2b2cde410fb93040c6700076c220c2a3785118dee76852ea283d72337b72c20dN

Sharing

Copy URL Twitter E-mail

General

Target

2b2cde410fb93040c6700076c220c2a3785118dee76852ea283d72337b72c20dN
Size

187KB
MD5

04b2b0322f0602484a59990dd2f70770
SHA1

dfa565a4e167cc2e7c5e292a979b8860d3f3cf6d
SHA256

2b2cde410fb93040c6700076c220c2a3785118dee76852ea283d72337b72c20d
SHA512

5556483e0c1a83d853a6e1584658f61f3b91eaea16393f3582ad6f92bac8bb1b5e7be517d092dec81d597d61a0c2c9e5c1603e8e19f2a0795780b740921148de
SSDEEP

1536:pc51BzcN6BODQWbCPaNWND5bWPBmk2wUrWtyazVcpAnxKXeH4BOkz633sMCediFw:pe1BwN6MocoCpmK5RYdjAL3cApma5P

Score

1^/10

Malware Config

Signatures

Files

2b2cde410fb93040c6700076c220c2a3785118dee76852ea283d72337b72c20dN
.dll windows:10 windows x64 arch:x64

ed7988298b6c68e0a63a784ef1147f68

Code Sign

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:20

Not After

14/11/2024, 19:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7d:40:a6:33:5e:da:f1:f9:7a:09:6d:03:4e:e6:ce:82:fc:9c:60:75:cc:ca:7c:74:4c:d2:12:e7:b5:cf:77:72
Signer

Actual PE Digest

7d:40:a6:33:5e:da:f1:f9:7a:09:6d:03:4e:e6:ce:82:fc:9c:60:75:cc:ca:7c:74:4c:d2:12:e7:b5:cf:77:72

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL

PDB Paths

cmi2migxml.pdb

Imports

msvcrt

??1type_info@@UEAA@XZ
?terminate@@YAXXZ
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
malloc
memmove_s
free
_purecall
calloc
__CxxFrameHandler3
__RTDynamicCast

kernel32

RtlCaptureContext
GetLastError
Sleep
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
SetLastError
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter

unbcl

??0InvalidOperationException@UnBCL@@QEAA@PEBG@Z
??0InvalidOperationException@UnBCL@@QEAA@PEBVString@1@PEAVException@1@@Z
?get_P@?$SmartPtr@VString@UnBCL@@@UnBCL@@QEBAPEAVString@2@XZ
??C?$SmartPtr@VString@UnBCL@@@UnBCL@@QEBAPEAVString@1@XZ
??4?$SmartPtr@VString@UnBCL@@@UnBCL@@QEAAAEAV01@AEBV01@@Z
?Steal@?$SmartPtr@VString@UnBCL@@@UnBCL@@QEAAPEAVString@2@XZ
??1?$SmartPtr@VString@UnBCL@@@UnBCL@@UEAA@XZ
??0?$SmartPtr@VString@UnBCL@@@UnBCL@@QEAA@XZ
??0?$SmartPtr@VString@UnBCL@@@UnBCL@@QEAA@PEAVString@1@@Z
??0ArgumentException@UnBCL@@QEAA@PEBG@Z
??0NotSupportedException@UnBCL@@QEAA@PEBG@Z
??0ArgumentNullException@UnBCL@@QEAA@PEBG@Z
?SetNamedItem@XmlAttributeCollection@UnBCL@@QEAAPEAVXmlNode@2@PEAV32@@Z
?get_Item@XmlAttributeCollection@UnBCL@@QEAAPEAVXmlAttribute@2@PEAVString@2@@Z
?SetMessage@Exception@UnBCL@@MEAAXPEAVString@2@@Z
?set_HResult@Exception@UnBCL@@MEAAXJ@Z
?get_HResult@Exception@UnBCL@@UEBAJXZ
?GetBaseException@Exception@UnBCL@@UEBAPEBV12@XZ
?AddStackTrace@Exception@UnBCL@@QEAAXPEBD@Z
?set_Source@Exception@UnBCL@@UEAAXPEBVString@2@@Z
?get_Source@Exception@UnBCL@@UEBAPEBVString@2@XZ
?get_Message@Exception@UnBCL@@UEBAPEBVString@2@XZ
?get_InnerException@Exception@UnBCL@@UEBAPEBV12@XZ
?ToString@Exception@UnBCL@@UEBAPEAVString@2@XZ
?MemAllocFailed@Allocator@UnBCL@@SAHXZ
?ExpandEnvironmentVariables@Environment@UnBCL@@SAPEAVString@2@PEBV32@@Z
?AppendChild@XmlNode@UnBCL@@QEAAPEAV12@PEAV12@@Z
?SelectSingleNode@XmlNode@UnBCL@@QEAAPEAV12@PEAVString@2@@Z
?SelectNodes@XmlNode@UnBCL@@QEAAPEAVXmlNodeList@2@PEAVString@2@@Z
?get_OwnerDocument@XmlNode@UnBCL@@QEAAPEAVXmlDocument@2@XZ
?get_OuterXml@XmlNode@UnBCL@@QEAAPEAVString@2@XZ
?get_ChildNodes@XmlNode@UnBCL@@QEAAPEAVXmlNodeList@2@XZ
?set_InnerText@XmlNode@UnBCL@@QEAAXPEAVString@2@@Z
?get_InnerText@XmlNode@UnBCL@@QEAAPEAVString@2@XZ
?get_Value@XmlNode@UnBCL@@QEAAPEAVString@2@XZ
?get_Name@XmlNode@UnBCL@@QEAAPEAVString@2@XZ
?get_NodeType@XmlNode@UnBCL@@QEAA?AW4XmlNodeType@2@XZ
?get_Attributes@XmlNode@UnBCL@@QEAAPEAVXmlAttributeCollection@2@XZ
?set_ValidateOnParse@XmlDocument@UnBCL@@QEAAXH@Z
?CreateNode@XmlDocument@UnBCL@@QEAAPEAVXmlNode@2@W4XmlNodeType@2@PEAVString@2@1@Z
