c0a70e326a8d3ab903efe29d428b9090_NeikiAnalytics

Sharing

Copy URL Twitter E-mail

General

Target

c0a70e326a8d3ab903efe29d428b9090_NeikiAnalytics
Size

353KB
MD5

c0a70e326a8d3ab903efe29d428b9090
SHA1

79d6e25e61880957dfb8920a2dedb2c8d60329cd
SHA256

65c786c3749a8c4dbf495ba160291292b90ccf7886f7d37ee223a6975abd8ac0
SHA512

72f18dfc63cac593efbe95637e89e2305feb9acfad48f42e774ee3c33d6f9e1b6e252339f3f92103e3ea6e5b107e12e2dfc843d6d6cfeeb2cc44e6bc02f2b99e
SSDEEP

6144:l57cnJONo9aG36ym7gnP5CEreInIlYqx3MXFESUY/eOZDVV0:/gJO1Mwe5CEreIIljA0

Score

1^/10

Malware Config

Signatures

Files

c0a70e326a8d3ab903efe29d428b9090_NeikiAnalytics
.exe windows:6 windows x64 arch:x64

67c311eef14ac1059133d8f457eba2b3

Code Sign

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

04/03/2014, 00:00

Not After

03/03/2024, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4c:fc:1a:5e:14:00:45:3f:59:a4:26:ca:71:f0:aa:6f
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

14/05/2015, 00:00

Not After

07/05/2017, 23:59

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=Photoshop\, Bridge,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:f3:7d:a1:71:67:51:bc:6a:8d:0a:d2:74:b2:8b:13
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

12/01/2016, 00:00

Not After

11/04/2027, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G1,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

fc:d6:85:d5:16:8a:2c:23:15:ce:8a:6c:d1:a0:11:a9:6f:e8:25:35
Signer

Actual PE Digest

fc:d6:85:d5:16:8a:2c:23:15:ce:8a:6c:d1:a0:11:a9:6f:e8:25:35

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\DynamicLinkMediaServer10\releases\2016.03\dynamiclinkmediaserver\Targets\Win\Release\64\amecommand.pdb

Imports

ws2_32

WSACleanup
WSAStartup

prm

?GetApplicationName@PRM@@YAPEBDXZ
?Initialize@PRM@@YAXW4ApplicationType@1@PEBD11_N@Z
?GetApplicationVersion@PRM@@YAPEBDXZ

aslfoundation

?ThrowError@DVAErrorManager@ASL@@UEBAXW4ErrorLevel@config@dvacore@@PEBDKJ_NAEBVReplacementValue@45@333@Z
?ExecuteFunctionWithTopLevelExceptionHandler@DVAErrorManager@ASL@@UEAAJV?$function0@J@boost@@@Z
?Create@Module@ASL@@SAHPEAUHINSTANCE__@@AEAV?$ObjectPtr@VModule@ASL@@VAtomicValue@2@@2@@Z
?Terminate@Foundation@ASL@@YAXXZ
?Initialize@Foundation@ASL@@YAXXZ
?AddTrailingSlash@PathUtils@ASL@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$STLAllocator@G@SmallBlockAllocator@utility@dvacore@@@std@@AEBV34@@Z
?FindDirectory@DirectoryRegistry@ASL@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$STLAllocator@G@SmallBlockAllocator@utility@dvacore@@@std@@AEBV34@@Z
??0Exception@ASL@@QEAA@XZ
??1Exception@ASL@@UEAA@XZ
?Dispose@Allocator@ASL@@SAXPEAX_K@Z
?CreateClassInstanceRef@ASL@@YA?AV?$InterfaceRef@UASLUnknown@ASL@@U12@@1@AEBVGuid@utility@dvacore@@@Z
?what@Exception@ASL@@UEBAPEBDXZ
?MakeString@ASL@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$STLAllocator@G@SmallBlockAllocator@utility@dvacore@@@std@@PEBD@Z
?Allocate@Allocator@ASL@@SAPEAX_K@Z
??0Application@ASL@@QEAA@AEBV?$ObjectPtr@VModule@ASL@@VAtomicValue@2@@1@0AEBV?$basic_string@GU?$char_traits@G@std@@V?$STLAllocator@G@SmallBlockAllocator@utility@dvacore@@@std@@H@Z
??1Application@ASL@@UEAA@XZ
?RegisterDirectory@DirectoryRegistry@ASL@@YAXAEBV?$basic_string@GU?$char_traits@G@std@@V?$STLAllocator@G@SmallBlockAllocator@utility@dvacore@@@std@@0@Z

