67a022b27ab2003c4ff0069406e6533fed0d3ad61b4104175aad9ad97a022311_NeikiAnalytics[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

67a022b27ab2003c4ff0069406e6533fed0d3ad61b4104175aad9ad97a022311_NeikiAnalytics.exe
Size

991KB
MD5

45bd633cd7778bb66cf640a8d7fff580
SHA1

4c5502464140a7a7a06e6b4dbacfd64088ece467
SHA256

67a022b27ab2003c4ff0069406e6533fed0d3ad61b4104175aad9ad97a022311
SHA512

357dc606acdad45930d2b843e9e27ae27221caee4b4db7ae3bcdc69608deed0a54eacce6791a81b1821c8292685b7b23a7e290bb6ca1de1b67991fe62a75b352
SSDEEP

24576:q78Re3G/6TRiX2xNu1UYaUZryQKHP6rQa1h+NDkxwS6NUR8UH+mYKBX:qwsWCNi6u1UYaUZrTKHP6rQa1hyDkxwG

Score

1^/10

Malware Config

Signatures

Files

67a022b27ab2003c4ff0069406e6533fed0d3ad61b4104175aad9ad97a022311_NeikiAnalytics.exe
.dll windows:4 windows x64 arch:x64

241c39c01a4e86dc2813ef26b7983219

Code Sign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15-06-2016 00:00

Not After

15-06-2024 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4e:26:ee:16:3d:0f:ce:45:51:d1:b5:c6
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

14-08-2020 07:07

Not After

14-11-2023 07:07

Subject

CN=LongEasy Co.\, Ltd,O=LongEasy Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

38:63:de:f8
Certificate

Issuer

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Not Before

24-12-1999 17:50

Not After

24-07-2029 14:15

Subject

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

58:da:13:ff:00:00:00:00:51:ce:0d:f7
Certificate

Issuer

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Not Before

22-07-2015 19:02

Not After

22-06-2029 19:32

Subject

CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f
Certificate

Issuer

CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

04-10-2022 17:21

Not After

01-01-2029 00:00

Subject

CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

8c:0b:6d:40:22:c4:de:99:9b:4b:b4:01:4c:b0:4f:f7:4d:e8:5a:2d:f8:d1:6e:27:a8:4d:da:38:cc:79:f7:2c
Signer

Actual PE Digest

8c:0b:6d:40:22:c4:de:99:9b:4b:b4:01:4c:b0:4f:f7:4d:e8:5a:2d:f8:d1:6e:27:a8:4d:da:38:cc:79:f7:2c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

