6d60d55974bd0d1e4e46632a018cc180_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

6d60d55974bd0d1e4e46632a018cc180_NeikiAnalytics.exe
Size

211KB
MD5

6d60d55974bd0d1e4e46632a018cc180
SHA1

a78f72f6a2bc29968fdc24c9fb66c2094a9e99fd
SHA256

28db712d049f172a7cb9b174db4f538f091d95bad6bdedb26f248953d561588b
SHA512

b57e509d23a99208ba41427992502fdf7d330ee055010e2feeff92cfafd799f0255392c6b7610890a949c5f294040f748c5a7bd46a5c55d1d33157c6a921da31
SSDEEP

3072:Zr4xsHq3Jp0K3fcKzVl+ipKZ4bSnM2mAhssoGRBovGZ5Z772TXgjhqOuCqmu2YFx:Zr4xsHIJ2A2thljXQFCixYxQYiZ6Xfk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6d60d55974bd0d1e4e46632a018cc180_NeikiAnalytics.exe

Files

6d60d55974bd0d1e4e46632a018cc180_NeikiAnalytics.exe
.dll windows:6 windows x86 arch:x86

5b8fa4d5a51ba0c483340451eeecd68b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

W:\_Build\Build20\BRAVOx\_BTrace\bravox.pdb

Imports

bravo

?Update@DisArray@@QAEPAVDis@@JPAV2@@Z
?Remove@DisArray@@QAEPAVDis@@J@Z
?Find@DisArray@@QBEJKJ@Z
?GetPos@DisArray@@QBEJPBVDis@@@Z
??1DisDefine@@UAE@XZ
?Ds_GetNames@@YAXPAVDis@@H@Z
?Ds_ConvertDis2Io@@YAXPAVDis@@@Z
?Ds_AccRemove@@YAXPAVDis@@K@Z
?Ds_GetDefStore@@YAPBVDis@@KPAVDisIo@@@Z
?Ds_LoadExec@@YAHPAVDis@@PAVDisIo@@@Z
?Ds_LoadSent0@@YAHPAVDis@@KPAVDisIo@@@Z
?Ds_SortFind@@YAJPBVDis@@00PAJ@Z
?Ds_SortTmpl@@YA_NPAVDis@@PBV1@J@Z
?Ds_SortTime@@YA_NPAVDis@@_N@Z
?Ds_FileList@@YAPAVDisIo@@PBDHHH@Z
?ExecFar@DisSentence@@QAE_NPAVDis@@H@Z
??1DisSentence@@UAE@XZ
??0SentProcess@@QAE@XZ
??1SentProcess@@UAE@XZ
?init@SentProcess@@QAE_NPBDHH@Z
?step@SentProcess@@QAE_NH@Z
?Exec@Model@@SAXAAVDis@@PAV2@@Z
?GetHier@Model@@SAPAVDis@@KABV2@H@Z
?GetDef@Model@@SAPAVDis@@KPBV2@H@Z
?GetDefX@Model@@SAPAVDis@@KPBV2@HPBD@Z
?Update@Model@@SA_NAAVDis@@@Z
?Select@Model@@SAPAVDis@@ABV2@PBV2@11H@Z
??1DisParam@@UAE@XZ
?SetMean@DisParam@@QAEPAVDis@@PAV2@@Z
??0DisIo@@QAA@KJPAVDis@@ZZ
??1DisIo@@UAE@XZ
??0xerror@@QAE@JPAX@Z
??1xerror@@QAE@XZ
??6xerror@@QAEAAV0@PAD@Z
??6xerror@@QAEAAV0@PBD@Z
??6xerror@@QAEAAV0@H@Z
??6xerror@@QAEAAV0@J@Z
?throwx@xerror@@SAXPAV1@HPBDH@Z
?catchx@xerror@@SAXPAV1@PBDH@Z
?IsA@Dis@@UBE?AW4disId@@XZ
?IsType@Dis@@UBE?AW4disType@@XZ
?IsArray@Dis@@UBE_NXZ
?SkipDis@Dis@@MAEPAV1@XZ
?NextDis@Dis@@MAEPAV1@PAV1@@Z
