01beb60eeed91a40da19136ec0113ec1f7c956762f546cb5572a188a32910869_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

01beb60eeed91a40da19136ec0113ec1f7c956762f546cb5572a188a32910869_NeikiAnalytics.exe
Size

127KB
MD5

66c9ed7cd29c12e0be9d8cc2084bc400
SHA1

91f23ebdaa4259f217ac1daccd5e779b43d52383
SHA256

01beb60eeed91a40da19136ec0113ec1f7c956762f546cb5572a188a32910869
SHA512

ae570c9ee828889534f01d7a70b8fa864af1b7e303b1b96be3db9eefb9d2280eb2f502bcc1acb801122a812f1c07b47194f217fb8db39fbab8dee323b137f9ae
SSDEEP

3072:bS2eGE6CKz3Wux5qf2N+JrXFl+6KcqNi4PGeKnA3O9caMFHt1BWg9RkkBzv+q/:bWXcfKngRZUmR/vl/

Score

1^/10

Malware Config

Signatures

Files

01beb60eeed91a40da19136ec0113ec1f7c956762f546cb5572a188a32910869_NeikiAnalytics.exe
.dll windows:6 windows x64 arch:x64

92287fe31602d17bbed70e71692499ae

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

59:dd:d2:bf:a6:72:e1:01:5a:f0:0f:f1
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

16/05/2024, 13:07

Not After

17/05/2025, 13:07

Subject

SERIALNUMBER=556821-8225,CN=Coffee Stain Studios AB,O=Coffee Stain Studios AB,STREET=Hertig Johans Gata 6,L=Skövde,ST=Västra Götaland,C=SE,1.2.840.113549.1.9.1=#0c14637373697440636f66666565737461696e2e7365,1.3.6.1.4.1.311.60.2.1.3=#13025345,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b9:ff:63:9d:af:19:26:10:72:1c:49:dd:cb:f1:77:2f:58:4d:bb:38:ed:80:34:52:43:78:7e:f4:6e:f2:43:d3
Signer

Actual PE Digest

b9:ff:63:9d:af:19:26:10:72:1c:49:dd:cb:f1:77:2f:58:4d:bb:38:ed:80:34:52:43:78:7e:f4:6e:f2:43:d3

