28eae9503730fbd53fe873285b401da0_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

28eae9503730fbd53fe873285b401da0_NeikiAnalytics.exe
Size

518KB
MD5

28eae9503730fbd53fe873285b401da0
SHA1

d40d3103a6608a1c45a7c7cb6b9157d50bd3a36c
SHA256

e644b97405507bb876176669a64e7e7c18740a078ce114534d387b74f17274ee
SHA512

ccba900db3c8d1563abbce203bfcd9a5b43e0f36c284a65d70012f34647688f171fb6364a369bc345c3c33fba93bcf6fe678fced61d4cd26543fbded98dfc458
SSDEEP

12288:SuY8p2iAG6lA5vXYCtk4k8+ARdlkTI8e878V5TCvDPd4euBjvrEH7au:SovwVx8+AR3zh878XGz+eIrEH7au

Score

1^/10

Malware Config

Signatures

Files

28eae9503730fbd53fe873285b401da0_NeikiAnalytics.exe
.dll windows:4 windows x86 arch:x86

cc88bc7c49ac3e68c35eebda77729ccc

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

55:cd:f0:cd:5f:ff:7b:9f:62:42:95:9e:fa:cd:84:25
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

05/08/2013, 00:00

Not After

04/10/2014, 23:59

Subject

CN=Initech\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Initech\, Inc.,L=Guro-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5e:30:9f:7d:2a:b0:a9:f3:cd:7d:f7:b3:00:5f:b2:f5:7c:9a:6e:50
Signer

Actual PE Digest

5e:30:9f:7d:2a:b0:a9:f3:cd:7d:f7:b3:00:5f:b2:f5:7c:9a:6e:50

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Work\INISAFE_Core_for_C\2.x\trunk\bin\inicore_v2.3.40.pdb

Imports

ws2_32

send
connect
shutdown
setsockopt
socket
gethostbyname
inet_addr
htons
WSAStartup
select
ioctlsocket
WSASetLastError
WSACleanup
recvfrom
sendto
recv
closesocket

inicrypto_v5.1.9

ini_Free
get_STACK_count
get_STACK_value
INICryptoInitialize
ChangeNonProvenMode
ChangeTestMode
free_RSA
new_RSA
cmp_BIGINT
HEX_to_BIGINT
final_RSASSA
update_RSASSA
init_RSASSA
insert_STACK_value
new_STACK
free_DIGEST_UNIT
final_Digest
update_Digest
init_Digest
get_DigestLength
new_DIGEST_UNIT
get_CryptoVersion
free_HMAC_UNIT
final_HMAC
update_HMAC
init_HMAC
new_HMAC_UNIT
ini_free
BIGINT_to_HEX
BIGINT_to_binary_unsigned
free_STACK_values
get_BIGINT_word
get_BIGINT_bits_length
dup_STACK
set_RSA_params
encrypt_RSAES
init_RSAES
decrypt_RSAES
final_KCDSA
update_KCDSA
init_KCDSA
get_KCDSA_length
get_RSA_length
add_RSASSA_PKCS1_PSS_ENCODE
add_EMSA_PKCS1_v1_5_ENCODE
generate_RSA_params
set_BIGINT_word
new_BIGINT
set_RSA_public_parmas
init_PRNG
new_PRNG_UNIT
free_PRNG_UNIT
get_rand
RAND_BYTES
File_to_binary
binary_to_File
get_KeyLength
free_BLOCK_CIPHER_UNIT
init_BlockCipher
new_BLOCK_CIPHER_UNIT
final_BlockCipher
update_BlockCipher
init_Advanced_BlockCipher
doFinal_Advanced_BlockCipher
BIGINT_to_DEC
dump_BIGINT
dump_hex
pop_STACK_value
get_DigestAlg_ID_by_Name
free_BIGINT

