79600c3789d7c02b138aef3819793960_NeikiAnalytics

Sharing

Copy URL Twitter E-mail

General

Target

79600c3789d7c02b138aef3819793960_NeikiAnalytics
Size

2.9MB
MD5

79600c3789d7c02b138aef3819793960
SHA1

9c767ffcf32fb2dbdfb3525c2ee84aeb65e27710
SHA256

dda101c4fc94180e47f18c20649cebdd6de54d0f23a316100c4f20b9ec91d948
SHA512

2975c04de86d1b250623e2b90fc8cd4fc629eefa7e48a10b38afa4215172828ee67343325b949f7211e7c4e2f23d70d04cb0273bd607cc4c9b6a39b7cdb80de5
SSDEEP

49152:3uKhK2f5FWfl+uzRwR0B7YrvZ6vEYRGqEgB9tet1mG3G2nQI+64sxX/D2a:3uM2fA0B7OvZWEYEE9tA7Nz+xsxvDL

Score

3^/10

Malware Config

Signatures

Unsigned PE 6 IoCs

Checks for missing Authenticode signature.

resource
79600c3789d7c02b138aef3819793960_NeikiAnalytics
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/inetc.dll
unpack001/$TEMP/NSISPromotiona.dll
unpack001/MiniBand.dll
unpack001/MultiLangEx64.dll

Files

79600c3789d7c02b138aef3819793960_NeikiAnalytics
.exe windows:5 windows x86 arch:x86

32f3282581436269b3a75b6675fe3e08

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
CompareFileTime
SearchPathW
GetShortPathNameW
GetFullPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
CreateDirectoryW
SetFileAttributesW
Sleep
GetTickCount
CreateFileW
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
SetErrorMode
CloseHandle
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
LoadLibraryW
CreateProcessW
lstrcmpiA
GetTempFileNameW
lstrcatW
GetProcAddress
LoadLibraryA
GetModuleHandleA
OpenProcess
lstrcpyW
GetVersionExW
GetSystemDirectoryW
GetVersion
lstrcpyA
RemoveDirectoryW
lstrcmpA
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GlobalFree
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
WideCharToMultiByte
lstrlenA
MulDiv
WriteFile
ReadFile
MultiByteToWideChar
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
lstrcpynA

user32

GetAsyncKeyState
IsDlgButtonChecked
ScreenToClient
GetMessagePos
CallWindowProcW
IsWindowVisible
LoadBitmapW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetWindowRect
AppendMenuW
CreatePopupMenu
GetSystemMetrics
EndDialog
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
DialogBoxParamW
CheckDlgButton
CreateWindowExW
SystemParametersInfoW
RegisterClassW
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharNextA
CharUpperW
CharPrevW
wvsprintfW
DispatchMessageW
PeekMessageW
wsprintfA
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
CharNextW
GetClassInfoW
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
FindWindowExW

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
SelectObject

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderLocation

advapi32

RegEnumKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 415KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 996KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 79KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallOptions.dll
.dll windows:5 windows x86 arch:x86

cd90e33ffbc335413a25300c682c83df

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcmpiW
GetModuleHandleW
GlobalLock
GlobalUnlock
GetCurrentDirectoryW
SetCurrentDirectoryW
GetPrivateProfileIntW
GetPrivateProfileStringW
lstrcatW
WritePrivateProfileStringW
lstrcpynW
lstrlenW
lstrcpyW
GlobalFree
GlobalAlloc

user32

OpenClipboard
DestroyIcon
LoadCursorW
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
ShowWindow
SetWindowLongW
GetClientRect
SetWindowRgn
LoadIconW
LoadImageW
CreateWindowExW
MapDialogRect
GetClipboardData
GetWindowRect
CreateDialogParamW
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
SetCursor
DrawTextW
GetWindowLongW
DrawFocusRect
CallWindowProcW
PostMessageW
wsprintfW
CharNextW
MessageBoxW
CloseClipboard
GetDlgCtrlID
MapWindowPoints
SetWindowPos
PtInRect
GetWindowTextW
SetWindowTextW
SendMessageW
DestroyWindow

gdi32

SelectObject
CreateRectRgn
GetObjectW
CombineRgn
DeleteObject
CreateCompatibleDC
GetDIBits
SetTextColor