libcrypto-1_1-x64

ASN1_OCTET_STRING_it
ASN1_item_d2i
ASN1_item_free
ASN1_item_i2d
ASYNC_WAIT_CTX_free
ASYNC_WAIT_CTX_get_all_fds
ASYNC_WAIT_CTX_get_changed_fds
ASYNC_WAIT_CTX_new
ASYNC_get_current_job
ASYNC_start_job
BIO_ADDR_clear
BIO_ADDR_free
BIO_ADDR_new
BIO_callback_ctrl
BIO_clear_flags
BIO_copy_next_retry
BIO_ctrl
BIO_dump_indent
BIO_f_buffer
BIO_find_type
BIO_free
BIO_free_all
BIO_get_data
BIO_get_init
BIO_get_retry_reason
BIO_get_shutdown
BIO_int_ctrl
BIO_method_type
BIO_new
BIO_next
BIO_pop
BIO_printf
BIO_push
BIO_puts
BIO_read
BIO_s_connect
BIO_s_file
BIO_s_mem
BIO_s_socket
BIO_set_data
BIO_set_flags
BIO_set_init
BIO_set_next
BIO_set_retry_reason
BIO_set_shutdown
BIO_snprintf
BIO_test_flags
BIO_up_ref
BIO_write
BN_bin2bn
BN_bn2bin
BN_clear_free
BN_copy
BN_dup
BN_free
BN_get_rfc3526_prime_3072
BN_get_rfc3526_prime_8192
BN_is_zero
BN_new
BN_num_bits
BN_set_word
BN_ucmp
BUF_MEM_free
BUF_MEM_grow
BUF_MEM_grow_clean
BUF_MEM_new
BUF_reverse
COMP_CTX_free
COMP_CTX_get_method
COMP_CTX_new
COMP_compress_block
COMP_expand_block
COMP_get_name
COMP_get_type
COMP_zlib
CONF_parse_list
CRYPTO_THREAD_lock_free
CRYPTO_THREAD_lock_new
CRYPTO_THREAD_read_lock
CRYPTO_THREAD_run_once
CRYPTO_THREAD_unlock
CRYPTO_THREAD_write_lock
CRYPTO_clear_free
CRYPTO_dup_ex_data
CRYPTO_free
CRYPTO_free_ex_data
CRYPTO_get_ex_data
CRYPTO_get_ex_new_index
CRYPTO_malloc
CRYPTO_mem_ctrl
CRYPTO_memcmp
CRYPTO_memdup
CRYPTO_new_ex_data
CRYPTO_realloc
CRYPTO_secure_free
CRYPTO_secure_zalloc
CRYPTO_set_ex_data
CRYPTO_strdup
CRYPTO_strndup
CRYPTO_zalloc
CTLOG_STORE_free
CTLOG_STORE_load_default_file
CTLOG_STORE_load_file
CTLOG_STORE_new
CT_POLICY_EVAL_CTX_free
CT_POLICY_EVAL_CTX_new
CT_POLICY_EVAL_CTX_set1_cert
CT_POLICY_EVAL_CTX_set1_issuer
CT_POLICY_EVAL_CTX_set_shared_CTLOG_STORE
CT_POLICY_EVAL_CTX_set_time
DH_check_params
DH_free
DH_get0_key
DH_get0_pqg
DH_get_1024_160
DH_get_2048_224
DH_new
DH_security_bits
DH_set0_key
DH_set0_pqg
EC_GROUP_get_curve_name
EC_GROUP_method_of
EC_KEY_can_sign
EC_KEY_free
EC_KEY_get0_group
EC_KEY_get_conv_form
EC_KEY_new_by_curve_name
EC_METHOD_get_field_type
EC_curve_nist2nid
ENGINE_finish
ENGINE_get_ssl_client_cert_function
ENGINE_init
ENGINE_load_ssl_client_cert
ERR_add_error_data
ERR_clear_error
ERR_func_error_string
ERR_load_strings_const
ERR_peek_error
ERR_peek_last_error
ERR_pop_to_mark
ERR_put_error
ERR_set_mark
EVP_CIPHER_CTX_block_size
EVP_CIPHER_CTX_cipher
EVP_CIPHER_CTX_ctrl
EVP_CIPHER_CTX_free
EVP_CIPHER_CTX_iv_length
EVP_CIPHER_CTX_new
EVP_CIPHER_CTX_reset
EVP_CIPHER_block_size
EVP_CIPHER_flags
