8c4bf443ea3ebeb90407cad395d89f00_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

8c4bf443ea3ebeb90407cad395d89f00_NeikiAnalytics.exe
Size

2.5MB
MD5

8c4bf443ea3ebeb90407cad395d89f00
SHA1

703bdf9b3bdbc737433789d7d4aecd12a5dd1167
SHA256

b1af22c17d92efb36b00b0d806fe46cf392180818b8e17f4fea5dce7251197e9
SHA512

bb8026f787c2785ba9f9073832d20d9d3ab08461d730fd77b070edecdc41374c918b76df1c6cceb6d8163b880034f7f8e8fe8340c72b0dc80d18190adcf43f81
SSDEEP

49152:be7hl+B7DcUTfGtpdhW5C7WpVEEVaSFD8Mr+:4h0UULYhW5C7CqEVuMa

Score

1^/10

Malware Config

Signatures

Files

8c4bf443ea3ebeb90407cad395d89f00_NeikiAnalytics.exe
.dll windows:10 windows x86 arch:x86

21bd2a113243324623e03f467b10324f

Code Sign

33:00:00:06:ad:ac:dd:3c:98:83:5e:29:49:00:00:00:00:06:ad
Certificate

Issuer

CN=Microsoft Development PCA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

13/07/2023, 22:37

Not After

15/09/2024, 22:37

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:03:c6:f9:b4:c3:ae:be:59:4b:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Development Root Certificate Authority 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

28/05/2014, 17:33

Not After

28/05/2029, 17:43

Subject

CN=Microsoft Development PCA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:ea:3c:56:dd:14:16:9c:84:0d:b3:52:9c:5f:cb:06:df:76:68:f0:95:54:46:10:9e:e1:99:60:de:b6:87:68
Signer

Actual PE Digest

04:ea:3c:56:dd:14:16:9c:84:0d:b3:52:9c:5f:cb:06:df:76:68:f0:95:54:46:10:9e:e1:99:60:de:b6:87:68

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

combase.pdb

Imports

api-ms-win-crt-string-l1-1-0

memset
strnlen
wcsncmp
wcsnlen

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e

api-ms-win-crt-private-l1-1-0

_o__purecall
_o__register_onexit_function
_o__resetstkoflw
_o__seh_filter_dll
_o__stricmp
_o__strnicmp
_o__ui64tow_s
_o__wcsicmp
_o__wcslwr
_o__wcsnicmp
_o__wcstoui64
_o__wtoi
_o__wtol
memmove
_o_free
_o_malloc
_o_qsort
_o_rand_s
_o_wcsncpy_s
_o_wcstok
_o_wcstoul
_o_wmemcpy_s
wcsstr
wcsrchr
__CxxFrameHandler3
__std_terminate
_except_handler4_common
_o__itow_s
_o__itoa_s
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__initialize_narrow_environment
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_CxxThrowException
_local_unwind4
memcmp
memcpy

rpcrt4

RpcErrorEndEnumeration
RpcBindingInqObject
RpcRaiseException
I_RpcFreeBuffer
RpcAsyncInitializeHandle
RpcAsyncGetCallStatus
RpcServerTestCancel
RpcAsyncCancelCall
RpcServerSubscribeForNotification
RpcServerUnsubscribeForNotification
RpcMgmtSetCancelTimeout
RpcCancelThreadEx
I_RpcGetBufferWithObject
I_RpcGetBuffer
I_RpcSendReceive
I_RpcAsyncSetHandle
I_RpcSend
I_RpcReceive
I_RpcAsyncAbortCall
RpcStringBindingParseW
RpcServerInqBindingHandle
RpcBindingToStringBindingW
RpcServerInqCallAttributesW
RpcBindingInqAuthInfoExW
RpcStringFreeW
RpcBindingSetAuthInfoExW
RpcRevertToSelfEx
RpcImpersonateClient
I_RpcBindingInqCurrentModifiedId
I_RpcSetDCOMAppId
RpcBindingInqAuthClientW
I_RpcOpenClientProcess
RpcCertGeneratePrincipalNameW
RpcServerRegisterAuthInfoW
RpcImpersonateClient2
RpcServerRegisterIf3
RpcServerUnregisterIf
I_RpcExceptionFilter
UuidFromStringW
RpcServerUseProtseqEpW
RpcServerInqBindings
RpcBindingVectorFree
RpcServerUseProtseqExW
RpcServerUseProtseqEpExW
RpcServerUseProtseqW
RpcAsyncCompleteCall
I_RpcSystemHandleTypeSpecificWork
I_RpcMgmtEnableDedicatedThreadPool
I_RpcServerGetAssociationID
I_RpcServerSubscribeForDisconnectNotification2
I_RpcServerUnsubscribeForDisconnectNotification
RpcBindingFromStringBindingW
RpcErrorStartEnumeration
RpcMgmtSetComTimeout
RpcMgmtInqComTimeout
MesEncodeFixedBufferHandleCreate
MesHandleFree
I_RpcSetSystemHandle
MesBufferHandleReset
NdrMesTypeEncode2
NdrMesTypeDecode2
NdrMesTypeFree2
NdrMesTypeAlignSize2
NdrGetUserMarshalInfo
NdrDllGetClassObject
NdrOleFree
NdrClientCall4
NdrOleAllocate
NdrDcomAsyncClientCall2
RpcBindingServerFromClient
NdrStubCall2
NdrStubCall
NdrServerInitialize
I_RpcRequestMutex
I_RpcFree
I_RpcAllocate
I_RpcClearMutex
NdrClientInitializeNew
I_RpcBCacheAllocate
NdrGetTypeFlags
SimpleTypeAlignment
NdrClearOutParameters
NdrFullPointerXlatFree
NdrFullPointerXlatInit
NdrCorrelationFree
NdrCorrelationInitialize
SimpleTypeMemorySize
I_RpcBCacheFree
SimpleTypeBufferSize
NdrConvert2
NdrClientCall2
NdrClientCall
NdrAsyncServerCall
NdrServerCall2
RpcExceptionFilter
MesDecodeIncrementalHandleCreate
MesEncodeIncrementalHandleCreate
I_RpcGetSystemHandle
RpcBindingBind
RpcBindingCreateW
I_RpcFreeSystemHandleCollection
I_RpcFreeSystemHandle
RpcErrorGetNextRecord
I_RpcBindingInqLocalClientPID
I_RpcBindingInqTransportType
I_RpcMgmtQueryDedicatedThreadPool
I_RpcBindingSetPrivateOption
RpcBindingFree
RpcBindingSetOption
RpcBindingUnbind
RpcBindingCopy
RpcSmDestroyClientContext
UuidCreate
RpcErrorAddRecord
MesDecodeBufferHandleCreate
ord1000

ntdll

RtlGetDeviceFamilyInfoEnum
RtlUpcaseUnicodeChar
RtlCopySid
RtlLengthSid
NtQueryInformationToken
RtlWow64IsWowGuestMachineSupported
RtlWow64GetEquivalentMachineCHPE
RtlImageNtHeaderEx
RtlSetThreadSubProcessTag
RtlDelete
RtlApplicationVerifierStop
RtlRealSuccessor
RtlCheckForOrphanedCriticalSections
NtQueryInformationThread
NtSetInformationObject
NtQueryObject
RtlInitializeCriticalSection
NtQueryInformationProcess
NtQueryVolumeInformationFile
RtlCaptureStackBackTrace
EtwEventWrite
EtwEventActivityIdControl
RtlInitUnicodeStringEx
RtlGetAppContainerNamedObjectPath
RtlAllocateHeap
NtQueryTimerResolution
NtTerminateProcess
RtlReportException
RtlCompareMemory
RtlIsMultiSessionSku
EvtIntReportEventAndSourceAsync
RtlClearThreadWorkOnBehalfTicket
RtlSetThreadWorkOnBehalfTicket
NtQuerySystemInformation
RtlQueryPackageClaims
DbgPrint
RtlCheckTokenCapability
RtlInitializeSidEx
RtlImageNtHeader
WinSqmSetDWORD
RtlIsCriticalSectionLockedByThread
EtwEventRegister
EtwEventUnregister
EtwEventWriteTransfer
EtwEventSetInformation
LdrStandardizeSystemPath
RtlDllShutdownInProgress
RtlPcToFileHeader
RtlImageDirectoryEntryToData
NtQueryValueKey
NtOpenKey
RtlEqualUnicodeString
RtlNtStatusToDosError
NtCreateKey
NtLoadKeyEx
RtlNtStatusToDosErrorNoTeb
RtlAdjustPrivilege
NtUnloadKey2
RtlInitUnicodeString
RtlDosPathNameToRelativeNtPathName_U_WithStatus
RtlFreeUnicodeString
RtlAppendUnicodeToString
NtDeleteKey
RtlLoadString
RtlUnsubscribeWnfStateChangeNotification
RtlSubscribeWnfStateChangeNotification
NtQueryWnfStateData
EtwTraceMessage
RtlGetAppContainerSidType
RtlSidDominates
EtwRegisterTraceGuidsW
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwGetTraceEnableFlags
EtwUnregisterTraceGuids
RtlWakeAllConditionVariable
RtlInitializeConditionVariable
RtlSleepConditionVariableCS
RtlDeleteCriticalSection
NtQueryKey
RtlRealPredecessor
RtlDeleteNoSplay
RtlCaptureContext
NtQuerySecurityAttributesToken
NtApphelpCacheControl
RtlIsStateSeparationEnabled
RtlValidRelativeSecurityDescriptor
RtlSplay
RtlFreeHeap
RtlQueryPackageIdentity
wcschr
RtlInitializeCriticalSectionAndSpinCount

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
OutputDebugStringA
IsDebuggerPresent

api-ms-win-core-errorhandling-l1-1-0

RaiseException
GetLastError
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-errorhandling-l1-1-2

RaiseFailFastException

api-ms-win-core-fibers-l1-1-0

FlsFree
FlsAlloc
FlsSetValue

api-ms-win-core-fibers-l1-1-1

IsThreadAFiber

api-ms-win-core-file-l1-1-0

RemoveDirectoryW
FindNextFileW
SetFileInformationByHandle
FindFirstFileW
FindClose
GetFinalPathNameByHandleW
SetFileAttributesW
CreateDirectoryW
GetFileSizeEx
GetFileType
GetFileAttributesExW
DeleteFileW
GetFileAttributesW
CreateFileW

api-ms-win-core-handle-l1-1-0

SetHandleInformation
CloseHandle
DuplicateHandle

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc
HeapReAlloc
HeapCompact
HeapCreate
HeapDestroy
HeapValidate
HeapSize

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree
GlobalAlloc
GlobalFree

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
GetModuleFileNameA
GetModuleHandleExA
GetModuleHandleW
FreeLibrary
GetModuleFileNameW
LoadLibraryExA
LoadLibraryExW
GetModuleHandleA
GetProcAddress
FreeLibraryAndExitThread

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-memory-l1-1-0

VirtualFree
VirtualAlloc
VirtualQuery
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
OpenFileMappingW
VirtualProtect

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentStringsW
FreeEnvironmentStringsW
ExpandEnvironmentStringsW
SearchPathW
GetCommandLineW

api-ms-win-core-processthreads-l1-1-0

OpenThreadToken
SetThreadStackGuarantee
OpenProcessToken
GetCurrentThread
GetCurrentThreadId
SetThreadToken
GetCurrentProcess
TerminateProcess
CreateThread
GetThreadPriority
ProcessIdToSessionId
GetProcessId
SwitchToThread
GetCurrentProcessId

api-ms-win-core-processthreads-l1-1-1

GetProcessHandleCount
OpenProcess
IsProcessorFeaturePresent
GetProcessMitigationPolicy

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-realtime-l1-1-0

QueryUnbiasedInterruptTime

api-ms-win-core-registry-l1-1-0

RegDeleteKeyExW
RegNotifyChangeKeyValue
RegLoadMUIStringW
RegOpenUserClassesRoot
RegOpenKeyExA
RegQueryInfoKeyW
RegCreateKeyExW
RegSetValueExW
RegOpenCurrentUser
RegGetValueW
RegEnumValueW
RegDeleteTreeW
RegSetValueExA
RegDeleteKeyExA
RegCreateKeyExA
RegGetValueA
RegEnumKeyExW
RegQueryValueExA
RegOpenKeyExW
RegSaveKeyExW
RegSetKeySecurity
RegCloseKey
RegLoadAppKeyW
RegQueryValueExW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar
CompareStringW
CompareStringOrdinal

api-ms-win-core-synch-l1-1-0

InitializeCriticalSection
TryAcquireSRWLockExclusive
ReleaseSemaphore
WaitForSingleObject
ReleaseMutex
WaitForSingleObjectEx
OpenSemaphoreW
CreateSemaphoreExW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
CreateMutexExW
AcquireSRWLockShared
DeleteCriticalSection
InitializeSRWLock
ReleaseSRWLockShared
CreateEventExW
SetWaitableTimerEx
OpenEventW
CreateEventW
SetEvent
ResetEvent
OpenEventA
CreateWaitableTimerExW
InitializeCriticalSectionAndSpinCount
WaitForMultipleObjectsEx
SleepEx

api-ms-win-core-synch-l1-2-0

InitOnceComplete
Sleep
InitOnceExecuteOnce
InitOnceBeginInitialize
WakeByAddressAll
WakeByAddressSingle
WaitOnAddress

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-sysinfo-l1-1-0

GetComputerNameExW
GetSystemWindowsDirectoryW
GetSystemDirectoryW
GetSystemTime
GetSystemTimeAsFileTime
GetTickCount64
GetTickCount
GetSystemInfo

api-ms-win-core-sysinfo-l1-2-0

GetNativeSystemInfo

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolWork
WaitForThreadpoolWorkCallbacks
SubmitThreadpoolWork
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
SetEventWhenCallbackReturns
CreateThreadpoolTimer
CreateThreadpoolWork
CloseThreadpoolWait
WaitForThreadpoolWaitCallbacks
SetThreadpoolWait
SetThreadpoolTimer
CreateThreadpoolWait

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-wow64-l1-1-1

GetSystemWow64Directory2W
Wow64SetThreadDefaultGuestMachine

api-ms-win-security-base-l1-1-0

SetSecurityDescriptorDacl
GetLengthSid
CopySid
GetSecurityDescriptorLength
GetSecurityDescriptorDacl
AccessCheckByType
ImpersonateAnonymousToken
MakeSelfRelativeSD
GetSecurityDescriptorControl
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
DuplicateToken
GetSidSubAuthorityCount
EqualSid
RevertToSelf
GetSecurityDescriptorSacl
GetSidLengthRequired
InitializeSid
AddAccessAllowedAce
ImpersonateLoggedOnUser
CheckTokenMembership
IsValidSid
AccessCheck
GetAce
MapGenericMask
GetKernelObjectSecurity
PrivilegeCheck
SetSecurityDescriptorOwner
GetSecurityDescriptorRMControl
GetSidSubAuthority
CreateWellKnownSid
ImpersonateSelf
IsValidSecurityDescriptor
InitializeSecurityDescriptor
InitializeAcl
SetSecurityDescriptorRMControl
SetSecurityDescriptorSacl
AddAce
SetSecurityDescriptorGroup
GetTokenInformation

api-ms-win-security-base-l1-2-0

GetAppContainerAce

api-ms-win-eventing-provider-l1-1-0

EventWriteEx
EventWriteTransfer
EventRegister
EventSetInformation
EventUnregister
EventActivityIdControl

api-ms-win-core-heap-obsolete-l1-1-0

GlobalReAlloc
GlobalLock
GlobalSize
GlobalUnlock

api-ms-win-core-privateprofile-l1-1-0

GetProfileStringW

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFindFileNameW
PathFindFileNameA

api-ms-win-core-sidebyside-l1-1-0

FindActCtxSectionStringW
GetCurrentActCtx
DeactivateActCtx
CreateActCtxW
ReleaseActCtx
AddRefActCtx
FindActCtxSectionGuid
ActivateActCtx

api-ms-win-core-windowserrorreporting-l1-1-0

WerRegisterMemoryBlock
WerUnregisterMemoryBlock

api-ms-win-core-quirks-l1-1-0

QuirkIsEnabled
QuirkIsEnabledForProcess

kernelbase

ParseApplicationUserModelId
VerifyPackageFullName
OpenPackageInfoByFullNameForUser
GetStagedPackagePathByFullName2
OpenPackageInfoByFullNameForMachine
FindPackagesByPackageFamily
IsDeveloperModeEnabled
GetCurrentPackageInfo3
GetApplicationUserModelId
GetCurrentApplicationUserModelId
GetCurrentPackageFamilyName
GetSystemMetadataPathForPackage

api-ms-win-core-path-l1-1-0

PathCchRemoveFileSpec

api-ms-win-core-processsnapshot-l1-1-0

PssCaptureSnapshot
PssFreeSnapshot
PssDuplicateSnapshot
PssQuerySnapshot

api-ms-win-core-string-l2-1-0

CharPrevW

api-ms-win-core-psapi-l1-1-0

K32GetModuleFileNameExW

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-wow64-l1-1-0

IsWow64Process

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

CLIPFORMAT_UserFree
CLIPFORMAT_UserMarshal
CLIPFORMAT_UserSize
CLIPFORMAT_UserUnmarshal
CLSIDFromOle1Class
CLSIDFromProgID
CLSIDFromProgIDEx
CLSIDFromString
CStdAsyncStubBuffer2_Connect
CStdAsyncStubBuffer2_Disconnect
CStdAsyncStubBuffer2_Release
CStdAsyncStubBuffer_AddRef
CStdAsyncStubBuffer_Connect
CStdAsyncStubBuffer_Disconnect
CStdAsyncStubBuffer_Invoke
CStdAsyncStubBuffer_QueryInterface
CStdAsyncStubBuffer_Release
CStdStubBuffer2_Connect
CStdStubBuffer2_CountRefs
CStdStubBuffer2_Disconnect
CStdStubBuffer2_QueryInterface
CStdStubBuffer_AddRef
CStdStubBuffer_Connect
CStdStubBuffer_CountRefs
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
CStdStubBuffer_Invoke
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_QueryInterface
CleanupComl2StateInAllTls
CleanupOleStateInAllTls
CleanupTlsComl2State
CleanupTlsOleState
ClearCleanupFlag
CoAddRefServerProcess
CoAllowUnmarshalerCLSID
CoCancelCall
CoCopyProxy
CoCreateErrorInfo
CoCreateFreeThreadedMarshaler
CoCreateGuid
CoCreateInstance
CoCreateInstanceEx
CoCreateInstanceFromApp
CoCreateObjectInContext
CoDeactivateObject
CoDecodeProxy
CoDecrementMTAUsage
CoDisableCallCancellation
CoDisconnectContext
CoDisconnectObject
CoEnableCallCancellation
CoFileTimeNow
CoFreeUnusedLibraries
CoFreeUnusedLibrariesEx
CoGetActivationState
CoGetApartmentID
CoGetApartmentType
CoGetCallContext
CoGetCallState
CoGetCallerTID
CoGetCancelObject
CoGetClassObject
CoGetClassVersion
CoGetContextToken
CoGetCurrentLogicalThreadId
CoGetCurrentProcess
CoGetDefaultContext
CoGetErrorInfo
CoGetInstanceFromFile
CoGetInstanceFromIStorage
CoGetInterfaceAndReleaseStream
CoGetMalloc
CoGetMarshalSizeMax
CoGetModuleArchitecture
CoGetModuleType
CoGetObjectContext
CoGetPSClsid
CoGetProcessIdentifier
CoGetStandardMarshal
CoGetStdMarshalEx
CoGetSystemSecurityPermissions
CoGetTreatAsClass
CoImpersonateClient
CoIncrementMTAUsage
CoInitializeEx
CoInitializeSecurity
CoInitializeWOW
CoInvalidateRemoteMachineBindings
CoIsHandlerConnected
CoIsOle1Class
CoLockObjectExternal
CoMarshalHresult
CoMarshalInterThreadInterfaceInStream
CoMarshalInterface
CoPopServiceDomain
CoPushServiceDomain
CoQueryAuthenticationServices
CoQueryClientBlanket
CoQueryProxyBlanket
CoReactivateObject
CoRegisterActivationFilter
CoRegisterClassObject
CoRegisterConsoleHandles
CoRegisterDeviceCatalog
CoRegisterInitializeSpy
CoRegisterMallocSpy
CoRegisterMessageFilter
CoRegisterPSClsid
CoRegisterRacActivationToken
CoRegisterSurrogate
CoRegisterSurrogateEx
CoReleaseMarshalData
CoReleaseServerProcess
CoResumeClassObjects
CoRetireServer
CoRevertToSelf
CoRevokeClassObject
CoRevokeConsoleHandles
CoRevokeDeviceCatalog
CoRevokeInitializeSpy
CoRevokeMallocSpy
CoRevokeRacActivationToken
CoSetCancelObject
CoSetErrorInfo
CoSetProxyBlanket
CoSuspendClassObjects
CoSwitchCallContext
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
CoTestCancel
CoTreatAsClass
CoUninitialize
CoUnloadingWOW
CoUnmarshalHresult
CoUnmarshalInterface
CoVrfCheckThreadState
CoVrfGetThreadState
CoVrfReleaseThreadState
CoWaitForMultipleHandles
CoWaitForMultipleObjects
CreateErrorInfo
CreateStreamOnHGlobal
DcomChannelSetHResult
DllDebugObjectRPCHook
DllGetActivationFactory
DllGetClassObject
EnableHookObject
FreePropVariantArray
FreePropVariantArrayWorker
GetCatalogHelper
GetErrorInfo
GetFuncDescs
GetHGlobalFromStream
GetHookInterface
GetRestrictedErrorInfo
HACCEL_UserFree
HACCEL_UserMarshal
HACCEL_UserSize
HACCEL_UserUnmarshal
HBITMAP_UserFree
HBITMAP_UserMarshal
HBITMAP_UserSize
HBITMAP_UserUnmarshal
HBRUSH_UserFree
HBRUSH_UserMarshal
HBRUSH_UserSize
HBRUSH_UserUnmarshal
HDC_UserFree
HDC_UserMarshal
HDC_UserSize
HDC_UserUnmarshal
HGLOBAL_UserFree
HGLOBAL_UserMarshal
HGLOBAL_UserSize
HGLOBAL_UserUnmarshal
HICON_UserFree
HICON_UserMarshal
HICON_UserSize
HICON_UserUnmarshal
HMENU_UserFree
HMENU_UserMarshal
HMENU_UserSize
HMENU_UserUnmarshal
HMONITOR_UserFree
HMONITOR_UserMarshal
HMONITOR_UserSize
HMONITOR_UserUnmarshal
HPALETTE_UserFree
HPALETTE_UserMarshal
HPALETTE_UserSize
HPALETTE_UserUnmarshal
HRGN_UserFree
HRGN_UserMarshal
HRGN_UserSize
HRGN_UserUnmarshal
HSTRING_UserFree
HSTRING_UserMarshal
HSTRING_UserSize
HSTRING_UserUnmarshal
HWND_UserFree
HWND_UserMarshal
HWND_UserSize
HWND_UserUnmarshal
HkOleRegisterObject
IIDFromString
InternalAppInvokeExceptionFilter
InternalCAggIdRelease
InternalCAggIdSetHandler
InternalCCFreeUnused
InternalCCGetClassInformationForDde
InternalCCGetClassInformationFromKey
InternalCCSetDdeServerWindow
InternalCMLSendReceive
InternalCMLSendReceive2
InternalCStdIdentityGetIProxyManager
InternalCStdIdentityGetInternalUnk
InternalCStdIdentityUpdateFlags
InternalCallAsProxyExceptionFilter
InternalCallFrameExceptionFilter
InternalCallerIsAppContainer
InternalCanMakeOutCall
InternalCanMakeOutCall2
InternalCoIsSurrogateProcess
InternalCoRegisterDisconnectCallback
InternalCoRegisterSurrogatedObject
InternalCoStdMarshalObject
InternalCoUnregisterDisconnectCallback
InternalCompleteObjRef
InternalCreateCAggId
InternalCreateIdentityHandler
InternalDoATClassCreate
InternalFillLocalOXIDInfo
InternalFreeObjRef
InternalGetWindowPropInterface
InternalGetWindowPropInterface2
InternalIrotEnumRunning
InternalIrotEnumRunning2
InternalIrotGetObject
InternalIrotGetObject2
InternalIrotGetObject3
InternalIrotGetTimeOfLastChange
InternalIrotGetTimeOfLastChange2
InternalIrotIsRunning
InternalIrotIsRunning2
InternalIrotNoteChangeTime
InternalIrotRegister
InternalIrotRevoke
InternalIsApartmentInitialized
InternalIsProcessInitialized
InternalMarshalObjRef
InternalNotifyDDStartOrStop
InternalOle1ClassFromCLSID2
InternalOleModalLoopBlockFn
InternalRegOpenClassKey
InternalRegisterWindowPropInterface
InternalRegisterWindowPropInterface2
InternalReleaseMarshalObjRef
InternalRevokeWindowPropInterface
InternalSTAInvoke
InternalServerExceptionFilter
InternalSetAptCallCtrlOnTlsIfRequired
InternalSetOleThunkWowPtr
InternalStubInvoke
InternalTlsAllocData
InternalUnmarshalObjRef
IsErrorPropagationEnabled
NdrCStdStubBuffer2_Release
NdrCStdStubBuffer_Release
NdrExtStubInitialize
NdrOleDllGetClassObject
NdrOleInitializeExtension
NdrProxyForwardingFunction10
NdrProxyForwardingFunction11
NdrProxyForwardingFunction12
NdrProxyForwardingFunction13
NdrProxyForwardingFunction14
NdrProxyForwardingFunction15
NdrProxyForwardingFunction16
NdrProxyForwardingFunction17
NdrProxyForwardingFunction18
NdrProxyForwardingFunction19
NdrProxyForwardingFunction20
NdrProxyForwardingFunction21
NdrProxyForwardingFunction22
NdrProxyForwardingFunction23
NdrProxyForwardingFunction24
NdrProxyForwardingFunction25
NdrProxyForwardingFunction26
NdrProxyForwardingFunction27
NdrProxyForwardingFunction28
NdrProxyForwardingFunction29
NdrProxyForwardingFunction3
NdrProxyForwardingFunction30
NdrProxyForwardingFunction31
NdrProxyForwardingFunction32
NdrProxyForwardingFunction4
NdrProxyForwardingFunction5
NdrProxyForwardingFunction6
NdrProxyForwardingFunction7
NdrProxyForwardingFunction8
NdrProxyForwardingFunction9
NdrpFindInterface
ObjectStublessClient10
ObjectStublessClient11
ObjectStublessClient12
ObjectStublessClient13
ObjectStublessClient14
ObjectStublessClient15
ObjectStublessClient16
ObjectStublessClient17
ObjectStublessClient18
ObjectStublessClient19
ObjectStublessClient20
ObjectStublessClient21
ObjectStublessClient22
ObjectStublessClient23
ObjectStublessClient24
ObjectStublessClient25
ObjectStublessClient26
ObjectStublessClient27
ObjectStublessClient28
ObjectStublessClient29
ObjectStublessClient3
ObjectStublessClient30
ObjectStublessClient31
ObjectStublessClient32
ObjectStublessClient4
ObjectStublessClient5
ObjectStublessClient6
ObjectStublessClient7
ObjectStublessClient8
ObjectStublessClient9
ProgIDFromCLSID
PropVariantClear
PropVariantCopy
ReleaseFuncDescs
RoActivateInstance
RoCaptureErrorContext
RoClearError
RoFailFastWithErrorContext
RoFailFastWithErrorContextInternal
RoFailFastWithErrorContextInternal2
RoFreeParameterizedTypeExtra
RoGetActivatableClassRegistration
RoGetActivationFactory
RoGetAgileReference
RoGetApartmentIdentifier
RoGetErrorReportingFlags
RoGetMatchingRestrictedErrorInfo
RoGetParameterizedTypeInstanceIID
RoGetServerActivatableClasses
RoInitialize
RoInspectCapturedStackBackTrace
RoInspectThreadErrorInfo
RoOriginateError
RoOriginateErrorW
RoOriginateLanguageException
RoParameterizedTypeExtraGetTypeSignature
RoRegisterActivationFactories
RoRegisterForApartmentShutdown
RoReportCapabilityCheckFailure
RoReportFailedDelegate
RoReportUnhandledError
RoResolveRestrictedErrorInfoReference
RoRevokeActivationFactories
RoSetErrorReportingFlags
RoTransformError
RoTransformErrorW
RoUninitialize
RoUnregisterForApartmentShutdown
SetCleanupFlag
SetErrorInfo
SetRestrictedErrorInfo
StringFromCLSID
StringFromGUID2
StringFromIID
UpdateDCOMSettings
UpdateProcessTracing
WdtpInterfacePointer_UserFree
WdtpInterfacePointer_UserMarshal
WdtpInterfacePointer_UserSize
WdtpInterfacePointer_UserUnmarshal
WindowsCompareStringOrdinal
WindowsConcatString
WindowsCreateString
WindowsCreateStringReference
WindowsDeleteString
WindowsDeleteStringBuffer
WindowsDuplicateString
WindowsGetStringLen
WindowsGetStringRawBuffer
WindowsInspectString
WindowsInspectString2
WindowsIsStringEmpty
WindowsPreallocateStringBuffer
WindowsPromoteStringBuffer
WindowsReplaceString
WindowsStringHasEmbeddedNull
WindowsSubstring
WindowsSubstringWithSpecifiedLength
WindowsTrimStringEnd
WindowsTrimStringStart

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.proxy
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 828B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 75KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 132KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

21bd2a113243324623e03f467b10324f

Code Sign

33:00:00:06:ad:ac:dd:3c:98:83:5e:29:49:00:00:00:00:06:adCertificate

Extended Key Usages

33:00:00:00:03:c6:f9:b4:c3:ae:be:59:4b:00:00:00:00:00:03Certificate

Key Usages

04:ea:3c:56:dd:14:16:9c:84:0d:b3:52:9c:5f:cb:06:df:76:68:f0:95:54:46:10:9e:e1:99:60:de:b6:87:68Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

rpcrt4

ntdll

api-ms-win-core-debug-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-errorhandling-l1-1-2

api-ms-win-core-fibers-l1-1-0

api-ms-win-core-fibers-l1-1-1

api-ms-win-core-file-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-realtime-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-wow64-l1-1-1

api-ms-win-security-base-l1-1-0

api-ms-win-security-base-l1-2-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-privateprofile-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-sidebyside-l1-1-0

api-ms-win-core-windowserrorreporting-l1-1-0

api-ms-win-core-quirks-l1-1-0

kernelbase

api-ms-win-core-path-l1-1-0

api-ms-win-core-processsnapshot-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-wow64-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 2.2MB - Virtual size: 2.2MB

.proxy Size: 16KB - Virtual size: 15KB

.data Size: 6KB - Virtual size: 14KB

.idata Size: 19KB - Virtual size: 19KB

.didat Size: 1024B - Virtual size: 828B

.rsrc Size: 75KB - Virtual size: 75KB

33:00:00:06:ad:ac:dd:3c:98:83:5e:29:49:00:00:00:00:06:ad
Certificate

33:00:00:00:03:c6:f9:b4:c3:ae:be:59:4b:00:00:00:00:00:03
Certificate

04:ea:3c:56:dd:14:16:9c:84:0d:b3:52:9c:5f:cb:06:df:76:68:f0:95:54:46:10:9e:e1:99:60:de:b6:87:68
Signer

.text
Size: 2.2MB - Virtual size: 2.2MB

.proxy
Size: 16KB - Virtual size: 15KB

.data
Size: 6KB - Virtual size: 14KB

.idata
Size: 19KB - Virtual size: 19KB

.didat
Size: 1024B - Virtual size: 828B

.rsrc
Size: 75KB - Virtual size: 75KB

.reloc
Size: 132KB - Virtual size: 132KB