?LoadXml@XmlDocument@UnBCL@@QEAAXPEAVString@2@@Z
??1XmlDocument@UnBCL@@UEAA@XZ
??0XmlDocument@UnBCL@@QEAA@XZ
?Format@String@UnBCL@@SAPEAV12@PEBGZZ
?Copy@String@UnBCL@@SAPEAV12@PEBV12@@Z
?Concat@String@UnBCL@@SAPEAV12@PEBG0@Z
?Concat@String@UnBCL@@SAPEAV12@PEBG00@Z
?Concat@String@UnBCL@@SAPEAV12@HZZ
?Compare@String@UnBCL@@SAHPEBG0H@Z
?Compare@String@UnBCL@@SAHPEBV12@0H@Z
?Trim@String@UnBCL@@QEBAPEAV12@XZ
?Replace@String@UnBCL@@QEBAPEAV12@PEBG0W4StringCasing@12@@Z
?IndexOfAny@String@UnBCL@@QEBAHPEBGH@Z
?IndexOf@String@UnBCL@@QEBAHPEBGH@Z
?StartsWith@String@UnBCL@@QEBAHPEBGH@Z
?get_CString@String@UnBCL@@QEBAPEBGXZ
?get_Length@String@UnBCL@@QEBAHXZ
?CompareTo@String@UnBCL@@UEBAHPEBVObject@2@@Z
?Clone@String@UnBCL@@UEBAPEAVObject@2@XZ
?ToString@String@UnBCL@@UEBAPEAV12@XZ
?GetHashCode@String@UnBCL@@UEBAHXZ
?Equals@String@UnBCL@@UEBAHPEBVObject@2@@Z
??1String@UnBCL@@UEAA@XZ
??0String@UnBCL@@QEAA@PEBV01@@Z
??0String@UnBCL@@QEAA@PEBG@Z
?get_Item@XmlNodeList@UnBCL@@QEAAPEAVXmlNode@2@H@Z
?get_Count@XmlNodeList@UnBCL@@QEAAHXZ
?SetLiteralStorage@_@UnBCL@@YAXPEAPEBVString@2@PEBG@Z
?DecRef@Object@UnBCL@@QEAAHXZ
?AddRef@Object@UnBCL@@QEAAXXZ
??3Object@UnBCL@@SAXPEAX@Z
??2Object@UnBCL@@SAPEAX_K@Z
?Clone@Object@UnBCL@@UEBAPEAV12@XZ
?CompareTo@Object@UnBCL@@UEBAHPEBV12@@Z
?GetObjectID@Object@UnBCL@@UEBAIXZ
?ToString@Object@UnBCL@@UEBAPEAVString@2@XZ
?GetType@Object@UnBCL@@UEBAPEAVType@2@XZ
?GetHashCode@Object@UnBCL@@UEBAHXZ
?Equals@Object@UnBCL@@UEBAHPEBV12@@Z
??1Object@UnBCL@@UEAA@XZ
??0Object@UnBCL@@QEAA@XZ
??0Object@UnBCL@@QEAA@AEBV01@@Z
??1NotSupportedException@UnBCL@@UEAA@XZ
??1InvalidOperationException@UnBCL@@UEAA@XZ
??1ArgumentOutOfRangeException@UnBCL@@UEAA@XZ
??4Object@UnBCL@@QEAAAEAV01@AEBV01@@Z
??1ArgumentException@UnBCL@@UEAA@XZ
??1ArgumentNullException@UnBCL@@UEAA@XZ
??4MutableString@UnBCL@@QEAAAEAV01@PEBG@Z
??0InvalidOperationException@UnBCL@@QEAA@PEBVString@1@@Z
?GetEnvironmentVar@Environment@UnBCL@@SAPEAVString@2@PEBV32@@Z
?SetEnvironmentVar@Environment@UnBCL@@SAXPEBVString@2@0@Z
??0ArgumentOutOfRangeException@UnBCL@@QEAA@PEBG@Z
?CloneNode@XmlNode@UnBCL@@QEAAPEAV12@H@Z

