41fe29df64e673c0bdcece6ab4641260_NeikiAnalytics

Sharing

Copy URL Twitter E-mail

General

Target

41fe29df64e673c0bdcece6ab4641260_NeikiAnalytics
Size

3.2MB
MD5

41fe29df64e673c0bdcece6ab4641260
SHA1

996c5cf51e2d9ccd1e727d4adec5f58545476664
SHA256

b66633bcb2a58f02d85a1b9648168c9f3abe57f049a7dcd0f9d4660e2cfd7e44
SHA512

5c01eb0fb55ed5def8d4702520dc58cc889d62e927fabb4d7d4463dc0ab2e5c257693ee7d6cad61a21870fdeefc6a43994bbc9ef661d703e9294e20720d013c1
SSDEEP

49152:dVd64uUkfrQpCNWAr/DKEdtO5TDuiQqjNReKDsCALOyKJiCao4+esLu+m:JgU1HNRVTJiCcslm

Score

1^/10

Malware Config

Signatures

Files

41fe29df64e673c0bdcece6ab4641260_NeikiAnalytics
.exe windows:6 windows x64 arch:x64

027166c97025b87b2219a54ea593c913

Code Sign

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2013, 12:00

Not After

15/01/2038, 12:00

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:0a:5a:39:6d:03:ea:60:cd:53:68:b3:d7:ba:f7:a6
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

21/09/2023, 00:00

Not After

15/09/2026, 23:59

Subject

CN=Winsider Seminars & Solutions Inc.,O=Winsider Seminars & Solutions Inc.,L=Montréal,ST=Quebec,C=CA

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a1:0f:5c:ed:a5:d2:9b:05:b0:ae:6f:87:4f:75:4a:b3:bd:c6:4b:a7:6c:07:1c:e4:b3:47:ab:99:c0:e6:b2:2d
Signer

Actual PE Digest

a1:0f:5c:ed:a5:d2:9b:05:b0:ae:6f:87:4f:75:4a:b3:bd:c6:4b:a7:6c:07:1c:e4:b3:47:ab:99:c0:e6:b2:2d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

SystemInformer.pdb

Imports

comctl32

ord381
PropertySheetW
ord345
InitCommonControlsEx
CreatePropertySheetPageW
ImageList_CoCreateInstance

