CTF4GF
ObGetVersionInfo
ObIsPlexFunction
Static task
static1
Behavioral task
behavioral1
Sample
2fcd7bd8c01d66bf5d20490e040dd6b0_NEIKI.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2fcd7bd8c01d66bf5d20490e040dd6b0_NEIKI.dll
Resource
win10v2004-20240419-en
Target
2fcd7bd8c01d66bf5d20490e040dd6b0_NEIKI
Size
324KB
MD5
2fcd7bd8c01d66bf5d20490e040dd6b0
SHA1
a81a8af9e35f46ce61efcf80e0349e640a1ccab1
SHA256
98c671f9f01b650f03be57f61dc03861907f471a3d8d4e2dd50997da04d79bbb
SHA512
405442f52de576f748a05f81e0cd40b279bb292bf31163505aad06370ba61a933eaef014a6b75549c26840d8c41565a331c38062371e352618da7832540eb486
SSDEEP
3072:qdjrUwE0k3rCy3cGo64XJwXwBBhadzekiopJN7VOr6PMymaRmFk3LwI1:u5E0k3vtqSXwiD7Ar6PMymaRAk3T1
Checks for missing Authenticode signature.
resource |
---|
2fcd7bd8c01d66bf5d20490e040dd6b0_NEIKI |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
??0ObVariantFld@@QAE@XZ
?SetAuxData@ObStateWin@@UAEXAAUObAuxCtrlInfo@@@Z
?DisplayContextMenu@ObStateWin@@UAEXHIVCPoint@@@Z
?SetPosition@ObPanel@@EAEXVCPoint@@@Z
?SetSize@ObPanel@@EAEXVCSize@@@Z
?SetText@ObPanel@@EAEXPBD@Z
?Repaint@ObPanel@@UAEXXZ
??1ObPanel@@UAE@XZ
?AddKeyBoardEvent@ObPanel@@QAEXJH@Z
?SetContextMenu@ObPanel@@QAEXHH@Z
?RegisterLogicalEvent@ObPanel@@QAEXHJ@Z
?pszGetResourceString@@YAPBDIPAVObPanel@@@Z
?LoadFields@HGrid@@QAEXH@Z
?AddEvent@ObPanel@@QAEXQAVObLogEvent@@@Z
?pBindControl@ObPanel@@IAEPAVObCtrl@@HHPAVHGrid@@@Z
?LoadControls@ObPanel@@QAEXXZ
??1ObRCDATA@@QAE@XZ
?Init@ObPanel@@QAEHW4ObWinType@@KKKW4PanelPlacement@1@H@Z
?pGetData@ObRCDATA@@QAEPADXZ
??0ObRCDATA@@QAE@PAVObPanel@@H@Z
?ChildPanelOptions@ObPanel@@QAEXHHH@Z
??0ObPanel@@QAE@QAVObFunctionData@@@Z
?Return@ObFunctionData@@QAEXXZ
?LogicalEvent@ObPanelAPI@@SAXPBD0AAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?Log@ObMessage@@SAXKW4ObMsgType@ObMsg@@JVObString@@PBDZZ
?Status@ObMessage@@SAXPBDZZ
?Box@ObMessage@@SAHKIPBDZZ
?Call@ObCallMgr@@SAXQAVObFunctionData@@QAVObParamVariable@@1HPBD2@Z
?GetPanelCWndByName@ObPanelAPI@@SAPAVCWnd@@PBD@Z
?Formatf@ObCharFld@@QAAXPBDZZ
?CastFrom@ObCharFld@@QAEXAAVObLdblFld@@@Z
?CastFrom@ObLdblFld@@QAEXAAVObCharFld@@@Z
?CastFrom@ObLdblFld@@QAEXAAVObIntFld@@@Z
?CastFrom@ObLdblFld@@QAEXAAVObLongFld@@@Z
?CastFrom@ObLongFld@@QAEXAAVObTimeFld@@@Z
?CastFrom@ObCharFld@@QAEXAAV1@@Z
?CastFrom@ObIntFld@@QAEXAAVObLdblFld@@@Z
?CastFrom@ObTimeFld@@QAEXAAVObLongFld@@@Z
?CastFrom@ObLongFld@@QAEXAAVObLdblFld@@@Z