wdscore

WdsSetupLogMessageW
CurrentIP
ConstructPartialMsgVW

Exports

Exports

??0CAppendNewAttributeRule@Mig@@QEAA@AEBV01@@Z
??0CAppendNewAttributeRule@Mig@@QEAA@PEAVString@UnBCL@@00PEAUITranslationRule@1@@Z
??0CAppendNewChildRule@Mig@@QEAA@AEBV01@@Z
??0CAppendNewChildRule@Mig@@QEAA@PEAVString@UnBCL@@W4XmlNodeType@3@PEAUITranslationRule@1@H@Z
??0CComponentPathRule@Mig@@QEAA@$$QEAV01@@Z
??0CComponentPathRule@Mig@@QEAA@AEBV01@@Z
??0CComponentPathRule@Mig@@QEAA@XZ
??0CCopyAttributesRule@Mig@@QEAA@$$QEAV01@@Z
??0CCopyAttributesRule@Mig@@QEAA@AEBV01@@Z
??0CCopyAttributesRule@Mig@@QEAA@XZ
??0CCopyChildrenRule@Mig@@QEAA@$$QEAV01@@Z
??0CCopyChildrenRule@Mig@@QEAA@AEBV01@@Z
??0CCopyChildrenRule@Mig@@QEAA@XZ
??0CEnvExpandRule@Mig@@QEAA@AEBV01@@Z
??0CEnvExpandRule@Mig@@QEAA@PEAVString@UnBCL@@@Z
??0CIdStringAsInnerTextRule@Mig@@QEAA@$$QEAV01@@Z
??0CIdStringAsInnerTextRule@Mig@@QEAA@AEBV01@@Z
??0CIdStringAsInnerTextRule@Mig@@QEAA@XZ
??0CLinkedRule@Mig@@QEAA@AEBV01@@Z
??0CLinkedRule@Mig@@QEAA@PEAUITranslationRule@1@@Z
??0CNodeInnerTextCopyRule@Mig@@QEAA@$$QEAV01@@Z
??0CNodeInnerTextCopyRule@Mig@@QEAA@AEBV01@@Z
??0CNodeInnerTextCopyRule@Mig@@QEAA@XZ
??0CSelectRule@Mig@@QEAA@AEBV01@@Z
??0CSelectRule@Mig@@QEAA@XZ
??0CStatePatternRule@Mig@@QEAA@$$QEAV01@@Z
??0CStatePatternRule@Mig@@QEAA@AEBV01@@Z
??0CStatePatternRule@Mig@@QEAA@XZ
??0CSupportedIdRule@Mig@@QEAA@$$QEAV01@@Z
??0CSupportedIdRule@Mig@@QEAA@AEBV01@@Z
??0CSupportedIdRule@Mig@@QEAA@XZ
??0CTranslationMigAttrib@Mig@@QEAA@AEBV01@@Z
??0CTranslationMigAttrib@Mig@@QEAA@PEAVString@UnBCL@@PEAVXmlNode@3@@Z
??0CTranslationPattern@Mig@@QEAA@AEBV01@@Z
??0CTranslationPattern@Mig@@QEAA@PEAVString@UnBCL@@0@Z
??0CTranslationRuleCollection@Mig@@QEAA@AEBV01@@Z
??0CTranslationRuleCollection@Mig@@QEAA@XZ
??0CUrlIdRule@Mig@@QEAA@$$QEAV01@@Z
??0CUrlIdRule@Mig@@QEAA@AEBV01@@Z
??0CUrlIdRule@Mig@@QEAA@XZ
??0CXPathRule@Mig@@QEAA@AEBV01@@Z
??0CXPathRule@Mig@@QEAA@PEAVString@UnBCL@@IIPEAUITranslationRule@1@@Z
??0ITranslationRule@Mig@@QEAA@$$QEAU01@@Z
??0ITranslationRule@Mig@@QEAA@AEBU01@@Z
??0ITranslationRule@Mig@@QEAA@XZ
??1CAppendNewAttributeRule@Mig@@UEAA@XZ
??1CAppendNewChildRule@Mig@@UEAA@XZ
??1CComponentPathRule@Mig@@UEAA@XZ
??1CCopyAttributesRule@Mig@@UEAA@XZ
??1CCopyChildrenRule@Mig@@UEAA@XZ
??1CEnvExpandRule@Mig@@UEAA@XZ
??1CIdStringAsInnerTextRule@Mig@@UEAA@XZ
??1CLinkedRule@Mig@@UEAA@XZ
??1CNodeInnerTextCopyRule@Mig@@UEAA@XZ
??1CSelectRule@Mig@@UEAA@XZ
??1CStatePatternRule@Mig@@UEAA@XZ
??1CSupportedIdRule@Mig@@UEAA@XZ
??1CTranslationMigAttrib@Mig@@UEAA@XZ
??1CTranslationPattern@Mig@@UEAA@XZ
??1CTranslationRuleCollection@Mig@@UEAA@XZ
??1CUrlIdRule@Mig@@UEAA@XZ
??1CXPathRule@Mig@@UEAA@XZ
??1ITranslationRule@Mig@@UEAA@XZ