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

FactoryServer-GooglePAD.pdb

Imports

factoryserver-coreuobject

?BuildSubobjectMapping@UObject@@UEBAXPEAV1@AEAV?$TMap@PEAVUObject@@PEAV1@VFDefaultSetAllocator@@U?$TDefaultMapHashableKeyFuncs@PEAVUObject@@PEAV1@$0A@@@@@@Z
?PreDestroyFromReplication@UObject@@UEAAXXZ
?PostNetReceive@UObject@@UEAAXXZ
?PreNetReceive@UObject@@UEAAXXZ
?IsSupportedForNetworking@UObject@@UEBA_NXZ
?IsFullNameStableForNetworking@UObject@@UEBA_NXZ
?IsNameStableForNetworking@UObject@@UEBA_NXZ
?RegisterReplicationFragments@UObject@@UEAAXAEAVFFragmentRegistrationContext@Net@UE@@W4EFragmentRegistrationFlags@34@@Z
?GetReplicatedCustomConditionState@UObject@@UEBAXAEAVFCustomPropertyConditionState@@@Z
?GetLifetimeReplicatedProps@UObject@@UEBAXAEAV?$TArray@VFLifetimeProperty@@V?$TSizedDefaultAllocator@$0CA@@@@@@Z
?TagSubobjects@UObject@@UEAAXW4EObjectFlags@@@Z
?IsSafeForRootSet@UObject@@UEBA_NXZ
?IsLocalizedResource@UObject@@UEBA_NXZ
?GetPrimaryAssetId@UObject@@UEBA?AUFPrimaryAssetId@@XZ
?IsAsset@UObject@@UEBA_NXZ
?GetAssetRegistryTags@UObject@@UEBAXAEAV?$TArray@UFAssetRegistryTag@UObject@@V?$TSizedDefaultAllocator@$0CA@@@@@@Z
?GetResourceSizeEx@UObject@@UEAAXAEAUFResourceSizeEx@@@Z
?GetWorld@UObject@@UEBAPEAVUWorld@@XZ
?Rename@UObject@@UEAA_NPEB_WPEAV1@I@Z
?GetPreloadDependencies@UObject@@UEAAXAEAV?$TArray@PEAVUObject@@V?$TSizedDefaultAllocator@$0CA@@@@@@Z
?CheckDefaultSubobjectsInternal@UObject@@MEBA_NXZ
?NeedsLoadForTargetPlatform@UObject@@UEBA_NPEBVITargetPlatform@@@Z
?NeedsLoadForServer@UObject@@UEBA_NXZ
?NeedsLoadForClient@UObject@@UEBA_NXZ
?Serialize@UObject@@UEAAXAEAVFArchive@@@Z
?Serialize@UObject@@UEAAXVFStructuredArchiveRecord@@@Z
?FinishDestroy@UObject@@UEAAXXZ
?BeginDestroy@UObject@@UEAAXXZ
?PostLoadSubobjects@UObject@@UEAAXPEAUFObjectInstancingGraph@@@Z
?PostLoad@UObject@@UEAAXXZ
?PreSave@UObject@@UEAAXPEBVITargetPlatform@@@Z
?PreSave@UObject@@UEAAXVFObjectPreSaveContext@@@Z
?PostSaveRoot@UObject@@UEAAX_N@Z
?PostSaveRoot@UObject@@UEAAXVFObjectPostSaveRootContext@@@Z
?PreSaveRoot@UObject@@UEAA_NPEB_W@Z
?PreSaveRoot@UObject@@UEAAXVFObjectPreSaveRootContext@@@Z
?PostReinitProperties@UObject@@UEAAXXZ
?PostInitProperties@UObject@@UEAAXXZ
?CreateCluster@UObjectBaseUtility@@UEAAXXZ
?CanBeInCluster@UObjectBaseUtility@@UEBA_NXZ
?GetFNameForStatID@UObjectBase@@UEBA?AVFName@@XZ
?DeferredRegister@UObjectBase@@MEAAXPEAVUClass@@PEB_W1@Z
?StepExplicitProperty@FFrame@@QEAAXQEAXPEAVFProperty@@@Z
?Step@FFrame@@QEAAXPEAVUObject@@QEAX@Z
?StaticClass@FArrayProperty@@SAPEAVFFieldClass@@XZ
?StaticClass@FStrProperty@@SAPEAVFFieldClass@@XZ
?StaticClass@FIntProperty@@SAPEAVFFieldClass@@XZ
?GetPrivateStaticClassBody@@YAXPEB_W0AEAPEAVUClass@@P6AXXZIIW4EClassFlags@@W4EClassCastFlags@@0P6AXAEBVFObjectInitializer@@@ZP6APEAVUObject@@AEAVFVTableHelper@@@Z$$QEAUFUObjectCppClassStaticFunctions@@P6APEAV1@XZP6APEAV1@XZ@Z
?RegisterFunctions@FNativeFunctionRegistrar@@SAXPEAVUClass@@PEBUFNameNativePtrPair@@H@Z
?ProcessEvent@UObject@@UEAAXPEAVUFunction@@PEAX@Z
?CallFunctionByNameWithArguments@UObject@@QEAA_NPEB_WAEAVFOutputDevice@@PEAV1@_N@Z
?AddReferencedObjects@UObject@@SAXPEAV1@AEAVFReferenceCollector@@@Z
?GetPrivateStaticClass@UObject@@CAPEAVUClass@@XZ
?GetFullName@UObjectBaseUtility@@QEBA?AVFString@@PEBVUObject@@W4EObjectFullNameFlags@@@Z
?RegisterCompiledInInfo@@YAXPEB_WPEBUFClassRegisterCompiledInInfo@@_KPEBUFStructRegisterCompiledInInfo@@2PEBUFEnumRegisterCompiledInInfo@@2@Z
?RegisterCompiledInInfo@@YAXP6APEAVUPackage@@XZPEB_WAEAU?$TRegistrationInfo@VUPackage@@UFPackageReloadVersionInfo@@@@AEBUFPackageReloadVersionInfo@@@Z
?GetStaticEnum@@YAPEAVUEnum@@P6APEAV1@XZPEAVUObject@@PEB_W@Z
?ConstructUClass@UECodeGen_Private@@YAXAEAPEAVUClass@@AEBUFClassParams@1@@Z
?ConstructUPackage@UECodeGen_Private@@YAXAEAPEAVUPackage@@AEBUFPackageParams@1@@Z
?ConstructUEnum@UECodeGen_Private@@YAXAEAPEAVUEnum@@AEBUFEnumParams@1@@Z
?ConstructUFunction@UECodeGen_Private@@YAXPEAPEAVUFunction@@AEBUFFunctionParams@1@@Z
?Get@FObjectInitializer@@SAAEAV1@XZ
?StaticAllocateObject@@YAPEAVUObject@@PEBVUClass@@PEAV1@VFName@@W4EObjectFlags@@W4EInternalObjectFlags@@_NPEA_NPEAVUPackage@@@Z
?IsDestructionThreadSafe@UObject@@UEBA_NXZ
?GetTransientPackage@@YAPEAVUPackage@@XZ