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteW
SHGetDesktopFolder

comdlg32

GetOpenFileNameW
CommDlgExtendedError
GetSaveFileNameW

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/SkinBaiDuIME_gomaudio_unicode.ini
$PLUGINSDIR/inetc.dll
.dll windows:4 windows x86 arch:x86

86cdacc6fa5e3ff4938d358350751516

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

wcstol
_adjust_fdiv
malloc
_initterm
free
strlen
strchr
strrchr
wcsrchr
wcstoul
wcsstr
wcschr
memset
_chkesp

kernel32

DeleteFileW
WideCharToMultiByte
CreateFileA
CreateThread
WaitForSingleObject
TerminateThread
GetModuleHandleW
MulDiv
lstrcpyW
GlobalAlloc
LoadLibraryW
GetProcAddress
lstrcmpiW
CreateFileW
lstrlenW
WriteFile
ReadFile
lstrcmpW
lstrcpynW
GetLastError
GetFileSize
GlobalFree
CloseHandle
SleepEx
SetFilePointer
GetTickCount
lstrcatW

user32

MessageBoxW
GetParent
ShowWindow
SetWindowLongW
IsWindow
SetWindowTextW
SendDlgItemMessageW
GetDlgItem
PostMessageW
GetWindowTextW
SendMessageW
SetDlgItemTextW
SetWindowPos
SystemParametersInfoW
GetClientRect
GetWindowRect
SetTimer
LoadIconW
DestroyWindow
KillTimer
UpdateWindow
RedrawWindow
DispatchMessageW
TranslateMessage
IsDialogMessageW
GetMessageW
IsWindowVisible
EnableWindow
CreateDialogParamW
FindWindowExW
wsprintfA
wsprintfW
GetWindowLongW

wininet

HttpSendRequestW
HttpSendRequestExW
HttpQueryInfoW
FtpCreateDirectoryW
FtpOpenFileW
InternetGetLastResponseInfoW
InternetSetFilePointer
InternetSetOptionW
InternetQueryOptionW
HttpAddRequestHeadersA
InternetCloseHandle
InternetErrorDlg
HttpAddRequestHeadersW
HttpOpenRequestW
HttpEndRequestW
InternetConnectW
InternetCrackUrlW
InternetOpenW
InternetReadFile
InternetWriteFile

comctl32

ord17

Exports

Exports

get
head
post
put

Sections

.text
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/modern-header.bmp
$PLUGINSDIR/modern-wizard.bmp
$PLUGINSDIR/welcome.bmp
$TEMP/NSISPromotiona.dll
.dll windows:5 windows x86 arch:x86

7cf0ddaa2b6748f972af8b85bb4db5d7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\1. NSIS_DEV\3. GOM Audio\NSISPromotionEx_GOMA\Release\NSISPromotionGA.pdb

Imports

kernel32

WriteFile
LoadLibraryW
GetProcAddress
FreeLibrary
lstrlenW
WideCharToMultiByte
GetFileAttributesW
CreateDirectoryW
GetTickCount
MultiByteToWideChar
GetVersionExW
ReadFile
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetThreadPriority
GetCurrentThread
InterlockedIncrement
InterlockedDecrement
lstrlenA
GetModuleHandleW
IsBadStringPtrW
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetProcessHeap
SetEndOfFile
GetLocaleInfoA
GetStringTypeA
LCMapStringA
SetFilePointer
LoadLibraryA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
SetStdHandle
InitializeCriticalSectionAndSpinCount
GetModuleHandleA
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
LCMapStringW
GetModuleFileNameA
IsValidCodePage
GetOEMCP
GetCPInfo
HeapReAlloc
VirtualAlloc
VirtualFree
HeapDestroy
HeapCreate
ExitProcess
HeapSize
CreateFileW
GetTempPathW
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
RtlUnwind
RaiseException
GetCommandLineA
GetCurrentThreadId
CreateThread
ResumeThread
ExitThread
HeapAlloc
HeapFree
GetLastError
Sleep
GetACP
GetCurrentProcess
GetExitCodeProcess
CloseHandle
WaitForSingleObject
CreateProcessW
DeleteFileW
GlobalAlloc
lstrcpynW
lstrcpyW
IsDebuggerPresent
SetUnhandledExceptionFilter
GetStringTypeW
GlobalFree
UnhandledExceptionFilter
TerminateProcess