??4CAppendNewAttributeRule@Mig@@QEAAAEAV01@AEBV01@@Z
??4CAppendNewChildRule@Mig@@QEAAAEAV01@AEBV01@@Z
??4CComponentPathRule@Mig@@QEAAAEAV01@$$QEAV01@@Z
??4CComponentPathRule@Mig@@QEAAAEAV01@AEBV01@@Z
??4CCopyAttributesRule@Mig@@QEAAAEAV01@$$QEAV01@@Z
??4CCopyAttributesRule@Mig@@QEAAAEAV01@AEBV01@@Z
??4CCopyChildrenRule@Mig@@QEAAAEAV01@$$QEAV01@@Z
??4CCopyChildrenRule@Mig@@QEAAAEAV01@AEBV01@@Z
??4CEnvExpandRule@Mig@@QEAAAEAV01@AEBV01@@Z
??4CIdStringAsInnerTextRule@Mig@@QEAAAEAV01@$$QEAV01@@Z
??4CIdStringAsInnerTextRule@Mig@@QEAAAEAV01@AEBV01@@Z
??4CLinkedRule@Mig@@QEAAAEAV01@AEBV01@@Z
??4CNodeInnerTextCopyRule@Mig@@QEAAAEAV01@$$QEAV01@@Z
??4CNodeInnerTextCopyRule@Mig@@QEAAAEAV01@AEBV01@@Z
??4CSelectRule@Mig@@QEAAAEAV01@AEBV01@@Z
??4CStatePatternRule@Mig@@QEAAAEAV01@$$QEAV01@@Z
??4CStatePatternRule@Mig@@QEAAAEAV01@AEBV01@@Z
??4CSupportedIdRule@Mig@@QEAAAEAV01@$$QEAV01@@Z
??4CSupportedIdRule@Mig@@QEAAAEAV01@AEBV01@@Z
??4CTranslationMigAttrib@Mig@@QEAAAEAV01@AEBV01@@Z
??4CTranslationPattern@Mig@@QEAAAEAV01@AEBV01@@Z
??4CTranslationRuleCollection@Mig@@QEAAAEAV01@AEBV01@@Z
??4CTranslationRuleFactory@Mig@@QEAAAEAV01@$$QEAV01@@Z
??4CTranslationRuleFactory@Mig@@QEAAAEAV01@AEBV01@@Z
??4CUrlIdRule@Mig@@QEAAAEAV01@$$QEAV01@@Z
??4CUrlIdRule@Mig@@QEAAAEAV01@AEBV01@@Z
??4CXPathRule@Mig@@QEAAAEAV01@AEBV01@@Z
??4ITranslationRule@Mig@@QEAAAEAU01@$$QEAU01@@Z
??4ITranslationRule@Mig@@QEAAAEAU01@AEBU01@@Z
??_7CAppendNewAttributeRule@Mig@@6BITranslationRule@1@@
??_7CAppendNewAttributeRule@Mig@@6BObject@UnBCL@@@
??_7CAppendNewChildRule@Mig@@6BITranslationRule@1@@
??_7CAppendNewChildRule@Mig@@6BObject@UnBCL@@@
??_7CComponentPathRule@Mig@@6B@
??_7CComponentPathRule@Mig@@6BITranslationRule@1@@
??_7CComponentPathRule@Mig@@6BObject@UnBCL@@@
??_7CCopyAttributesRule@Mig@@6BITranslationRule@1@@
??_7CCopyAttributesRule@Mig@@6BObject@UnBCL@@@
??_7CCopyChildrenRule@Mig@@6BITranslationRule@1@@
??_7CCopyChildrenRule@Mig@@6BObject@UnBCL@@@
??_7CEnvExpandRule@Mig@@6BITranslationRule@1@@
??_7CEnvExpandRule@Mig@@6BObject@UnBCL@@@
??_7CIdStringAsInnerTextRule@Mig@@6B@
??_7CIdStringAsInnerTextRule@Mig@@6BITranslationRule@1@@
??_7CIdStringAsInnerTextRule@Mig@@6BObject@UnBCL@@@
??_7CLinkedRule@Mig@@6BITranslationRule@1@@
??_7CLinkedRule@Mig@@6BObject@UnBCL@@@
??_7CNodeInnerTextCopyRule@Mig@@6BITranslationRule@1@@
??_7CNodeInnerTextCopyRule@Mig@@6BObject@UnBCL@@@
??_7CSelectRule@Mig@@6BITranslationRule@1@@
??_7CSelectRule@Mig@@6BObject@UnBCL@@@
??_7CStatePatternRule@Mig@@6BITranslationRule@1@@
??_7CStatePatternRule@Mig@@6BObject@UnBCL@@@
??_7CSupportedIdRule@Mig@@6B@
??_7CSupportedIdRule@Mig@@6BITranslationRule@1@@
??_7CSupportedIdRule@Mig@@6BObject@UnBCL@@@
??_7CTranslationMigAttrib@Mig@@6B@