??4ObIntFld@@QAEABV0@ABVObLdblFld@@@Z
??4ObLdblFld@@QAEABV0@ABV0@@Z
??4ObLongFld@@QAEABV0@ABV0@@Z
??4ObTimeFld@@QAEABV0@ABV0@@Z
??1ObVariantFld@@UAE@XZ
?GetCWinApp@ObAppAPI@@SAPAVCWinApp@@XZ
?CastFrom@ObLongFld@@QAEXAAVObCharFld@@@Z
?fGetNextSelected@HGrid@@QAEHXZ
?fGetFirstRecord@HGrid@@QAEHXZ
?GetText@ObCharFld@@QBEPADXZ
??4ObVariantFld@@QAEABV0@ABVObLongFld@@@Z
?TrimSpaces@ObCharFld@@QAEXXZ
?CastFrom@ObVariantFld@@QAEXAAVObCharFld@@@Z
??0ObComFld@@QAE@U_GUID@@0@Z
??0ObLongFld@@QAE@ABV0@@Z
?CastFrom@ObLongFld@@QAEXAAVObIntFld@@@Z
?SetEmpty@ObTimeFld@@QAEXXZ
??1ObFunctionData@@UAE@XZ
?Entry@ObFunctionData@@QAEHXZ
?IsValid@ObFunctionData@@SAHQAV1@IIPBDI@Z
??0ObFunctionData@@QAE@QAVObFncParameter@@QAVObLocalVariable@@PBD22II@Z
?EnableKeyBoardState@ObPanel@@QAEXJH@Z
?EndSetFocus@ObPanel@@QAEXXZ
??1ObFncDataHandler@@QAE@XZ
?StartPanel@ObPanel@@QAEXXZ
??0ObFncDataHandler@@QAE@QAVObFunctionData@@@Z
?SetPanel@ObFunctionData@@QAEXQAVObPanel@@@Z
?AddFld@ObRTDI@@SAXPAVObFunctionData@@HKPBD1W4FldType@@W4FldPCType@@W4FldAS400Type@@W4FldSQLType@@GGGG@Z
?AddVarFld@ObRTDI@@SAXPAVObVariable@@PAVObRTType@@HHW4eFldUsage@1@G@Z
?AddFncVar@ObRTDI@@SAXPAVObFunctionData@@PAVObVariable@@HHG@Z
?AddVar@ObRTDI@@SAXPAVObFunctionData@@HKPBD1W4eVarClass@1@1G@Z
?AddFnc@ObRTDI@@SAXPAVObFunctionData@@HKPBD1W4ObFncTypeSys@@W4ObFncLanguageSys@@111W4ObSystemType@@PAX@Z
?SetEmpty@ObCharFld@@QAEXXZ
?SetState@ObStateWin@@QAEXI@Z
??4ObCharFld@@QAEABV0@ABV0@@Z
??4ObIntFld@@QAEABV0@ABVObLongFld@@@Z
?NameField@ObActiveXAPI@@SAXPAVObRTType@@PBD@Z
?RunScript@ObActiveXAPI@@SAHHPBD@Z
??0ObIntFld@@QAE@FG@Z
??4ObIntFld@@QAEABV0@ABV0@@Z
?GetPanelByName@ObPanelAPI@@SAPAVObPanel@@PBD@Z
?SetSite@ObPanel@@QAEHPBDH@Z
?GetValue@ObPropertyAPI@@SAXAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBDHH@Z
?PrepareAPICall@ObUserAPI@@SAXPAVObFunctionData@@@Z
?SetValue@ObPropertyAPI@@SAXPBD0HH@Z
?StartAccess@HGrid@@QAEXW4AccMode@@@Z
??0ObCharFld@@QAE@JHHGPBD000G@Z
??0ObCharFld@@QAE@PBDG@Z
?pszObTrimSpaces@@YAPADPAD@Z
?iObCompString@@YAHPBD0@Z
?fGetFirstSelected@HGrid@@QAEHXZ
?GetFieldAccMode@HGrid@@QAE?AW4AccMode@@W42@@Z
?EndAccess@HGrid@@QAEXW4AccMode@@@Z
?ProcessHResult@ObComFld@@IAEXPAVObFunctionData@@@Z
??4ObCharFld@@QAEABV0@ABVObVariantFld@@@Z
?pGetBSTR@ObVariantFld@@QAEPAPAGXZ
?GetBSTR@ObVariantFld@@QAEPAGXZ
??4ObVariantFld@@QAEABV0@ABV0@@Z
?CastFrom@ObVariantFld@@QAEXAAV1@@Z
?GetLong@ObVariantFld@@QAEJXZ
?CastFrom@ObVariantFld@@QAEXAAVObLongFld@@@Z
??4ObLongFld@@QAEABV0@ABVObVariantFld@@@Z
?pGetLong@ObVariantFld@@QAEPAJXZ
??4ObByteFld@@QAEABV0@ABVObVariantFld@@@Z
?CastFrom@ObVariantFld@@QAEXAAVObByteFld@@@Z
??0ObDateFld@@QAE@HHHG@Z
??0ObTimeFld@@QAE@HHHG@Z
??0ObTimeStampFld@@QAE@HHHHHHJG@Z
?ConcatCopy@ObString@@IAEXHPBDH0@Z
?GetLength@ObString@@QBEHXZ
??1ObComFld@@QAE@XZ
?SetInterface@ObComFld@@UAEXPAUIUnknown@@@Z
?GetIUnknown@ObComFld@@UAEJAAPAUIUnknown@@@Z
?isLicensed@ObComFld@@UAEHXZ
?GetLicenseKey@ObComFld@@UAEPAGXZ
?CreateInstance@ObComFld@@UAEJPBD0PAVObFunctionData@@@Z
?CastFrom@ObComFld@@UAEJAAVObVariantFld@@@Z
?CastFrom@ObComFld@@UAEJPAUIUnknown@@@Z
?CastFrom@ObComFld@@UAEJAAV1@@Z
?CompareEqual@ObComFld@@UAE_NAAV1@@Z
?CompareNotEqual@ObComFld@@UAE_NAAV1@@Z
?CheckInterface@ObComFld@@UAE_NXZ
?MapEvent@ObComFld@@UAEXPAVObFunctionData@@U_GUID@@JJPAVObVariable@@@Z
?StartSetFocus@ObPanel@@QAEXXZ
??1ObCtrObj@@UAE@XZ
?DeleteRTDIVarFldMapArray@ObVariable@@QAEXXZ
?strGetText@ObCharFld@@UAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?PutText@ObCharFld@@UAEXPBD@Z
?strGetAS400StateDefault@ObCharFld@@UAEPADPADAAHGHHD@Z
?fSetStateFromAS400@ObCharFld@@UAEHPBDIHHD@Z
?strGetMaskedText@ObCharFld@@UAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD@Z
?strGetText@ObTimeStampFld@@UAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?PutText@ObTimeStampFld@@UAEXPBD@Z
?strGetAS400StateDefault@ObTimeStampFld@@UAEPADPADAAHGHHD@Z
?fSetStateFromAS400@ObTimeStampFld@@UAEHPBDIHHD@Z
?strGetMaskedText@ObTimeStampFld@@UAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD@Z
?strGetText@ObTimeFld@@UAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?PutText@ObTimeFld@@UAEXPBD@Z
?strGetAS400StateDefault@ObTimeFld@@UAEPADPADAAHGHHD@Z
?fSetStateFromAS400@ObTimeFld@@UAEHPBDIHHD@Z
?strGetMaskedText@ObTimeFld@@UAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD@Z
?strGetText@ObDateFld@@UAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?PutText@ObDateFld@@UAEXPBD@Z
?strGetAS400StateDefault@ObDateFld@@UAEPADPADAAHGHHD@Z
?fSetStateFromAS400@ObDateFld@@UAEHPBDIHHD@Z
?strGetMaskedText@ObDateFld@@UAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD@Z
?DDX@ObCtrl@@QAEHW4AccMode@@AAVObIntFld@@@Z
?DDX@ObCtrl@@QAEHW4AccMode@@AAVObTimeFld@@@Z
?CollateFieldStates@@YAHAAVObRTType@@0H@Z