ntdll

NtSetEvent
NtCreateEvent
NtAlpcQueryInformation
NtReadVirtualMemory
NtReadFile
NtWriteFile
NtQueryInformationThread
NtSuspendProcess
NtResumeThread
NtWaitForSingleObject
NtSetInformationDebugObject
NtUnmapViewOfSection
RtlRaiseStatus
NtSetInformationProcess
NtShutdownSystem
NtDuplicateObject
NtInitiatePowerAction
NtClose
NtQueryInformationToken
NtResumeProcess
NtSetSystemPowerState
NtRemoveProcessDebug
NtQueryInformationProcess
RtlEnterCriticalSection
RtlLeaveCriticalSection
RtlDeleteCriticalSection
RtlInitializeCriticalSection
RtlSetHeapInformation
NtProtectVirtualMemory
NtSuspendThread
RtlExitUserProcess
NtFreeVirtualMemory
RtlQueryPerformanceFrequency
RtlNtStatusToDosErrorNoTeb
NtCreateDirectoryObject
RtlTimeFieldsToTime
RtlGUIDFromString
NtDuplicateToken
RtlRandomEx
RtlTimeToTimeFields
RtlCreateProcessReflection
RtlGetAce
RtlGetFullPathName_UEx
NtDelayExecution
RtlFindMessage
RtlStringFromGUID
RtlQueryPerformanceCounter
RtlCreateProcessParameters
NtQueryDefaultLocale
RtlCreateUserProcess
RtlGetDaclSecurityDescriptor
NtTerminateProcess
RtlExpandEnvironmentStrings_U
RtlFirstEntrySList
RtlUnicodeToMultiByteN
RtlDowncaseUnicodeChar
NtCreateThreadEx
NtAllocateVirtualMemory
RtlReAllocateHeap
TpSimpleTryPost
RtlUTF8ToUnicodeN
RtlMultiByteToUnicodeN
RtlMultiByteToUnicodeSize
RtlUnicodeToMultiByteSize
RtlUnicodeToUTF8N
RtlFindClearBitsAndSet
RtlInterlockedPopEntrySList
RtlGetVersion
NtUnlockFile
NtSetInformationFile
NtLockFile
NtFlushBuffersFile
NtQueryInformationFile
NtGetContextThread
LdrGetProcedureAddress
LdrUnloadDll
LdrLoadDll
NtQueryValueKey
NtQueryKey
NtOpenProcessToken
NtOpenThread
RtlQueueApcWow64Thread
NtOpenSymbolicLinkObject
NtEnumerateKey
NtGetNextProcess
NtUnloadDriver
NtEnumerateValueKey
NtQueueApcThread
NtOpenKey
RtlGetSaclSecurityDescriptor
RtlDosPathNameToNtPathName_U_WithStatus
RtlConvertSidToUnicodeString
NtQuerySymbolicLinkObject
NtOpenProcess
NtTerminateThread
NtCreateNamedPipeFile
NtGetNextThread
NtQueryInformationJobObject
NtSetSecurityObject
NtDeleteValueKey
NtWaitForMultipleObjects
NtDeviceIoControlFile
NtOpenDirectoryObject
RtlGetUnloadEventTraceEx
NtFsControlFile
NtQueryDirectoryObject
NtAdjustGroupsToken
NtSetSystemEnvironmentValueEx
NtOpenThreadToken
NtTraceControl
NtQuerySystemEnvironmentValueEx
RtlInitializeBitMap
RtlNumberOfSetBits
NtLoadKeyEx
NtCreateKey
NtEnumerateSystemEnvironmentValuesEx
NtQueueApcThreadEx
NtQuerySecurityAttributesToken
NtQueryObject
NtCreateFile
NtQueryDirectoryFile
NtOpenSection
NtQuerySecurityObject
NtSetValueKey
RtlQueryEnvironmentVariable
NtOpenFile
NtQueryFullAttributesFile
NtReleaseKeyedEvent
NtWaitForKeyedEvent
NtCreateKeyedEvent
NtLoadDriver
LdrFindResource_U
LdrAccessResource
RtlLengthSecurityDescriptor
RtlValidSecurityDescriptor
NtClearEvent
NtCreateSemaphore
NtFlushInstructionCache
RtlSetOwnerSecurityDescriptor
RtlGetControlSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlSetControlSecurityDescriptor
RtlSetGroupSecurityDescriptor
TpWaitForIoCompletion
TpAllocIoCompletion
TpReleasePool
TpReleaseIoCompletion
TpAllocPool
TpSetPoolMinThreads
TpCancelAsyncIoOperation
TpStartAsyncIoOperation
TpSetPoolMaxThreads
NtSetTimer
NtAlertThread
NtCreateTimer
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlUnwindEx
RtlPcToFileHeader
NtResetEvent
NtQueryVirtualMemory
NtQueryOpenSubKeysEx
NtQuerySection
NtMapViewOfSection
NtQueryVolumeInformationFile
NtAssignProcessToJobObject
NtTerminateJobObject
NtSystemDebugControl
NtOpenMutant
NtAdjustPrivilegesToken
RtlSetUnhandledExceptionFilter
RtlSetCurrentDirectory_U
NtCreateMutant
NtWriteVirtualMemory
NtQuerySystemInformation
NtSetSystemInformation
RtlDestroyQueryDebugBuffer
RtlQueryProcessDebugInformation
RtlCreateQueryDebugBuffer
RtlDestroyHeap
RtlAllocateHeap
RtlFreeHeap
RtlCreateHeap
RtlInterlockedPushEntrySList
RtlInterlockedFlushSList
RtlIpv4AddressToStringExW
RtlIpv6AddressToStringExW
NtQueryTimer
NtSetLowEventPair
NtPulseEvent
NtCancelTimer
NtQuerySemaphore
NtQueryEvent
NtSetHighEventPair
NtReleaseSemaphore
NtDeleteKey
RtlQueryElevationFlags
NtCreateSection
RtlAbsoluteToSelfRelativeSD
NtRequestWaitReplyPort
NtConnectPort
RtlSelfRelativeToAbsoluteSD2
RtlValidRelativeSecurityDescriptor
NtCreatePort
RtlSetDaclSecurityDescriptor
NtReplyWaitReceivePort
NtAcceptConnectPort
NtQueryAttributesFile
RtlUpcaseUnicodeChar
NtSetInformationToken
NtPowerInformation
NtTestAlert
NtSetInformationThread
RtlSizeHeap
NtIsProcessInJob
NtQuerySystemInformationEx
RtlRegisterWait
RtlDeregisterWaitEx
RtlCreateSecurityDescriptor
RtlCreateAcl
NtQueryMutant
RtlAddAccessAllowedAce