?PrevDis@Dis@@MAEPAV1@PAV1@@Z
?IsA@DisMean@@UBE?AW4disId@@XZ
?IsType@DisMean@@UBE?AW4disType@@XZ
?IsNum@DisMean@@UBE_NXZ
?GetNum@DisMean@@UBENXZ
?SetNum@DisMean@@UAEXN@Z
?IsA@DisMeanDbl@@UBE?AW4disId@@XZ
?IsNum@DisMeanDbl@@UBE_NXZ
?GetNum@DisMeanDbl@@UBENXZ
?SetNum@DisMeanDbl@@UAEXN@Z
?IsA@DisMeanInt@@UBE?AW4disId@@XZ
?IsNum@DisMeanInt@@UBE_NXZ
?GetNum@DisMeanInt@@UBENXZ
?SetNum@DisMeanInt@@UAEXN@Z
?IsA@DisObject@@UBE?AW4disId@@XZ
?IsType@DisObject@@UBE?AW4disType@@XZ
?IsArray@DisArray@@UBE_NXZ
?IsA@DisDefine@@UBE?AW4disId@@XZ
?IsType@DisDefine@@UBE?AW4disType@@XZ
?IsA@DisParam@@UBE?AW4disId@@XZ
?IsType@DisParam@@UBE?AW4disType@@XZ
?IsType@DisIo@@UBE?AW4disType@@XZ
?IsA@DisIo@@UBE?AW4disId@@XZ
?XPrint@DisIo@@UBEHPADH@Z
?nameOf@DisIo@@UBEPBDXZ
?typeOf@DisIo@@UBEPBDXZ
?read@DisIo@@MAEXAAVbstream@@@Z
?write@DisIo@@MBEXAAVbstream@@@Z
?xml_write@DisIo@@MBEXAAVbstream@@@Z
?Check@DisDefine@@UBEXXZ
?XPrint@DisDefine@@UBEHPADH@Z
?nameOf@DisDefine@@UBEPBDXZ
?typeOf@DisDefine@@UBEPBDXZ
?read@DisDefine@@MAEXAAVbstream@@@Z
?write@DisDefine@@MBEXAAVbstream@@@Z
?xml_write@DisDefine@@MBEXAAVbstream@@@Z
?IsEqvMean@DisMeanInt@@UBE_NABVDis@@@Z
?MathMean@DisMeanInt@@UBE?AW4ciType@DisMean@@ABV3@@Z
?ResetMean@DisMeanInt@@UAEXXZ
?Check@DisMeanInt@@UBEXXZ
?Clone@DisMeanInt@@UBEPAVDis@@XZ
?CopyMean@DisMeanInt@@UAEXPAVDis@@_N@Z
?ReadMean@DisMeanInt@@UAEHPBD@Z
?XPrint@DisMeanInt@@UBEHPADH@Z
?nameOf@DisMeanInt@@UBEPBDXZ
?read@DisMeanInt@@MAEXAAVbmemfile@@@Z
?read@DisMeanInt@@MAEXAAVbstream@@@Z
?write@DisMeanInt@@MBEXAAVbmemfile@@@Z
?write@DisMeanInt@@MBEXAAVbstream@@@Z
?size@DisMeanInt@@MBEJXZ
?Detach@DisArray@@UAEXPAVDis@@@Z
?IsEqv@DisArray@@UBE_NABVDis@@@Z
?Check@DisArray@@UBEXXZ
?Reset@DisArray@@UAEXXZ
?Clone@DisArray@@UBEPAVDis@@XZ
?Copy@DisArray@@UAEXPAVDis@@_N@Z
?SkipDis@DisArray@@MAEPAVDis@@XZ
?NextDis@DisArray@@MAEPAVDis@@PAV2@@Z
?PrevDis@DisArray@@MAEPAVDis@@PAV2@@Z
?read@DisArray@@MAEXAAVbmemfile@@@Z
?write@DisArray@@MBEXAAVbmemfile@@@Z
?size@DisArray@@MBEJXZ
?IsEqvMean@DisMeanDbl@@UBE_NABVDis@@@Z
?MathMean@DisMeanDbl@@UBE?AW4ciType@DisMean@@ABV3@@Z
?ResetMean@DisMeanDbl@@UAEXXZ
?Check@DisMeanDbl@@UBEXXZ
?Clone@DisMeanDbl@@UBEPAVDis@@XZ
?CopyMean@DisMeanDbl@@UAEXPAVDis@@_N@Z