inipki_v5.1.40

OCSP_REVOKED_INFO_to_Seq
asn1TimeToGENERALIZED_TIME
new_OCSP_REVOKED_INFO
add_single_OCSP_RESPONSE
getCurrentGMTime
Seq_to_OCSP_REVOKED_INFO
Seq_to_OCSP_RESPONSE_DATA
free_OCSP_RESPONSE_BYTES
OCSP_RESPONSE_to_Seq
generate_OCSP_RESPONSE
generate_OCSP_RESPONSE_BYTES
generate_BASIC_OCSP_RESPONSE_ex
Seq_to_P8_PRIV_KEY_INFO
free_KISA_HSM_SIGNATURE_VALUE
Seq_to_KISA_HSM_SIGNATURE_VALUE
verify_KISA_HSM_SIGNATURE_VALUE
ln_from_index
_load_pkcs11_module
_unload_pkcs11_module
p11_C_Initialize
p11_C_Finalize
p11_C_GetSlotList
p11_C_Login
p11_C_OpenSession
p11_C_Logout
p11_C_CloseSession
p11_C_FindObjectsFinal
p11_C_FindObjects
p11_C_FindObjectsInit
p11_C_DestroyObject
p11_C_Encrypt
p11_C_EncryptInit
p11_C_Decrypt
p11_C_DecryptInit
p11_C_Sign
p11_C_SignInit
p11_C_Verify
p11_C_VerifyInit
p11_C_GetAttributeValue
p11_C_GenerateKeyPair
p11_C_Digest
p11_C_DigestInit
p11_C_CreateObject
p11_C_GetTokenInfo
free_PKCS12
free_P7_CONTENT_INFO
free_P12_SAFEBAGS
P12_PFX_to_Seq
set_PKCS12_mac
PKCS12_add_safes
PKCS12_add_safe
encrypt_CMS
add_PKCS12_friendlyname_ASC
add_PKCS12_LKID
add_PKCS12_keyinfo
get_ASN1_hash
check_X509_keypair
P8_ENCRYPTED_KEY_to_Seq
encrypt_PKCS5
encrypt_PKCS5_ex
import_PKCS12
Seq_to_P12_PFX
encrypt_PBES1_KISA
decrypt_PBES1_KISA
encrypt_PBES1
decrypt_PBES1
encrypt_PBES2
decrypt_PBES2
PBKDF1
PBKDF2
P7_CONTENT_INFO_to_Seq
Seq_to_P7_CONTENT_INFO
new_ASN1_STRING
index_from_oid_string
set_P7_version
add_PKCS7_Certificate
add_PKCS7_Signature
new_PKCS7_Content
set_PKCS7_Type
new_P7_CONTENT_INFO
sign_PKCS7
add_PKCS7_Unauthenticated_Attribute
add_PKCS7_Signed_Attribute
verify_PKCS7
X509_ATTRIBUTES_to_Seq
cmp_P7_ISSUER_AND_SERIAL_NUMBER
addToDERSequence
new_ASN1_UNIT
encrypt_PKCS7
encrypt_PKCS7_userKEY
add_PKCS7_Recipient
add_PKCS7_Recipient_withEncryptedAlgorithm
decrypt_PKCS7
decrypt_PKCS7_enveloped_CEK
sign_encrypt_PKCS7
sign_encrypt_PKCS7_userKEY
verify_decrypt_PKCS7
free_P7_SIGNER_INFO
new_P7_SIGNER_INFO
Seq_to_X509_ATTRIBUTES
P7_ENCRYPTED_DATA_to_Seq
P7_DIGESTED_DATA_to_Seq
P7_SIGNED_AND_ENVELOPED_DATA_to_Seq
P7_ENVELOPED_DATA_to_Seq
P7_SIGNED_DATA_to_Seq
ASN1_STRING_to_Seq
free_P5_PBE_PARAM
new_PKCS8
new_P5_PBE_PARAM
dup_ASYMMETRIC_KEY
get_PKCS8_P5_PBE_PARAM
free_X509_ATTRIBUTES
free_OCSP_REVOKED_INFO
add_X509_ATTRIBUTES_child
new_X509_ATTRIBUTES
add_X509_ATTRIBUTE_data
binaryToBIT_STRING
get_OBJECT_IDENTIFIER
new_X509_ATTRIBUTE
encode_KCDSASignatureValue
decode_KCDSASignatureValue
writePKCS1PublicKey_to_Binary
free_PKCS1_RSA_PRIVATE_KEY
get_RSA_UNIT_from_PKCS1_RSA_PRIVATE_KEY
Seq_to_PKCS1_RSA_PRIVATE_KEY
new_ASYMMETRIC_KEY
writePEM_to_Binary
check_VID
free_X509_TIME
new_X509_TIME
cmp_UTC_TIME
add_UTC_TIME
cmp_GENERALIZED_TIME
get_X509_CRL_nextUpdate
get_X509_CRL_issuer
ASYMMETRIC_KEY_to_RSA_UNIT
OID_LIST
dump_ASN1STRING
get_X509_NAME_CHILD
get_X509_NAME_count
new_UTC_TIME
charToASN1_TIME
free_CERTIFICATE_POLICIES
Seq_to_CERTIFICATE_POLICIES
free_ISSUING_DIST_POINTS
Seq_to_issuing_DIST_POINTS
free_POLICY_MAPPINGS
Seq_to_POLICY_MAPPINGS
free_BASIC_CONSTRAINTS
Seq_to_BASIC_CONSTRAINTS
free_POLICY_CONSTRAINTS
Seq_to_POLICY_CONSTRAINTS
free_NAME_CONSTRAINTS
Seq_to_NAME_CONSTRAINTS
free_CRL_DIST_POINTS
Seq_to_CRL_DIST_POINTS
getDERChildAt
free_AUTHORITY_INFO_ACCESS
Seq_to_AUTHORITY_INFO_ACCESS
free_KISA_IDENTIFY_DATA
free_GENERAL_NAMES
Seq_to_KISA_IDENTIFY_DATA
Seq_to_GENERAL_NAMES
free_BIT_STRING
decodeToDERBitString
decodeToDEROctetString
free_AUTHORITY_KEYID
Seq_to_AUTHORITY_KEYID
get_X509_EXTENSION
get_X509_EXTENSION_count
X509_NAME_to_Seq
X509_PUBKEY_to_Seq
get_X509_sig_value
get_X509_notAfter
get_X509_notBefore
get_X509_signature
get_X509_serial
get_X509_version
dup_ASN1_STRING
Seq_to_X509_CRL
get_X509_REVOKED_CRLreason
get_X509_REVOKED_revocationDate
free_X509_SIGN
X509_SIGN_to_Seq
new_X509_SIGN
Seq_to_X509_SIGN
decodeToDERASN1String
get_X509_EXTENSION_index_by_OID_index
free_X509_ALGO_IDENTIFIER
free_OBJECT_IDENTIFIER
utcTimeToASN1_TIME
free_ASN1_STRING
cmp_ISSUER_AND_SERIAL_NUMBER
cmp_ASN1_STRING
free_OCTET_STRING
X509_CERT_to_Seq
verify_CMS
new_CMS_CONTENT_INFO
set_CMS_Type
new_CMS_Content
new_ENCAPSULATED_CONTENT_INFO
index_to_OBJECT_IDENTIFIER
new_OCTET_STRING
set_ENCAPSULATED_CONTENT_INFO
add_CMS_Signature
add_CMS_Certificate
add_CMS_Signed_Attribute
dup_ASN1_TIME
asn1TimeToUTC_TIME
set_CMS_version
sign_CMS
free_X509_CERT
free_ASN1_TIME
free_UTC_TIME
free_ASYMMETRIC_KEY
decodeToDERSequence
Seq_to_CMS_CONTENT_INFO
free_CMS_CONTENT_INFO
CMS_CONTENT_INFO_to_Seq
ASN1_to_binary
free_ASN1_UNIT
Seq_to_OCSP_SINGLE_REQUEST
free_OCSP_SINGLE_REQUEST
get_OCSP_REQUEST_list
OCSP_SINGLE_REQUEST_to_Seq
generate_OCSP_RESPONSE_DATA
OCSP_RESPONSE_DATA_to_Seq
free_OCSP_RESPONSE_DATA
P8_PRIV_KEY_INFO_to_Seq
Seq_to_OCSP_REQUEST
is_OCSP_REQUEST_signature
verify_OCSP_REQUEST
get_OCSP_REQUEST_list_count
get_OCSP_REQUEST_nonce
get_OCSP_REQUEST_signature_cert
writeDER_to_Binary
new_OCSP_RESPONSE
Seq_to_OCSP_RESPONSE
get_BASIC_OCSP_RESPONSE
verify_BASIC_OCSP_RESPONSE
get_CERT_STATUS_from_OCSP_RESPONSE_index
free_BASIC_OCSP_RESPONSE
free_OCSP_RESPONSE
new_OCSP_REQUEST
Seq_to_X509_CERT
readPEM_from_Binary
generate_single_OCSP_REQUEST
gen_P8_PRIV_KEY_INFO
Seq_to_P8_ENCRYPTED_KEY
decrypt_PKCS5
sign_OCSP_REQUEST_ex
OCSP_REQUEST_to_Seq
free_OCSP_REQUEST
free_PKCS8
free_P8_PRIV_KEY_INFO
get_PkiVersion
decode_Base64
encode_Base64
encode_Base64_Line
verify_SIG_X509_CRL
free_X509_CRL
get_X509_SPKI
verify_SIG_X509_CERT
verify_X509_validity
get_X509_subject
get_X509_issuer
cmp_X509_NAME
free_X509_CERTIFICATES
Seq_to_X509_PUBKEY
Seq_to_X509_ALGO_IDENTIFIER
readDER_from_Binary
index_from_OBJECT_IDENTIFIER
ASN1_STRING_to_binary
free_X509_PUBKEY
new_ASN1_TIME
writePKCS1PrivateKey_to_Binary
readPKCS1_from_Binary
get_DigestID_from_OID
get_OID_from_DigestID
sn_from_index
decode_PEM
encode_PEM
getSequenceChildNum
decrypt_content_encryption_key
decrypt_CMS
new_X509_ALGO_IDENTIFIER
set_X509_ALGO_IDENTIFIER_value
new_RSAES_OAEP_PARAM
add_CMS_Recipient
get_CipherID_from_OID
set_CMS_Cipher
free_X509_ATTRIBUTE
encrypt_CMS_userKEY
add_PKCS12_cert

wldap32

ord38
ord26
ord13
ord41
ord50
ord82
ord60
ord143
ord302
ord35
ord27
ord25
ord34

kernel32

GetProcAddress
LoadLibraryA
GetLastError
DeviceIoControl
CloseHandle
FreeLibrary
CreateMutexA
WaitForSingleObject
ReleaseMutex
GetCurrentProcessId
GetCurrentThreadId
HeapFree
HeapAlloc
EnterCriticalSection
LeaveCriticalSection
GetModuleHandleA
ExitProcess
SetEndOfFile
GetStringTypeW
GetStringTypeA
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoA
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
SetStdHandle
HeapSize
ReadFile
LCMapStringW
MultiByteToWideChar
LCMapStringA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
SetFilePointer
GetTimeZoneInformation
RtlUnwind
FlushFileBuffers
GetConsoleMode
GetConsoleCP
InitializeCriticalSection
InterlockedDecrement
SetLastError
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
Sleep
GetStartupInfoA
GetFileType
SetHandleCount
GetModuleFileNameA
GetStdHandle
WriteFile
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
DeleteCriticalSection
WideCharToMultiByte
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetProcessHeap
GetVersionExA
GetCommandLineA
GetDateFormatA
GetTimeFormatA
HeapReAlloc
GetSystemTimeAsFileTime

Exports

Exports

ICL_Asc2Bin
ICL_Base128Decoding
ICL_Base128Encoding
ICL_Base128_Decode
ICL_Base128_Encode
ICL_Base64_Decode
ICL_Base64_Decode_F
ICL_Base64_Encode
ICL_Base64_Encode_F
ICL_Base64_Encode_LF
ICL_CGICheckEmail
ICL_CGICheckFile
ICL_CGICheckStr09AZaz
ICL_CGICookieAnayzer
ICL_CGICookieFindValue
ICL_CGICookieFreeEntries
ICL_CGICookiePrintEntries
ICL_CGIEnv
ICL_CGIError
ICL_CGIErrorContact
ICL_CGIErrorLog
ICL_CGIFileDecoder
ICL_CGIFileFindValue
ICL_CGIFileFreeEntries
ICL_CGIFilePrintEntries
ICL_CGIGetGMTTime
ICL_CGIGetTime
ICL_CGIPrintContentType
ICL_CGIPrintFileStdOut
ICL_CGIPrintfMessage
ICL_CGIPuts
ICL_CGIQuery
ICL_CGIQueryDecoder
ICL_CGIQueryEntryPrint
ICL_CGIQueryFindValue
ICL_CGIQueryFindValue2Int
ICL_CGIQueryFreeEntries
ICL_CGIQueryPrintAllEntries
ICL_CGIReadCounter
ICL_CGISaveCounter
ICL_CGISetCookie
ICL_CGISpaceRemover
ICL_CGIURLCheck
ICL_CGIUpdateCounter
ICL_CMP_Version
ICL_CMS_Add_Signed_Data
ICL_CMS_Check_Format
ICL_CMS_Get_Sign_Time
ICL_CMS_Get_Signer_Certs
ICL_CMS_Get_Signer_Count
ICL_CMS_Make_Enveloped_Data
ICL_CMS_Make_Signed_Data
ICL_CMS_Make_Signed_Data_With_AttrOption
ICL_CMS_Verify_Enveloped_Data
ICL_CMS_Verify_Signed_Data
ICL_COM_ChangeTestMode
ICL_COM_Change_Non_Proven
ICL_COM_Change_Password
ICL_COM_Check_Password
ICL_COM_DER_to_PEM
ICL_COM_Decrypt_Password
ICL_COM_Encrypt_Password
ICL_COM_GetPrivateKeyType
ICL_COM_Get_Random
ICL_COM_HEX2BIGINT_n_cmp
ICL_COM_Is_Pem
ICL_COM_PEM_to_DER
ICL_COM_WebContentScriptInit
ICL_COM_WebContentScriptVerifier_RSA
ICL_COM_convert_hash_id_to_name
ICL_CPV_Cert_Path_Validation
ICL_CPV_Check_CRL
ICL_Cert_conv_DER_type
ICL_Check_License
ICL_Check_License_Ex
ICL_Check_License_with_functional_restricted
ICL_Check_Version
ICL_Check_file_License_with_functional_restricted
ICL_Compress
ICL_CompressData
ICL_CompressPattern2
ICL_ConvertEUCKRToUCS2
ICL_ConvertEUCKRToUTF8
ICL_ConvertStrKSCToUCS2
ICL_ConvertStrUCS2ToKSC
ICL_ConvertStrUCS2ToUTF8
ICL_ConvertStrUTF8ToUCS2
ICL_ConvertUCS2ToEUCKR
ICL_ConvertUTF8ToEUCKR
ICL_Decompress
ICL_Free
ICL_Free_Config
ICL_GM2LocalTime
ICL_GenTime_To_LocalTime
ICL_GetErrorString
ICL_GetLastError
ICL_Get_Error_Msg
ICL_Get_Next_Section
ICL_Get_Num
ICL_Get_OCSP_request_from_list
ICL_Get_Revoked_Reason
ICL_Get_Section_Count
ICL_Get_Section_Value_Count
ICL_Get_Section_Value_by_IDX
ICL_Get_Section_by_IDX
ICL_Get_String
ICL_Get_infomation_from_cert
ICL_Get_single_requet_info
ICL_HASH_Data
ICL_HASH_FILE
ICL_HASH_Final
ICL_HASH_Free
ICL_HASH_Get_Length
ICL_HASH_Init
ICL_HASH_New
ICL_HASH_Update
ICL_Hex2Char
ICL_HexaDump
ICL_HtonDouble
ICL_HtonFloat
ICL_HtonInt
ICL_HtonInt32
ICL_HtonShort
ICL_Http_Get_file
ICL_Initialize
ICL_IsOnlyASCII
ICL_IsOnlyDBCS
ICL_IsOnlyUTF8
ICL_IsValidDate
ICL_IsValidDate2
ICL_Ldap_Get_Data
ICL_Ldap_Simple_Search
ICL_Load_File
ICL_Local2GMTime
ICL_LockClear
ICL_LockInit
ICL_LockRelease
ICL_LockWait
ICL_Log
ICL_LogClose
ICL_LogInit
ICL_Log_HEXA
ICL_Log_Init
ICL_MAC_HMAC
ICL_Make_OCSP_response_final
ICL_Make_OCSP_response_init
ICL_Make_OCSP_response_init_one
ICL_Make_OCSP_response_update
ICL_Make_revoke_info
ICL_NTP_Close
ICL_NTP_Get_Current_GM_Time
ICL_NTP_Get_Current_GM_Time_t
ICL_NTP_Get_Current_Local_Time
ICL_NTP_Get_Current_Local_Time_t
ICL_NTP_Init
ICL_NtohDouble
ICL_NtohFloat
ICL_NtohInt
ICL_NtohInt16
ICL_NtohInt32
ICL_NtohShort
ICL_OCSP_Response
ICL_OCSP_Response_error
ICL_OCSP_Single_Request
ICL_PK11_Close_Session
ICL_PK11_Delete_RSAKey
ICL_PK11_Delete_Sym_Key
ICL_PK11_Finalize
ICL_PK11_Get_All_Certs
ICL_PK11_Get_All_Certs_Count
ICL_PK11_Get_Cert
ICL_PK11_Get_HSM_Driver_Count
ICL_PK11_Get_HSM_Driver_Signature_Count
ICL_PK11_Get_HSM_Signer_IssuerDN
ICL_PK11_Get_Slot_Count
ICL_PK11_Get_Token_FreeMemory
ICL_PK11_Get_Token_Serial
ICL_PK11_Get_Vid_Random
ICL_PK11_Hash
ICL_PK11_Initialize
ICL_PK11_Load_Library
ICL_PK11_Logout
ICL_PK11_Open_Session
ICL_PK11_RSA_Decrypt
ICL_PK11_RSA_Encrypt
ICL_PK11_RSA_Key_Generate
ICL_PK11_RSA_Sign
ICL_PK11_RSA_Verify
ICL_PK11_Set_RSAKey
ICL_PK11_Set_Sym_Key
ICL_PK11_Sym_Decrypt
ICL_PK11_Sym_Encrypt
ICL_PK11_Unload_Library
ICL_PK11_Verify_HSM_Driver_Info
ICL_PK11_Verify_HSM_Driver_Signature_Info
ICL_PK12_Make_PFX
ICL_PK12_Make_PFX_With_Pass
ICL_PK12_Verify_PFX
ICL_PK12_Verify_PFX_With_Pass
ICL_PK1_Cert_To_Privatekey_Pemfile
ICL_PK1_Cert_To_Publickey_Pemfile
ICL_PK1_Cert_To_RSAINFO
ICL_PK1_Free_PKISTRINFO
ICL_PK1_Free_PKISTRINFOS
ICL_PK1_Generate_RSA_Key
ICL_PK1_New_PKISTRINFO
ICL_PK1_PK8file_Hashvalue_Sign
ICL_PK1_PK8file_Hashvalue_Sign_ex
ICL_PK1_Private_Decrypt
ICL_PK1_Private_Decrypt_all
ICL_PK1_Private_Decrypt_ex
ICL_PK1_Private_Encrypt
ICL_PK1_Private_Encrypt_ex
ICL_PK1_Private_Sign
ICL_PK1_Privatekey_To_RSAINFO
ICL_PK1_Public_Decrypt
ICL_PK1_Public_Decrypt_all
ICL_PK1_Public_Decrypt_ex
ICL_PK1_Public_Encrypt
ICL_PK1_Public_Encrypt_ex
ICL_PK1_Public_Verify
ICL_PK1_Set_PKISTRINFO
ICL_PK5_Decrypt_PBES1
ICL_PK5_Decrypt_PBES1_KISA
ICL_PK5_Decrypt_PBES2
ICL_PK5_Encrypt_PBES1
ICL_PK5_Encrypt_PBES1_KISA
ICL_PK5_Encrypt_PBES2
ICL_PK5_PBKDF1
ICL_PK5_PBKDF2
ICL_PK7_Add_Signed_Data
ICL_PK7_Add_Signed_Data_HSM
ICL_PK7_Add_Signed_Data_HSM_With_Option
ICL_PK7_Add_Signed_Data_HSM_With_Random
ICL_PK7_Add_Signed_Data_HSM_With_Unauth_Attr
ICL_PK7_Add_Signed_Data_With_Option
ICL_PK7_Add_Signed_Data_With_Random
ICL_PK7_Add_Signed_Data_With_Unauth_Attr
ICL_PK7_Check_Format
ICL_PK7_Get_EncDigest
ICL_PK7_Get_PubKey
ICL_PK7_Get_Sign_Time
ICL_PK7_Get_Signer_Certs
ICL_PK7_Get_Signer_Count
ICL_PK7_Make_Enveloped_Data
ICL_PK7_Make_SignedData_Init
ICL_PK7_Make_Signed_And_Enveloped_Data
ICL_PK7_Make_Signed_Data
ICL_PK7_Make_Signed_Data_Final_HSM
ICL_PK7_Make_Signed_Data_HSM
ICL_PK7_Make_Signed_Data_HSM_With_Option
ICL_PK7_Make_Signed_Data_HSM_With_Random
ICL_PK7_Make_Signed_Data_HSM_With_Unauth_Attr
ICL_PK7_Make_Signed_Data_Init_HSM
ICL_PK7_Make_Signed_Data_Init_HSM_With_Option
ICL_PK7_Make_Signed_Data_Init_HSM_With_Random
ICL_PK7_Make_Signed_Data_Init_HSM_With_Unauth_Attr
ICL_PK7_Make_Signed_Data_WithOut_Plain_With_MD
ICL_PK7_Make_Signed_Data_With_Option
ICL_PK7_Make_Signed_Data_With_OutSign
ICL_PK7_Make_Signed_Data_With_Random
ICL_PK7_Make_Signed_Data_With_SignData
ICL_PK7_Make_Signed_Data_With_Unauth_Attr
ICL_PK7_Remove_ContentType
ICL_PK7_Verify_Enveloped_Data
ICL_PK7_Verify_Signed_And_Enveloped_Data
ICL_PK7_Verify_Signed_Data
ICL_PK7_Verify_Signed_Data_WithOut_Plain
ICL_PK7_Verify_Signed_Data_With_Add_Cert_Data
ICL_PK8_Change_Passwd
ICL_PK8_Check_Passwd
ICL_PK8_DER_to_PK1_PEM
ICL_PK8_Get_Random
ICL_PK8_Make_PrivateKey
ICL_PK8_Remove_RData
ICL_PK8_to_PK1
ICL_PRNG_Get_Random
ICL_PRNG_Get_SeedRandom
ICL_PRNG_Get_T_Random
ICL_PRNG_Get_TimeRandom
ICL_PRNG_T_Random_Clean
ICL_PRNG_T_Random_Init
ICL_Parsing_OCSP_request
ICL_Priv_to_key_unit
ICL_Read_File
ICL_SYM_Decrypt
ICL_SYM_Decrypt_F
ICL_SYM_Decrypt_doFinal_Adv
ICL_SYM_Decrypt_init_Adv
ICL_SYM_Encrypt
ICL_SYM_Encrypt_F
ICL_SYM_Encrypt_doFinal_Adv
ICL_SYM_Encrypt_init_Adv
ICL_SYM_Get_Block_Length
ICL_SYM_Get_Key_Length
ICL_SetAlphaNumericCasePattern
ICL_SetBinaryFrontPattern
ICL_SetBinaryPattern
ICL_SetBinaryTailPattern
ICL_SetBlankPattern
ICL_SetCheckFlag
ICL_SetControlASCIIPattern
ICL_SetControlFrontPattern
ICL_SetControlTailPattern
ICL_SetLowerCasePattern
ICL_SetNumericPattern
ICL_SetUpperCasePattern
ICL_StrMid
ICL_StrTrim
ICL_Str_to_Time
ICL_String_free
ICL_URLDecode
ICL_URLEncode
ICL_URL_Decode
ICL_URL_Encode
ICL_Verify_CertTime
ICL_Write_File
ICL_X509_CRL_Verify
ICL_X509_CRL_Verify_Issuer
ICL_X509_CRL_Verify_NextUpdate
ICL_X509_Check_Update
ICL_X509_Check_VID
ICL_X509_Conv_Cert2DER
ICL_X509_Conv_Cert2PEM
ICL_X509_Exist_VID
ICL_X509_Free_X509_Info
ICL_X509_Info_Get_CRLdp
ICL_X509_Info_Get_CRLdp_Count
ICL_X509_Info_Get_CRLdp_Index
ICL_X509_Info_Get_DN_Field
ICL_X509_Info_Get_IssuerDN
ICL_X509_Info_Get_LicenseIPs
ICL_X509_Info_Get_Pubkey
ICL_X509_Info_Get_PubkeyAlg
ICL_X509_Info_Get_Serial
ICL_X509_Info_Get_Signature
ICL_X509_Info_Get_SignatureAlg
ICL_X509_Info_Get_SubjectDN
ICL_X509_Info_Get_ValidityFrom
ICL_X509_Info_Get_ValidityTo
ICL_X509_Init_X509_Info
ICL_X509_Is_Revoked
ICL_X509_Is_Revoked_With_Reason
ICL_X509_SIGN_to_binary
ICL_X509_Verify
ICL_X509_Verify_DN
ICL_X509_Verify_Signature
ICL_X509_Verify_Validity
ICL_binary_to_X509_SIGN
ICL_check_cert_license
ICL_check_file_license
ICL_check_file_license_ex
ICL_check_ip
ICL_cmp_HEX_STR
ICL_convert_env
ICL_convert_version_int
ICL_count_line
ICL_get_licence_products
ICL_get_section
ICL_get_token
ICL_get_value_index
ICL_hexa2i
ICL_log
ICL_ltrim
ICL_read_line
ICL_replace
ICL_setLogLevel
ICL_set_st_info
ICL_str_token
ICL_str_tokenizer
ICL_stristr
ICL_strtok
ICL_trim
ICL_verify_signature

Sections

.text
Size: 292KB - Virtual size: 291KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 112KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cc88bc7c49ac3e68c35eebda77729ccc

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

55:cd:f0:cd:5f:ff:7b:9f:62:42:95:9e:fa:cd:84:25Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

5e:30:9f:7d:2a:b0:a9:f3:cd:7d:f7:b3:00:5f:b2:f5:7c:9a:6e:50Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

inicrypto_v5.1.9

inipki_v5.1.40

wldap32

kernel32

Exports

Exports

Sections

.text Size: 292KB - Virtual size: 291KB

.rdata Size: 112KB - Virtual size: 111KB

.data Size: 8KB - Virtual size: 12KB

.rsrc Size: 4KB - Virtual size: 1008B

.reloc Size: 16KB - Virtual size: 12KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

55:cd:f0:cd:5f:ff:7b:9f:62:42:95:9e:fa:cd:84:25
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

5e:30:9f:7d:2a:b0:a9:f3:cd:7d:f7:b3:00:5f:b2:f5:7c:9a:6e:50
Signer

.text
Size: 292KB - Virtual size: 291KB

.rdata
Size: 112KB - Virtual size: 111KB

.data
Size: 8KB - Virtual size: 12KB

.rsrc
Size: 4KB - Virtual size: 1008B

.reloc
Size: 16KB - Virtual size: 12KB