kernel32

FindFirstFileExW
FindClose
SetEndOfFile
WideCharToMultiByte
SetStdHandle
GetOEMCP
GetACP
IsValidCodePage
MultiByteToWideChar
GetCPInfo
GetStringTypeW
HeapReAlloc
GetLastError
SetConsoleCtrlHandler
FreeConsole
GetConsoleWindow
AllocConsole
LoadLibraryExW
LocalFree
SearchPathW
GetTimeFormatEx
GetLocaleInfoW
GetDateFormatEx
FormatMessageW
GetNumberFormatW
CreateProcessW
TlsSetValue
SetLastError
TlsAlloc
TlsGetValue
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
IsProcessorFeaturePresent
FreeLibrary
GetCurrentProcess
LocalAlloc
GlobalSize
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
LCMapStringW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
HeapFree
HeapAlloc
SetFilePointerEx
GetFileSizeEx
GetModuleHandleExW
ExitProcess
GetModuleFileNameW
GetStdHandle
GetFileType
CreateFileW
GetConsoleOutputCP
WriteFile
CloseHandle
ReadConsoleW
GetConsoleMode
ReadFile
GetProcAddress
TlsFree
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
EncodePointer
RaiseException
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCommandLineW
GetProcessHeap
FlushFileBuffers
WriteConsoleW
HeapSize
FindNextFileW
GetCommandLineA

user32

GetCapture
RegisterClassExW
UnregisterClassW
GetDC
GetFocus
CallWindowProcW
DefWindowProcW
LoadImageW
PostQuitMessage
KillTimer
SetCursor
TranslateMessage
IsDialogMessageW
SetTimer
DispatchMessageW
GetMessageW
TranslateAcceleratorW
IsChild
LoadAcceleratorsW
SendMessageTimeoutW
UpdateWindow
OpenWindowStationW
OpenDesktopW
CreateMenu
EndDeferWindowPos
ChangeWindowMessageFilterEx
IntersectRect
SetMenu
CloseDesktop
BeginDeferWindowPos
IsWindow
GetWindowPlacement
CreateWindowExW
CloseWindowStation
GetWindow
ShowWindowAsync
DeferWindowPos
MoveWindow
GetMonitorInfoW
IsHungAppWindow
SetActiveWindow
MonitorFromWindow
MonitorFromPoint
GetForegroundWindow
GetDoubleClickTime
CreateIconIndirect
GetProcessWindowStation
SetWindowTextW
EnumDesktopsW
ReleaseCapture
PtInRect
SetCapture
GetAsyncKeyState
SetWindowPlacement
GetGUIThreadInfo
PeekMessageW
MsgWaitForMultipleObjects
MonitorFromRect
MessageBoxW
GetScrollBarInfo
GetWindowDC
SetMenuInfo
GetIconInfo
FindWindowExW
GetWindowTextW
SystemParametersInfoW
CreateDialogIndirectParamW
GetDesktopWindow
LookupIconIdFromDirectoryEx
IsClipboardFormatAvailable
GetUserObjectInformationW
SetClipboardData
GetClipboardData
EnumWindows
LoadMenuIndirectW
DialogBoxIndirectParamW
InternalGetWindowText
EmptyClipboard
CloseClipboard
GetWindowInfo
OpenClipboard
GetActiveWindow
GetThreadDesktop
GetSystemMetrics
GetGuiResources
EnumChildWindows
GetPropW
CreateIconFromResourceEx
GetWindowTextLengthW
DestroyMenu
TrackPopupMenu
CreatePopupMenu
InsertMenuItemW
SetScrollPos
ShowCaret
EnableScrollBar
DestroyCaret
DragDetect
CreateCaret
SetCaretPos
GetScrollInfo
RegisterClipboardFormatW
SetScrollInfo
SetCursorPos
ScrollWindowEx
GetUpdateRect
GetMessageTime
DrawFocusRect
InvalidateRgn
WaitMessage
MessageBeep
GetMessagePos
GetUpdateRgn
IsIconic
SetForegroundWindow
GetDlgItem
ShowWindow
SendMessageW
DestroyWindow
LockWorkStation
ExitWindowsEx
IsWindowVisible
AllowSetForegroundWindow
GetShellWindow
GetWindowThreadProcessId
EnableWindow
GetParent
IsWindowEnabled
EndDialog
GetClassNameW
GetCursorPos
InvalidateRect
GetClientRect
FindWindowW
SetLayeredWindowAttributes
ClientToScreen
DestroyIcon
RedrawWindow
GetSubMenu
GetWindowLongPtrW
ScreenToClient
SetWindowLongPtrW
GetMenuItemCount
GetMenu
PostMessageW
GetKeyState
GetMenuItemInfoW
GetSysColorBrush
DrawTextW
GetSysColor
FillRect
MapWindowPoints
FrameRect
SetWindowPos
GetWindowRect
MapDialogRect
SetFocus
DrawIconEx
EnableMenuItem
BringWindowToTop
DeleteMenu
GetSystemMenu
EndPaint
BeginPaint
ReleaseDC
GetDCEx
GetAncestor
DrawFrameControl
GetClassInfoExW
DrawEdge
TrackMouseEvent

