata@@QEAAXHAEBVAcDbHandle@@@Z
?setString@TH_ARXAppXdata@@QEAAXHPEB_W@Z
?getHandle@TH_ARXAppXdata@@QEAA_NHAEAVAcDbHandle@@_N@Z
?getString@TH_ARXAppXdata@@QEAA_NHAEAV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@_N@Z
?asArray@TH_ARXSelectSet@@QEAAXAEAV?$AcArray@VAcDbObjectId@@V?$AcArrayMemCopyReallocator@VAcDbObjectId@@@@@@@Z
??0TH_ARXAppXdata@@QEAA@PEB_WPEAVAcDbDatabase@@@Z

pccadbase.arx

?GetPccadPath@@YA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?rx_getTextStyle@@YA?AW4ErrorStatus@Acad@@AEAVAcGiTextStyle@@VAcDbObjectId@@@Z

th_calcoper

?Initialize@THCalcOperate@@QEAAHXZ
?clear@THCalcOperate@@QEAAXXZ
?getExpVarMap@THCalcOperate@@QEAAHAEAVCMapStringToString@@@Z
?setExpress@THCalcOperate@@QEAAXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
??0THCalcOperate@@QEAA@XZ
??1THCalcOperate@@UEAA@XZ
?ValidateCheck@THCalcOperate@@QEAAHXZ
?setExpName@THCalcOperate@@QEAAXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?setValMap@THCalcOperate@@QEAAXAEBVCMapStringToString@@@Z

thtabledatapickup.arx

?GetData@THTablePickUpEngine@@QEAAXAEAV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?DoPickUp@THTablePickUpEngine@@QEAA_NH@Z
??1THTablePickUpEngine@@UEAA@XZ
??0THTablePickUpEngine@@QEAA@XZ

Exports

Exports

??0TH_HAttBlockData@@QEAA@VAcDbObjectId@@@Z
??0TH_HAttBlockData@@QEAA@XZ
??1TH_HAttBlockData@@QEAA@XZ
?AddMapArray@TH_HAttBlockData@@AEAAXAEAV?$CArray@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@V12@@@0H@Z
?GetBasePoint@TH_HAttBlockData@@QEBA?AVAcGePoint3d@@XZ
?GetCode@TH_HAttBlockData@@AEAA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@V23@@Z
?GetFileName@TH_HAttBlockData@@QEBA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?GetHBlockPath@TH_HAttBlockData@@QEBA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?GetKeyByCode@TH_HAttBlockData@@QEAA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@V23@@Z
?GetNormal@TH_HAttBlockData@@QEBA?AVAcGeVector3d@@XZ
?GetPosition@TH_HAttBlockData@@QEBA?AVAcGePoint3d@@XZ
?GetRotation@TH_HAttBlockData@@QEBANXZ
?GetScaleFactors@TH_HAttBlockData@@QEBA?AVAcGeScale3d@@XZ
?GetTextHeight@TH_HAttBlockData@@QEBANXZ
?GetTextStyle@TH_HAttBlockData@@QEBA?AVAcDbObjectId@@XZ
?GetValueByCode@TH_HAttBlockData@@QEAA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@V23@@Z
?HBlockDefinition@TH_HAttBlockData@@QEAAHXZ
?HBlockEditForGetAtt@TH_HAttBlockData@@QEAAHVAcDbObjectId@@@Z
?HBlockEditForSetAtt@TH_HAttBlockData@@QEAAHVAcDbObjectId@@@Z
?HBlockReference@TH_HAttBlockData@@QEAA?AVAcDbObjectId@@V2@@Z
?HBlockReference@TH_HAttBlockData@@QEAA?AVAcDbObjectId@@XZ
?InitComboMapArray@TH_HAttBlockData@@AEAAXPEAVCMapStringToPtr@@@Z
?ReturnValueByMap@TH_HAttBlockData@@AEAAXAEAV?$CTypedPtrArray@VCObArray@@PEAVCMapStringToString@@@@@Z
?SetBasePoint@TH_HAttBlockData@@QEAAXAEBVAcGePoint3d@@@Z
?SetFileName@TH_HAttBlockData@@QEAAXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?SetHBlockPath@TH_HAttBlockData@@QEAAXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?SetNormal@TH_HAttBlockData@@QEAAXAEBVAcGeVector3d@@@Z
?SetPosition@TH_HAttBlockData@@QEAAXAEBVAcGePoint3d@@@Z
?SetRotation@TH_HAttBlockData@@QEAAXN@Z
?SetScaleFactors@TH_HAttBlockData@@QEAAXAEBVAcGeScale3d@@@Z
?SetTextHeight@TH_HAttBlockData@@QEAAXN@Z
?SetTextStyle@TH_HAttBlockData@@QEAAXVAcDbObjectId@@@Z
?SetValueByCode@TH_HAttBlockData@@QEAA_NV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@0@Z
?ToAddXData@TH_HAttBlockData@@AEAAHV?$AcArray@VAcDbObjectId@@V?$AcArrayMemCopyReallocator@VAcDbObjectId@@@@@@@Z
?ToEditAttDef@TH_HAttBlockData@@AEAAHV?$AcArray@VAcDbObjectId@@V?$AcArrayMemCopyReallocator@VAcDbObjectId@@@@@@@Z
?ToFindFileName@TH_HAttBlockData@@AEAAHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@AEAVAcDbObjectId@@@Z
?ToGetBlockName@TH_HAttBlockData@@AEAA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@V23@@Z
?ToGetHBlockName@TH_HAttBlockData@@QEAA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?ToInitAttValue@TH_HAttBlockData@@AEAAHVAcDbObjectId@@@Z
?ToMakeEditMap@TH_HAttBlockData@@AEAAHVAcDbObjectId@@@Z
?ToMakeEditMapOrder@TH_HAttBlockData@@AEAAXAEAV?$CTypedPtrArray@VCObArray@@PEAVCMapStringToString@@@@@Z
?ToMakeXData@TH_HAttBlockData@@AEAAHPEAVAcDbDatabase@@AEAPEAVAcDbEntity@@J@Z
?ToRefBlock@TH_HAttBlockData@@AEAA?AVAcDbObjectId@@V2@@Z
?ToSelectSSet@TH_HAttBlockData@@AEAAHV?$AcArray@VAcDbObjectId@@V?$AcArrayMemCopyReallocator@VAcDbObjectId@@@@@@@Z
?ToSetAttAigVal@TH_HAttBlockData@@AEAA_NPEAVAcDbAttribute@@PEAVAcDbAttributeDefinition@@PEAVAcDbBlockReference@@@Z
?ToSetAttNumVal@TH_HAttBlockData@@AEAAXPEAVAcDbAttribute@@PEAVAcDbAttributeDefinition@@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?ToShowAttRef@TH_HAttBlockData@@AEAAHVAcDbObjectId@@@Z
?UpdateEdValueByMap@TH_HAttBlockData@@QEAAXAEBVCMapStringToString@@@Z
?UpdateValueByMap@TH_HAttBlockData@@QEAAXAEBVCMapStringToString@@@Z
?alignmentAttribute@TH_HAttBlockData@@QEAA_NVAcDbObjectId@@@Z
acrxEntryPoint
acrxGetApiVersion

Sections

.text
Size: 191KB - Virtual size: 190KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 94KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

ARXCOMMA
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

ADSSYMBO
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

DBXCUSTO
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

370382907cb3543ad661ab535f2cebde

Headers

DLL Characteristics

File Characteristics

Imports

msvcp110

mfc110u

msvcr110

kernel32

user32

gdi32

advapi32

comctl32

oleaut32

acdb20

acge20

ac1st20

accore

acui20

adui20

th_uibase.arx

th_arxbase.arx

pccadbase.arx

th_calcoper

thtabledatapickup.arx

Exports

Exports

Sections

.text Size: 191KB - Virtual size: 190KB

.rdata Size: 94KB - Virtual size: 94KB

.data Size: 28KB - Virtual size: 29KB

.pdata Size: 8KB - Virtual size: 8KB

ARXCOMMA Size: 512B - Virtual size: 16B

ADSSYMBO Size: 512B - Virtual size: 16B

DBXCUSTO Size: 512B - Virtual size: 16B

.rsrc Size: 41KB - Virtual size: 41KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 191KB - Virtual size: 190KB

.rdata
Size: 94KB - Virtual size: 94KB

.data
Size: 28KB - Virtual size: 29KB

.pdata
Size: 8KB - Virtual size: 8KB

ARXCOMMA
Size: 512B - Virtual size: 16B

ADSSYMBO
Size: 512B - Virtual size: 16B

DBXCUSTO
Size: 512B - Virtual size: 16B

.rsrc
Size: 41KB - Virtual size: 41KB

.reloc
Size: 6KB - Virtual size: 5KB