aslmessaging

?Terminate@Messaging@ASL@@YAXXZ
?Initialize@Messaging@ASL@@YAXXZ
?FlushPostedMessagesOnUIThread@StationUtils@ASL@@YAXXZ

mediafoundation

?PurgeMemory@DVAErrorManager@MF@@UEAA_N_K@Z
?GetMediaManager@MF@@YA?AV?$InterfaceRef@UIMediaManager@MF@@U12@@ASL@@XZ

dynamiclinkmedia

?Initialize@DynamicLinkMedia@@YAHXZ
?SourceIDToPrefs@DynamicLinkMedia@@YA?AVBinaryData@MF@@AEBVGuid@utility@dvacore@@@Z
?Shutdown@DynamicLinkMedia@@YAXXZ

imagerenderer

IR_Terminate
IR_Initialize

backend

?Initialize@BE@@YAXXZ
?kXMLFileReaderClassID@BE@@3VGuid@utility@dvacore@@B
?kMediaType_Video@BE@@3VGuid@utility@dvacore@@B
?GetMedia@MasterClipUtils@BE@@YA?AV?$InterfaceRef@UIMedia@BE@@U12@@ASL@@AEBV?$InterfaceRef@UIMasterClip@BE@@U12@@4@I@Z
?Shutdown@BE@@YAXXZ
?GetBackend@BE@@YA?AV?$InterfaceRef@UIBackend@BE@@U12@@ASL@@XZ

mlfoundation

?SetRegistrationServer@ML@@YAXV?$InterfaceRef@UIRegistration@ML@@U12@@ASL@@@Z

pluginsupport

?ClearPluginCache@ML@@YAXXZ
?Initialize@PluginSupport@ML@@YAHXZ
?LoadAllPlugins@PluginSupport@ML@@YAHAEBV?$vector@V?$basic_string@GU?$char_traits@G@std@@V?$STLAllocator@G@SmallBlockAllocator@utility@dvacore@@@std@@V?$allocator@V?$basic_string@GU?$char_traits@G@std@@V?$STLAllocator@G@SmallBlockAllocator@utility@dvacore@@@std@@@2@@std@@@Z
?Shutdown@PluginSupport@ML@@YAHXZ

sweetpeasupport

?Shutdown@SweetPeaSupport@ML@@YAHXZ
?Initialize@SweetPeaSupport@ML@@YAHXZ

videorenderer

?Shutdown@VideoRenderer@ML@@YAHXZ
?Initialize@VideoRenderer@ML@@YAHXZ

importerhost

?SuppressPeakFileGeneration@ML@@YAX_N@Z
?NeedsConform@ConformUtils@ML@@SA_NV?$InterfaceRef@UISequence@BE@@U12@@ASL@@_NAEBVImmutableString@utility@dvacore@@V?$InterfaceRef@UIAbort@MF@@U12@@4@V?$InterfaceRef@UIProgress@BE@@U12@@4@@Z

exporterhost

?Shutdown@ExporterHost@ML@@YAHXZ
?Initialize@ExporterHost@ML@@YAHXZ

encoderhost

?Initialize@EncoderHost@@YAXXZ
?Terminate@EncoderHost@@YAXXZ
?CreateMasterClipFromFilePath@EncoderHost@@YAHAEBV?$basic_string@GU?$char_traits@G@std@@V?$STLAllocator@G@SmallBlockAllocator@utility@dvacore@@@std@@AEBVBinaryData@MF@@AEAV?$InterfaceRef@UIMasterClip@BE@@U12@@ASL@@@Z
?IsDropFrame@EncoderHost@@YA_NV?$InterfaceRef@UIMasterClip@BE@@U12@@ASL@@@Z

audiofilterhost

?Shutdown@AudioFilterHost@ML@@YAHXZ
?Initialize@AudioFilterHost@ML@@YAHXZ

dynamiclink

?InitializeClient@processcoordination@@YA_NXZ
?UninitializeClient@processcoordination@@YAXXZ
?GetSharedServer@dynamiclink@@YA?AV?$shared_ptr@VServer@SocketTransport@dvatransport@@@boost@@XZ