gdi32

SaveDC
GetClipRgn
SelectClipRgn
RestoreDC
IntersectClipRect
SetBoundsRect
TextOutW
GetCharWidthW
Rectangle
GetDIBits
GetDeviceCaps
GdiAlphaBlend
CreateRectRgn
CombineRgn
PatBlt
ExcludeClipRect
CreateDIBSection
CreateFontW
Polyline
SetDCPenColor
GetTextMetricsW
GetTextColor
SetBkColor
GetTextExtentPoint32W
GetObjectW
RectVisible
GetStockObject
SetDCBrushColor
BitBlt
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
DeleteDC
SetTextColor
SetBkMode
CreateSolidBrush
CreateFontIndirectW
DeleteObject

advapi32

CloseServiceHandle
LsaClose
LsaAddAccountRights
CreateServiceW
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerExW
CreateProcessAsUserW
GetEffectiveRightsFromAclW
LsaSetSecurityObject
LsaQuerySecurityObject
SetSecurityInfo
GetSecurityInfo
GetInheritanceSourceW
LsaLookupSids
LsaFreeMemory
LsaLookupPrivilegeValue
LsaLookupPrivilegeDisplayName
LsaLookupNames2
LsaOpenPolicy
LsaEnumeratePrivileges
LsaLookupPrivilegeName
OpenSCManagerW
ChangeServiceConfig2W
DeleteService
SetServiceObjectSecurity
ControlService
EnumDependentServicesW
StartServiceW
EnumServicesStatusExW
QueryServiceConfigW
ChangeServiceConfigW
QueryServiceConfig2W
OpenServiceW
QueryServiceStatusEx
QueryServiceObjectSecurity
InitiateShutdownW
CreateProcessWithLogonW
LogonUserW