?DDX@ObCtrl@@QAEHW4AccMode@@AAVObCharFld@@@Z
??0ObLdblFld@@QAE@OG@Z
??0ObLongFld@@QAE@JG@Z
?strGetText@ObLdblFld@@QAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@H@Z
?SetEmpty@ObLdblFld@@QAEXXZ
?PutText@ObLdblFld@@UAEXPBD@Z
?strGetAS400StateDefault@ObLdblFld@@UAEPADPADAAHGHHD@Z
?fSetStateFromAS400@ObLdblFld@@UAEHPBDIHHD@Z
?strGetMaskedText@ObLdblFld@@UAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD@Z
?SetEmpty@ObLongFld@@QAEXXZ
?strGetText@ObLongFld@@UAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?PutText@ObLongFld@@UAEXPBD@Z
?strGetAS400StateDefault@ObLongFld@@UAEPADPADAAHGHHD@Z
?fSetStateFromAS400@ObLongFld@@UAEHPBDIHHD@Z
?strGetMaskedText@ObLongFld@@UAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD@Z
??0ObComFld@@QAE@U_GUID@@@Z
?SetEmpty@ObIntFld@@QAEXXZ
?strGetText@ObIntFld@@UAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?PutText@ObIntFld@@UAEXPBD@Z
?strGetAS400StateDefault@ObIntFld@@UAEPADPADAAHGHHD@Z
?fSetStateFromAS400@ObIntFld@@UAEHPBDIHHD@Z
?strGetMaskedText@ObIntFld@@UAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD@Z
?SetEmpty@ObByteFld@@QAEXXZ
?strGetText@ObByteFld@@UAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?PutText@ObByteFld@@UAEXPBD@Z
?strGetAS400StateDefault@ObByteFld@@UAEPADPADAAHGHHD@Z
?fSetStateFromAS400@ObByteFld@@UAEHPBDIHHD@Z
?strGetMaskedText@ObByteFld@@UAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD@Z
?CheckLength@ObString@@AAEXXZ
?Init@ObString@@AAEXHJH@Z
?ObMIx@@YAHHHAAVObString@@@Z
??4ObVariantFld@@QAEABV0@ABVObCharFld@@@Z
?ClearCreationDetails@ObComFld@@QAEXXZ
GetVersionExA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
ExitProcess
DeleteCriticalSection
InitializeCriticalSection
InterlockedDecrement
LocalFree
LoadLibraryA
GetProcAddress
CoInitialize
ord265
ord1098
ord1084
ord578
ord310
ord297
ord304
ord2475
ord2468
ord5154
ord764
ord762
ord266
ord5833
ord3389
ord6067
ord6090
ord2902
ord2131
ord876
??1type_info@@UAE@XZ
free
_except_handler3
__CxxFrameHandler
memcpy
memset
?terminate@@YAXXZ
_makepath
_splitpath
malloc
_initterm
_adjust_fdiv
__CppXcptFilter
__security_error_handler
__dllonexit
_onexit
strlen
_CxxThrowException
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
SysFreeString
VariantCopy
VariantInit
VariantClear
GetErrorInfo
SysAllocString
CTF4GF
ObGetVersionInfo
ObIsPlexFunction
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