D:\work\Client\_Symbols\Release\Aatrix_Signature.pdb
Static task
static1
Behavioral task
behavioral1
Sample
17086a9c28868f1ecef02934a1b153254b52bf9ddcce2056295caa6657048702.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
17086a9c28868f1ecef02934a1b153254b52bf9ddcce2056295caa6657048702.dll
Resource
win10v2004-20240802-en
General
-
Target
17086a9c28868f1ecef02934a1b153254b52bf9ddcce2056295caa6657048702
-
Size
117KB
-
MD5
b7724a46c12d112db78dd347f74e1163
-
SHA1
fd285caf31492de80a49386c87722bc35bb2e15d
-
SHA256
17086a9c28868f1ecef02934a1b153254b52bf9ddcce2056295caa6657048702
-
SHA512
33c39888cb881e914159a1e20ac65340f2265bd39fe49f6f9f58a22fd8048514a99d62f8db8570b30d0c360aad0bc785434ce5be050c3c6ed8c549ee8df331d3
-
SSDEEP
3072:IZt3ssrnQVHso7WLJDso0pwNH8iChHiiOFRRj:IZ9sunQVHsoGl0pwqi9Fv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 17086a9c28868f1ecef02934a1b153254b52bf9ddcce2056295caa6657048702
Files
-
17086a9c28868f1ecef02934a1b153254b52bf9ddcce2056295caa6657048702.dll windows:6 windows x86 arch:x86
61637156161adf195a5f5056a6e0b5e0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
aatrix_log
?LogSystemError@Error@Aatrix@@SAXW4Level@12@@Z
?msgBoxReturnWithTitle@Log@Aatrix@@SAHPBDH0W4Level@12@PAUHWND__@@00I@Z
?LogMessage@Log@Aatrix@@SAXPBDH0W4Level@12@0ZZ
aatrix_database
??0RecordSet@Aatrix@@QAE@PAVDatabaseEx@1@@Z
??1RecordSet@Aatrix@@QAE@XZ
?SetQuerySelect@RecordSet@Aatrix@@QAEXPBD@Z
?SetQueryFrom@RecordSet@Aatrix@@QAEXPBD@Z
?SetQueryOrderBy@RecordSet@Aatrix@@QAEXPBD@Z
?Open@RecordSet@Aatrix@@QAE_NXZ
?GetRecordCount@RecordSet@Aatrix@@QBEHXZ
?GetFieldValue@RecordSet@Aatrix@@QBE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@H@Z
?ExecuteInsert@DatabaseEx@Aatrix@@QAE_NPBDH@Z
?SetQueryWhere@RecordSet@Aatrix@@QAEXPBD@Z
?MoveNext@RecordSet@Aatrix@@QAEXXZ
?ClearFields@DatabaseEx@Aatrix@@QAEXXZ
aatrix_filesystem
?GetAatrixAppDataDirectory@FileSystem@Aatrix@@SA?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?GetAatrixLocalAppDataDirectory@FileSystem@Aatrix@@SA?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?OpenFile@FileSystem@Aatrix@@SA_NPBD@Z
mfc140
ord13475
ord7094
ord1131
ord1353
ord12551
ord4713
ord2252
ord11339
ord7784
ord5398
ord1999
ord824
ord6725
ord13090
ord1509
ord3808
ord485
ord2263
ord12074
ord8997
ord10963
ord11343
ord3396
ord3395
ord3159
ord6193
ord13677
ord2758
ord9096
ord12115
ord9167
ord6505
ord4476
ord8326
ord8770
ord4870
ord14421
ord13027
ord10421
ord7459
ord3689
ord1443
ord1000
ord6806
ord6104
ord12111
ord12067
ord4997
ord12163
ord9092
ord3250
ord4227
ord458
ord6768
ord7727
ord5710
ord13006
ord9931
ord9485
ord9636
ord9549
ord10114
ord9740
ord14157
ord2808
ord3140
ord6195
ord13681