ole32

CoUninitialize
CoTaskMemFree
CoInitializeEx
CoSetProxyBlanket

Exports

Exports

KphEnumerateProcessHandles2
KphLevel
KphQueryHashInformationFile
PhAddElementAvlTree
PhAddEntryHashtable
PhAddEntryHashtableEx
PhAddItemArray
PhAddItemList
PhAddItemPointerList
PhAddItemSimpleHashtable
PhAddItemsArray
PhAddItemsList
PhAddJsonArrayObject
PhAddJsonObject
PhAddJsonObject2
PhAddJsonObjectInt64
PhAddJsonObjectUInt64
PhAddJsonObjectValue
PhAddLayoutItem
PhAddLayoutItemEx
PhAddListViewColumn
PhAddListViewGroup
PhAddListViewGroupItem
PhAddListViewItem
PhAddPlusMaxMemorySingles
PhAddProcessPropPage
PhAddProcessPropPage2
PhAddPropPageLayoutItem
PhAddSetting
PhAddSettings
PhAddTabControlTab
PhAddTreeNewFilter
PhAdjustPrivilege
PhAdjustRectangleToBounds
PhAdjustRectangleToWorkingArea
PhAllocate
PhAllocateExSafe
PhAllocateFromFreeList
PhAllocatePage
PhAllocateSafe
PhAppResolverGetAppIdForWindow
PhAppendBytesBuilder
PhAppendBytesBuilder2
PhAppendBytesBuilderEx
PhAppendCharStringBuilder
PhAppendCharStringBuilder2
PhAppendFormatStringBuilder
PhAppendFormatStringBuilder_V
PhAppendStringBuilder
PhAppendStringBuilderEx
PhApplyTreeNewFilters
PhApplyTreeNewFiltersToNode
PhAutoDereferenceObject
PhBitmapSetAlpha
PhBoostProvider
PhBufferToHexString
PhBufferToHexStringEx
PhCallKphQueryFileInformationWithTimeout
PhCenterRectangle
PhCenterWindow
PhChangeServiceConfig2
PhClearArray
PhClearCacheDirectory
PhClearCircularBuffer_FLOAT
PhClearCircularBuffer_PVOID
PhClearCircularBuffer_ULONG
PhClearCircularBuffer_ULONG64
PhClearHashtable
PhClearIgnoredSettings
PhClearList
PhCloseServiceHandle
PhCmLoadSettings
PhCmSaveSettings
PhCompareStringRef
PhCompareStringZNatural
PhCompareUnicodeStringZIgnoreMenuPrefix
PhConcatStringRef2
PhConcatStringRef3
PhConcatStrings
PhConcatStrings2
PhConcatStrings_V
PhConnectPipe
PhConvertIgnoredSettings
PhConvertMultiByteToUtf16
PhConvertMultiByteToUtf16Ex
PhConvertUtf16ToAsciiEx
PhConvertUtf16ToMultiByte
PhConvertUtf16ToMultiByteEx
PhConvertUtf16ToUtf8
PhConvertUtf16ToUtf8Buffer
PhConvertUtf16ToUtf8Ex
PhConvertUtf16ToUtf8Size
PhConvertUtf8ToUtf16
PhConvertUtf8ToUtf16Buffer
PhConvertUtf8ToUtf16Ex
PhConvertUtf8ToUtf16Size
PhCopyBytesZ
PhCopyCircularBuffer_FLOAT
PhCopyCircularBuffer_PVOID
PhCopyCircularBuffer_ULONG
PhCopyCircularBuffer_ULONG64
PhCopyConvertCircularBufferULONG
PhCopyListView
PhCopyListViewInfoTip
PhCopyStringZ
PhCopyStringZFromBytes
PhCopyStringZFromMultiByte
PhCountStringZ
PhCreateAlloc
PhCreateBytes
PhCreateBytesEx
PhCreateCacheFile
PhCreateDialog
PhCreateDirectoryFullPathWin32
PhCreateDirectoryWin32
PhCreateEMenu
PhCreateEMenuItem
PhCreateFile
PhCreateFileStream
PhCreateFileStream2
PhCreateFileWin32
PhCreateFileWin32Ex
PhCreateHashtable
PhCreateJsonArray
PhCreateJsonObject
PhCreateJsonParser
PhCreateJsonParserEx
PhCreateKey
PhCreateKsiSettingsBlob
PhCreateList
PhCreateNamedPipe
PhCreateObject
PhCreateObjectType
PhCreateObjectTypeEx
PhCreateOpenFileDialog
PhCreatePipe
PhCreatePointerList
PhCreateProcess
PhCreateProcessAsUser
PhCreateProcessPropContext
PhCreateProcessPropPageContext
PhCreateProcessPropPageContextEx
PhCreateProcessRedirection
PhCreateProcessWin32
PhCreateProcessWin32Ex
PhCreateSaveFileDialog
PhCreateSearchControl
PhCreateSecurityPage
PhCreateServiceListControl
PhCreateSimpleHashtable
PhCreateString
PhCreateString3
PhCreateStringEx
PhCreateSymbolProvider
PhCreateThread
PhCreateThread2
PhCreateThreadEx
PhCreateXmlNode
PhCreateXmlOpaqueNode
PhDecodeUnicodeDecoder
PhDelayExecution
PhDeleteArray
PhDeleteAutoPool
PhDeleteBytesBuilder
PhDeleteCacheFile
PhDeleteCallback
PhDeleteCircularBuffer_FLOAT
PhDeleteCircularBuffer_PVOID