factoryserver-engine

??0UBlueprintFunctionLibrary@@QEAA@AEAVFVTableHelper@@@Z
??0UBlueprintFunctionLibrary@@QEAA@AEBVFObjectInitializer@@@Z
?GetPrivateStaticClass@UBlueprintFunctionLibrary@@CAPEAVUClass@@XZ
??1UBlueprintFunctionLibrary@@UEAA@XZ
?Z_Construct_UClass_UBlueprintFunctionLibrary@@YAPEAVUClass@@XZ
?GetFunctionCallspace@UBlueprintFunctionLibrary@@UEAAHPEAVUFunction@@PEAUFFrame@@@Z

factoryserver-core

?GetBlocks@FNameDebugVisualizer@@SAPEAPEAEXZ
?CheckVerifyFailedImpl@FDebug@@SA_NPEBD0HPEAXPEB_WZZ
?Convert@Private@Core@UE@@YAPEAW4UTF8CHAR@FGenericPlatformTypes@@PEAW445@HPEB_WH@Z
?GetConvertedLength@Private@Core@UE@@YAHPEBW4UTF8CHAR@FGenericPlatformTypes@@PEB_WH@Z
?GCoreObjectHandlePackageDebug@@3PEAUFObjectHandlePackageDebugData@Private@CoreUObject@UE@@EA
?GCoreComplexObjectPathDebug@@3PEAUFStoredObjectPathDebug@Private@CoreUObject@UE@@EA
?GCoreObjectArrayForDebugVisualizers@@3PEAVFChunkedFixedUObjectArray@@EA
?DoSetup@FThreadSafeStaticStatBase@@IEBAPEBUTStatIdData@@PEBDPEB_W001_N2W4Type@EStatDataType@@22W4EMemoryCounterRegion@FWindowsPlatformMemory@@@Z
??1FLogCategoryBase@@QEAA@XZ
??0FLogCategoryBase@@QEAA@AEBVFName@@W4Type@ELogVerbosity@@1@Z
??0FName@@QEAA@PEBDW4EFindName@@@Z
??0FName@@QEAA@PEB_WW4EFindName@@@Z
?Free@FMemory@@SAXPEAX@Z
?HandleAtomicsFailure@FWindowsPlatformAtomics@@KAXPEB_WZZ
?Realloc@FMemory@@SAPEAXPEAX_KI@Z
?QuantizeSize@FMemory@@SA_K_KI@Z
?OnInvalidArrayNum@Private@Core@UE@@YAX_K@Z
?ResizeAllocation@ForAnyElementType@?$TSizedHeapAllocator@$0CA@UFMemory@@@@QEAAXHH_K@Z
?ResizeAllocation@ForAnyElementType@?$TSizedHeapAllocator@$0CA@UFMemory@@@@QEAAXHH_KI@Z
??0FString@@QEAA@PEB_W@Z
?FromValidEName@FNameEntryId@@CA?AU1@W4EName@@@Z
?Malloc@FMemory@@SAPEAX_KI@Z

vcruntime140

memmove
__current_exception
__current_exception_context
memset
memcpy
__std_type_info_destroy_list
__C_specific_handler

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_seh_filter_dll
_execute_onexit_table
_initialize_narrow_environment
_initialize_onexit_table
_crt_atexit
terminate
_crt_at_quick_exit
_initterm
_register_onexit_function
_configure_narrow_argv
_cexit
_initterm_e

kernel32

InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
GetModuleHandleW
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

