JE7Y4F
ObGetVersionInfo
ObIsPlexFunction
Static task
static1
Behavioral task
behavioral1
Sample
4b4f3696574e9d60470c6f8876713380_NeikiAnalytics.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
4b4f3696574e9d60470c6f8876713380_NeikiAnalytics.dll
Resource
win10v2004-20240508-en
Target
4b4f3696574e9d60470c6f8876713380_NeikiAnalytics.exe
Size
394KB
MD5
4b4f3696574e9d60470c6f8876713380
SHA1
d389b1d6964d8c1aa3d9225fb2a1dde200814140
SHA256
3a6abd52aa2d854173b74d2fe07753779b91dd32ce2910aa962390113cfa70b0
SHA512
e6948c7cb487b69a5a83f88a850ec61515bc3443a76ffa5e3bd31e1b91aac18ae879a9eddbfa64f3de0225e56b63820d1333683675690072edde97b960da8120
SSDEEP
6144:8iBsXWw3y6fMcO5txD7LxRjzhxx6PZsmaRP5EgNdfnON8:8ryTJ7LDNfnON
Checks for missing Authenticode signature.
resource |
---|
4b4f3696574e9d60470c6f8876713380_NeikiAnalytics.exe |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
?Repaint@ObPanel@@UAEXXZ
??1ObPanel@@UAE@XZ
?AddKeyBoardEvent@ObPanel@@QAEXJH@Z
?SetContextMenu@ObPanel@@QAEXHH@Z
?RegisterLogicalEvent@ObPanel@@QAEXHJ@Z
?pszGetResourceString@@YAPBDIPAVObPanel@@@Z
?AddEvent@ObPanel@@QAEXQAVObLogEvent@@@Z
?pBindControl@ObPanel@@IAEPAVObCtrl@@HHPAVHGrid@@@Z
?LoadControls@ObPanel@@QAEXXZ
??1ObRCDATA@@QAE@XZ
?Init@ObPanel@@QAEHW4ObWinType@@KKKW4PanelPlacement@1@H@Z
?pGetData@ObRCDATA@@QAEPADXZ
??0ObRCDATA@@QAE@PAVObPanel@@H@Z
??0ObPanel@@QAE@QAVObFunctionData@@@Z
?Log@ObMessage@@SAXKW4ObMsgType@ObMsg@@JVObString@@PBDZZ
?Status@ObMessage@@SAXPBDZZ
?Box@ObMessage@@SAHKIPBDZZ
?Call@ObCallMgr@@SAXQAVObFunctionData@@QAVObParamVariable@@1HPBD2@Z
?GetPanelCWndByName@ObPanelAPI@@SAPAVCWnd@@PBD@Z
?Formatf@ObCharFld@@QAAXPBDZZ
?GetCWinApp@ObAppAPI@@SAPAVCWinApp@@XZ
?CastFrom@ObLongFld@@QAEXAAVObCharFld@@@Z
?EndSetFocus@ObPanel@@QAEXXZ
??4ObIntFld@@QAEABV0@ABV0@@Z
??0ObIntFld@@QAE@FG@Z
?GetText@ObCharFld@@QBEPADXZ
?CastFrom@ObCharFld@@QAEXAAV1@@Z
??4ObLongFld@@QAEABV0@ABV0@@Z
??4ObVariantFld@@QAEABV0@ABVObLongFld@@@Z
?CastFrom@ObVariantFld@@QAEXAAVObDateFld@@@Z
??4ObVariantFld@@QAEABV0@ABVObCharFld@@@Z
??0ObLongFld@@QAE@ABV0@@Z
??4ObIntFld@@QAEABV0@ABVObLongFld@@@Z
??4ObFixedDecFld@@QAEABV0@ABV0@@Z
??4ObDateFld@@QAEABV0@ABV0@@Z
??4ObFixedDecFld@@QAEABV0@ABVObDblFld@@@Z
?SetText@ObPanel@@EAEXPBD@Z
??0ObDateFld@@QAE@PBDG@Z
??4ObTimeFld@@QAEABV0@ABV0@@Z
?SetEmpty@ObDateFld@@QAEXXZ
?SetEmpty@ObCharFld@@QAEXXZ
?SetEmpty@ObTimeFld@@QAEXXZ
??4ObDblFld@@QAEABV0@ABV0@@Z
??0ObCharFld@@QAE@JHHGPBD000G@Z
?CastFrom@ObLongFld@@QAEXAAV1@@Z
??1ObFunctionData@@UAE@XZ
?Entry@ObFunctionData@@QAEHXZ
?IsValid@ObFunctionData@@SAHQAV1@IIPBDI@Z
??0ObFunctionData@@QAE@QAVObFncParameter@@QAVObLocalVariable@@PBD22II@Z
??1ObFncDataHandler@@QAE@XZ
?StartPanel@ObPanel@@QAEXXZ
??0ObFncDataHandler@@QAE@QAVObFunctionData@@@Z
?SetPanel@ObFunctionData@@QAEXQAVObPanel@@@Z
??0ObCharFld@@QAE@PBDG@Z
??4ObCharFld@@QAEABV0@ABV0@@Z
?pszObTrimSpaces@@YAPADPAD@Z
?iObCompString@@YAHPBD0@Z
??0ObFixedDecImpl@@QAE@PBD@Z
?strGetText@ObFixedDecFld@@QAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@H@Z
?PutText@ObFixedDecFld@@UAEXPBD@Z
?strGetAS400StateDefault@ObFixedDecFld@@UAEPADPADAAHGHHD@Z
?fSetStateFromAS400@ObFixedDecFld@@UAEHPBDIHHD@Z
?strGetMaskedText@ObFixedDecFld@@UAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD@Z
??0ObComFld@@QAE@U_GUID@@@Z
??0ObComFld@@QAE@U_GUID@@0@Z
?AddFld@ObRTDI@@SAXPAVObFunctionData@@HKPBD1W4FldType@@W4FldPCType@@W4FldAS400Type@@W4FldSQLType@@GGGG@Z
?AddVarFld@ObRTDI@@SAXPAVObVariable@@PAVObRTType@@HHW4eFldUsage@1@G@Z
?AddFncVar@ObRTDI@@SAXPAVObFunctionData@@PAVObVariable@@HHG@Z
?AddVar@ObRTDI@@SAXPAVObFunctionData@@HKPBD1W4eVarClass@1@1G@Z
?AddFnc@ObRTDI@@SAXPAVObFunctionData@@HKPBD1W4ObFncTypeSys@@W4ObFncLanguageSys@@111W4ObSystemType@@PAX@Z
?PrepareAPICall@ObUserAPI@@SAXPAVObFunctionData@@@Z
?TrimSpaces@ObCharFld@@QAEXXZ
?SetSize@ObPanel@@EAEXVCSize@@@Z
?SetPosition@ObPanel@@EAEXVCPoint@@@Z
?DisplayContextMenu@ObStateWin@@UAEXHIVCPoint@@@Z
?SetAuxData@ObStateWin@@UAEXAAUObAuxCtrlInfo@@@Z
??4ObDblFld@@QAEABV0@ABVObFixedDecFld@@@Z
?SetState@ObStateWin@@QAEXI@Z
?Return@ObFunctionData@@QAEXXZ
?ConcatCopy@ObString@@IAEXHPBDH0@Z
?GetLength@ObString@@QBEHXZ
?pszGetFunctionResourceString@@YAPBDIPAVObFunctionData@@@Z
?ProcessHResult@ObComFld@@IAEXPAVObFunctionData@@@Z
??4ObCharFld@@QAEABV0@ABVObVariantFld@@@Z
?pGetBSTR@ObVariantFld@@QAEPAPAGXZ
?GetBSTR@ObVariantFld@@QAEPAGXZ
??4ObVariantFld@@QAEABV0@ABV0@@Z
?CastFrom@ObVariantFld@@QAEXAAV1@@Z
?GetLong@ObVariantFld@@QAEJXZ
?CastFrom@ObVariantFld@@QAEXAAVObLongFld@@@Z
??4ObLongFld@@QAEABV0@ABVObVariantFld@@@Z
?pGetLong@ObVariantFld@@QAEPAJXZ
??4ObByteFld@@QAEABV0@ABVObVariantFld@@@Z
?CastFrom@ObVariantFld@@QAEXAAVObByteFld@@@Z
??0ObDateFld@@QAE@HHHG@Z
??0ObTimeFld@@QAE@HHHG@Z
??0ObTimeStampFld@@QAE@HHHHHHJG@Z
??1ObComFld@@QAE@XZ
?SetInterface@ObComFld@@UAEXPAUIUnknown@@@Z
?GetIUnknown@ObComFld@@UAEJAAPAUIUnknown@@@Z
?isLicensed@ObComFld@@UAEHXZ
?GetLicenseKey@ObComFld@@UAEPAGXZ
?CreateInstance@ObComFld@@UAEJPBD0PAVObFunctionData@@@Z
?CastFrom@ObComFld@@UAEJAAVObVariantFld@@@Z
?CastFrom@ObComFld@@UAEJPAUIUnknown@@@Z
?CastFrom@ObComFld@@UAEJAAV1@@Z
?CompareEqual@ObComFld@@UAE_NAAV1@@Z
?CompareNotEqual@ObComFld@@UAE_NAAV1@@Z
?CheckInterface@ObComFld@@UAE_NXZ
?MapEvent@ObComFld@@UAEXPAVObFunctionData@@U_GUID@@JJPAVObVariable@@@Z
?StartSetFocus@ObPanel@@QAEXXZ
??1ObCtrObj@@UAE@XZ
?DeleteRTDIVarFldMapArray@ObVariable@@QAEXXZ
?strGetText@ObCharFld@@UAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?PutText@ObCharFld@@UAEXPBD@Z
?strGetAS400StateDefault@ObCharFld@@UAEPADPADAAHGHHD@Z
?fSetStateFromAS400@ObCharFld@@UAEHPBDIHHD@Z
?strGetMaskedText@ObCharFld@@UAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD@Z
?strGetText@ObTimeStampFld@@UAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?PutText@ObTimeStampFld@@UAEXPBD@Z
?strGetAS400StateDefault@ObTimeStampFld@@UAEPADPADAAHGHHD@Z
?fSetStateFromAS400@ObTimeStampFld@@UAEHPBDIHHD@Z
?strGetMaskedText@ObTimeStampFld@@UAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD@Z
?strGetText@ObTimeFld@@UAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?PutText@ObTimeFld@@UAEXPBD@Z
?strGetAS400StateDefault@ObTimeFld@@UAEPADPADAAHGHHD@Z
?fSetStateFromAS400@ObTimeFld@@UAEHPBDIHHD@Z
?strGetMaskedText@ObTimeFld@@UAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD@Z
?strGetText@ObDateFld@@UAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?PutText@ObDateFld@@UAEXPBD@Z
?strGetAS400StateDefault@ObDateFld@@UAEPADPADAAHGHHD@Z
?fSetStateFromAS400@ObDateFld@@UAEHPBDIHHD@Z
?strGetMaskedText@ObDateFld@@UAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD@Z
??1ObVariantFld@@UAE@XZ
?CastFrom@ObVariantFld@@QAEXAAVObCharFld@@@Z
?strGetText@ObVariantFld@@UAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?PutText@ObVariantFld@@UAEXPBD@Z
?strGetMaskedText@ObVariantFld@@UAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD@Z
?DDX@ObCtrl@@QAEHW4AccMode@@AAVObFixedDecFld@@@Z
?DDX@ObCtrl@@QAEHW4AccMode@@AAVObDateFld@@@Z
?DDX@ObCtrl@@QAEHW4AccMode@@AAVObLongFld@@@Z
?DDX@ObCtrl@@QAEHW4AccMode@@AAVObCharFld@@@Z
?CollateFieldStates@@YAHAAVObRTType@@0H@Z
??0ObLongFld@@QAE@JG@Z
?strGetText@ObDblFld@@QAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@H@Z
?SetEmpty@ObDblFld@@QAEXXZ
?PutText@ObDblFld@@UAEXPBD@Z
?strGetAS400StateDefault@ObDblFld@@UAEPADPADAAHGHHD@Z
?fSetStateFromAS400@ObDblFld@@UAEHPBDIHHD@Z
?strGetMaskedText@ObDblFld@@UAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD@Z
?SetEmpty@ObLongFld@@QAEXXZ
?strGetText@ObLongFld@@UAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?PutText@ObLongFld@@UAEXPBD@Z
?strGetAS400StateDefault@ObLongFld@@UAEPADPADAAHGHHD@Z
?fSetStateFromAS400@ObLongFld@@UAEHPBDIHHD@Z
?strGetMaskedText@ObLongFld@@UAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD@Z
?SetEmpty@ObIntFld@@QAEXXZ
?strGetText@ObIntFld@@UAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?PutText@ObIntFld@@UAEXPBD@Z
?strGetAS400StateDefault@ObIntFld@@UAEPADPADAAHGHHD@Z
?fSetStateFromAS400@ObIntFld@@UAEHPBDIHHD@Z
??0ObVariantFld@@QAE@XZ
?strGetMaskedText@ObIntFld@@UAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD@Z
?SetEmpty@ObByteFld@@QAEXXZ
?strGetText@ObByteFld@@UAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?PutText@ObByteFld@@UAEXPBD@Z
?strGetAS400StateDefault@ObByteFld@@UAEPADPADAAHGHHD@Z
?fSetStateFromAS400@ObByteFld@@UAEHPBDIHHD@Z
?strGetMaskedText@ObByteFld@@UAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD@Z
??1ObFixedDecImpl@@QAE@XZ
?CheckLength@ObString@@AAEXXZ
?Init@ObString@@AAEXHJH@Z
?ObMIx@@YAHHHAAVObString@@@Z
??0ObDblFld@@QAE@NG@Z
?ClearCreationDetails@ObComFld@@QAEXXZ
GetVersionExA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
ExitProcess
DeleteCriticalSection
InitializeCriticalSection
InterlockedDecrement
LocalFree
LoadLibraryA
GetProcAddress
CoInitialize
SysAllocString
SysFreeString
VariantCopy
VariantClear
GetErrorInfo
VariantInit
ord2902
ord1098
ord1084
ord578
ord310
ord297
ord304
ord2475
ord2468
ord5154
ord764
ord5403
ord2469
ord6180
ord266
ord6090
ord5833
ord3389
ord6067
ord2131
ord876
ord762
ord265
ord6174
_makepath
free
_except_handler3
__CxxFrameHandler
memcpy
_splitpath
tolower
isalpha
toupper
isalnum
memset
strlen
malloc
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_initterm
_adjust_fdiv
__CppXcptFilter
__security_error_handler
__dllonexit
_onexit
_CxxThrowException
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
JE7Y4F
ObGetVersionInfo
ObIsPlexFunction
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