ord3298
ord3295
ord8173
ord2759
ord14699
ord10237
ord10239
ord10236
ord10240
ord5631
ord11671
ord11672
ord9083
ord12032
ord3830
ord11881
ord8718
ord8922
ord12129
ord6947
ord10950
ord9213
ord3259
ord13798
ord12205
ord1717
ord1739
ord1765
ord1751
ord1772
ord4920
ord4987
ord4932
ord4950
ord4944
ord4938
ord4993
ord4981
ord4926
ord5003
ord4958
ord4896
ord4911
ord4972
ord4493
ord9647
ord4485
ord3050
ord14510
ord7887
ord14508
ord6848
ord11663
ord13628
ord5911
ord2680
ord12053
ord3933
ord3364
ord3363
ord3258
ord12100
ord5228
ord5528
ord5739
ord9305
ord5504
ord5769
ord5231
ord5390
ord5210
ord7687
ord7688
ord7677
ord5388
ord8182
ord10207
ord9166
ord6588
ord266
ord1507
ord1044
ord9986
ord1526
ord13011
ord4865
ord2518
ord1106
ord6942
ord7783
ord4315
ord10238
ord450
ord6460
ord4219
ord7487
ord4084
ord2986
ord300
ord14054
ord2520
ord13455
ord6540
ord3874
ord316
ord4807
ord2298
ord6533
ord1204
ord581
ord4655
ord12528
ord7619
ord1695
ord6724
ord3230
ord12291
ord2376
ord14518
ord12201
ord4841
ord12348
ord262
ord14571
ord1693
ord1696
ord8322
ord8717
ord3825
ord265
ord4640
ord2383
ord2387
ord2381
ord4468
ord13198
ord13199
ord2241
ord3789
ord1068
ord6471
ord9085
ord3142
ord4213
ord8703
ord2988
ord3864
ord1064
ord6464
ord4210
ord1447
ord974
ord305
ord5898
ord4820
ord14502
ord3005
ord1109
ord1529
ord310
ord7295
kernel32
GetPrivateProfileStringA
WritePrivateProfileStringA
MultiByteToWideChar
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
DeleteCriticalSection
GetLastError
InitializeCriticalSectionEx
OutputDebugStringW
GetLocaleInfoA
GetCurrentThreadId
GetModuleFileNameA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
user32
SetWindowLongA
GetNextDlgTabItem
MessageBeep
GetAsyncKeyState
GetFocus
SendMessageA
KillTimer
PostMessageA
DestroyWindow
UnhookWindowsHookEx
UpdateWindow
SetWindowPos
SetWindowsHookExA
SetTimer
DefWindowProcA
LoadStringA
GetWindowRect
GetDC
LoadCursorA
CreateWindowExA
GetCapture
GetClientRect
EnableWindow
ReleaseDC
GetWindowDC
ReleaseCapture
SetCapture
LoadImageA
IsWindow
GetParent
RegisterClassA
SetFocus
CallNextHookEx
gdi32
GetWindowOrgEx
BitBlt
CreateDCA
CreateFontA
CreateCompatibleBitmap
CreateCompatibleDC
GetObjectA
CreatePen
StretchBlt
advapi32
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
ole32
CreateStreamOnHGlobal
oleaut32
VarDateFromStr
SystemTimeToVariantTime
VariantTimeToSystemTime
gdiplus
GdipSaveImageToStream
GdipCreateBitmapFromHBITMAP
GdipCreateHBITMAPFromBitmap
GdipDisposeImage
GdipCloneImage
GdipCreateBitmapFromStream
GdipFree
GdipAlloc
GdiplusStartup
GdipGetImageEncoders
GdipGetImageEncodersSize
GdiplusShutdown
vcruntime140
__std_terminate
memset
__CxxFrameHandler3
__current_exception_context
_except_handler4_common