PhDeleteCircularBuffer_ULONG
PhDeleteCircularBuffer_ULONG64
PhDeleteDirectoryWin32
PhDeleteFastLock
PhDeleteFile
PhDeleteFileWin32
PhDeleteFreeList
PhDeleteGraphState
PhDeleteImageVersionInfo
PhDeleteLayoutManager
PhDeleteMemoryItemList
PhDeleteProviderThread
PhDeleteStaticWindowIcon
PhDeleteStringBuilder
PhDeleteTreeNewColumnMenu
PhDeleteTreeNewFilterSupport
PhDeleteValueKey
PhDeleteWorkQueue
PhDereferenceObject
PhDereferenceObjectDeferDelete
PhDereferenceObjectEx
PhDereferenceProcessRecord
PhDeselectAllProcessNodes
PhDeselectAllServiceNodes
PhDestroyEMenu
PhDestroyEMenuItem
PhDestroyWindowIcon
PhDestroyWindowRemote
PhDetermineDosPathNameType
PhDevFreeObjects
PhDevGetObjects
PhDeviceIoControlFile
PhDeviceProviderInitialization
PhDialogBox
PhDisconnectNamedPipe
PhDivideSinglesBySingle
PhDnsFree
PhDnsQuery
PhDnsQuery2
PhDoPropPageLayout
PhDoesFileExist
PhDoesFileExistWin32
PhDosErrorToNtStatus
PhDosPathNameToNtPathName
PhDrainAutoPool
PhDrawGraphDirect
PhDrawTrayIconText
PhDuplicateBytesZ
PhDuplicateBytesZSafe
PhDuplicateProcessInformation
PhDuplicateProcessNodeList
PhDuplicateStringZ
PhEditSecurity
PhEllipsisString
PhEllipsisStringPath
PhEncodeUnicode
PhEnumAvlTree
PhEnumChildWindows
PhEnumDependentServices
PhEnumDirectoryFile
PhEnumDirectoryObjects
PhEnumFileStreams
PhEnumFirmwareEnvironmentValues
PhEnumGenericModules
PhEnumHashtable
PhEnumKernelModules
PhEnumNetworkItems
PhEnumNetworkItemsByProcessId
PhEnumNextProcess
PhEnumNextThread
PhEnumObjectIdInformation
PhEnumObjectTypes
PhEnumPagefiles
PhEnumPointerListEx
PhEnumProcessEnvironmentVariables
PhEnumProcessItems
PhEnumProcesses
PhEnumProcessesEx
PhEnumReparsePointInformation
PhEnumWindows
PhEnumerateKey
PhEnumeratePlugins
PhEnumeratePrivileges
PhEnumerateValueKey
PhEqualStringRef
PhEscapeCommandLinePart
PhEscapeStringForMenuPrefix
PhExecuteRunAsCommand2
PhExecuteRunAsCommand3
PhExpandAllProcessNodes
PhExpandEnvironmentStrings
PhExponentiate
PhExponentiate64
PhExtractIcon
PhExtractIconEx
PhFillMemoryUlong
PhFinalArrayItems
PhFinalBytesBuilderBytes
PhFinalHash
PhFinalStringBuilderString
PhFindCharInStringRef
PhFindEMenuItem
PhFindElementAvlTree
PhFindEntryHashtable
PhFindItemList
PhFindItemPointerList
PhFindItemSimpleHashtable
PhFindLastCharInStringRef
PhFindListViewItemByFlags
PhFindListViewItemByParam
PhFindNetworkNode
PhFindPlugin2
PhFindProcessInformation
PhFindProcessInformationByImageName
PhFindProcessNode
PhFindProcessRecord
PhFindServiceNode
PhFindStringInStringRef
PhFindXmlObject
PhFlushFileStream
PhFormat
PhFormatBytes
PhFormatBytes_V
PhFormatDate
PhFormatDateTime
PhFormatDecimal
PhFormatGuid
PhFormatImageVersionInfo
PhFormatLogEntry
PhFormatNativeKeyName
PhFormatSize
PhFormatString
PhFormatString_V
PhFormatTime
PhFormatTimeSpan
PhFormatTimeSpanRelative
PhFormatToBuffer
PhFormatUInt64
PhFree
PhFreeFileDialog
PhFreeJsonObject
PhFreeLibrary
PhFreeLibraryAsImageResource
PhFreePage
PhFreeToFreeList
PhFreeXmlObject
PhGenerateGuid
PhGenerateGuidFromName
PhGenerateRandomAlphaString
PhGenerateRandomNumber64
PhGetAccessEntries
PhGetAccessString
PhGetActiveProcessorCount
PhGetApplicationDataFileName
PhGetApplicationDirectory
PhGetApplicationDirectoryFileName
PhGetApplicationDirectoryWin32
PhGetApplicationFileNameWin32
PhGetApplicationIcon
PhGetApplicationIconEx
PhGetBaseDirectory
PhGetBaseName
PhGetClassObject
PhGetClientIdName
PhGetClientIdNameEx
PhGetComboBoxString
PhGetDeviceIcon
PhGetDeviceProperty
PhGetDeviceType
PhGetDialogItemValue
PhGetDllFileName
PhGetDllHandle
PhGetDpi
PhGetDpiValue
PhGetDrawInfoGraphBuffers
PhGetEnabledProvider
PhGetEtwPublisherName
PhGetFileDialogFileName
PhGetFileDialogFilterIndex
PhGetFileDialogOptions
PhGetFileFullAttributesInformation
PhGetFileName
PhGetFilePosition
PhGetFileSize
PhGetFileVersionFixedInfo
PhGetFileVersionInfo
PhGetFileVersionInfoEx
PhGetFileVersionInfoLangCodePage
PhGetFileVersionInfoString
PhGetFileVersionInfoString2
PhGetFilterSupportNetworkTreeList
PhGetFilterSupportProcessTreeList
PhGetFilterSupportServiceTreeList
PhGetFirmwareEnvironmentVariable
PhGetFullPath
PhGetGeneralCallback
PhGetGenericTreeNewLines
PhGetGlobalWorkQueue
PhGetHandleInformation
PhGetHandleInformationEx
PhGetImageListIcon
PhGetIntegerPairStringRefSetting
PhGetIntegerStringRefSetting
PhGetJobProcessIdList
PhGetJsonArrayIndexObject
PhGetJsonArrayLength
PhGetJsonArrayLong64
PhGetJsonArrayString
PhGetJsonObject
PhGetJsonObjectAsArrayList
PhGetJsonObjectBool
PhGetJsonObjectLength
PhGetJsonObjectType
PhGetJsonValueAsInt64
PhGetJsonValueAsString
PhGetJsonValueAsUInt64
PhGetKernelFileName
PhGetKernelFileName2
PhGetKnownFolderPath
PhGetKnownLocation
PhGetLineFromAddress
PhGetListBoxString
PhGetListViewContextMenuPoint
PhGetListViewItemImageIndex
PhGetListViewItemParam
PhGetListViewItemText
PhGetListViewSelectedItemText
PhGetMessage
PhGetModuleFromAddress
PhGetModuleProcAddress
PhGetMonitorDpi
PhGetNamedPipeClientComputerName
PhGetNamedPipeClientProcessId
PhGetNamedPipeServerProcessId
PhGetNtMessage
PhGetObjectSecurity
PhGetObjectType
PhGetObjectTypeInformation
PhGetObjectTypeName
PhGetOwnTokenAttributes
PhGetPhVersion
PhGetPhVersionHash
PhGetPhVersionNumbers
PhGetPluginCallback
PhGetPluginFileName
PhGetPluginInformation
PhGetPluginInterface
PhGetPluginName
PhGetPositionFileStream
PhGetPrimeNumber
PhGetProcedureAddress
PhGetProcedureAddressRemote
PhGetProcessCommandLine
PhGetProcessDepStatus
PhGetProcessDeviceMap
PhGetProcessEnvironment
PhGetProcessImageFileName
PhGetProcessImageFileNameByProcessId
PhGetProcessImageFileNameWin32
PhGetProcessIsDotNet
PhGetProcessIsDotNetEx
PhGetProcessIsSuspended
PhGetProcessKnownType
PhGetProcessKnownTypeEx
PhGetProcessMappedFileName
PhGetProcessPackageFullName
PhGetProcessPebString
PhGetProcessPriority
PhGetProcessPriorityClassString
PhGetProcessSmallImageList
PhGetProcessUnloadedDlls
PhGetProcessWindowTitle
PhGetProcessWorkingSetInformation
PhGetProcessWsCounters
PhGetProtocolTypeName
PhGetScalableIntegerPairStringRefSetting
PhGetSeObjectSecurity
PhGetSelectedAndPropagateProcessItems
PhGetSelectedListViewItemParam
PhGetSelectedListViewItemParams
PhGetSelectedProcessItem
PhGetSelectedProcessItems
PhGetSelectedProcessNodes
PhGetSelectedServiceItem
PhGetSelectedServiceItems
PhGetServiceChange
PhGetServiceConfig
PhGetServiceConfigFileName
PhGetServiceDescription
PhGetServiceDllParameter
PhGetServiceErrorControlInteger
PhGetServiceErrorControlString
PhGetServiceFileName
PhGetServiceNameFromTag
PhGetServiceStartTypeInteger
PhGetServiceStartTypeString
PhGetServiceStateString
PhGetServiceTypeInteger
PhGetServiceTypeString
PhGetShieldBitmap
PhGetSidFullName
PhGetSizeDpiValue
PhGetStatisticsTime
PhGetStatisticsTimeString
PhGetStatusMessage
PhGetStockApplicationIcon
PhGetStringRefSetting
PhGetSymbolFromAddress
PhGetSymbolFromName
PhGetSystemDirectory
PhGetSystemDpi
PhGetSystemMetrics
PhGetSystemParametersInfo
PhGetSystemRoot
PhGetTaskbarDpi
PhGetTcpStateName
PhGetTemporaryDirectoryRandomAlphaFileName
PhGetThreadServiceTag
PhGetTokenGroups
PhGetTokenIntegrityLevel
PhGetTokenIntegrityLevelRID
PhGetTokenOwner
PhGetTokenPrimaryGroup
PhGetTokenPrivileges
PhGetTokenUser
PhGetTreeNewText
PhGetWin32Message
PhGetWindowContext
PhGetWindowDpi
PhGetWindowText
PhGetWindowTextEx
PhGetXmlInterface

