1cda496be4d923d6c443c2fc3a7eb7a0d67d629aa58624b051a69c76714f79ff

Sharing

Copy URL

Twitter E-mail

General

Target

1cda496be4d923d6c443c2fc3a7eb7a0d67d629aa58624b051a69c76714f79ff
Size

751KB
MD5

5e8ccd9af139405a896fa2519cb952ed
SHA1

1682aedb9c3d45dee2a1404a2c42acdb7f6347a6
SHA256

1cda496be4d923d6c443c2fc3a7eb7a0d67d629aa58624b051a69c76714f79ff
SHA512

a997835b91e544fb17bf9e67831edb2a171e1f5cc3377557c8336e109bda38caee57a7d2018fe7e78fd785b0d322c933920cae0e20f791ebd10721466d3cef9a
SSDEEP

12288:vhyRFglwLaZxfiBAxtLi8yDye4iRJNGilfv6hqm+X/gzBDPDiSdXu5ga:3wqcAx5cDiiRJNG6v6A1/g1DP9Xu5v

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1cda496be4d923d6c443c2fc3a7eb7a0d67d629aa58624b051a69c76714f79ff

Files

1cda496be4d923d6c443c2fc3a7eb7a0d67d629aa58624b051a69c76714f79ff
.dll windows:5 windows x86 arch:x86

8f42b18881a1d54654278fea62d9061a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

gdiplus

GdipClosePathFigure
GdipAddPathLine
GdipDeletePath
GdipAddPathPolygon
GdipGetPointCount
GdipCreatePath
GdipAddPathLine2
GdipResetPath

mfc90

ord1087
ord1137
ord1603
ord266
ord798
ord300
ord817
ord4311
ord910
ord316
ord820
ord601
ord800
ord452
ord321
ord6148
ord2480
ord899
ord3178
ord605
ord1278
ord1243
ord1241
ord1268
ord1180
ord1233
ord2084
ord391
ord1152
ord1277
ord1275
ord1145
ord1075
ord322
ord801
ord310
ord265
ord2539
ord945

msvcr90

_access
_close
_read
_lseek
ftell
__clean_type_info_names_internal
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBD@Z
__CxxFrameHandler3
?what@exception@std@@UBEPBDXZ
_mbsnbcpy
??0exception@std@@QAE@XZ
setlocale
_purecall
memset
strncpy
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
memmove_s
strcmp
memcpy
strcpy
atan
strcat
getenv
strchr
strrchr
strlen
_ftol
fabs
memcmp
atan2
sin
cos
atoi
qsort
bsearch
sprintf
strncmp
memmove
abs
atof
fclose
setvbuf
fopen
fputs
fread
fseek
_open
fwrite
_filelength
malloc
free
strstr
fgets
fgetc
atol
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_gmtime32
_mktime32
?terminate@@YAXXZ

kernel32

QueryPerformanceCounter
LoadResource
SizeofResource
FindResourceA
LocalFree
LocalAlloc
InterlockedExchange
Sleep
InterlockedCompareExchange
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
LockResource
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess

msvcp90

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

Exports

Exports

APDXFAcadCp2Ansi
APDXFAnsiCp2Acad
APDXFLoadFile
APDXFSaveFile

Sections

.text
Size: 412KB - Virtual size: 412KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 256KB - Virtual size: 256KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8f42b18881a1d54654278fea62d9061a

Headers

File Characteristics

Imports

gdiplus

mfc90

msvcr90

kernel32

msvcp90

Exports

Exports

Sections

.text Size: 412KB - Virtual size: 412KB

.rdata Size: 30KB - Virtual size: 30KB

.data Size: 32KB - Virtual size: 90KB

.rsrc Size: 256KB - Virtual size: 256KB

.reloc Size: 18KB - Virtual size: 18KB

.text
Size: 412KB - Virtual size: 412KB

.rdata
Size: 30KB - Virtual size: 30KB

.data
Size: 32KB - Virtual size: 90KB

.rsrc
Size: 256KB - Virtual size: 256KB

.reloc
Size: 18KB - Virtual size: 18KB