661d74a71a827593be28cd7787d5f9f0_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

661d74a71a827593be28cd7787d5f9f0_NeikiAnalytics.exe
Size

2.3MB
MD5

661d74a71a827593be28cd7787d5f9f0
SHA1

923aac0dfaf5f5e4bc1a3cd4559bddc43cb1ddcd
SHA256

37841250f4f63281483487ac77c8f66d6705fd4daf85c3e4fe8ef862b8a1b109
SHA512

040d622a5a837b849b4ff496b4e948fcba7f5fe0c37d2db0a8634ed8d0924431de50cd36578b43a630b9328b182a88c27b28a4e8687a0995535a25429f3ffb16
SSDEEP

49152:kxCWunLCLSyCRbYOs3f4WPx0Nd3gTXhMJ:kUWuLESyClHd8E

Score

1^/10

Malware Config

Signatures

Files

661d74a71a827593be28cd7787d5f9f0_NeikiAnalytics.exe
.exe regsvr32 windows:4 windows x86 arch:x86

fcc07789cd1b73fd35739bf1b78d0393

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:ee:f5:b2:97:d0:5b:3a:cd:7c:c3:cc:c1:fd:f6:61
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

22/08/2008, 00:00

Not After

25/09/2009, 23:59

Subject

CN=Acronis\, Inc,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Headquarter,O=Acronis\, Inc,L=South San Francisco,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

d6:1a:b7:a7:0f:b4:15:e0:78:a5:c8:d7:35:29:ff:9f:04:a2:48:b8
Signer

Actual PE Digest

d6:1a:b7:a7:0f:b4:15:e0:78:a5:c8:d7:35:29:ff:9f:04:a2:48:b8

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\bs_hudson\workspace\cdp_driver_rc\3517\exe\vs\release\afcdpsrv.pdb

Imports

setupapi

SetupDiGetClassDevsA
SetupDiEnumDeviceInfo
SetupDiGetDeviceInstanceIdA

advapi32

CryptReleaseContext
CryptDestroyKey
ImpersonateLoggedOnUser
RegCloseKey
RegFlushKey
RegCreateKeyExA
RevertToSelf
SetServiceStatus
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
CloseServiceHandle
OpenServiceA
OpenSCManagerA
RegOpenKeyExW
RegCreateKeyExW
RegEnumKeyExW
RegEnumValueW
RegDeleteKeyW
RegSetValueExW
RegQueryValueExW
RegDeleteValueW
GetUserNameW
RegOpenKeyExA
RegEnumKeyExA
RegEnumValueA
RegDeleteKeyA
RegSetValueExA
RegQueryValueExA
RegDeleteValueA
GetUserNameA
QueryServiceConfigW
QueryServiceStatus
OpenServiceW
StartServiceA
OpenProcessToken
OpenThreadToken
GetSidSubAuthority
GetSidSubAuthorityCount
GetSidIdentifierAuthority
IsValidSid
AdjustTokenPrivileges
LookupPrivilegeValueA
SetThreadToken
SetFileSecurityW
GetSecurityDescriptorOwner
GetFileSecurityW
CreateProcessAsUserW
DuplicateTokenEx
CryptDecrypt
CryptSetKeyParam
CryptImportKey
CryptAcquireContextA
CryptGetUserKey

kernel32

GlobalMemoryStatus
GetModuleFileNameW
FreeLibrary
GetProcAddress
LoadLibraryA
SetUnhandledExceptionFilter
GetModuleHandleA
TerminateProcess
CloseHandle
CreateProcessW
FindNextFileW
FindFirstFileW
GetCurrentDirectoryW
SetCurrentDirectoryW
CreateFileW
GetTempFileNameW
GetLogicalDriveStringsW
GetDriveTypeW
GetSystemDirectoryW
GetShortPathNameW
CreateDirectoryW
RemoveDirectoryW
GetFileAttributesW
SetFileAttributesW
DeleteFileW
CopyFileW
MoveFileW
MoveFileExW
GetFullPathNameW
OutputDebugStringW
ExpandEnvironmentStringsW
LoadLibraryW
LoadLibraryExW
GetStartupInfoW
GetComputerNameW
SetComputerNameW
GetLocaleInfoW
GetTimeFormatW
GetDateFormatW
GetNumberFormatW
WriteConsoleW
GetEnvironmentVariableW
SetEnvironmentVariableW
WriteConsoleA
WideCharToMultiByte
GetConsoleOutputCP
FindNextFileA
FindFirstFileA
GetCurrentDirectoryA
SetCurrentDirectoryA
CreateFileA
LocalAlloc
GetTempPathA
GetSystemInfo
GetLogicalDriveStringsA
GetDriveTypeA
GetSystemDirectoryA
GetWindowsDirectoryA
GetShortPathNameA
CreateDirectoryA
RemoveDirectoryA
GetFileAttributesA
SetFileAttributesA
DeleteFileA
CopyFileA
MoveFileA
GetFullPathNameA
OutputDebugStringA
ExpandEnvironmentStringsA
LoadLibraryExA
CreateProcessA
GetStartupInfoA
GetModuleFileNameA
GetComputerNameA
SetComputerNameA
GetLocaleInfoA
GetTimeFormatA
GetDateFormatA
GetNumberFormatA
GetEnvironmentVariableA
SetEnvironmentVariableA
lstrcmpiW
Sleep
GetCurrentThread
SetLastError
WaitForSingleObject
CreateEventA
WaitForSingleObjectEx
SetEvent
ResetEvent
CreateMutexA
ReleaseMutex
CreateSemaphoreA
ReleaseSemaphore
WaitForMultipleObjects
InterlockedIncrement
InterlockedDecrement
SetThreadPriority
InterlockedCompareExchange
VirtualAlloc
SetProcessWorkingSetSize
GetProcessWorkingSetSize
VirtualFree
GetOverlappedResult
DeviceIoControl
GetVersionExA
FindClose
GetLogicalDrives
SetFileApisToANSI
SetErrorMode
GetSystemTimeAsFileTime
GetTimeZoneInformation
FindCloseChangeNotification
FindNextChangeNotification
ReadFile
WriteFile
FlushFileBuffers
SetFilePointer
SetEndOfFile
LockFileEx
UnlockFileEx
SetFileTime
EnumResourceLanguagesW
LockResource
GetVersion
FindResourceExW
ExitThread
GetSystemDefaultLangID
EnumResourceNamesW
TlsAlloc
TlsFree
TlsGetValue
CompareStringW
GetCompressedFileSizeW
FindFirstChangeNotificationW
GetDiskFreeSpaceW
GetVolumeInformationW
GetFileInformationByHandle
GetDiskFreeSpaceA
CompareStringA
FindFirstChangeNotificationA
GetVolumeInformationA
WritePrivateProfileStringA
BackupWrite
BackupRead
BackupSeek
GetFileTime
FileTimeToSystemTime
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
GetSystemTime
CompareFileTime
GetExitCodeProcess
GetThreadPriority
FormatMessageA
MultiByteToWideChar
FormatMessageW
LocalFree
QueryDosDeviceA
GetTickCount
GetCurrentThreadId
InterlockedExchange
QueryPerformanceCounter
GetCurrentProcessId
UnhandledExceptionFilter
IsDebuggerPresent
RaiseException
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
GetWindowsDirectoryW
GetLastError
GetTempPathW
GetCurrentProcess
SetPriorityClass
GetTempFileNameA
LeaveCriticalSection
TerminateThread
LCMapStringW
LCMapStringA
FindVolumeClose
FindNextVolumeW
GetVolumePathNamesForVolumeNameW
FindFirstVolumeW
LoadResource

user32

CreateDialogIndirectParamW
PeekMessageW
DispatchMessageW
RegisterClipboardFormatW
PostMessageW
AppendMenuW
ModifyMenuW
SetWindowTextW
SystemParametersInfoW
VkKeyScanW
SendNotifyMessageW
SendMessageW
SetWindowLongW
GetWindowLongW
DefWindowProcW
RegisterClassExW
RegisterDeviceNotificationA
UnregisterDeviceNotification
GetClipboardFormatNameW
VkKeyScanA
CharUpperBuffA
CharUpperBuffW
CreateWindowExA
GetMessageA
wsprintfW
VkKeyScanExA
TranslateMessage
WinHelpA
GetClipboardFormatNameA
SystemParametersInfoA
VkKeyScanExW
WinHelpW
SetWindowTextA
ModifyMenuA
AppendMenuA
RegisterClipboardFormatA
RegisterClassExA
DispatchMessageA
PeekMessageA
CreateDialogIndirectParamA
PostMessageA
SendNotifyMessageA
SendMessageA
SetWindowLongA
GetWindowLongA
DefWindowProcA

gdi32

EnumFontFamiliesExW
GetTextMetricsW
GetTextMetricsA
CreateFontIndirectA
EnumFontFamiliesExA
CreateFontIndirectW

shell32

ShellExecuteW
SHGetFileInfoA
Shell_NotifyIconA
SHGetPathFromIDListA
ShellExecuteA
ShellExecuteExA
SHGetDesktopFolder
SHGetMalloc
ShellExecuteExW

comdlg32

GetOpenFileNameA
GetSaveFileNameW
GetOpenFileNameW
GetSaveFileNameA

mpr

WNetAddConnection3A
WNetOpenEnumW
WNetEnumResourceW
WNetCancelConnection2W
WNetCloseEnum
WNetGetUniversalNameA
WNetAddConnection3W
WNetGetUniversalNameW

ole32

OleUninitialize
CoInitialize
OleInitialize
CoCreateInstance
StringFromGUID2
CoUninitialize
CoInitializeSecurity
CoInitializeEx

oleaut32

SysAllocString
VariantClear
SafeArrayUnaccessData
SafeArrayAccessData
VariantChangeType
VariantInit

rpcrt4

RpcServerListen
RpcServerRegisterIf
RpcServerUseProtseqEpA
RpcServerUnregisterIf
RpcMgmtStopServerListening
NdrServerCall2
NdrClientCall2

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

fltlib

FilterLoad

msvcp80

?end@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?_Tidy@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@IAEX_NI@Z
?reserve@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
?begin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@I_W@Z
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@ABV12@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ID@Z
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@I_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@_W@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD0@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W0@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@ABV12@@Z
?find_first_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?compare@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEHIIABV12@II@Z
?rbegin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$reverse_iterator@V?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@XZ
?compare@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEHABV12@@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NPB_WABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@@Z
?find_first_not_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?deallocate@?$allocator@D@std@@QAEXPADI@Z
??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
?push_back@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEX_W@Z
?allocate@?$allocator@D@std@@QAEPADI@Z
?deallocate@?$allocator@_W@std@@QAEXPA_WI@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@_W@Z
?allocate@?$allocator@_W@std@@QAEPA_WI@Z
??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NPB_WABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@@Z
?insert@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@II_W@Z
?destroy@?$allocator@D@std@@QAEXPAD@Z
?construct@?$allocator@D@std@@QAEXPADABD@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_WI@Z
??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
?compare@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEHIIABV12@@Z
?begin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?end@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?_Xran@_String_base@std@@SAXXZ
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_WABV10@@Z
?swap@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXAAV12@@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@I_W@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHIIPBDI@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?set_new_handler@std@@YAP6AXXZP6AXXZ@Z
?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IID@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@_W@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?insert@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@IPB_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@II@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_WI@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@0@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W0@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_WI@Z
?resize@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@ABV12@II@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDI@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD0@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
?compare@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEHIIPB_WI@Z
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z
?compare@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEHIIPB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@II@Z

msvcr80

_onexit
_decode_pointer
?terminate@@YAXXZ
_invoke_watson
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
exit
__initenv
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_controlfp_s
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_encode_pointer
__set_app_type
strtoul
_except_handler4_common
_unlock
__dllonexit
toupper
__CxxFrameHandler3
_purecall
??3@YAXPAX@Z
??2@YAPAXI@Z
??_V@YAXPAX@Z
memset
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
memcpy
vsprintf_s
sprintf_s
fclose
fputws
fprintf
_wfopen
_snwprintf
memmove
memchr
sprintf
sscanf
malloc
free
abort
_time64
srand
rand
wcschr
_wcsicmp
swscanf
_vsnprintf
_beginthreadex
strncpy
wcsncmp
_localtime64
_wcsnicmp
memmove_s
tolower
__RTDynamicCast
_mktime64
_lock

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 324KB - Virtual size: 323KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 56KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 132KB - Virtual size: 129KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fcc07789cd1b73fd35739bf1b78d0393

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

38:ee:f5:b2:97:d0:5b:3a:cd:7c:c3:cc:c1:fd:f6:61Certificate

Extended Key Usages

Key Usages

d6:1a:b7:a7:0f:b4:15:e0:78:a5:c8:d7:35:29:ff:9f:04:a2:48:b8Signer

Headers

File Characteristics

PDB Paths

Imports

setupapi

advapi32

kernel32

user32

gdi32

shell32

comdlg32

mpr

ole32

oleaut32

rpcrt4

version

fltlib

msvcp80

msvcr80

userenv

Exports

Exports

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.rdata Size: 324KB - Virtual size: 323KB

.data Size: 56KB - Virtual size: 60KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 132KB - Virtual size: 129KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

38:ee:f5:b2:97:d0:5b:3a:cd:7c:c3:cc:c1:fd:f6:61
Certificate

d6:1a:b7:a7:0f:b4:15:e0:78:a5:c8:d7:35:29:ff:9f:04:a2:48:b8
Signer

.text
Size: 1.7MB - Virtual size: 1.7MB

.rdata
Size: 324KB - Virtual size: 323KB

.data
Size: 56KB - Virtual size: 60KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 132KB - Virtual size: 129KB