P:\Dev\v2023R\Bin.Win\Programs_VS142_64.fin\Archicad.pdb
Static task
static1
1 signatures
General
-
Target
Archicad.exe
-
Size
107.0MB
-
MD5
a87c9aeadf0d10b2933f5ea4dfab833f
-
SHA1
4494fb3000145c7ace9e9b37efd964c037fccc4e
-
SHA256
1082d6a38aa78696035b3d1d3ad532e121f8cc2172628373e710e765f91f8cdd
-
SHA512
f7df0555a99421ad7721104598605a64857ebb06654678b219a06ec9842a4e7ba7beac8783dffe1b32d9cf9772fc5640c64e0957475de4af55fe2232ff627b10
-
SSDEEP
786432:YLWgu9DtUD0Tcspxr2bCFmUd3Lbk+S4v/0teR6Y8Xt9Vcj6uvCF:YLWgORG0IqxxNk+S4on3
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Archicad.exe
Files
-
Archicad.exe.exe windows:10 windows x64 arch:x64
32fcd95370ef0fd06d6e25a6e75f4e36
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
ws2_32
freeaddrinfo
gethostname
getaddrinfo
gethostbyname
gethostbyaddr
sendto
recvfrom
inet_addr
bind
getpeername
WSAGetLastError
socket
shutdown
setsockopt
send
select
recv
getsockopt
ioctlsocket
connect
closesocket
accept
__WSAFDIsSet
inet_ntoa
htons
WSACleanup
WSAStartup
crypt32
CertCloseStore
CertFindCertificateInStore
CertFreeCertificateContext
CertGetNameStringA
CertGetNameStringW
CryptMsgGetParam
CryptMsgClose
CryptQueryObject
kernel32
GetUserDefaultUILanguage
GetDiskFreeSpaceA
GetTempPathA
GetLocalTime
SystemTimeToFileTime
GetACP
SetConsoleCtrlHandler
GetCurrentDirectoryA
HeapFree
TerminateProcess
GetCurrentThread
SetThreadPriority
SetPriorityClass
GetVersionExA
VirtualProtect
VirtualQuery
GetModuleFileNameA
GetModuleHandleA
SetLastError
GetSystemInfo
GetSystemDirectoryA
GetWindowsDirectoryA
GetSystemWindowsDirectoryA
GetNativeSystemInfo
GetComputerNameA
IsBadReadPtr
GetModuleHandleExA
RtlAddFunctionTable
Process32First
Process32Next
GetTickCount64
CreateDirectoryA
CreateFileA
FindClose
FindFirstFileA
FindNextFileA
GetFileSizeEx
RemoveDirectoryA
SetEndOfFile
SetFilePointer
WriteFile
CloseHandle
GetLastError
QueryPerformanceCounter
QueryPerformanceFrequency
ReleaseSemaphore
ReleaseMutex
WaitForSingleObject
CreateMutexA
GetProcessTimes
SwitchToThread
GetTickCount
MapViewOfFileEx
UnmapViewOfFile
GetProcAddress
LocalFree
FormatMessageA
CreateSemaphoreA
CreateFileMappingA
OpenProcess
GetSystemTimeAsFileTime
FreeLibrary
LoadLibraryA
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentVariableA
SetCurrentDirectoryA
GetFileAttributesA
GetFullPathNameA
GetSystemTime
FileTimeToSystemTime
GetTimeZoneInformation
AreFileApisANSI
GetExitCodeProcess
CreateProcessA
GetStdHandle
GetConsoleMode
ExitThread
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
DeleteFileA
SetFileTime
GlobalFree
GetProfileStringA
DuplicateHandle
FlushFileBuffers
GetFileTime
ReadFile
GetExitCodeThread
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
ExitProcess
GetModuleHandleW
GetModuleHandleExW
GetCPInfo
CreateThread
FreeLibraryAndExitThread
CreateFileW
GetFileType
RaiseException
GetStringTypeW
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleCP
SetFilePointerEx
SetStdHandle
HeapReAlloc
HeapSize
IsValidCodePage
GetCommandLineW
GetModuleFileNameW
WriteConsoleW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
LocalAlloc
MapViewOfFile
OpenFileMappingA
GetPrivateProfileIntA
GetPrivateProfileStringA
WritePrivateProfileStringA
GetPrivateProfileSectionA
WritePrivateProfileSectionA
CreateToolhelp32Snapshot
Thread32First
Thread32Next
SetEvent
ResetEvent
CreateEventA
OpenEventA
WaitForMultipleObjects
ProcessIdToSessionId
IsBadWritePtr
OpenSemaphoreA
FlushInstructionCache
GetVersion
DeviceIoControl
LockFile
UnlockFile
IsBadStringPtrA
IsBadStringPtrW
GetDriveTypeA
GetThreadContext
GetLogicalDrives
GetOverlappedResult
CreateEventW
EnumSystemFirmwareTables
GetSystemFirmwareTable
OpenMutexA
TryEnterCriticalSection
InitializeCriticalSectionEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
InitializeSListHead
WaitForSingleObjectEx
SetThreadContext
GetCurrentThreadId
GetStartupInfoW
GetCurrentProcessId
GetCurrentProcess
Sleep
GetProcessHeap