user32

PostMessageW
wsprintfW
FindWindowW
LoadStringW
RegisterWindowMessageW
SendMessageW

advapi32

OpenProcessToken
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
GetTokenInformation

wintrust

WinVerifyTrust

wininet

InternetCrackUrlW
InternetCanonicalizeUrlW
InternetCloseHandle
InternetReadFile
InternetQueryDataAvailable
HttpQueryInfoW
InternetOpenUrlW
InternetSetOptionW
InternetOpenW

Exports

Exports

CheckBaiDuIMEInstall
CheckGOMAudionIM
CheckIODataInstall
GetBaiDuIME_Path
HttpTrigger
InstBaiDuIME
InstIOData
Verify
Verify2

Sections

.text
Size: 82KB - Virtual size: 82KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
MiniBand.dll
.dll regsvr32 windows:5 windows x64 arch:x64

812d3bfb5e59a7213a246ca8b5cfb97b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

GetUserDefaultLangID
MulDiv
lstrlenA
lstrcpyW
IsBadReadPtr
IsBadWritePtr
IsBadStringPtrW
lstrcmpW
DeleteFileW
FreeResource
LockResource
lstrcatW
Sleep
WriteFile
FlushFileBuffers
WriteConsoleW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCurrentProcessId
QueryPerformanceCounter
GetModuleFileNameA
GetConsoleCP
GetFileType
SetFilePointerEx
ReadConsoleW
GetConsoleMode
LCMapStringW
GetStringTypeW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
GetStdHandle
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
HeapSize
GetCommandLineA
GetModuleHandleExW
ExitProcess
GetSystemTimeAsFileTime
HeapReAlloc
RtlUnwindEx
RtlLookupFunctionEntry
RtlPcToFileHeader
IsProcessorFeaturePresent
OutputDebugStringW
IsDebuggerPresent
VirtualFree
VirtualAlloc
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
GetProcessHeap
HeapFree
HeapAlloc
WideCharToMultiByte
GetFileAttributesW
CreateFileW
CreateDirectoryW
GetTempPathW
GetPrivateProfileStringW
GetPrivateProfileIntW
CreateProcessW
lstrlenW
lstrcpynW
GetTickCount
SetFilePointer
ReadFile
GetFileSize
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
CloseHandle
LoadLibraryW
SetLastError
GetCurrentThreadId
GetCurrentProcess
FlushInstructionCache
GetSystemDefaultLangID
SetEndOfFile
MultiByteToWideChar
FindResourceW
GetModuleHandleW
GetModuleFileNameW
LoadLibraryExW
lstrcmpiW
SizeofResource
LoadResource
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
GetLastError
RaiseException
GetProcAddress
DisableThreadLibraryCalls
FreeLibrary
DecodePointer
EncodePointer

user32

EnableWindow
IsWindowVisible
PtInRect
IsRectEmpty
SetRectEmpty
SetRect
DrawTextW
GetWindow
GetClassNameW
FindWindowExW
GetParent
GetDesktopWindow
SetWindowTextW
RedrawWindow
InvalidateRgn
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
GetKeyState
LoadMenuW
CreatePopupMenu
DefWindowProcW
CallWindowProcW
CharNextW
GetWindowLongPtrW
SetWindowLongPtrW
UnregisterClassW
SendMessageW
PostMessageW
RegisterClassExW
GetClassInfoExW
CreateWindowExW
IsWindow
DestroyWindow
SetWindowPos
SetTimer
KillTimer
SetForegroundWindow
DestroyMenu
GetSubMenu
GetMenuItemCount
TrackPopupMenu
SetWindowRgn
SetCursor
GetClassLongW
SetClassLongW
SetParent
LoadCursorFromFileW
DestroyCursor
UpdateWindow
RemovePropW
DialogBoxIndirectParamW
EndDialog
SetDlgItemTextW
LoadIconW
UnionRect
EnumWindows
RegisterWindowMessageA
BeginPaint
EndPaint
SetPropW
GetPropW
GetClientRect
GetCursorPos
ScreenToClient
GetSysColor
FillRect
FindWindowW
LoadCursorW
ShowWindow
MessageBoxW
RegisterWindowMessageW
DispatchMessageW
PeekMessageW
MoveWindow
InvalidateRect
ReleaseDC
GetDC
DestroyAcceleratorTable
CreateAcceleratorTableW
ReleaseCapture
SetCapture
GetFocus
SetFocus
GetDlgItem
IsChild
GetSystemMetrics
wsprintfW
LoadStringW
SystemParametersInfoW
SetWindowLongW
GetWindowLongW
EqualRect
OffsetRect
IntersectRect
CopyRect
ClientToScreen
GetWindowRect
GetWindowTextLengthW
GetWindowTextW
GetForegroundWindow
GetWindowPlacement

gdi32

CreateRectRgn
CreateRoundRectRgn
CreateRectRgnIndirect
CreateFontW
CreateEllipticRgn
CombineRgn
ExtCreateRegion
OffsetRgn
CreateDIBSection
GetDIBColorTable
SetTextColor
GetObjectW
GetStockObject
GetDeviceCaps
CreateSolidBrush
CreatePen
DeleteObject
GetTextExtentPoint32W
LineTo
SelectObject
SetBkColor
SetBkMode
GetTextMetricsW
MoveToEx
ExtTextOutW
BitBlt
CreateCompatibleBitmap
Rectangle
DeleteDC
CreateCompatibleDC

advapi32

RegCreateKeyExW
RegSetValueExA
RegQueryValueExW
RegCreateKeyW
RegCloseKey
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW

shell32

ShellExecuteW

ole32

OleSetContainedObject
CreateStreamOnHGlobal
OleLockRunning
OleUninitialize
OleInitialize
CLSIDFromProgID
CLSIDFromString
CoFreeLibrary
CoLoadLibrary
CoGetClassObject
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
StringFromGUID2
CoCreateInstance
OleCreate

oleaut32

OleLoadPicture
OleCreateFontIndirect
SysAllocStringLen
VariantClear
VariantInit
UnRegisterTypeLi
RegisterTypeLi
LoadRegTypeLi
LoadTypeLi
VarUI4FromStr
SysStringLen
SysFreeString
SysAllocString

gdiplus

GdipCreateBitmapFromGdiDib
GdipDisposeImage
GdipCloneImage
GdiplusShutdown
GdiplusStartup
GdipFree
GdipAlloc
GdipCreateFromHDC
GdipCreateFromHWND
GdipDeleteGraphics
GdipDrawImageI
GdipDrawImagePointRectI

comctl32

ord17
_TrackMouseEvent

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 395KB - Virtual size: 395KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 179KB - Virtual size: 179KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 139KB - Virtual size: 138KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
MultiLangEx64.dll
.dll windows:6 windows x64 arch:x64

259beebb99aa39d7c0b8d65a9c8a90d8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\working\GOMDev\GomAudio\bin\x64\MultiLangEx64.pdb

Imports

kernel32

GetModuleFileNameW
SetLastError
lstrlenA
GetModuleHandleW
IsBadStringPtrW
IsBadReadPtr
IsBadWritePtr
GetSystemDefaultLangID
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
ReadConsoleW
SetEndOfFile
WriteConsoleW
FlushFileBuffers
SetStdHandle
SetFilePointerEx
GetConsoleMode
GetConsoleCP
LoadLibraryExW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCurrentProcessId
lstrlenW
GetModuleFileNameA
GetFileType
LCMapStringW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
Sleep
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WriteFile
GetStdHandle
GetStringTypeW
RtlPcToFileHeader
InitializeCriticalSectionEx
GetPrivateProfileStringW
HeapSize
GetModuleHandleExW
ExitProcess
RtlUnwindEx
GetProcessHeap
GetCurrentThreadId
GetCommandLineA
GetSystemTimeAsFileTime
HeapReAlloc
IsProcessorFeaturePresent
HeapAlloc
EncodePointer
HeapFree
GetCurrentProcess
FreeLibrary
GetProcAddress
GetFileAttributesW
MultiByteToWideChar
WideCharToMultiByte
ReadFile
CloseHandle
GetFileSize
CreateFileW
DeleteCriticalSection
DecodePointer
GetLastError
RaiseException
QueryPerformanceCounter

user32

SendMessageW
FindWindowW
RegisterWindowMessageW
ModifyMenuW
GetMenuItemID
GetSubMenu
LoadMenuW
GetMenuStringW
GetMenuItemCount
IsMenu
EnumChildWindows
SetWindowTextW
GetParent
GetDlgCtrlID
LoadStringW

gdi32

CreateFontW

Exports

Exports

CreateMultiLangEx
DeleteMultiLangEx

Sections

.text
Size: 104KB - Virtual size: 104KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 648B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

32f3282581436269b3a75b6675fe3e08

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 28KB - Virtual size: 27KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 512B - Virtual size: 415KB

.ndata Size: - Virtual size: 996KB

.rsrc Size: 79KB - Virtual size: 79KB

.reloc Size: 4KB - Virtual size: 3KB

cd90e33ffbc335413a25300c682c83df

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 1024B - Virtual size: 17KB

.rsrc Size: 512B - Virtual size: 152B

.reloc Size: 1KB - Virtual size: 1KB

86cdacc6fa5e3ff4938d358350751516

Headers

File Characteristics

Imports

msvcrt

kernel32

user32

wininet

comctl32

Exports

Exports

Sections

.text Size: 19KB - Virtual size: 18KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 3KB - Virtual size: 5KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 2KB

7cf0ddaa2b6748f972af8b85bb4db5d7

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

wintrust

wininet

Exports

Exports

Sections

.text Size: 82KB - Virtual size: 82KB

.rdata Size: 15KB - Virtual size: 15KB

.data Size: 5KB - Virtual size: 78KB

.rsrc Size: 24KB - Virtual size: 23KB

.reloc Size: 10KB - Virtual size: 9KB

.text
Size: 28KB - Virtual size: 27KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 512B - Virtual size: 415KB

.ndata
Size: - Virtual size: 996KB

.rsrc
Size: 79KB - Virtual size: 79KB

.reloc
Size: 4KB - Virtual size: 3KB

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 1024B - Virtual size: 17KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1KB - Virtual size: 1KB

.text
Size: 19KB - Virtual size: 18KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 3KB - Virtual size: 5KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 2KB

.text
Size: 82KB - Virtual size: 82KB

.rdata
Size: 15KB - Virtual size: 15KB

.data
Size: 5KB - Virtual size: 78KB

.rsrc
Size: 24KB - Virtual size: 23KB

.reloc
Size: 10KB - Virtual size: 9KB

.text
Size: 395KB - Virtual size: 395KB

.rdata
Size: 179KB - Virtual size: 179KB

.data
Size: 19KB - Virtual size: 99KB

.pdata
Size: 19KB - Virtual size: 19KB

.rsrc
Size: 139KB - Virtual size: 138KB

.reloc
Size: 5KB - Virtual size: 5KB

.text
Size: 104KB - Virtual size: 104KB

.rdata
Size: 38KB - Virtual size: 38KB

.data
Size: 6KB - Virtual size: 17KB

.pdata
Size: 5KB - Virtual size: 4KB

.rsrc
Size: 1024B - Virtual size: 648B

.reloc
Size: 2KB - Virtual size: 1KB