__std_type_info_destroy_list
__current_exception
memcpy
api-ms-win-crt-convert-l1-1-0
strtol
atoi
api-ms-win-crt-heap-l1-1-0
malloc
free
api-ms-win-crt-runtime-l1-1-0
_resetstkoflw
_cexit
_crt_atexit
terminate
_seh_filter_dll
_execute_onexit_table
_configure_narrow_argv
_initialize_narrow_environment
_initterm
_initterm_e
_initialize_onexit_table
_register_onexit_function
api-ms-win-crt-multibyte-l1-1-0
_ismbcupper
_ismbclower
_mbsnbcpy
_ismbcdigit
_ismbcalpha
_mbsicmp
_mbsrchr
_mbctolower
_mbctoupper
_mbscmp
_ismbcalnum
api-ms-win-crt-time-l1-1-0
_localtime64_s
_time64
api-ms-win-crt-string-l1-1-0
tolower
Exports
Exports
??0SignatureButton@Aatrix@@QAE@XZ
??0SignatureDlg@Aatrix@@QAE@PAVCWnd@@@Z
??0SignatureInfoDlg@Aatrix@@QAE@PAVCWnd@@@Z
??0SignaturePin94xDlg@Aatrix@@QAE@PAVCWnd@@@Z
??0SignaturePinDlg@Aatrix@@QAE@PAVCWnd@@@Z
??0SignaturePinEntryDlg@Aatrix@@QAE@PAVCWnd@@@Z
??1SignatureButton@Aatrix@@UAE@XZ
??1SignatureDlg@Aatrix@@UAE@XZ
??1SignatureInfoDlg@Aatrix@@UAE@XZ
??1SignaturePin94xDlg@Aatrix@@UAE@XZ
??1SignaturePinDlg@Aatrix@@UAE@XZ
??1SignaturePinEntryDlg@Aatrix@@UAE@XZ
??_7SignatureButton@Aatrix@@6B@
??_7SignatureDlg@Aatrix@@6B@
??_7SignatureInfoDlg@Aatrix@@6B@
??_7SignaturePin94xDlg@Aatrix@@6B@
??_7SignaturePinDlg@Aatrix@@6B@
??_7SignaturePinEntryDlg@Aatrix@@6B@
??_FSignatureDlg@Aatrix@@QAEXXZ
??_FSignatureInfoDlg@Aatrix@@QAEXXZ
??_FSignaturePin94xDlg@Aatrix@@QAEXXZ
??_FSignaturePinDlg@Aatrix@@QAEXXZ
??_FSignaturePinEntryDlg@Aatrix@@QAEXXZ
?DoDataExchange@SignatureDlg@Aatrix@@MAEXPAVCDataExchange@@@Z
?DoDataExchange@SignatureInfoDlg@Aatrix@@MAEXPAVCDataExchange@@@Z
?DoDataExchange@SignaturePin94xDlg@Aatrix@@MAEXPAVCDataExchange@@@Z
?DoDataExchange@SignaturePinDlg@Aatrix@@MAEXPAVCDataExchange@@@Z
?DoDataExchange@SignaturePinEntryDlg@Aatrix@@MAEXPAVCDataExchange@@@Z
?DrawItem@SignatureButton@Aatrix@@UAEXPAUtagDRAWITEMSTRUCT@@@Z
?GetBitmap@SignatureDlg@Aatrix@@QAEPAUHBITMAP__@@XZ
?GetCompanyDatabase@SignatureButton@Aatrix@@QBEPAVCompanyDatabase@2@XZ
?GetMessageMap@SignatureButton@Aatrix@@MBEPBUAFX_MSGMAP@@XZ
?GetMessageMap@SignatureDlg@Aatrix@@MBEPBUAFX_MSGMAP@@XZ
?GetMessageMap@SignatureInfoDlg@Aatrix@@MBEPBUAFX_MSGMAP@@XZ
?GetMessageMap@SignaturePin94xDlg@Aatrix@@MBEPBUAFX_MSGMAP@@XZ
?GetMessageMap@SignaturePinDlg@Aatrix@@MBEPBUAFX_MSGMAP@@XZ
?GetMessageMap@SignaturePinEntryDlg@Aatrix@@MBEPBUAFX_MSGMAP@@XZ
?GetReportingAgent@SignatureButton@Aatrix@@QBE_NXZ
?GetSignatureBase64@SignatureButton@Aatrix@@QBE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?GetSignatureValid@SignatureButton@Aatrix@@QBE_NXZ
?GetThisMessageMap@SignatureButton@Aatrix@@KGPBUAFX_MSGMAP@@XZ