Exports

Exports

??$StaticClass@VUGooglePADFunctionLibrary@@@@YAPEAVUClass@@XZ
??$StaticEnum@W4EGooglePADCellularDataConfirmStatus@@@@YAPEAVUEnum@@XZ
??$StaticEnum@W4EGooglePADDownloadStatus@@@@YAPEAVUEnum@@XZ
??$StaticEnum@W4EGooglePADErrorCode@@@@YAPEAVUEnum@@XZ
??$StaticEnum@W4EGooglePADStorageMethod@@@@YAPEAVUEnum@@XZ
??0UGooglePADFunctionLibrary@@QEAA@AEAVFVTableHelper@@@Z
??0UGooglePADFunctionLibrary@@QEAA@AEBVFObjectInitializer@@@Z
??1UGooglePADFunctionLibrary@@UEAA@XZ
??2UGooglePADFunctionLibrary@@SAPEAX_KPEAW4EInternal@@@Z
??2UGooglePADFunctionLibrary@@SAPEAX_KW4EInternal@@PEAVUObject@@VFName@@W4EObjectFlags@@@Z
??3UGooglePADFunctionLibrary@@SAXPEAX@Z
??_7UGooglePADFunctionLibrary@@6B@
??_FUGooglePADFunctionLibrary@@QEAAXXZ
?CancelDownload@UGooglePADFunctionLibrary@@SA?AW4EGooglePADErrorCode@@V?$TArray@VFString@@V?$TSizedDefaultAllocator@$0CA@@@@@@Z
?ConvertAssetPackNames@UGooglePADFunctionLibrary@@CAPEAPEADV?$TArray@VFString@@V?$TSizedDefaultAllocator@$0CA@@@@@@Z
?DownloadStateMap@UGooglePADFunctionLibrary@@0V?$TMap@HPEAXVFDefaultSetAllocator@@U?$TDefaultMapHashableKeyFuncs@HPEAX$0A@@@@@A
?DownloadStateMapIndex@UGooglePADFunctionLibrary@@0HA
?GetAssetPackLocation@UGooglePADFunctionLibrary@@SA?AW4EGooglePADErrorCode@@AEBVFString@@AEAH@Z
?GetAssetsPath@UGooglePADFunctionLibrary@@SA?AVFString@@H@Z
?GetBytesDownloaded@UGooglePADFunctionLibrary@@SAHH@Z
?GetDownloadState@UGooglePADFunctionLibrary@@SA?AW4EGooglePADErrorCode@@AEBVFString@@AEAH@Z
?GetDownloadStatus@UGooglePADFunctionLibrary@@SA?AW4EGooglePADDownloadStatus@@H@Z
?GetPrivateStaticClass@UGooglePADFunctionLibrary@@CAPEAVUClass@@XZ
?GetShowCellularDataConfirmationStatus@UGooglePADFunctionLibrary@@SA?AW4EGooglePADErrorCode@@AEAW4EGooglePADCellularDataConfirmStatus@@@Z
?GetStorageMethod@UGooglePADFunctionLibrary@@SA?AW4EGooglePADStorageMethod@@H@Z
?GetTotalBytesToDownload@UGooglePADFunctionLibrary@@SAHH@Z
?HandleApplicationHasEnteredForeground@UGooglePADFunctionLibrary@@CAXXZ
?HandleApplicationWillEnterBackground@UGooglePADFunctionLibrary@@CAXXZ
?Initialize@UGooglePADFunctionLibrary@@SAXXZ
?LocationMap@UGooglePADFunctionLibrary@@0V?$TMap@HPEAXVFDefaultSetAllocator@@U?$TDefaultMapHashableKeyFuncs@HPEAX$0A@@@@@A
?LocationMapIndex@UGooglePADFunctionLibrary@@0HA
?LogGooglePAD@@3UFLogCategoryLogGooglePAD@@A
?PauseHandle@UGooglePADFunctionLibrary@@0VFDelegateHandle@@A
?ReleaseAssetPackLocation@UGooglePADFunctionLibrary@@SAXH@Z
?ReleaseAssetPackNames@UGooglePADFunctionLibrary@@CAXPEAPEBDH@Z
?ReleaseDownloadState@UGooglePADFunctionLibrary@@SAXH@Z
?RequestDownload@UGooglePADFunctionLibrary@@SA?AW4EGooglePADErrorCode@@V?$TArray@VFString@@V?$TSizedDefaultAllocator@$0CA@@@@@@Z
?RequestInfo@UGooglePADFunctionLibrary@@SA?AW4EGooglePADErrorCode@@V?$TArray@VFString@@V?$TSizedDefaultAllocator@$0CA@@@@@@Z
?RequestRemoval@UGooglePADFunctionLibrary@@SA?AW4EGooglePADErrorCode@@AEBVFString@@@Z
?ResumeHandle@UGooglePADFunctionLibrary@@0VFDelegateHandle@@A
?ShowCellularDataConfirmation@UGooglePADFunctionLibrary@@SA?AW4EGooglePADErrorCode@@XZ
?Shutdown@UGooglePADFunctionLibrary@@SAXXZ
?StaticClass@UGooglePADFunctionLibrary@@SAPEAVUClass@@XZ
?StaticClassCastFlags@UGooglePADFunctionLibrary@@SA?AW4EClassCastFlags@@XZ
?StaticClassFlags@UGooglePADFunctionLibrary@@2W4EClassFlags@@B
?StaticPackage@UGooglePADFunctionLibrary@@SAPEB_WXZ
?StaticRegisterNativesUGooglePADFunctionLibrary@UGooglePADFunctionLibrary@@CAXXZ
?Z_Construct_UClass_UGooglePADFunctionLibrary@@YAPEAVUClass@@XZ
?Z_Construct_UClass_UGooglePADFunctionLibrary_NoRegister@@YAPEAVUClass@@XZ
?Z_Construct_UEnum_GooglePAD_EGooglePADCellularDataConfirmStatus@@YAPEAVUEnum@@XZ
?Z_Construct_UEnum_GooglePAD_EGooglePADDownloadStatus@@YAPEAVUEnum@@XZ
?Z_Construct_UEnum_GooglePAD_EGooglePADErrorCode@@YAPEAVUEnum@@XZ
?Z_Construct_UEnum_GooglePAD_EGooglePADStorageMethod@@YAPEAVUEnum@@XZ
?__DefaultConstructor@UGooglePADFunctionLibrary@@SAXAEBVFObjectInitializer@@@Z
?__VTableCtorCaller@UGooglePADFunctionLibrary@@SAPEAVUObject@@AEAVFVTableHelper@@@Z
?execCancelDownload@UGooglePADFunctionLibrary@@SAXPEAVUObject@@AEAUFFrame@@QEAX@Z
?execGetAssetPackLocation@UGooglePADFunctionLibrary@@SAXPEAVUObject@@AEAUFFrame@@QEAX@Z
?execGetAssetsPath@UGooglePADFunctionLibrary@@SAXPEAVUObject@@AEAUFFrame@@QEAX@Z
?execGetBytesDownloaded@UGooglePADFunctionLibrary@@SAXPEAVUObject@@AEAUFFrame@@QEAX@Z
?execGetDownloadState@UGooglePADFunctionLibrary@@SAXPEAVUObject@@AEAUFFrame@@QEAX@Z
?execGetDownloadStatus@UGooglePADFunctionLibrary@@SAXPEAVUObject@@AEAUFFrame@@QEAX@Z
?execGetShowCellularDataConfirmationStatus@UGooglePADFunctionLibrary@@SAXPEAVUObject@@AEAUFFrame@@QEAX@Z
?execGetStorageMethod@UGooglePADFunctionLibrary@@SAXPEAVUObject@@AEAUFFrame@@QEAX@Z
?execGetTotalBytesToDownload@UGooglePADFunctionLibrary@@SAXPEAVUObject@@AEAUFFrame@@QEAX@Z
?execReleaseAssetPackLocation@UGooglePADFunctionLibrary@@SAXPEAVUObject@@AEAUFFrame@@QEAX@Z
?execReleaseDownloadState@UGooglePADFunctionLibrary@@SAXPEAVUObject@@AEAUFFrame@@QEAX@Z
?execRequestDownload@UGooglePADFunctionLibrary@@SAXPEAVUObject@@AEAUFFrame@@QEAX@Z
?execRequestInfo@UGooglePADFunctionLibrary@@SAXPEAVUObject@@AEAUFFrame@@QEAX@Z
?execRequestRemoval@UGooglePADFunctionLibrary@@SAXPEAVUObject@@AEAUFFrame@@QEAX@Z
?execShowCellularDataConfirmation@UGooglePADFunctionLibrary@@SAXPEAVUObject@@AEAUFFrame@@QEAX@Z
InitializeModule