?ReadMean@DisMeanDbl@@UAEHPBD@Z
?XPrint@DisMeanDbl@@UBEHPADH@Z
?nameOf@DisMeanDbl@@UBEPBDXZ
?read@DisMeanDbl@@MAEXAAVbmemfile@@@Z
?read@DisMeanDbl@@MAEXAAVbstream@@@Z
?write@DisMeanDbl@@MBEXAAVbmemfile@@@Z
?write@DisMeanDbl@@MBEXAAVbstream@@@Z
?size@DisMeanDbl@@MBEJXZ
?Detach@DisParam@@UAEXPAVDis@@@Z
?IsEqv@DisParam@@UBE_NABVDis@@@Z
?Check@DisParam@@UBEXXZ
?Reset@DisParam@@UAEXXZ
?Clone@DisParam@@UBEPAVDis@@XZ
?Copy@DisParam@@UAEXPAVDis@@_N@Z
?XPrint@DisParam@@UBEHPADH@Z
?nameOf@DisParam@@UBEPBDXZ
?typeOf@DisParam@@UBEPBDXZ
?SkipDis@DisParam@@MAEPAVDis@@XZ
?NextDis@DisParam@@MAEPAVDis@@PAV2@@Z
?PrevDis@DisParam@@MAEPAVDis@@PAV2@@Z
?read@DisParam@@MAEXAAVbmemfile@@@Z
?read@DisParam@@MAEXAAVbstream@@@Z
?write@DisParam@@MBEXAAVbmemfile@@@Z
?write@DisParam@@MBEXAAVbstream@@@Z
?size@DisParam@@MBEJXZ
?translate@DisParam@@MAEXAAVbstream@@@Z
?retranslate@DisParam@@MBEXAAVbstream@@@Z
?xml_write@DisParam@@MBEXAAVbstream@@@Z
?IsEmpty@DisMean@@UBE_NXZ
?IsEqv@DisMean@@UBE_NABVDis@@@Z
?IsEqvMean@DisMean@@UBE_NABVDis@@@Z
?MathMean@DisMean@@UBE?AW4ciType@1@ABV1@@Z
?Reset@DisMean@@UAEXXZ
?ResetMean@DisMean@@UAEXXZ
?Copy@DisMean@@UAEXPAVDis@@_N@Z
?CopyMean@DisMean@@UAEXPAVDis@@_N@Z
?ReadMean@DisMean@@UAEHPBD@Z
?XPrint@DisMean@@UBEHPADH@Z
?nameOf@DisMean@@UBEPBDXZ
?typeOf@DisMean@@UBEPBDXZ
?read@DisMean@@MAEXAAVbstream@@@Z
?write@DisMean@@MBEXAAVbstream@@@Z
?xml_write@DisMean@@MBEXAAVbstream@@@Z
?nameOf@DisObject@@UBEPBDXZ
?typeOf@DisObject@@UBEPBDXZ
?xml_write@DisObject@@MBEXAAVbstream@@@Z
?IsEqv@Dis@@UBE_NABV1@@Z
?Detach@Dis@@UAEXPAV1@@Z
?Check@Dis@@UBEXXZ
?Reset@Dis@@UAEXXZ
?Copy@Dis@@UAEXPAV1@_N@Z
?Clone@Dis@@UBEPAV1@XZ
?XPrint@Dis@@UBEHPADH@Z
?nameOf@Dis@@UBEPBDXZ
?typeOf@Dis@@UBEPBDXZ
?read@Dis@@MAEXAAVbmemfile@@@Z
?read@Dis@@MAEXAAVbstream@@@Z
?write@Dis@@MBEXAAVbmemfile@@@Z
?write@Dis@@MBEXAAVbstream@@@Z
?size@Dis@@MBEJXZ
?translate@Dis@@MAEXAAVbstream@@@Z
?retranslate@Dis@@MBEXAAVbstream@@@Z
?xml_write@Dis@@MBEXAAVbstream@@@Z
??_7DisMean@@6B@
??_7DisMeanDbl@@6B@
??_7DisMeanInt@@6B@
??_7DisObject@@6B@
??_7DisArray@@6B@
??_7DisSentence@@6B@
??_7DisParam@@6B@
?dstracex@@YAHPBDHH0PBVDis@@@Z
??1DisMeanStr@@UAE@XZ
?SetStr@DisMeanStr@@QAEPAV1@PBD@Z
?GetParentId@Dis@@QBEPAV1@K@Z
?Insert@DisArray@@QAEXJPAVDis@@@Z
?GetUserId@Model@@SAKXZ
?GetName@Model@@SAHKPADHPAVDisIo@@@Z
?GetIdentNew@Model@@SAKABVDis@@@Z
?Delete@Model@@SA_NK@Z
?Transact@Model@@SA_NK@Z
?ProfileGet@Model@@SAPAVDis@@PAV2@HK@Z
??6@YAAAVxerror@@AAV0@ABUxmodel@@@Z
?IsA@DisMeanStr@@UBE?AW4disId@@XZ
?IsA@DisNotion@@UBE?AW4disId@@XZ
?IsType@DisNotion@@UBE?AW4disType@@XZ
?IsA@DisSentence@@UBE?AW4disId@@XZ
?IsType@DisSentence@@UBE?AW4disType@@XZ
?Detach@DisSentence@@UAEXPAVDis@@@Z
?Copy@DisSentence@@UAEXPAVDis@@_N@Z
?XPrint@DisSentence@@UBEHPADH@Z
?nameOf@DisSentence@@UBEPBDXZ
?typeOf@DisSentence@@UBEPBDXZ
?read@DisSentence@@MAEXAAVbstream@@@Z
?write@DisSentence@@MBEXAAVbstream@@@Z
?xml_write@DisSentence@@MBEXAAVbstream@@@Z
?IsEmpty@DisMeanStr@@UBE_NXZ
?SetNum@DisMeanStr@@UAEXN@Z
?GetNum@DisMeanStr@@UBENXZ
?IsEqvMean@DisMeanStr@@UBE_NABVDis@@@Z
?MathMean@DisMeanStr@@UBE?AW4ciType@DisMean@@ABV3@@Z
?ResetMean@DisMeanStr@@UAEXXZ
?Check@DisMeanStr@@UBEXXZ
?Clone@DisMeanStr@@UBEPAVDis@@XZ
?CopyMean@DisMeanStr@@UAEXPAVDis@@_N@Z
?XPrint@DisMeanStr@@UBEHPADH@Z
?nameOf@DisMeanStr@@UBEPBDXZ
?read@DisMeanStr@@MAEXAAVbmemfile@@@Z
?read@DisMeanStr@@MAEXAAVbstream@@@Z
?write@DisMeanStr@@MBEXAAVbmemfile@@@Z
?write@DisMeanStr@@MBEXAAVbstream@@@Z
?translate@DisMeanStr@@MAEXAAVbstream@@@Z
?size@DisMeanStr@@MBEJXZ
?XPrint@DisNotion@@UBEHPADH@Z
?nameOf@DisNotion@@UBEPBDXZ
?typeOf@DisNotion@@UBEPBDXZ
?read@DisNotion@@MAEXAAVbstream@@@Z
?write@DisNotion@@MBEXAAVbstream@@@Z
?xml_write@DisNotion@@MBEXAAVbstream@@@Z
??_7DisMeanStr@@6B@
Ds_NameToStr
?Ds_SortAdd@@YAJPAVDis@@0PBV1@@Z
?StrRpl@DisMeanStr@@QAEPAV1@PBD0_N@Z
?Move@DisArray@@QAE_NJJ@Z
?GetApiName@Model@@SAHKPADHPAVDisIo@@@Z
bstroutl
bstricmp
bini_getstr
bf_exist
bf_mkdirs
?Current@bftime@@SA?AV1@H@Z
?SetTime@DisMeanTime@@QAEXKVbftime@@0@Z
?Clone@DisMeanTime@@UBEPAVDis@@XZ
??1DisMeanTime@@UAE@XZ
?Ds_GetTemplSent@@YAPAVDis@@KPAVDisIo@@@Z
?Merge@Model@@SA_NABVDis@@PBV2@11K@Z
??_7DisMeanTime@@6B@
bstrncpy
bstrncat
??0bstream@@QAE@XZ
??1bstream@@QAE@XZ
?open@bstream@@QAEXPBDH@Z
?close@bstream@@QAEXXZ
?write@bstream@@QAEJPBEJ@Z
?detach@bstream@@QAEPADXZ
??6bstream@@QAEAAV0@W4_const_@@@Z
?SetModifys@Dis@@QAEPAV1@PAV1@@Z
??1DisMeanByte@@UAE@XZ
?GetModelTemp@Model@@SAHPADH@Z
?Run@Model@@SA_NAAVDis@@H@Z
?Ds_GetLocalDef@@YAPAVDis@@PBV1@@Z
?Ds_GetLocalIx@@YAPAVDis@@PBV1@@Z
?IsA@DisMeanByte@@UBE?AW4disId@@XZ
?IsEmpty@DisMeanByte@@UBE_NXZ
?SetNum@DisMeanByte@@UAEXN@Z
?GetNum@DisMeanByte@@UBENXZ
?IsEqvMean@DisMeanByte@@UBE_NABVDis@@@Z
?MathMean@DisMeanByte@@UBE?AW4ciType@DisMean@@ABV3@@Z
?ResetMean@DisMeanByte@@UAEXXZ
?Check@DisMeanByte@@UBEXXZ
?Clone@DisMeanByte@@UBEPAVDis@@XZ
?CopyMean@DisMeanByte@@UAEXPAVDis@@_N@Z
?XPrint@DisMeanByte@@UBEHPADH@Z
?nameOf@DisMeanByte@@UBEPBDXZ
?read@DisMeanByte@@MAEXAAVbmemfile@@@Z
?read@DisMeanByte@@MAEXAAVbstream@@@Z
?write@DisMeanByte@@MBEXAAVbmemfile@@@Z
?write@DisMeanByte@@MBEXAAVbstream@@@Z
?size@DisMeanByte@@MBEJXZ
??_7DisNotion@@6B@
?writehex@bstream@@QAEJPBEJ_N@Z
?put@bstream@@QAEXH@Z
?GetAcc@Dis@@QBEKXZ
?Ds_PrintTime@@YAHPADHPBVDisMeanTime@@@Z
?Ds_PrintDis@@YAHPADHPBVDis@@PAVDisIo@@@Z
bstrtol
bstrnicmp
?Ds_AddDef@@YAKPAVDis@@PBDKH@Z
?Ds_FileRead@@YAJPBDPAVDisMeanByte@@JH@Z
?Ds_StoreFoldLink@@YAXKKK@Z
?GetModelWork@Model@@SAHPADH@Z
?GetNameId@Model@@SAKPBD@Z
??_7DisMeanByte@@6B@
?FindIsa@Dis@@QAEPAV1@HPAV1@@Z
?New@Dis@@SAPAV1@H@Z
?Skip@DisItr@@QAEPAVDis@@XZ
??1DisArray@@UAE@XZ
?Ds_CopyApiName@@YAPAVDis@@PAV1@0H@Z
?Ds_Sort@@YAXPAVDis@@PBV1@@Z
bmemresize
??1bmem@@QAE@XZ
?year@bdate@@QBEJXZ
?Current@bdate@@SA?AV1@XZ
?CurDays@bdate@@SAKXZ
?cmp@bftime@@QBEHABV1@@Z
??4bftime@@QAEABV0@ABV0@@Z
?format@bftime@@QBEHPADHPBD@Z
?GetNamePtr@Dis@@QAEPAV1@XZ
?SetDis@Dis@@QAEXPBD@Z
?SetDis@Dis@@QAEXKKJJ@Z
?FindModify@Dis@@QBEPAV1@KK@Z
?ReplaceName@Dis@@QAEHPBV1@0@Z
?ReplaceName@Dis@@QAEHKK@Z
?dstrace@@YAHPBDHH0PBVDis@@@Z
?Move@DisItr@@QAEXPAVDis@@@Z
?SetMemSize@DisMeanStr@@QAEPADH@Z
?StrAdd@DisMeanStr@@QAEPAV1@PBD@Z
?StrIns@DisMeanStr@@QAEPAV1@HPBD@Z
?StrDel@DisMeanStr@@QAEPAV1@HH@Z
??0DisMeanTime@@QAE@KVbftime@@@Z
?CopyMean@DisParam@@QAEXPBVDis@@@Z
?CopyParams@DisArray@@QAEHPAVDis@@_N@Z
??0DisDefine@@QAA@KJPAVDis@@ZZ
?GetNotion@DisDefine@@QAEPAVDis@@PBV2@@Z
Ds_StrToName
?Ds_GetTemplate@@YAPAVDis@@KPAVDisIo@@@Z
?Ds_Path@@YAPAVDis@@PBV1@PBDPAH@Z
?GetStore@Model@@SAPBVDis@@XZ
?ExecFar@Model@@SAXAAVDis@@PAV2@@Z
?Notify@Model@@SAXPAVDis@@@Z
?NotifyFar@Model@@SAXPBD0PBVDis@@@Z
?IsHier@Model@@SA_NKKK@Z
?IsHier@Model@@SA_NKKPAVDis@@@Z
?Lock@Model@@SA_NABVDis@@K@Z
?Config@Model@@SAPAVDis@@KKK@Z
?IsA@DisMeanTime@@UBE?AW4disId@@XZ
?GetNum@DisMeanTime@@UBENXZ
?SetNum@DisMeanTime@@UAEXN@Z
?IsEmpty@DisMeanTime@@UBE_NXZ
?IsEqvMean@DisMeanTime@@UBE_NABVDis@@@Z
?MathMean@DisMeanTime@@UBE?AW4ciType@DisMean@@ABV3@@Z
?ResetMean@DisMeanTime@@UAEXXZ
?Check@DisMeanTime@@UBEXXZ
?CopyMean@DisMeanTime@@UAEXPAVDis@@_N@Z
?ReadMean@DisMeanTime@@UAEHPBD@Z
?XPrint@DisMeanTime@@UBEHPADH@Z
?nameOf@DisMeanTime@@UBEPBDXZ
?read@DisMeanTime@@MAEXAAVbmemfile@@@Z
?read@DisMeanTime@@MAEXAAVbstream@@@Z
?write@DisMeanTime@@MBEXAAVbmemfile@@@Z
?write@DisMeanTime@@MBEXAAVbstream@@@Z
?size@DisMeanTime@@MBEJXZ
?defFormat@bdate@@2QBDB
?defFormat@bftime@@2QBDB
?MdInfo@Model@@SAPAVDis@@KPBV2@@Z
?GetVerDate@Model@@SAKXZ
?GetVerJavaDate@Model@@SAKXZ
?month@bdate@@QBEJXZ
?monthday@bdate@@QBEJXZ
?GetModifyDefine@Dis@@QAEPAV1@K_N@Z
?SetOut@DisDefine@@QAEPAVDis@@KPAK@Z
Ds_NameToFile
?Ds_GetNameTmpl@@YAHPAVDis@@PADHPBD@Z
?Ds_FileRename@@YA_NPBD0H@Z
?Ds_FileExist@@YA_NPBDH@Z
?GetDefNotion@Model@@SAKK@Z
?GetDefModify@Model@@SAPAVDis@@PBV2@KK_N@Z
?Move@Model@@SAHAAVDis@@0PAV2@K@Z
??1bstr@@QAE@XZ
?Ds_ValueExec@@YAXPAVDis@@0PAVbstr@@@Z
?SetMem@DisMeanStr@@QAEPADPAD@Z
?GetRoot@Dis@@QBEPAV1@XZ
?Add@DisArray@@QAEHPAVDis@@K@Z
?Add@DisArray@@QAEHPAVDis@@@Z
?At@DisArray@@QBEPAVDis@@J@Z
?SetSize@DisArray@@QAEXJ@Z
??1DisObject@@UAE@XZ
??1DisMeanInt@@UAE@XZ
?SetInt@DisMeanInt@@QAEXKJJ@Z
??1DisMeanDbl@@UAE@XZ
?SetDbl@DisMeanDbl@@QAEXKNN@Z
??1DisMean@@UAE@XZ
?Next@DisItr@@QAEPAVDis@@XZ
??6@YAAAVxerror@@AAV0@PBVDis@@@Z
?FindRef@Dis@@QAEPAV1@HPAV1@@Z
?XFindNext@Dis@@QAEPAV1@PBV1@PAV1@P6AH00@Z@Z
?FindNext@Dis@@QAEPAV1@PBV1@PAV1@P6AH00@Z@Z
?FindNext@Dis@@QAEPAV1@KPAV1@@Z
?Exec@Dis@@QAE_NPBD_N@Z
?Exec@Dis@@QAEXPAV1@@Z
?AddModify@Dis@@QAEXPAV1@@Z
?DetachModify@Dis@@QAEPAV1@K@Z
?FindModify@Dis@@QBEPAV1@K@Z
?GetModify@Dis@@QAEPAV1@K_N@Z
??0DisSentence@@QAA@KJPAVDis@@ZZ
?GetParentDef@Dis@@QBEPAVDisDefine@@XZ
?SetName@Dis@@QAEPAV1@PBD@Z
?SetDisAs@Dis@@QAEXABV1@@Z
?GetApiName@Dis@@QAEHPADH@Z
?GetName@Dis@@QAEPBDXZ
??1Dis@@UAE@XZ
??0Dis@@QAE@KKJJ@Z
??0Dis@@QAE@ABV0@@Z
bsnprintf
btraceoutf
balloc_delete
balloc_new
??1DisNotion@@UAE@XZ
btraceout

vcruntime140

__CxxFrameHandler3
__std_terminate
strchr
strrchr
memcpy
__std_type_info_destroy_list
__current_exception
__current_exception_context
_except_handler4_common
memset

api-ms-win-crt-runtime-l1-1-0

_seh_filter_dll
_initterm_e
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
_cexit
_initterm
terminate

kernel32

GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetModuleHandleW

Exports

Exports

dp_admin
dp_autor
dp_calc
dp_cmdquerynew
dp_cmdquerys
dp_cmdreports
dp_count
dp_defix
dp_docfile
dp_finder
dp_folder
dp_getage
dp_getlast
dp_getlinks
dp_getstruct
dp_loaddef
dp_loadstruct
dp_sortexec
dp_sorttemplate
dp_sorttimea
dp_sorttimez
dp_store
dp_storepath
dp_task
dp_trace
dp_tskchk
dp_tskend
dp_tskfin
dp_tskgrid
dp_tskmsg
dp_tskref
dp_upgrade
dp_value
dp_version
dp_view
fix_query
upd_depin
upd_docfile
upd_doclink
upd_docname
upd_hrin
upd_meanout
upd_name
upd_prsout
upd_sotrout
upd_store

Sections

.text
Size: 153KB - Virtual size: 153KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5b8fa4d5a51ba0c483340451eeecd68b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

bravo

vcruntime140

api-ms-win-crt-runtime-l1-1-0

kernel32

Exports

Exports

Sections

.text Size: 153KB - Virtual size: 153KB

.rdata Size: 35KB - Virtual size: 35KB

.data Size: 1024B - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 19KB - Virtual size: 18KB

.text
Size: 153KB - Virtual size: 153KB

.rdata
Size: 35KB - Virtual size: 35KB

.data
Size: 1024B - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 19KB - Virtual size: 18KB