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 708KB - Virtual size: 706KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 80KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 4KB - Virtual size: 640B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.si3rc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.si3rd
Size: 4KB - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 292KB - Virtual size: 289KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

027166c97025b87b2219a54ea593c913

Code Sign

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5cCertificate

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

05:0a:5a:39:6d:03:ea:60:cd:53:68:b3:d7:ba:f7:a6Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

a1:0f:5c:ed:a5:d2:9b:05:b0:ae:6f:87:4f:75:4a:b3:bd:c6:4b:a7:6c:07:1c:e4:b3:47:ab:99:c0:e6:b2:2dSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

comctl32

ntdll

kernel32

user32

gdi32

advapi32

ole32

Exports

Exports

Sections

.text Size: 2.0MB - Virtual size: 2.0MB

.rdata Size: 708KB - Virtual size: 706KB

.data Size: 36KB - Virtual size: 64KB

.pdata Size: 80KB - Virtual size: 76KB

.didat Size: 4KB - Virtual size: 512B

_RDATA Size: 4KB - Virtual size: 640B

.si3rc Size: 12KB - Virtual size: 8KB

.si3rd Size: 4KB - Virtual size: 24B

.rsrc Size: 292KB - Virtual size: 289KB

.reloc Size: 12KB - Virtual size: 11KB

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

05:0a:5a:39:6d:03:ea:60:cd:53:68:b3:d7:ba:f7:a6
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

a1:0f:5c:ed:a5:d2:9b:05:b0:ae:6f:87:4f:75:4a:b3:bd:c6:4b:a7:6c:07:1c:e4:b3:47:ab:99:c0:e6:b2:2d
Signer

.text
Size: 2.0MB - Virtual size: 2.0MB

.rdata
Size: 708KB - Virtual size: 706KB

.data
Size: 36KB - Virtual size: 64KB

.pdata
Size: 80KB - Virtual size: 76KB

.didat
Size: 4KB - Virtual size: 512B

_RDATA
Size: 4KB - Virtual size: 640B

.si3rc
Size: 12KB - Virtual size: 8KB

.si3rd
Size: 4KB - Virtual size: 24B

.rsrc
Size: 292KB - Virtual size: 289KB

.reloc
Size: 12KB - Virtual size: 11KB