Sections

.text
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

92287fe31602d17bbed70e71692499ae

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

59:dd:d2:bf:a6:72:e1:01:5a:f0:0f:f1Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

b9:ff:63:9d:af:19:26:10:72:1c:49:dd:cb:f1:77:2f:58:4d:bb:38:ed:80:34:52:43:78:7e:f4:6e:f2:43:d3Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

factoryserver-coreuobject

factoryserver-engine

factoryserver-core

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

kernel32

Exports

Exports

Sections

.text Size: 21KB - Virtual size: 21KB

.rdata Size: 30KB - Virtual size: 29KB

.data Size: 2KB - Virtual size: 3KB

.pdata Size: 2KB - Virtual size: 2KB

.rsrc Size: 59KB - Virtual size: 58KB

.reloc Size: 1024B - Virtual size: 920B

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

59:dd:d2:bf:a6:72:e1:01:5a:f0:0f:f1
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

b9:ff:63:9d:af:19:26:10:72:1c:49:dd:cb:f1:77:2f:58:4d:bb:38:ed:80:34:52:43:78:7e:f4:6e:f2:43:d3
Signer

.text
Size: 21KB - Virtual size: 21KB

.rdata
Size: 30KB - Virtual size: 29KB

.data
Size: 2KB - Virtual size: 3KB

.pdata
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 59KB - Virtual size: 58KB

.reloc
Size: 1024B - Virtual size: 920B