boost_system

?system_category@system@boost@@YAAEBVerror_category@12@XZ

dvacore

??0Gate@threads@dvacore@@QEAA@_N@Z
?Allocate@SmallBlockAllocator@utility@dvacore@@YAPEAX_K@Z
?Dispose@SmallBlockAllocator@utility@dvacore@@YAXPEAX_K@Z
?UTF16to8@utility@dvacore@@YA?AV?$basic_string@EU?$char_traits@E@std@@V?$STLAllocator@E@SmallBlockAllocator@utility@dvacore@@@std@@AEBV?$basic_string@GU?$char_traits@G@std@@V?$STLAllocator@G@SmallBlockAllocator@utility@dvacore@@@4@@Z
?AsciiToUTF16@utility@dvacore@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$STLAllocator@G@SmallBlockAllocator@utility@dvacore@@@std@@PEBD_K@Z
?IsDebuggerAttached@debug@dvacore@@YA_NXZ
?CreateUnique@Guid@utility@dvacore@@SA?AV123@XZ
?AsString@Guid@utility@dvacore@@QEBA?AV?$basic_string@GU?$char_traits@G@std@@V?$STLAllocator@G@SmallBlockAllocator@utility@dvacore@@@std@@XZ
?AsUTF8String@Guid@utility@dvacore@@QEBA?AV?$basic_string@EU?$char_traits@E@std@@V?$STLAllocator@E@SmallBlockAllocator@utility@dvacore@@@std@@XZ
?StringToGUID@Guid@utility@dvacore@@CA?AU_GUID@@PEBD_K@Z
?StringToGUID@Guid@utility@dvacore@@CA?AU_GUID@@AEBV?$basic_string@GU?$char_traits@G@std@@V?$STLAllocator@G@SmallBlockAllocator@utility@dvacore@@@std@@@Z
?BreakAfterContractDialog@debug@dvacore@@YA_NPEBD00J@Z
??0ReplacementValue@config@dvacore@@QEAA@XZ
??1ReplacementValue@config@dvacore@@QEAA@XZ
?ThrowError@config@dvacore@@YAXW4ErrorLevel@12@PEBDKJ_NAEBVReplacementValue@12@333@Z
??1ImmutableString@utility@dvacore@@QEAA@XZ
?CreateStatic@ImmutableString@utility@dvacore@@SA?AV123@PEBD@Z
??_7Localizer@config@dvacore@@6B@
??0Localizer@config@dvacore@@QEAA@XZ
?PurgeMemory@ErrorManager@config@dvacore@@UEAA_N_K@Z
?NewDeferredErrorReporter@ErrorManager@config@dvacore@@UEAA?AV?$intrusive_ptr@VDeferredErrorReporter@config@dvacore@@@boost@@_N@Z
?IncrementLazilyDisplayErrors@ErrorManager@config@dvacore@@UEAAXXZ
?GetParser@MSXMLParserFactory@xml@dvacore@@UEAA?AV?$auto_ptr@VAbstractDocParser@xml@dvacore@@@std@@AEAV?$auto_ptr@VAbstractParseHandler@xml@dvacore@@@5@@Z
?ExecuteFunctionAndConvertException@ErrorManager@config@dvacore@@UEAAJV?$function0@J@boost@@@Z
?DecrementLazilyDisplayErrors@ErrorManager@config@dvacore@@UEAAXXZ
?Initialize@Locale@dvacore@@YAXAEBV?$basic_string@GU?$char_traits@G@std@@V?$STLAllocator@G@SmallBlockAllocator@utility@dvacore@@@std@@@Z
?MixInData@MixHash@utility@dvacore@@CAXAEAVHashValue@23@PEBE_K@Z
??0Dir@filesupport@dvacore@@QEAA@AEBV?$basic_string@GU?$char_traits@G@std@@V?$STLAllocator@G@SmallBlockAllocator@utility@dvacore@@@std@@@Z
??0Dir@filesupport@dvacore@@QEAA@AEBV012@AEBV?$basic_string@GU?$char_traits@G@std@@V?$STLAllocator@G@SmallBlockAllocator@utility@dvacore@@@std@@@Z
??1Dir@filesupport@dvacore@@QEAA@XZ
?SetParserFactory@xml@dvacore@@YAXAEAV?$auto_ptr@VDocParserFactory@xml@dvacore@@@std@@@Z
??1DocParserFactory@xml@dvacore@@UEAA@XZ
?ExecutableDir@commondirs@filesupport@dvacore@@YA?AVDir@23@XZ
?Set@Localizer@config@dvacore@@SAXPEAV123@@Z
?SetClientInternalVersion@config@dvacore@@YAXAEBV?$basic_string@GU?$char_traits@G@std@@V?$STLAllocator@G@SmallBlockAllocator@utility@dvacore@@@std@@@Z
?SetClientVersion@config@dvacore@@YAXAEBV?$basic_string@GU?$char_traits@G@std@@V?$STLAllocator@G@SmallBlockAllocator@utility@dvacore@@@std@@@Z
?SetClientName@config@dvacore@@YAXAEBV?$basic_string@GU?$char_traits@G@std@@V?$STLAllocator@G@SmallBlockAllocator@utility@dvacore@@@std@@@Z
??0File@filesupport@dvacore@@QEAA@AEBVDir@12@AEBV?$basic_string@GU?$char_traits@G@std@@V?$STLAllocator@G@SmallBlockAllocator@utility@dvacore@@@std@@_N@Z
?PackageDir@Dir@filesupport@dvacore@@SA?AV123@XZ
?Set@ErrorManager@config@dvacore@@SAXPEAV123@@Z
??1ErrorManager@config@dvacore@@UEAA@XZ
??0ErrorManager@config@dvacore@@QEAA@XZ
??0Guid@utility@dvacore@@QEAA@KGGEEEEEEEE@Z
?sNullString@ImmutableString@utility@dvacore@@0QBEB
?BuildCall@serialization@dvacore@@YA?AV?$shared_ptr@Vany@boost@@@boost@@PEBDAEBVany@4@@Z
?Close@Gate@threads@dvacore@@QEAAXXZ
?Open@Gate@threads@dvacore@@QEAAXXZ
?PassThrough@Gate@threads@dvacore@@QEBA_NH@Z
??1Gate@threads@dvacore@@QEAA@XZ
?SetCompanyName@config@dvacore@@YAXAEBV?$basic_string@GU?$char_traits@G@std@@V?$STLAllocator@G@SmallBlockAllocator@utility@dvacore@@@std@@@Z
?GetRegisteredMainThread@threads@dvacore@@YA?AV?$shared_ptr@VAsyncEventLoopAdaptor@threads@dvacore@@@boost@@XZ
?RegisterCurrentThreadAsMainThread@threads@dvacore@@YA?AV?$shared_ptr@VAsyncEventLoopAdaptor@threads@dvacore@@@boost@@XZ
?GetCPUBoundExecutor@threads@dvacore@@YA?AV?$shared_ptr@VAsyncExecutor@threads@dvacore@@@boost@@XZ
?RunPlatformEventLoop@threads@dvacore@@YAXXZ
?StringToNumber@utility@dvacore@@YAXAEAKAEBV?$basic_string@GU?$char_traits@G@std@@V?$STLAllocator@G@SmallBlockAllocator@utility@dvacore@@@std@@V?$Flags@G@12@@Z
?StringToNumber@utility@dvacore@@YAXAEA_JAEBV?$basic_string@GU?$char_traits@G@std@@V?$STLAllocator@G@SmallBlockAllocator@utility@dvacore@@@std@@V?$Flags@G@12@@Z
?Length@IPlatformByteStream@filesupport@dvacore@@UEBA_KXZ
?ReadBlock@IPlatformByteStream@filesupport@dvacore@@UEAAXPEAEK@Z
??0IPlatformByteStream@filesupport@dvacore@@QEAA@AEBVFile@12@V?$Flags@K@utility@2@@Z
??1IPlatformByteStream@filesupport@dvacore@@UEAA@XZ
?Create@RecycledMemory@utility@dvacore@@SA?AV?$shared_ptr@VRecycledMemory@utility@dvacore@@@boost@@_K@Z
?Allocate@RecycledMemory@utility@dvacore@@QEAAX_K@Z
?AddToObject@serialization@dvacore@@YAXAEAVany@boost@@AEBV?$basic_string@GU?$char_traits@G@std@@V?$STLAllocator@G@SmallBlockAllocator@utility@dvacore@@@std@@AEBV34@@Z
?AddToObject@serialization@dvacore@@YAXAEAVany@boost@@PEBDAEBV34@@Z
?AppendToArray@serialization@dvacore@@YAXAEAVany@boost@@AEBV34@@Z
?Size@File@filesupport@dvacore@@QEBA_KW4FileSizeSelector@23@@Z
?Exists@File@filesupport@dvacore@@QEBA_NXZ
?FullPath@File@filesupport@dvacore@@QEBA?AV?$basic_string@GU?$char_traits@G@std@@V?$STLAllocator@G@SmallBlockAllocator@utility@dvacore@@@std@@XZ
??1File@filesupport@dvacore@@QEAA@XZ
??0File@filesupport@dvacore@@QEAA@AEBV?$basic_string@GU?$char_traits@G@std@@V?$STLAllocator@G@SmallBlockAllocator@utility@dvacore@@@std@@@Z
?GlobalPrefDir@Dir@filesupport@dvacore@@SA?AV123@XZ
?AppDir@Dir@filesupport@dvacore@@SA?AV123@XZ
?Create@Dir@filesupport@dvacore@@QEAAXXZ
?Exists@Dir@filesupport@dvacore@@QEBA_NXZ
?FullPath@Dir@filesupport@dvacore@@QEBA?AV?$basic_string@GU?$char_traits@G@std@@V?$STLAllocator@G@SmallBlockAllocator@utility@dvacore@@@std@@XZ

dvamediatypes

?CreateMultichannelLayout@dvamediatypes@@YA?AV?$vector@UAudioChannelDescription@dvamediatypes@@@SmallBlockAllocator@utility@dvacore@@H@Z
?CreateStereoChannelLayout@dvamediatypes@@YA?AV?$vector@UAudioChannelDescription@dvamediatypes@@@SmallBlockAllocator@utility@dvacore@@XZ
?CreateLegacy51ChannelLayout@dvamediatypes@@YA?AV?$vector@UAudioChannelDescription@dvamediatypes@@@SmallBlockAllocator@utility@dvacore@@XZ
?Create51ChannelLayout@dvamediatypes@@YA?AV?$vector@UAudioChannelDescription@dvamediatypes@@@SmallBlockAllocator@utility@dvacore@@XZ
?CreateMonoChannelLayout@dvamediatypes@@YA?AV?$vector@UAudioChannelDescription@dvamediatypes@@@SmallBlockAllocator@utility@dvacore@@XZ

dvatransport

?GetPort@Server@SocketTransport@dvatransport@@QEAAGXZ
?Create@SocketTransport@dvatransport@@SA?AV?$shared_ptr@VSocketTransport@dvatransport@@@boost@@H@Z
?GetAddress@Server@SocketTransport@dvatransport@@QEAA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?ClientStart@SocketTransport@dvatransport@@QEAA?AV?$shared_ptr@VSession@dvatransport@@@boost@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@G@Z

dvamarshal

?SendRequest@RPCClient@dvamarshal@@QEAA_JV?$shared_ptr@Vany@boost@@@boost@@V?$function2@XAEBV?$shared_ptr@Vany@boost@@@boost@@_J@4@V?$function3@XJAEBV?$basic_string@GU?$char_traits@G@std@@V?$STLAllocator@G@SmallBlockAllocator@utility@dvacore@@@std@@_J@4@_J@Z
?SendNotification@RPCClient@dvamarshal@@QEAAXV?$shared_ptr@Vany@boost@@@boost@@@Z
??0RPCClient@dvamarshal@@QEAA@AEBV?$shared_ptr@VSession@dvatransport@@@boost@@AEBV?$basic_string@GU?$char_traits@G@std@@V?$STLAllocator@G@SmallBlockAllocator@utility@dvacore@@@std@@@Z
?UnRegister@MessageRegistrar@dvamarshal@@QEAAXPEBD@Z
?Register@MessageRegistrar@dvamarshal@@QEAAXPEBDV?$shared_ptr@VMessageHandlerBase@dvamarshal@@@boost@@@Z
?Instance@MessageRegistrar@dvamarshal@@SAPEAV12@XZ
??1RPCClient@dvamarshal@@QEAA@XZ

kernel32

TlsAlloc
TlsFree
SetDllDirectoryW
CreateEventA
DeleteCriticalSection
WaitForSingleObject
GetCurrentThreadId
SetEvent
CreateDirectoryW
InitializeCriticalSectionEx
LeaveCriticalSection
CloseHandle
EnterCriticalSection
PostQueuedCompletionStatus
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetLastError
RaiseException
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
EncodePointer
OutputDebugStringW
IsDebuggerPresent
GetModuleHandleW
DecodePointer

user32

UnregisterClassW

shell32

SHGetFolderPathW
SHGetFolderPathAndSubDirW

ole32

CoInitialize
CoUninitialize

oleaut32

SysFreeString

msvcp120

?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Winerror_map@std@@YAPEBDH@Z
?_Orphan_all@_Container_base0@std@@QEAAXXZ

msvcr120

_initterm_e
__setusermatherr
_configthreadlocale
_cexit
_exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
_onexit
__dllonexit
_calloc_crt
_unlock
_lock
__C_specific_handler
?terminate@@YAXXZ
memmove_s
memset
_recalloc
memcpy
__CxxFrameHandler3
_initterm
signal
_mktime64
??1bad_cast@std@@UEAA@XZ
??0bad_cast@std@@QEAA@AEBV01@@Z
??0bad_cast@std@@QEAA@PEBD@Z
??8type_info@@QEBA_NAEBV0@@Z
??_V@YAXPEAX@Z
?what@exception@std@@UEBAPEBDXZ
??1exception@std@@UEAA@XZ
??0exception@std@@QEAA@AEBV01@@Z
??0exception@std@@QEAA@AEBQEBDH@Z
??0exception@std@@QEAA@AEBQEBD@Z
memmove
free
exit
_hypot
sprintf
printf
??2@YAPEAX_K@Z
_purecall
??3@YAXPEAX@Z
__winitenv
_fmode
__crtCapturePreviousContext
__crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
_CxxThrowException
__crtCaptureCurrentContext
__crtSetUnhandledExceptionFilter
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
_commode

Sections

.text
Size: 213KB - Virtual size: 213KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 101KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

67c311eef14ac1059133d8f457eba2b3

Code Sign

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49Certificate

Extended Key Usages

Key Usages

4c:fc:1a:5e:14:00:45:3f:59:a4:26:ca:71:f0:aa:6fCertificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

54:f3:7d:a1:71:67:51:bc:6a:8d:0a:d2:74:b2:8b:13Certificate

Extended Key Usages

Key Usages

fc:d6:85:d5:16:8a:2c:23:15:ce:8a:6c:d1:a0:11:a9:6f:e8:25:35Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

prm

aslfoundation

aslmessaging

mediafoundation

dynamiclinkmedia

imagerenderer

backend

mlfoundation

pluginsupport

sweetpeasupport

videorenderer

importerhost

exporterhost

encoderhost

audiofilterhost

dynamiclink

boost_system

dvacore

dvamediatypes

dvatransport

dvamarshal

kernel32

user32

shell32

ole32

oleaut32

msvcp120

msvcr120

Sections

.text Size: 213KB - Virtual size: 213KB

.rdata Size: 101KB - Virtual size: 101KB

.data Size: 8KB - Virtual size: 12KB

.pdata Size: 20KB - Virtual size: 19KB

.rsrc Size: 1KB - Virtual size: 1KB

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

4c:fc:1a:5e:14:00:45:3f:59:a4:26:ca:71:f0:aa:6f
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

54:f3:7d:a1:71:67:51:bc:6a:8d:0a:d2:74:b2:8b:13
Certificate

fc:d6:85:d5:16:8a:2c:23:15:ce:8a:6c:d1:a0:11:a9:6f:e8:25:35
Signer

.text
Size: 213KB - Virtual size: 213KB

.rdata
Size: 101KB - Virtual size: 101KB

.data
Size: 8KB - Virtual size: 12KB

.pdata
Size: 20KB - Virtual size: 19KB

.rsrc
Size: 1KB - Virtual size: 1KB