??_7CTranslationPattern@Mig@@6B@
??_7CTranslationRuleCollection@Mig@@6BITranslationRule@1@@
??_7CTranslationRuleCollection@Mig@@6BObject@UnBCL@@@
??_7CUrlIdRule@Mig@@6B@
??_7CUrlIdRule@Mig@@6BITranslationRule@1@@
??_7CUrlIdRule@Mig@@6BObject@UnBCL@@@
??_7CXPathRule@Mig@@6BITranslationRule@1@@
??_7CXPathRule@Mig@@6BObject@UnBCL@@@
??_8CAppendNewAttributeRule@Mig@@7B@
??_8CAppendNewAttributeRule@Mig@@7BCLinkedRule@1@@
??_8CAppendNewAttributeRule@Mig@@7BITranslationRule@1@@
??_8CAppendNewChildRule@Mig@@7B@
??_8CAppendNewChildRule@Mig@@7BCLinkedRule@1@@
??_8CAppendNewChildRule@Mig@@7BITranslationRule@1@@
??_8CComponentPathRule@Mig@@7B@
??_8CComponentPathRule@Mig@@7BCIdStringAsInnerTextRule@1@@
??_8CComponentPathRule@Mig@@7BITranslationRule@1@@
??_8CCopyAttributesRule@Mig@@7B01@@
??_8CCopyAttributesRule@Mig@@7BITranslationRule@1@@
??_8CCopyChildrenRule@Mig@@7B01@@
??_8CCopyChildrenRule@Mig@@7BITranslationRule@1@@
??_8CEnvExpandRule@Mig@@7B01@@
??_8CEnvExpandRule@Mig@@7BITranslationRule@1@@
??_8CNodeInnerTextCopyRule@Mig@@7B01@@
??_8CNodeInnerTextCopyRule@Mig@@7BITranslationRule@1@@
??_8CSelectRule@Mig@@7B01@@
??_8CSelectRule@Mig@@7BITranslationRule@1@@
??_8CStatePatternRule@Mig@@7B01@@
??_8CStatePatternRule@Mig@@7BITranslationRule@1@@
??_8CSupportedIdRule@Mig@@7B01@@
??_8CSupportedIdRule@Mig@@7BCIdStringAsInnerTextRule@1@@
??_8CSupportedIdRule@Mig@@7BCUrlIdRule@1@@
??_8CSupportedIdRule@Mig@@7BITranslationRule@1@@
??_8CTranslationMigAttrib@Mig@@7B@
??_8CTranslationPattern@Mig@@7B@
??_8CTranslationRuleCollection@Mig@@7B01@@
??_8CTranslationRuleCollection@Mig@@7BITranslationRule@1@@
??_8CUrlIdRule@Mig@@7B@
??_8CUrlIdRule@Mig@@7BCIdStringAsInnerTextRule@1@@
??_8CUrlIdRule@Mig@@7BITranslationRule@1@@
??_8CXPathRule@Mig@@7B@
??_8CXPathRule@Mig@@7BCLinkedRule@1@@
??_8CXPathRule@Mig@@7BITranslationRule@1@@
??_DCAppendNewAttributeRule@Mig@@QEAAXXZ
??_DCAppendNewChildRule@Mig@@QEAAXXZ
??_DCComponentPathRule@Mig@@QEAAXXZ
??_DCCopyAttributesRule@Mig@@QEAAXXZ
??_DCCopyChildrenRule@Mig@@QEAAXXZ
??_DCEnvExpandRule@Mig@@QEAAXXZ
??_DCNodeInnerTextCopyRule@Mig@@QEAAXXZ
??_DCSelectRule@Mig@@QEAAXXZ
??_DCStatePatternRule@Mig@@QEAAXXZ
??_DCSupportedIdRule@Mig@@QEAAXXZ
??_DCTranslationMigAttrib@Mig@@QEAAXXZ
??_DCTranslationPattern@Mig@@QEAAXXZ
??_DCTranslationRuleCollection@Mig@@QEAAXXZ
??_DCUrlIdRule@Mig@@QEAAXXZ
??_DCXPathRule@Mig@@QEAAXXZ
?AddAssemblyIdentityRule@CSelectRule@Mig@@QEAAXPEAUITranslationRule@2@@Z
?AddRule@CTranslationRuleCollection@Mig@@QEAAXPEAUITranslationRule@2@@Z
?AddSupportedComponentIdentityRule@CSelectRule@Mig@@QEAAXPEAUITranslationRule@2@@Z
?CreateRuleNode@CStatePatternRule@Mig@@IEAAPEAVXmlNode@UnBCL@@PEAV34@PEAVString@4@0@Z
?CreateTranslationRule@CTranslationRuleFactory@Mig@@SAPEAUITranslationRule@2@PEAVString@UnBCL@@HH@Z
?GetIdString@CIdStringAsInnerTextRule@Mig@@IEAAPEAVString@UnBCL@@PEAVXmlNode@4@@Z
?GetPatterns@CStatePatternRule@Mig@@IEAAPEAV?$ArrayList@PEAVCTranslationPattern@Mig@@@UnBCL@@PEAVXmlNode@4@H@Z
?GetType@CStatePatternRule@Mig@@IEAAPEAVString@UnBCL@@XZ
?TransformIdString@CComponentPathRule@Mig@@UEAAPEAVString@UnBCL@@PEAVXmlNode@4@PEAV34@@Z
?TransformIdString@CSupportedIdRule@Mig@@UEAAPEAVString@UnBCL@@PEAVXmlNode@4@PEAV34@@Z
?TransformIdString@CUrlIdRule@Mig@@MEAAPEAVString@UnBCL@@PEAVXmlNode@4@PEAV34@@Z
?Translate@CAppendNewAttributeRule@Mig@@UEAAHPEAVXmlNode@UnBCL@@0@Z
?Translate@CAppendNewChildRule@Mig@@UEAAHPEAVXmlNode@UnBCL@@0@Z
?Translate@CCopyAttributesRule@Mig@@UEAAHPEAVXmlNode@UnBCL@@0@Z
?Translate@CCopyChildrenRule@Mig@@UEAAHPEAVXmlNode@UnBCL@@0@Z
?Translate@CEnvExpandRule@Mig@@UEAAHPEAVXmlNode@UnBCL@@0@Z
?Translate@CIdStringAsInnerTextRule@Mig@@UEAAHPEAVXmlNode@UnBCL@@0@Z
?Translate@CNodeInnerTextCopyRule@Mig@@UEAAHPEAVXmlNode@UnBCL@@0@Z
?Translate@CSelectRule@Mig@@UEAAHPEAVXmlNode@UnBCL@@0@Z
?Translate@CStatePatternRule@Mig@@UEAAHPEAVXmlNode@UnBCL@@0@Z
?Translate@CTranslationRuleCollection@Mig@@UEAAHPEAVXmlNode@UnBCL@@0@Z
?Translate@CXPathRule@Mig@@UEAAHPEAVXmlNode@UnBCL@@0@Z
?TranslateToMigRule@CStatePatternRule@Mig@@IEAAPEAVXmlNode@UnBCL@@PEAVXmlDocument@4@PEAVString@4@PEAVCTranslationMigAttrib@2@@Z
?get_Attribute@CTranslationMigAttrib@Mig@@QEAAPEAVXmlNode@UnBCL@@XZ
?get_Context@CTranslationPattern@Mig@@QEAAPEAVString@UnBCL@@XZ
?get_PatternString@CTranslationPattern@Mig@@QEAAPEAVString@UnBCL@@XZ
?get_RuleName@CTranslationMigAttrib@Mig@@QEAAPEAVString@UnBCL@@XZ
Translate

Sections

.text
Size: 87KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 78KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ed7988298b6c68e0a63a784ef1147f68

Code Sign

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5fCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

7d:40:a6:33:5e:da:f1:f9:7a:09:6d:03:4e:e6:ce:82:fc:9c:60:75:cc:ca:7c:74:4c:d2:12:e7:b5:cf:77:72Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

kernel32

unbcl

wdscore

Exports

Exports

Sections

.text Size: 87KB - Virtual size: 87KB

.rdata Size: 78KB - Virtual size: 78KB

.data Size: 4KB - Virtual size: 5KB

.pdata Size: 4KB - Virtual size: 4KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

7d:40:a6:33:5e:da:f1:f9:7a:09:6d:03:4e:e6:ce:82:fc:9c:60:75:cc:ca:7c:74:4c:d2:12:e7:b5:cf:77:72
Signer

.text
Size: 87KB - Virtual size: 87KB

.rdata
Size: 78KB - Virtual size: 78KB

.data
Size: 4KB - Virtual size: 5KB

.pdata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB