Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
Behavioral task
behavioral1
Sample
17dc0f05500c9faf6f72d7e2b39068cc61c451f94fbae71174830e5768606f9c_NeikiAnalytics.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
17dc0f05500c9faf6f72d7e2b39068cc61c451f94fbae71174830e5768606f9c_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
Target
17dc0f05500c9faf6f72d7e2b39068cc61c451f94fbae71174830e5768606f9c_NeikiAnalytics.exe
Size
602KB
MD5
a84822672317f3cf41d4ceb3a0a5dbf0
SHA1
82d6eb71a38ca1a4bf07e85467d74c41ae9304ec
SHA256
17dc0f05500c9faf6f72d7e2b39068cc61c451f94fbae71174830e5768606f9c
SHA512
bc4b0ef56d6a29cdff0334c29eb8fba7e425c49b9abeeffeb1413af11420b4337f6bdd0a436f3f8e722b3e7d9deeafda7f0ca7263769eb36f2024b9876f8e04c
SSDEEP
12288:NvRkVk6Pd74pPEGzbVgMf110NB4izCL6o/QYflhBsaQPvgyX:NvuG6Pd747zbSq10NijL6o/BtcaQPZX
resource | yara_rule |
---|---|
sample | vmprotect |
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
CreateFileW
MultiByteToWideChar
Process32FirstW
ProcessIdToSessionId
Process32NextW
WTSGetActiveConsoleSessionId
CreateToolhelp32Snapshot
CloseHandle
SetFileAttributesW
CreateMutexW
FreeLibrary
CreateDirectoryW
WaitForSingleObject
SetEvent
ConnectNamedPipe
CreateNamedPipeW
InitializeCriticalSection
LoadLibraryW
GetConsoleWindow
LeaveCriticalSection
DisconnectNamedPipe
GetFileSize
ResetEvent
CreateEventW
CreateThread
GetSystemTime
FileTimeToLocalFileTime
FileTimeToSystemTime
SystemTimeToFileTime
GetFileAttributesW
GetModuleFileNameW
GetModuleFileNameA
GetLocalTime
GetProcAddress
GetFileAttributesA
Sleep
DeleteCriticalSection
DecodePointer
GetLastError
InitializeCriticalSectionAndSpinCount
EncodePointer
IsDebuggerPresent
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
SetLastError
GetModuleHandleA
OutputDebugStringW
GetStdHandle
GetFileType
GetTickCount
GlobalMemoryStatus
LoadLibraryA
FlushConsoleInputBuffer
ReadFile
WideCharToMultiByte
OpenProcess
GetTempPathA
WriteFile
EnterCriticalSection
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
MessageBoxA
GetProcessWindowStation
ShowWindow
GetUserObjectInformationW
ReportEventA
RegisterEventSourceA
DeregisterEventSource
GetTokenInformation
ImpersonateLoggedOnUser
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
OpenProcessToken
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAH@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??Bid@locale@std@@QAEIXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
?_Winerror_map@std@@YAPBDH@Z
?_Syserror_map@std@@YAPBDH@Z
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_BADOFF@std@@3_JB
?id@?$ctype@D@std@@2V0locale@2@A
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?uncaught_exception@std@@YA_NXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
sscanf
strncmp
_wtoi
atoi
_ultoa
exit
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
??1type_info@@UAE@XZ
_amsg_exit
__getmainargs
__set_app_type
_exit
_cexit
_configthreadlocale
__setusermatherr
_initterm_e
_initterm
__initenv
_fmode
_commode
_except_handler4_common
?terminate@@YAXXZ
__crtSetUnhandledExceptionFilter
_invoke_watson
_controlfp_s
_stricmp
isupper
_stat64i32
isxdigit
getenv
_setmode
fwrite
_fileno
fgets
fflush
ferror
feof
isspace
isdigit
strcmp
realloc
malloc
raise
_vsnprintf
wcsstr
qsort
_wcsicmp
_time64
fclose
strrchr
asctime
fprintf
??_V@YAXPAX@Z
fopen
_beginthreadex
_gmtime64
sprintf
??0exception@std@@QAE@ABV01@@Z
??0bad_cast@std@@QAE@ABV01@@Z
??0bad_cast@std@@QAE@PBD@Z
??1bad_cast@std@@UAE@XZ
tolower
fread
ftell
fseek
_wfopen
strncpy
__iob_func
strchr
abort
memcpy
memset
_strnicmp
_itoa
_errno
strerror
free
??2@YAPAXI@Z
??3@YAXPAX@Z
_purecall
isalnum
memchr
memmove
strtoul
signal
fputs
_getch
strstr
_CxxThrowException
_XcptFilter
__CxxFrameHandler3
ord293
ord1660
ord5022
ord5825
ord305
ord316
ord300
ord310
ord306
ord1043
ord1527
ord4623
ord1521
ord8064
ord286
ord290
ord4621
ord2967
ord2968
ord285
ord5824
ord8243
ord12636
ord2949
ord1695
ord1691
ord4772
ord4774
ord1658
ord8242
ord2948
ord2354
ord12981
ord12186
ord12188
ord2290
ord321
ord545
ord13623
ord5604
ord2847
ord1172
ord11866
ord296
ord280
ord1042
ord1518
ord1520
ord12755
ord12792
ord5021
ord1528
ord12634
ord1685
ord1649
ord5020
ord1525
CryptStringToBinaryA
GetTcpTable
ord3
ord5
ord2
ord4
ord1
closesocket
socket
bind
send
htons
WSAGetLastError
inet_addr
WSAStartup
listen
accept
recv
WSASetLastError
shutdown
<� �� �0^֣�i�bL��'oI>0�]� ܚz�-�^Ϛ��Ҩ03.�� ����<X�aȚ��j�k���cZɥ��>��Xf�-�kf���,�����vRNJ������_�v��yW*-s{vI���z�%~$XQ����JlO= :�^�(& �E%�f��y5��1��#��� ��Z�xy6:#,��y���I���HϝU�^��[}��#����!�t��Eď�4��gV�x����y�{�r���n�q�TQ�}"�5W26/��WGz8Qzb��r���tP'gT����M����K%Z���?��H���'�E5c����+`$d�����A@V٥w��I� ���zO���ژӆ~�JA; �¥��x�!;z�q���[z� -,�q ���s�����am�not+�O����B l��x����>���#��j+n5kd>��} uЁn4��/������oΆ�������TNt��������=�%�c>�R�K�|��Ч7�������CEA��12��1 ֹp\@���hj�?��Z���"�q3��Zx�J�W`@�1��?"���!p��q��x�n����`����7R}�����V���Y@��硧c}��`�1D�&5ꢜq��[�es����T�ZzW�쐵�����vH0�� o�9��T����Sij��#�C��c���c�v7&�O�zW:L���mp������E��n���i�y� I5�[z! ��Ui�U ����0�gU��Z ��֗��bk����L�Y͜�/u<7��GS�s�9�����`�� �fC~x k�9I��nZU ��V�~�S�?��������!�C:P]����I��z$�t� ���9�h^�eP$�gͯ�����p��F,�U;�]����a��d,��>wp_[REs���d�qD>�2:�.���z� �9��:�֑�����k}&�� �(@S��g<p���Vn�h82ܢK�8���O�b��l�hB�`[�����"�4E |��"�?�#��z��-.�ٛo�H=�Ľ��t�?�������pj��0�[qڹ#���/�=ݱ�f�{y)=:�똉_�s��z`�x��DF y�)�f*����nW{>ȞA��K6�k�4;��F#��<Y1q�^��G�}l<��e3l@ѵ���^7��Z����#�|���Atu�\5:Ͻ���C���Mrc��?� �k;����oW���4m�}e�xV�T.��(�Q�W&ņ��ucM�n@�q͑������ ��55oZEֻZ�ԗ��L��K�.�F�1rD���?(pc�M�C���=�4#��!���a�&ޭu2�@��0�/�ߓ�X�Sd�妯���oH��GHE��_����hd����"�k�?��5�_�6��z��'�>C�0�+g�Qy|.�74o 8��bz2x��t���%�=ư�ӥfT���$(]�\��2�V-�-PZ9�rr�����z}?���|4�Zr���H�vxqb���I��b��ec~_�� �yࣼ& �M%�DTg?EYU�K�֞���~?������PXQ��m�F�����F2��s��I�^������:���:v�n�����O6�z�^� hFN2�௸��ڞ�j� 9%{����H2�;Eޯ���gq�!�9i\(���2�?�Z�MԌ��5��eV��.-ح��-�l������թ�6%p�C���\����wnu��0|���I_[��[���FQ� %� I�Ej��� Q�6w�f�y�� �T���r�;���wP��q ]����ǂ�^g�4ं��Uc9_�P<���#8$AI�X�k�1��' ������ 2�?L���`�5LKFl$��)�����%Q:���3�=xv*�3��q�p�Q}kmQ�b;FT!�R�d����B��yA,��v}�p���� mY��>R!�@�Z����k��������}�Q��P�@I&_k�U&�"Ot�V�ȴ�y(a��Ʃ����d���]�G������kk��ĿS҄�︍�����Uv �)Df�Bغ�Y2$>/�2y��?��(���cV���"����7Y}>o|Lb�h ݯ�+��2.K͖SG4��5�y��-���u]�H�� Ծ���7�>!��^�P��7!ۚmR� Y�&��'���jҘ� ��'�%x���OB��ҚP�d��3�y�2Xfo�Dzʚ��t,_뀯�B �s�P���hkr��f7(֎z�ɦ�U�.���}�t�&| $Xb���Ժa�5t4,=�ϼS�(��C���9�:�"*��I�Sfh��Ct�>\�>ˣ����?6�yn[D�x��$%���$1��?Bt �c�u�d*����϶��|�j��zv��!L��m���E����"�� ��p81d�����vǪ3�:��&�h&�|N�?��o��$�)x��H[�^���R���*QV�e��}��rkF��<���P}f�W�E�L\Ԭ=��g����x9J]�����5(^?��mڲuA���;A�_7���Bao3oK��+� X�x��cV>�0�{(+��#�٣9��)}q�m�x��� emDc�kpI: !��*�� ��rY��F��f ��P�Vd�F�x���a��*����#|�;������n����]�_p�CG̽���K~��K~ת(:����X'��~��+�HDt�7�1�D��N�S ��rU7�9��A3e�蘀%�-����r�9�8�SV@���8(�cI(�SO�$b=}�&�;�}C>(w�g���b���J,��^L�A�ScݍaFyTHQ -�\ qՅ�]�9>�ĝ�\f���X ��N�w��JJ��L} ��@ rЫt ��O`"��yI�B�=�b��p�G���y+B�s/�ڔ��b����B?��q�d:�e���� ��";;��3�ڨ8���^eJ�z.�=��_�3j��<�ˎh�r.&�Ϗv����ԓ���\����P�����0.�������T�sW+ �壎�ENv�tN����w�mk�[Ά)<�Q�Y���t����6�N&�H�u�L���K���yT�u:B�J�F��x���(�
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