HeapAlloc
HeapCreate
RtlCaptureContext
EncodePointer
DecodePointer
LCMapStringEx
GetLocaleInfoEx
CompareStringEx
RtlPcToFileHeader
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
RtlUnwind
FindFirstFileExW
FindNextFileW
GetCommandLineA
GetOEMCP
user32
TranslateMessage
DispatchMessageA
PeekMessageA
CallMsgFilterA
EnumDisplayDevicesA
CharUpperBuffA
CharLowerBuffA
MessageBoxA
MessageBoxW
DrawMenuBar
GetSystemMenu
AppendMenuA
LoadStringA
wsprintfA
shell32
ShellExecuteExA
advapi32
ConvertStringSecurityDescriptorToSecurityDescriptorA
SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetUserNameA
RegCreateKeyExA
RegDeleteValueA
RegEnumKeyExA
RegEnumValueA
RegSetValueExA
CryptAcquireContextA
CryptReleaseContext
CryptGenRandom
RegDeleteKeyA
RegFlushKey
CloseServiceHandle
OpenSCManagerA
OpenServiceA
QueryServiceConfigA
QueryServiceStatus
StartServiceA
QueryServiceStatusEx
psapi
GetModuleFileNameExA
powrprof
PowerReadFriendlyName
version
GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA
winhttp
WinHttpGetDefaultProxyConfiguration
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpCloseHandle
WinHttpOpen
wintrust
WinVerifyTrust
ntdll
RtlAddVectoredExceptionHandler
RtlRemoveVectoredExceptionHandler
Exports
Exports
??0StairFloorPlanDraftPrimitive@StairGenerator@VBElem@@QEAA@$$QEAV012@@Z
??0StairFloorPlanDraftPrimitive@StairGenerator@VBElem@@QEAA@AEBV012@@Z
??0StairFloorPlanDrafts@StairGenerator@VBElem@@QEAA@$$QEAV012@@Z
??0StairFloorPlanDrafts@StairGenerator@VBElem@@QEAA@AEBV012@@Z
??0StairFloorPlanDrafts@StairGenerator@VBElem@@QEAA@XZ
??1StairFloorPlanDraftPrimitive@StairGenerator@VBElem@@QEAA@XZ
??1StairFloorPlanDrafts@StairGenerator@VBElem@@QEAA@XZ
??4StairFloorPlanDraftPrimitive@StairGenerator@VBElem@@QEAAAEAV012@$$QEAV012@@Z
??4StairFloorPlanDraftPrimitive@StairGenerator@VBElem@@QEAAAEAV012@AEBV012@@Z
??4StairFloorPlanDrafts@StairGenerator@VBElem@@QEAAAEAV012@$$QEAV012@@Z
??4StairFloorPlanDrafts@StairGenerator@VBElem@@QEAAAEAV012@AEBV012@@Z
??4StairSchemeGenOptions@StairGenerator@VBElem@@QEAAAEAV012@$$QEAV012@@Z
??4StairSchemeGenOptions@StairGenerator@VBElem@@QEAAAEAV012@AEBV012@@Z
??4StairSchemeGenOptionsData@StairGenerator@VBElem@@QEAAAEAV012@$$QEAV012@@Z
??4StairSchemeGenOptionsData@StairGenerator@VBElem@@QEAAAEAV012@AEBV012@@Z
??4StairSchemeGenOptionsOverrideGuard@StairGenerator@VBElem@@QEAAAEAV012@AEBV012@@Z
?Clear@StairFloorPlanDrafts@StairGenerator@VBElem@@QEAAXXZ
?GetArc@StairFloorPlanDraftPrimitive@StairGenerator@VBElem@@QEBAAEBV?$Optional@VGenArc@Geometry@@@GS@@XZ
?GetDrafts@StairFloorPlanDrafts@StairGenerator@VBElem@@QEBAAEBV?$PagedArray@VStairFloorPlanDraftPrimitive@StairGenerator@VBElem@@$07@GS@@XZ
?GetSector@StairFloorPlanDraftPrimitive@StairGenerator@VBElem@@QEBAAEBV?$Optional@USector@@@GS@@XZ
?IsForFeedbackDraw@StairFloorPlanDraftPrimitive@StairGenerator@VBElem@@QEBA_NXZ
?IsForFinalDraw@StairFloorPlanDraftPrimitive@StairGenerator@VBElem@@QEBA_NXZ
?IsForStatusGen@StairFloorPlanDraftPrimitive@StairGenerator@VBElem@@QEBA_NXZ
Sections
__wibu00 Size: 38.4MB - Virtual size: 38.4MB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
__wibu01 Size: 18.8MB - Virtual size: 18.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
__wibu02 Size: 2.7MB - Virtual size: 4.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
__wibu03 Size: 1.6MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 40.1MB - Virtual size: 40.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
__wibu04 Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
__wibu05 Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
__wibu06 Size: 76KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
__wibu07 Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
__wibu08 Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
__wibu09 Size: 100KB - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
__wibu0a Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE