5aac5be3cd999511fb74d1cc3588fcd0_NeikiAnalytics

Sharing

Copy URL Twitter E-mail

General

Target

5aac5be3cd999511fb74d1cc3588fcd0_NeikiAnalytics
Size

7.4MB
MD5

5aac5be3cd999511fb74d1cc3588fcd0
SHA1

58e65431f615ed421b456a5cbc123de1acd1c94a
SHA256

2ea0fe865b6ee65616f38fd21a884571855f66ce46e71f7c9cef7fb7e21c9835
SHA512

83e1efe86abde57454fe89684f2a75f535fd961319b63582cbc0707a9fccd1447440eee052f4ea2bcccbe684f286e63d6ba5e667a1b016d0e5ea8c0080597bd9
SSDEEP

98304:EWtXrN+OuV9/5Kge5f9lzwVAs0BAF3BHex7:xxrN+V9/g9nzuA+Fo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5aac5be3cd999511fb74d1cc3588fcd0_NeikiAnalytics

Files

5aac5be3cd999511fb74d1cc3588fcd0_NeikiAnalytics
.exe windows:4 windows x64 arch:x64

b4908ac0c92da84afd018238cd011319

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

AddAccessAllowedAce
AdjustTokenPrivileges
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
GetLengthSid
GetTokenInformation
InitializeAcl
InitializeSecurityDescriptor
LookupPrivilegeValueA
OpenProcessToken
SetSecurityDescriptorDacl

crypt32

CertCloseStore
CertEnumCertificatesInStore
CertFreeCertificateContext
CertOpenSystemStoreA

libgcc_s_seh-1

_Unwind_Resume
__emutls_get_address
__udivmodti4
__udivti3
__umodti3

kernel32

CancelIoEx
CloseHandle
CreateEventA
CreateFileA
CreateFileMappingA
CreateFileW
CreateIoCompletionPort
CreateMutexA
CreateProcessA
CreateSemaphoreA
CreateThread
CreateWaitableTimerA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
FillConsoleOutputAttribute
FillConsoleOutputCharacterA
FlushConsoleInputBuffer
FlushFileBuffers
FlushViewOfFile
FormatMessageA
FormatMessageW
GetConsoleMode
GetConsoleScreenBufferInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentVariableA
GetExitCodeProcess
GetFileAttributesA
GetFileAttributesW
GetFileInformationByHandle
GetFileSize
GetFileSizeEx
GetLargePageMinimum
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetModuleHandleW
GetOverlappedResult
GetProcAddress
GetProcessHeap
GetProcessTimes
GetQueuedCompletionStatus
GetStartupInfoA
GetStdHandle
GetSystemInfo
GetSystemPowerStatus
GetSystemTimeAsFileTime
GetSystemTimes
GetTimeZoneInformation
GetVersion
GetVersionExA
HeapAlloc
HeapFree
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
IsDBCSLeadByteEx
LeaveCriticalSection
LocalFree
LockFile
LockFileEx
MapViewOfFileEx
MoveFileExW
MultiByteToWideChar
OpenMutexA
OpenProcess
PostQueuedCompletionStatus
QueryPerformanceCounter
QueryPerformanceFrequency
ReadConsoleW
ReadFile
ReleaseMutex
ReleaseSemaphore
SetConsoleCursorPosition
SetConsoleMode
SetConsoleTextAttribute
SetEndOfFile
SetEvent
SetFileAttributesW
SetFilePointer
SetLastError
SetUnhandledExceptionFilter
SetWaitableTimer
SignalObjectAndWait
Sleep
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnlockFile
UnmapViewOfFile
VerSetConditionMask
VerifyVersionInfoA
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjectsEx
WaitForSingleObject
WaitForSingleObjectEx
WideCharToMultiByte
WriteFile
__C_specific_handler

msvcrt

___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_acmdln
_aligned_free
_aligned_malloc
_amsg_exit
_beginthread
_cexit
_close
_close
_commode
_errno
_exit
_fdopen
_fileno
_fmode
_fpreset
_ftime64
_getpid
_gmtime64
_initterm
_isatty
_isctype
_lock
_mkdir
_mktime64
_onexit
_open_osfhandle
_putenv
_strdup
_time64
_unlock
_vsnprintf
abort
atoi
atol
calloc
exit
fclose
fprintf
fputc
free
fwrite
getc
getenv
isalnum
isalpha
islower
isspace
isupper
isxdigit
localeconv
malloc
memchr
memcmp
memcpy
memmove
memset
raise
realloc
rand
rename
signal
srand
strcat
strchr
strcmp
strerror
strftime
strlen
strncmp
strncpy
strrchr
strtok
strtol
strtoul
tolower
toupper
ungetc
vfprintf
wcscpy
wcslen
wcstombs

libwinpthread-1

nanosleep
pthread_create
pthread_detach
pthread_join
pthread_mutex_destroy
pthread_mutex_init
pthread_mutex_lock
pthread_mutex_unlock

shell32

SHGetSpecialFolderPathW

libssp-0

__chk_fail
__memcpy_chk
__memmove_chk
__memset_chk
__stack_chk_fail
__stack_chk_guard

libstdc++-6

_ZNKSt11logic_error4whatEv
_ZNKSt12__basic_fileIcE7is_openEv
_ZNKSt13bad_exception4whatEv
_ZNKSt13runtime_error4whatEv
_ZNKSt3_V214error_category10_M_messageB5cxx11Ei
_ZNKSt5ctypeIcE13_M_widen_initEv
_ZNKSt6localeeqERKS_
_ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE12find_last_ofEPKcyy
_ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE17find_first_not_ofEPKcyy
_ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE17find_first_not_ofEcy
_ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE4copyEPcyy
_ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE4findEPKcy
_ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE4findEPKcyy
_ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE4findEcy
_ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE5rfindEcy
_ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE6substrEyy
_ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE7compareEPKc
_ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE7compareEyyRKS4_
_ZNKSt7__cxx1115basic_stringbufIcSt11char_traitsIcESaIcEE3strEv
_ZNKSt7__cxx118time_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE3getES4_S4_RSt8ios_baseRSt12_Ios_IostateP2tmPKcSD_
_ZNKSt8__detail20_Prime_rehash_policy11_M_next_bktEy
_ZNKSt8__detail20_Prime_rehash_policy14_M_need_rehashEyyy
_ZNKSt9bad_alloc4whatEv
_ZNKSt9type_infoeqERKS_
_ZNSdD2Ev
_ZNSi10_M_extractIxEERSiRT_
_ZNSi10_M_extractIyEERSiRT_
_ZNSi3getERc
_ZNSi3getEv
_ZNSi4peekEv
_ZNSi4readEPcx
_ZNSi5seekgESt4fposIiE
_ZNSi5seekgExSt12_Ios_Seekdir
_ZNSi5tellgEv
_ZNSi6sentryC1ERSib
_ZNSo3putEc
_ZNSo5flushEv
_ZNSo5tellpEv
_ZNSo5writeEPKcx
_ZNSo6sentryC1ERSo
_ZNSo6sentryD1Ev
_ZNSo9_M_insertIPKvEERSoT_
_ZNSo9_M_insertIbEERSoT_
_ZNSo9_M_insertIdEERSoT_
_ZNSo9_M_insertImEERSoT_
_ZNSo9_M_insertIxEERSoT_
_ZNSo9_M_insertIyEERSoT_
_ZNSolsEi
_ZNSolsEs
_ZNSt11logic_errorC1EPKc
_ZNSt11logic_errorC2EPKc
_ZNSt11logic_errorC2ERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEE
_ZNSt11logic_errorC2ERKS_
_ZNSt11logic_errorD1Ev
_ZNSt11logic_errorD2Ev
_ZNSt11range_errorC1EPKc
_ZNSt11range_errorD1Ev
_ZNSt12__basic_fileIcED1Ev
_ZNSt12length_errorC1EPKc
_ZNSt12length_errorD1Ev
_ZNSt12out_of_rangeC2ERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEE
_ZNSt12out_of_rangeD2Ev
_ZNSt13bad_exceptionD2Ev
_ZNSt13basic_filebufIcSt11char_traitsIcEE4openEPKcSt13_Ios_Openmode
_ZNSt13basic_filebufIcSt11char_traitsIcEE5closeEv
_ZNSt13basic_filebufIcSt11char_traitsIcEEC1Ev
_ZNSt13basic_filebufIcSt11char_traitsIcEED1Ev
_ZNSt13runtime_errorC1EPKc
_ZNSt13runtime_errorC1ERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEE
_ZNSt13runtime_errorC2EPKc
_ZNSt13runtime_errorC2ERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEE
_ZNSt13runtime_errorC2ERKS_
_ZNSt13runtime_errorD1Ev
_ZNSt13runtime_errorD2Ev
_ZNSt14basic_ifstreamIcSt11char_traitsIcEED1Ev
_ZNSt14basic_ofstreamIcSt11char_traitsIcEE5closeEv
_ZNSt14basic_ofstreamIcSt11char_traitsIcEED1Ev
_ZNSt14overflow_errorC1EPKc
_ZNSt14overflow_errorD1Ev
_ZNSt14overflow_errorD2Ev
_ZNSt15__exception_ptr13exception_ptr10_M_releaseEv
_ZNSt15__exception_ptr13exception_ptr9_M_addrefEv
_ZNSt15__exception_ptr13exception_ptrC1EPv
_ZNSt15basic_streambufIcSt11char_traitsIcEE4syncEv
_ZNSt15basic_streambufIcSt11char_traitsIcEE5imbueERKSt6locale
_ZNSt15basic_streambufIcSt11char_traitsIcEE5sputcEc
_ZNSt15basic_streambufIcSt11char_traitsIcEE5uflowEv
_ZNSt15basic_streambufIcSt11char_traitsIcEE6setbufEPcx
_ZNSt15basic_streambufIcSt11char_traitsIcEE6xsgetnEPcx
_ZNSt15basic_streambufIcSt11char_traitsIcEE6xsputnEPKcx
_ZNSt15basic_streambufIcSt11char_traitsIcEE8overflowEi
_ZNSt15basic_streambufIcSt11char_traitsIcEE9pbackfailEi
_ZNSt15basic_streambufIcSt11char_traitsIcEE9showmanycEv
_ZNSt15basic_streambufIcSt11char_traitsIcEE9underflowEv
_ZNSt16invalid_argumentC1EPKc
_ZNSt16invalid_argumentD1Ev
_ZNSt16invalid_argumentD2Ev
_ZNSt3_V214error_categoryD2Ev
_ZNSt3_V215system_categoryEv
_ZNSt3_V216generic_categoryEv
_ZNSt6chrono3_V212steady_clock3nowEv
_ZNSt6chrono3_V212system_clock3nowEv
_ZNSt6locale7classicEv
_ZNSt6localeC1ERKS_
_ZNSt6localeC1Ev
_ZNSt6localeD1Ev
_ZNSt6localeaSERKS_
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE10_M_disposeEv
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE10_M_replaceEyyPKcy
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE12_M_constructEyc
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE13_S_copy_charsEPcPKcS7_
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE14_M_replace_auxEyyyc
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE4swapERS4_
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE6appendEPKc
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE6resizeEyc
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE7replaceEyyPKcy
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE7reserveEy
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE8_M_eraseEyy
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE9_M_appendEPKcy
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE9_M_assignERKS4_
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE9_M_createERyy
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE9_M_mutateEyyPKcy
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE9push_backEc
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEC1EPKcRKS3_
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEC1ERKS4_
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEaSEOS4_
_ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE10_M_disposeEv
_ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE12_M_constructEyw
_ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE4swapERS4_
_ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE9_M_createERyy
_ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEEC1EOS4_
_ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEEC1ERKS4_
_ZNSt7__cxx1115basic_stringbufIcSt11char_traitsIcESaIcEE7_M_syncEPcyy
_ZNSt7__cxx1115basic_stringbufIcSt11char_traitsIcESaIcEE8overflowEi
_ZNSt7__cxx1115basic_stringbufIcSt11char_traitsIcESaIcEE9pbackfailEi
_ZNSt7__cxx1115basic_stringbufIcSt11char_traitsIcESaIcEE9showmanycEv
_ZNSt7__cxx1115basic_stringbufIcSt11char_traitsIcESaIcEE9underflowEv
_ZNSt7__cxx1118basic_stringstreamIcSt11char_traitsIcESaIcEEC1Ev
_ZNSt7__cxx1118basic_stringstreamIcSt11char_traitsIcESaIcEED1Ev
_ZNSt7__cxx1119basic_istringstreamIcSt11char_traitsIcESaIcEEC1ERKNS_12basic_stringIcS2_S3_EESt13_Ios_Openmode
_ZNSt7__cxx1119basic_istringstreamIcSt11char_traitsIcESaIcEED1Ev
_ZNSt7__cxx1119basic_ostringstreamIcSt11char_traitsIcESaIcEEC1Ev
_ZNSt7__cxx1119basic_ostringstreamIcSt11char_traitsIcESaIcEED1Ev
_ZNSt8__detail15_List_node_base11_M_transferEPS0_S1_
_ZNSt8__detail15_List_node_base7_M_hookEPS0_
_ZNSt8__detail15_List_node_base9_M_unhookEv
_ZNSt8bad_castD2Ev
_ZNSt8ios_base4InitC1Ev
_ZNSt8ios_base4InitD1Ev
_ZNSt8ios_baseC2Ev
_ZNSt8ios_baseD2Ev
_ZNSt9bad_allocD1Ev
_ZNSt9bad_allocD2Ev
_ZNSt9basic_iosIcSt11char_traitsIcEE11_M_setstateESt12_Ios_Iostate
_ZNSt9basic_iosIcSt11char_traitsIcEE4initEPSt15basic_streambufIcS1_E
_ZNSt9basic_iosIcSt11char_traitsIcEE5clearESt12_Ios_Iostate
_ZNSt9basic_iosIcSt11char_traitsIcEE5imbueERKSt6locale
_ZNSt9exceptionD2Ev
_ZSt11_Hash_bytesPKvyy
_ZSt16__ostream_insertIcSt11char_traitsIcEERSt13basic_ostreamIT_T0_ES6_PKS3_x
_ZSt16__throw_bad_castv
_ZSt17__throw_bad_allocv
_ZSt17current_exceptionv
_ZSt17rethrow_exceptionNSt15__exception_ptr13exception_ptrE
_ZSt18_Rb_tree_decrementPKSt18_Rb_tree_node_base
_ZSt18_Rb_tree_decrementPSt18_Rb_tree_node_base
_ZSt18_Rb_tree_incrementPKSt18_Rb_tree_node_base
_ZSt18_Rb_tree_incrementPSt18_Rb_tree_node_base
_ZSt18uncaught_exceptionv
_ZSt19__throw_logic_errorPKc
_ZSt20__throw_length_errorPKc
_ZSt20__throw_out_of_rangePKc
_ZSt20__throw_system_errori
_ZSt24__throw_out_of_range_fmtPKcz
_ZSt25__throw_bad_function_callv
_ZSt28_Rb_tree_rebalance_for_erasePSt18_Rb_tree_node_baseRS_
_ZSt28__throw_bad_array_new_lengthv
_ZSt29_Rb_tree_insert_and_rebalancebPSt18_Rb_tree_node_baseS0_RS_
_ZSt4cerr
_ZSt4cout
_ZSt4endlIcSt11char_traitsIcEERSt13basic_ostreamIT_T0_ES6_
_ZSt7getlineIcSt11char_traitsIcESaIcEERSt13basic_istreamIT_T0_ES7_RNSt7__cxx1112basic_stringIS4_S5_T1_EES4_
_ZSt9has_facetINSt7__cxx118messagesIcEEEbRKSt6locale
_ZSt9terminatev
_ZSt9use_facetINSt7__cxx117collateIcEEERKT_RKSt6locale
_ZSt9use_facetINSt7__cxx118messagesIcEEERKT_RKSt6locale
_ZSt9use_facetINSt7__cxx118numpunctIcEEERKT_RKSt6locale
_ZSt9use_facetINSt7__cxx118time_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEEEERKT_RKSt6locale
_ZSt9use_facetISt5ctypeIcEERKT_RKSt6locale
_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc
_ZStrsIcSt11char_traitsIcESaIcEERSt13basic_istreamIT_T0_ES7_RNSt7__cxx1112basic_stringIS4_S5_T1_EE
_ZTINSt7__cxx1115basic_stringbufIcSt11char_traitsIcESaIcEEE
_ZTIPKc
_ZTISo
_ZTISt15basic_streambufIcSt11char_traitsIcEE
_ZTIa
_ZTIb
_ZTId
_ZTIh
_ZTIi
_ZTIj
_ZTIs
_ZTIt
_ZTIv
_ZTIx
_ZTIy
_ZTTNSt7__cxx1118basic_stringstreamIcSt11char_traitsIcESaIcEEE
_ZTTNSt7__cxx1119basic_istringstreamIcSt11char_traitsIcESaIcEEE
_ZTTNSt7__cxx1119basic_ostringstreamIcSt11char_traitsIcESaIcEEE
_ZTTSt13basic_fstreamIcSt11char_traitsIcEE
_ZTTSt14basic_ifstreamIcSt11char_traitsIcEE
_ZTTSt14basic_ofstreamIcSt11char_traitsIcEE
_ZTVN10__cxxabiv117__class_type_infoE
_ZTVN10__cxxabiv119__pointer_type_infoE
_ZTVN10__cxxabiv120__function_type_infoE
_ZTVN10__cxxabiv120__si_class_type_infoE
_ZTVN10__cxxabiv121__vmi_class_type_infoE
_ZTVNSt7__cxx1115basic_stringbufIcSt11char_traitsIcESaIcEEE
_ZTVNSt7__cxx1118basic_stringstreamIcSt11char_traitsIcESaIcEEE
_ZTVNSt7__cxx1119basic_istringstreamIcSt11char_traitsIcESaIcEEE
_ZTVNSt7__cxx1119basic_ostringstreamIcSt11char_traitsIcESaIcEEE
_ZTVSi
_ZTVSo
_ZTVSt13basic_filebufIcSt11char_traitsIcEE
_ZTVSt13basic_fstreamIcSt11char_traitsIcEE
_ZTVSt14basic_ifstreamIcSt11char_traitsIcEE
_ZTVSt14basic_ofstreamIcSt11char_traitsIcEE
_ZTVSt14overflow_error
_ZTVSt15basic_streambufIcSt11char_traitsIcEE
_ZTVSt16invalid_argument
_ZTVSt9bad_alloc
_ZTVSt9basic_iosIcSt11char_traitsIcEE
_ZdaPv
_ZdlPv
_ZdlPvy
_Znay
_Znwy
__cxa_allocate_exception
__cxa_begin_catch
__cxa_demangle
__cxa_end_catch
__cxa_free_exception
__cxa_guard_abort
__cxa_guard_acquire
__cxa_guard_release
__cxa_init_primary_exception
__cxa_rethrow
__cxa_throw
__cxa_throw_bad_array_new_length
__dynamic_cast
__gxx_personality_seh0

user32

GetSystemMetrics

ws2_32

WSACleanup
WSAGetLastError
WSAIoctl
WSARecv
WSASend
WSASetLastError
WSASocketW
WSAStartup
WSAStringToAddressA
__WSAFDIsSet
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
getsockname
getsockopt
htonl
ioctlsocket
listen
ntohl
select
setsockopt
shutdown

libboost_filesystem-mt

_ZN5boost10filesystem11path_traits7convertEPKcS3_RNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEEERKSt7codecvtIwciE
_ZN5boost10filesystem11path_traits7convertEPKwS3_RNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEERKSt7codecvtIwciE
_ZN5boost10filesystem4path7codecvtEv
_ZN5boost10filesystem4path9append_v3ERKS1_
_ZN5boost10filesystem6detail13dir_itr_closeERPv
_ZN5boost10filesystem6detail15last_write_timeERKNS0_4pathEPNS_6system10error_codeE
_ZN5boost10filesystem6detail18create_directoriesERKNS0_4pathEPNS_6system10error_codeE
_ZN5boost10filesystem6detail28directory_iterator_constructERNS0_18directory_iteratorERKNS0_4pathEjPNS_6system10error_codeE
_ZN5boost10filesystem6detail28directory_iterator_incrementERNS0_18directory_iteratorEPNS_6system10error_codeE
_ZN5boost10filesystem6detail5spaceERKNS0_4pathEPNS_6system10error_codeE
_ZN5boost10filesystem6detail6removeERKNS0_4pathEPNS_6system10error_codeE
_ZN5boost10filesystem6detail6statusERKNS0_4pathEPNS_6system10error_codeE
_ZNK5boost10filesystem4path21find_parent_path_sizeEv

libboost_program_options-mt

_ZN5boost15program_options10validators22check_first_occurrenceERKNS_3anyE
_ZN5boost15program_options11bool_switchEv
_ZN5boost15program_options11to_internalERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEE
_ZN5boost15program_options13variables_mapC1Ev
_ZN5boost15program_options16validation_error12get_templateB5cxx11ENS1_6kind_tE
_ZN5boost15program_options19options_description11add_optionsEv
_ZN5boost15program_options19options_description21m_default_line_lengthE
_ZN5boost15program_options19options_description3addERKS1_
_ZN5boost15program_options19options_descriptionC1ERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEjj
_ZN5boost15program_options20invalid_option_valueC1ERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEE
_ZN5boost15program_options22error_with_option_nameC2ERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEES9_S9_i
_ZN5boost15program_options29options_description_easy_initclEPKcPKNS0_14value_semanticES3_
_ZN5boost15program_options3argB5cxx11E
_ZN5boost15program_options5storeERKNS0_20basic_parsed_optionsIcEERNS0_13variables_mapEb
_ZN5boost15program_options6detail7cmdline23set_options_descriptionERKNS0_19options_descriptionE
_ZN5boost15program_options6detail7cmdline27get_canonical_option_prefixEv
_ZN5boost15program_options6detail7cmdline3runEv
_ZN5boost15program_options6detail7cmdlineC2ERKSt6vectorINSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEESaIS9_EE
_ZN5boost15program_options6notifyERNS0_13variables_mapE
_ZN5boost15program_options8validateERNS_3anyERKSt6vectorINSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEESaIS9_EEPS9_i
_ZN5boost15program_optionslsERSoRKNS0_19options_descriptionE
_ZNK5boost15program_options19options_description12find_nothrowERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEbbb
_ZNK5boost15program_options22abstract_variables_mapixERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEE
_ZNK5boost15program_options22error_with_option_name23substitute_placeholdersERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEE
_ZNK5boost15program_options22error_with_option_name4whatEv
_ZNK5boost15program_options29value_semantic_codecvt_helperIcE5parseERNS_3anyERKSt6vectorINSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEESaISB_EEb
_ZTVN5boost15program_options13variables_mapE
_ZTVN5boost15program_options22error_with_option_nameE

libboost_serialization-mt

_ZN5boost7archive6detail20basic_serializer_map5eraseEPKNS1_16basic_serializerE
_ZN5boost7archive6detail20basic_serializer_map6insertEPKNS1_16basic_serializerE
_ZNK5boost7archive6detail20basic_serializer_map4findERKNS_13serialization18extended_type_infoE

libboost_thread-mt

_ZN5boost11this_thread18interruptible_waitEPvRKNS_6detail23mono_platform_timepointE
_ZN5boost11this_thread6get_idEv
_ZN5boost15future_categoryEv
_ZN5boost6detail12get_tss_dataEPKv
_ZN5boost6detail12set_tss_dataEPKvPFvPFvPvES3_ES5_S3_b
_ZN5boost6detail16thread_data_baseD2Ev
_ZN5boost6thread13join_noexceptEv
_ZN5boost6thread20hardware_concurrencyEv
_ZN5boost6thread21start_thread_noexceptERKNS_17thread_attributesE
_ZN5boost6thread21start_thread_noexceptEv
_ZN5boost6thread6detachEv
_ZN5boost6thread9interruptEv
_ZN5boost6threadC1Ev
_ZNK5boost6thread6get_idEv
_ZNK5boost6thread8joinableEv
_ZTVN5boost6detail16thread_data_baseE

libcrypto-1_1-x64

ASN1_INTEGER_set
BIO_ctrl
BIO_ctrl_pending
BIO_free
BIO_new_bio_pair
BIO_read
BIO_write
BN_free
BN_new
BN_set_word
CONF_modules_unload
EC_GROUP_check
EC_GROUP_free
EC_GROUP_new_by_curve_name
EC_GROUP_set_asn1_flag
EC_GROUP_set_point_conversion_form
EC_KEY_free
EC_KEY_generate_key
EC_KEY_new
EC_KEY_set_group
ERR_clear_error
ERR_func_error_string
ERR_get_error
ERR_lib_error_string
ERR_reason_error_string
EVP_PKEY_assign
EVP_PKEY_free
EVP_PKEY_new
EVP_sha256
GENERAL_NAMES_free
OPENSSL_sk_num
OPENSSL_sk_value
RSA_free
RSA_generate_key_ex
RSA_new
SHA256_Final
SHA256_Init
SHA256_Update
X509_NAME_ENTRY_get_data
X509_NAME_get_entry
X509_NAME_get_index_by_NID
X509_STORE_CTX_get0_chain
X509_STORE_CTX_get_current_cert
X509_STORE_CTX_get_error_depth
X509_STORE_CTX_get_ex_data
X509_STORE_add_cert
X509_STORE_new
X509_digest
X509_free
X509_get_ext_d2i
X509_get_serialNumber
X509_get_subject_name
X509_getm_notAfter
X509_getm_notBefore
X509_gmtime_adj
X509_new
X509_set_issuer_name
X509_set_pubkey
X509_sign
d2i_X509

libhidapi-0

hid_close
hid_enumerate
hid_error
hid_free_enumeration
hid_init
hid_open_path
hid_read
hid_read_timeout
hid_write

libsodium-23

crypto_verify_32

libssl-1_1-x64

OPENSSL_init_ssl
SSL_CTX_clear_options
SSL_CTX_ctrl
SSL_CTX_free
SSL_CTX_get_default_passwd_cb_userdata
SSL_CTX_get_ex_data
SSL_CTX_load_verify_locations
SSL_CTX_new
SSL_CTX_set_cert_store
SSL_CTX_set_cipher_list
SSL_CTX_set_default_passwd_cb_userdata
SSL_CTX_set_ex_data
SSL_CTX_set_options
SSL_CTX_set_verify_depth
SSL_CTX_use_PrivateKey
SSL_CTX_use_PrivateKey_file
SSL_CTX_use_certificate
SSL_CTX_use_certificate_chain_file
SSL_accept
SSL_connect
SSL_ctrl
SSL_free
SSL_get_error
SSL_get_ex_data
SSL_get_ex_data_X509_STORE_CTX_idx
SSL_get_shutdown
SSL_get_verify_callback
SSL_get_verify_mode
SSL_new
SSL_read
SSL_set_bio
SSL_set_ex_data
SSL_set_verify
SSL_shutdown
SSL_write
TLS_method

libunbound-8

ub_ctx_add_ta
ub_ctx_async
ub_ctx_create
ub_ctx_delete
ub_ctx_hosts
ub_ctx_resolvconf
ub_ctx_set_fwd
ub_ctx_set_option
ub_ctx_zone_add
ub_resolve
ub_resolve_free

Exports

Exports

_ZN5boost13serialization16singleton_module4lockEv
_ZN5boost13serialization16singleton_module6unlockEv
_ZN5boost13serialization16singleton_module8get_lockEv
_ZN5boost13serialization16singleton_module9is_lockedEv
_ZN5boost13serialization9singletonINS_7archive6detail12extra_detail3mapINS2_24portable_binary_iarchiveEEEE12is_destroyedEv
_ZN5boost13serialization9singletonINS_7archive6detail12extra_detail3mapINS2_24portable_binary_iarchiveEEEE18get_const_instanceEv
_ZN5boost13serialization9singletonINS_7archive6detail12extra_detail3mapINS2_24portable_binary_iarchiveEEEE20get_mutable_instanceEv
_ZN5boost13serialization9singletonINS_7archive6detail12extra_detail3mapINS2_24portable_binary_oarchiveEEEE12is_destroyedEv
_ZN5boost13serialization9singletonINS_7archive6detail12extra_detail3mapINS2_24portable_binary_oarchiveEEEE18get_const_instanceEv
_ZN5boost13serialization9singletonINS_7archive6detail12extra_detail3mapINS2_24portable_binary_oarchiveEEEE20get_mutable_instanceEv
_ZNK5boost7archive12codecvt_nullIwE11do_encodingEv
_ZNK5boost7archive12codecvt_nullIwE13do_max_lengthEv
_ZNK5boost7archive12codecvt_nullIwE16do_always_noconvEv

Sections

.text
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

text_env
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 220KB - Virtual size: 219KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 400KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/4
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/19
Size: 128KB - Virtual size: 127KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/31
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/45
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/57
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/70
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/81
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/97
Size: 77KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/113
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b4908ac0c92da84afd018238cd011319

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

crypt32

libgcc_s_seh-1

kernel32

msvcrt

libwinpthread-1

shell32

libssp-0

libstdc++-6

user32

ws2_32

libboost_filesystem-mt

libboost_program_options-mt

libboost_serialization-mt

libboost_thread-mt

libcrypto-1_1-x64

libhidapi-0

libsodium-23

libssl-1_1-x64

libunbound-8

Exports

Exports

Sections

.text Size: 3.0MB - Virtual size: 3.0MB

text_env Size: 12KB - Virtual size: 12KB

.data Size: 17KB - Virtual size: 17KB

.rdata Size: 1.2MB - Virtual size: 1.2MB

.pdata Size: 71KB - Virtual size: 70KB

.xdata Size: 220KB - Virtual size: 219KB

.bss Size: - Virtual size: 400KB

.edata Size: 1KB - Virtual size: 1KB

.idata Size: 36KB - Virtual size: 35KB

.CRT Size: 512B - Virtual size: 104B

.tls Size: 512B - Virtual size: 16B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 12KB - Virtual size: 12KB

/4 Size: 3KB - Virtual size: 3KB

/19 Size: 128KB - Virtual size: 127KB

/31 Size: 25KB - Virtual size: 25KB

/45 Size: 59KB - Virtual size: 58KB

/57 Size: 14KB - Virtual size: 14KB

/70 Size: 2KB - Virtual size: 1KB

/81 Size: 21KB - Virtual size: 21KB

/97 Size: 77KB - Virtual size: 76KB

/113 Size: 3KB - Virtual size: 2KB

.text
Size: 3.0MB - Virtual size: 3.0MB

text_env
Size: 12KB - Virtual size: 12KB

.data
Size: 17KB - Virtual size: 17KB

.rdata
Size: 1.2MB - Virtual size: 1.2MB

.pdata
Size: 71KB - Virtual size: 70KB

.xdata
Size: 220KB - Virtual size: 219KB

.bss
Size: - Virtual size: 400KB

.edata
Size: 1KB - Virtual size: 1KB

.idata
Size: 36KB - Virtual size: 35KB

.CRT
Size: 512B - Virtual size: 104B

.tls
Size: 512B - Virtual size: 16B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 12KB - Virtual size: 12KB

/4
Size: 3KB - Virtual size: 3KB

/19
Size: 128KB - Virtual size: 127KB

/31
Size: 25KB - Virtual size: 25KB

/45
Size: 59KB - Virtual size: 58KB

/57
Size: 14KB - Virtual size: 14KB

/70
Size: 2KB - Virtual size: 1KB

/81
Size: 21KB - Virtual size: 21KB

/97
Size: 77KB - Virtual size: 76KB

/113
Size: 3KB - Virtual size: 2KB