?GetThisMessageMap@SignatureDlg@Aatrix@@KGPBUAFX_MSGMAP@@XZ
?GetThisMessageMap@SignatureInfoDlg@Aatrix@@KGPBUAFX_MSGMAP@@XZ
?GetThisMessageMap@SignaturePin94xDlg@Aatrix@@KGPBUAFX_MSGMAP@@XZ
?GetThisMessageMap@SignaturePinDlg@Aatrix@@KGPBUAFX_MSGMAP@@XZ
?GetThisMessageMap@SignaturePinEntryDlg@Aatrix@@KGPBUAFX_MSGMAP@@XZ
?Init@SignatureButton@Aatrix@@QAE_NXZ
?OnAcceptButton@SignatureDlg@Aatrix@@IAEXXZ
?OnClearButton@SignatureDlg@Aatrix@@IAEXXZ
?OnDestroy@SignatureDlg@Aatrix@@IAEXXZ
?OnEnable@SignatureButton@Aatrix@@IAEXH@Z
?OnHelp@SignaturePin94xDlg@Aatrix@@IAEXXZ
?OnHelpInfo@SignaturePin94xDlg@Aatrix@@IAEHPAUtagHELPINFO@@@Z
?OnInitDialog@SignatureDlg@Aatrix@@MAEHXZ
?OnInitDialog@SignatureInfoDlg@Aatrix@@MAEHXZ
?OnInitDialog@SignaturePin94xDlg@Aatrix@@MAEHXZ
?OnInitDialog@SignaturePinDlg@Aatrix@@MAEHXZ
?OnInitDialog@SignaturePinEntryDlg@Aatrix@@MAEHXZ
?OnLButtonDown@SignatureDlg@Aatrix@@IAEXIVCPoint@@@Z
?OnLButtonUp@SignatureDlg@Aatrix@@IAEXIVCPoint@@@Z
?OnMouseMove@SignatureDlg@Aatrix@@IAEXIVCPoint@@@Z
?OnOK@SignatureInfoDlg@Aatrix@@MAEXXZ
?OnOK@SignaturePin94xDlg@Aatrix@@MAEXXZ
?OnOK@SignaturePinDlg@Aatrix@@MAEXXZ
?OnOK@SignaturePinEntryDlg@Aatrix@@MAEXXZ
?OnSignatureAgentRadioButton@SignaturePin94xDlg@Aatrix@@IAEXXZ
?OnSignatureButton@SignatureInfoDlg@Aatrix@@IAEXXZ
?OnSignatureNewRadioButton@SignaturePin94xDlg@Aatrix@@IAEXXZ
?OnSignatureNewRadioButton@SignaturePinDlg@Aatrix@@IAEXXZ
?OnSignaturePinRadioButton@SignaturePin94xDlg@Aatrix@@IAEXXZ
?OnSignaturePinRadioButton@SignaturePinDlg@Aatrix@@IAEXXZ
?SetBitmap@SignatureButton@Aatrix@@QAEXPAUHBITMAP__@@@Z
?SetBitmap@SignatureDlg@Aatrix@@QAEXPAUHBITMAP__@@@Z
?SetCompanyDatabase@SignatureButton@Aatrix@@QAEXPAVCompanyDatabase@2@@Z
?SetReportingAgent@SignatureButton@Aatrix@@QAEX_N@Z
?SetSignatureBase64@SignatureButton@Aatrix@@QAEXV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?SetSignatureValid@SignatureButton@Aatrix@@QBEX_N@Z
?ShowSignatureDlg@SignatureButton@Aatrix@@QAE_NXZ
?ShowSignatureInfoDlg@SignatureButton@Aatrix@@QAE_NXZ
?ShowSignaturePin94xDlg@SignatureButton@Aatrix@@QAE_NXZ
?ShowSignaturePinDlg@SignatureButton@Aatrix@@QAE_NXZ
?_SetSignature@SignaturePin94xDlg@Aatrix@@QAEXH@Z
?_SetSignature@SignaturePinDlg@Aatrix@@AAEXH@Z
?__autoclassinit2@SignatureButton@Aatrix@@QAEXI@Z
?__autoclassinit2@SignatureDlg@Aatrix@@QAEXI@Z
?__autoclassinit2@SignatureInfoDlg@Aatrix@@QAEXI@Z
?__autoclassinit2@SignaturePin94xDlg@Aatrix@@QAEXI@Z
?__autoclassinit2@SignaturePinDlg@Aatrix@@QAEXI@Z
?__autoclassinit2@SignaturePinEntryDlg@Aatrix@@QAEXI@Z
Sections
.text Size: 52KB - Virtual size: 51KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 40KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