EVP_CIPHER_iv_length
EVP_CIPHER_key_length
EVP_Cipher
EVP_CipherFinal_ex
EVP_CipherInit_ex
EVP_CipherUpdate
EVP_DecryptFinal
EVP_DecryptInit_ex
EVP_DecryptUpdate
EVP_Digest
EVP_DigestFinal
EVP_DigestFinal_ex
EVP_DigestInit
EVP_DigestInit_ex
EVP_DigestSign
EVP_DigestSignFinal
EVP_DigestSignInit
EVP_DigestUpdate
EVP_DigestVerify
EVP_DigestVerifyFinal
EVP_DigestVerifyInit
EVP_EncryptFinal
EVP_EncryptInit_ex
EVP_EncryptUpdate
EVP_MD_CTX_copy
EVP_MD_CTX_copy_ex
EVP_MD_CTX_ctrl
EVP_MD_CTX_free
EVP_MD_CTX_md
EVP_MD_CTX_new
EVP_MD_CTX_set_flags
EVP_MD_size
EVP_MD_type
EVP_PKEY_CTX_ctrl
EVP_PKEY_CTX_free
EVP_PKEY_CTX_new
EVP_PKEY_CTX_new_id
EVP_PKEY_asn1_find_str
EVP_PKEY_asn1_get0_info
EVP_PKEY_assign
EVP_PKEY_cmp
EVP_PKEY_copy_parameters
EVP_PKEY_decrypt
EVP_PKEY_decrypt_init
EVP_PKEY_derive
EVP_PKEY_derive_init
EVP_PKEY_derive_set_peer
EVP_PKEY_encrypt
EVP_PKEY_encrypt_init
EVP_PKEY_free
EVP_PKEY_get0
EVP_PKEY_get0_DH
EVP_PKEY_get0_EC_KEY
EVP_PKEY_get0_RSA
EVP_PKEY_get1_tls_encodedpoint
EVP_PKEY_get_default_digest_nid
EVP_PKEY_id
EVP_PKEY_keygen
EVP_PKEY_keygen_init
EVP_PKEY_missing_parameters
EVP_PKEY_new
EVP_PKEY_new_mac_key
EVP_PKEY_new_raw_private_key
EVP_PKEY_paramgen
EVP_PKEY_paramgen_init
EVP_PKEY_security_bits
EVP_PKEY_set1_DH
EVP_PKEY_set1_tls_encodedpoint
EVP_PKEY_set_type
EVP_PKEY_size
EVP_PKEY_up_ref
EVP_add_cipher
EVP_add_digest
EVP_aes_128_cbc
EVP_aes_128_cbc_hmac_sha1
EVP_aes_128_cbc_hmac_sha256
EVP_aes_128_ccm
EVP_aes_128_gcm
EVP_aes_192_cbc
EVP_aes_256_cbc
EVP_aes_256_cbc_hmac_sha1
EVP_aes_256_cbc_hmac_sha256
EVP_aes_256_ccm
EVP_aes_256_gcm
EVP_aria_128_gcm
EVP_aria_256_gcm
EVP_camellia_128_cbc
EVP_camellia_256_cbc
EVP_chacha20_poly1305
EVP_des_cbc
EVP_des_ede3_cbc
EVP_enc_null
EVP_get_cipherbyname
EVP_get_digestbyname
EVP_md5
EVP_md5_sha1
EVP_rc2_40_cbc
EVP_rc2_cbc
EVP_rc4
EVP_rc4_hmac_md5
EVP_seed_cbc
EVP_sha1
EVP_sha224
EVP_sha256
EVP_sha384
EVP_sha512
HMAC_CTX_free
HMAC_CTX_new
HMAC_Final
HMAC_Init_ex
HMAC_Update
HMAC_size
INT32_it
MD5_Init
MD5_Transform
OBJ_NAME_add
OBJ_bsearch_
OBJ_ln2nid
OBJ_nid2sn
OBJ_sn2nid
OCSP_BASICRESP_free
OCSP_RESPID_free
OCSP_RESPONSE_free
OCSP_SINGLERESP_get1_ext_d2i
OCSP_resp_count
OCSP_resp_get0
OCSP_response_get1_basic
OPENSSL_DIR_end
OPENSSL_DIR_read
OPENSSL_LH_delete
OPENSSL_LH_doall_arg
OPENSSL_LH_free
OPENSSL_LH_get_down_load
OPENSSL_LH_insert
OPENSSL_LH_new
OPENSSL_LH_num_items
OPENSSL_LH_retrieve
OPENSSL_LH_set_down_load
OPENSSL_atexit
OPENSSL_cleanse
OPENSSL_init_crypto
OPENSSL_sk_delete
OPENSSL_sk_dup
OPENSSL_sk_find
OPENSSL_sk_free
OPENSSL_sk_insert
OPENSSL_sk_new
OPENSSL_sk_new_null
OPENSSL_sk_new_reserve
OPENSSL_sk_num
OPENSSL_sk_pop
OPENSSL_sk_pop_free
OPENSSL_sk_push
OPENSSL_sk_set_cmp_func
OPENSSL_sk_shift
OPENSSL_sk_sort
OPENSSL_sk_value
PEM_ASN1_read
PEM_ASN1_read_bio
PEM_ASN1_write
PEM_ASN1_write_bio
PEM_read_bio
PEM_read_bio_DHparams
PEM_read_bio_PrivateKey
PEM_read_bio_RSAPrivateKey
PEM_read_bio_X509
PEM_read_bio_X509_AUX
RAND_bytes
RAND_priv_bytes
RSA_flags
RSA_free
RSA_pkey_ctx_ctrl
RSA_private_decrypt
RSA_size
RSA_up_ref
SCT_LIST_free
SCT_LIST_validate
SCT_get_validation_status
SCT_set_source
SHA1_Init
SHA1_Transform
SHA224_Init
SHA256_Init
SHA256_Transform
SHA384_Init
SHA512_Init
SHA512_Transform
SRP_Calc_A
SRP_Calc_B
SRP_Calc_client_key
SRP_Calc_server_key
SRP_Calc_u
SRP_Calc_x
SRP_Verify_A_mod_N
SRP_Verify_B_mod_N
SRP_check_known_gN_param
SRP_create_verifier_BN
SRP_get_default_gN
UINT32_it
X509_EXTENSION_free
X509_LOOKUP_ctrl
X509_LOOKUP_file
X509_LOOKUP_hash_dir
X509_NAME_cmp
X509_NAME_dup
X509_NAME_free
X509_NAME_hash
X509_STORE_CTX_free
X509_STORE_CTX_get0_chain
X509_STORE_CTX_get0_param
X509_STORE_CTX_get1_chain
X509_STORE_CTX_get_error
X509_STORE_CTX_init
X509_STORE_CTX_new
X509_STORE_CTX_set0_dane
X509_STORE_CTX_set_default
X509_STORE_CTX_set_ex_data
X509_STORE_CTX_set_flags
X509_STORE_CTX_set_verify_cb
X509_STORE_add_cert
X509_STORE_add_lookup
X509_STORE_free
X509_STORE_load_locations
X509_STORE_new
X509_STORE_set_default_paths
X509_STORE_up_ref
X509_VERIFY_PARAM_add1_host
X509_VERIFY_PARAM_free
X509_VERIFY_PARAM_get0_peername
X509_VERIFY_PARAM_get_depth
X509_VERIFY_PARAM_inherit
X509_VERIFY_PARAM_move_peername
X509_VERIFY_PARAM_new
X509_VERIFY_PARAM_set1
X509_VERIFY_PARAM_set1_host
X509_VERIFY_PARAM_set_auth_level
X509_VERIFY_PARAM_set_depth
X509_VERIFY_PARAM_set_hostflags
X509_VERIFY_PARAM_set_purpose
X509_VERIFY_PARAM_set_trust
X509_chain_check_suiteb
X509_chain_up_ref
X509_check_private_key
X509_cmp
X509_free
X509_get0_pubkey
X509_get_ext_d2i
X509_get_extension_flags
X509_get_issuer_name
X509_get_key_usage
X509_get_pubkey
X509_get_signature_info
X509_get_signature_nid
X509_get_subject_name
X509_it
X509_up_ref
X509_verify_cert
X509_verify_cert_error_string
ZINT32_it
ZINT64_it
ZUINT32_it
ZUINT64_it
conf_ssl_get
conf_ssl_get_cmd
conf_ssl_name_find
d2i_OCSP_RESPID
d2i_OCSP_RESPONSE
d2i_PUBKEY
d2i_PrivateKey
d2i_PrivateKey_bio
d2i_RSAPrivateKey
d2i_RSAPrivateKey_bio
d2i_X509
d2i_X509_EXTENSIONS
d2i_X509_NAME
d2i_X509_bio
err_free_strings_int
i2d_OCSP_RESPID
i2d_X509
i2d_X509_EXTENSIONS
i2d_X509_NAME
o2i_SCT_LIST

kernel32

DeleteCriticalSection
EnterCriticalSection
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetSystemTime
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetLastError
SetUnhandledExceptionFilter
Sleep
SystemTimeToFileTime
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery

msvcrt

__dllonexit
__iob_func
_amsg_exit
_errno
_initterm
_lock
_onexit
_stricmp
_strnicmp
_time64
_unlock
abort
atoi
calloc
free
fwrite
malloc
memchr
memcmp
memcpy
memmove
memset
qsort
signal
sprintf
strchr
strcmp
strcpy
strlen
strncmp
vfprintf

Exports

Exports

BIO_f_ssl
BIO_new_buffer_ssl_connect
BIO_new_ssl
BIO_new_ssl_connect
BIO_ssl_copy_session_id
BIO_ssl_shutdown
DTLS_client_method
DTLS_get_data_mtu
DTLS_method
DTLS_server_method
DTLS_set_timer_cb
DTLSv1_2_client_method
DTLSv1_2_method
DTLSv1_2_server_method
DTLSv1_client_method
DTLSv1_listen
DTLSv1_method
DTLSv1_server_method
ERR_load_SSL_strings
OPENSSL_cipher_name
OPENSSL_init_ssl
PEM_read_SSL_SESSION
PEM_read_bio_SSL_SESSION
PEM_write_SSL_SESSION
PEM_write_bio_SSL_SESSION
SRP_Calc_A_param
SSL_CIPHER_description
SSL_CIPHER_find
SSL_CIPHER_get_auth_nid
SSL_CIPHER_get_bits
SSL_CIPHER_get_cipher_nid
SSL_CIPHER_get_digest_nid
SSL_CIPHER_get_handshake_digest
SSL_CIPHER_get_id
SSL_CIPHER_get_kx_nid
SSL_CIPHER_get_name
SSL_CIPHER_get_protocol_id
SSL_CIPHER_get_version
SSL_CIPHER_is_aead
SSL_CIPHER_standard_name
SSL_COMP_add_compression_method
SSL_COMP_get0_name
SSL_COMP_get_compression_methods
SSL_COMP_get_id
SSL_COMP_get_name
SSL_COMP_set0_compression_methods
SSL_CONF_CTX_clear_flags
SSL_CONF_CTX_finish
SSL_CONF_CTX_free
SSL_CONF_CTX_new
SSL_CONF_CTX_set1_prefix
SSL_CONF_CTX_set_flags
SSL_CONF_CTX_set_ssl
SSL_CONF_CTX_set_ssl_ctx
SSL_CONF_cmd
SSL_CONF_cmd_argv
SSL_CONF_cmd_value_type
SSL_CTX_SRP_CTX_free
SSL_CTX_SRP_CTX_init
SSL_CTX_add1_to_CA_list
SSL_CTX_add_client_CA
SSL_CTX_add_client_custom_ext
SSL_CTX_add_custom_ext
SSL_CTX_add_server_custom_ext
SSL_CTX_add_session
SSL_CTX_callback_ctrl
SSL_CTX_check_private_key
SSL_CTX_clear_options
SSL_CTX_config
SSL_CTX_ct_is_enabled
SSL_CTX_ctrl
SSL_CTX_dane_clear_flags
SSL_CTX_dane_enable
SSL_CTX_dane_mtype_set
SSL_CTX_dane_set_flags
SSL_CTX_enable_ct
SSL_CTX_flush_sessions
SSL_CTX_free
SSL_CTX_get0_CA_list
SSL_CTX_get0_certificate
SSL_CTX_get0_ctlog_store
SSL_CTX_get0_param
SSL_CTX_get0_privatekey
SSL_CTX_get0_security_ex_data
SSL_CTX_get_cert_store
SSL_CTX_get_ciphers
SSL_CTX_get_client_CA_list
SSL_CTX_get_client_cert_cb
SSL_CTX_get_default_passwd_cb
SSL_CTX_get_default_passwd_cb_userdata
SSL_CTX_get_ex_data
SSL_CTX_get_info_callback
SSL_CTX_get_keylog_callback
SSL_CTX_get_max_early_data
SSL_CTX_get_num_tickets
SSL_CTX_get_options
SSL_CTX_get_quiet_shutdown
SSL_CTX_get_record_padding_callback_arg
SSL_CTX_get_recv_max_early_data
SSL_CTX_get_security_callback
SSL_CTX_get_security_level
SSL_CTX_get_ssl_method
SSL_CTX_get_timeout
SSL_CTX_get_verify_callback
SSL_CTX_get_verify_depth
SSL_CTX_get_verify_mode
SSL_CTX_has_client_custom_ext
SSL_CTX_load_verify_locations
SSL_CTX_new
SSL_CTX_remove_session
SSL_CTX_sess_get_get_cb
SSL_CTX_sess_get_new_cb
SSL_CTX_sess_get_remove_cb
SSL_CTX_sess_set_get_cb
SSL_CTX_sess_set_new_cb
SSL_CTX_sess_set_remove_cb
SSL_CTX_sessions
SSL_CTX_set0_CA_list
SSL_CTX_set0_ctlog_store
SSL_CTX_set0_security_ex_data
SSL_CTX_set1_cert_store
SSL_CTX_set1_param
SSL_CTX_set_allow_early_data_cb
SSL_CTX_set_alpn_protos
SSL_CTX_set_alpn_select_cb
SSL_CTX_set_block_padding
SSL_CTX_set_cert_cb
SSL_CTX_set_cert_store
SSL_CTX_set_cert_verify_callback
SSL_CTX_set_cipher_list
SSL_CTX_set_ciphersuites
SSL_CTX_set_client_CA_list
SSL_CTX_set_client_cert_cb
SSL_CTX_set_client_cert_engine
SSL_CTX_set_client_hello_cb
SSL_CTX_set_cookie_generate_cb
SSL_CTX_set_cookie_verify_cb
SSL_CTX_set_ct_validation_callback
SSL_CTX_set_ctlog_list_file
SSL_CTX_set_default_ctlog_list_file
SSL_CTX_set_default_passwd_cb
SSL_CTX_set_default_passwd_cb_userdata
SSL_CTX_set_default_read_buffer_len
SSL_CTX_set_default_verify_dir
SSL_CTX_set_default_verify_file
SSL_CTX_set_default_verify_paths
SSL_CTX_set_ex_data
SSL_CTX_set_generate_session_id
SSL_CTX_set_info_callback
SSL_CTX_set_keylog_callback
SSL_CTX_set_max_early_data
SSL_CTX_set_msg_callback
SSL_CTX_set_next_proto_select_cb
SSL_CTX_set_next_protos_advertised_cb
SSL_CTX_set_not_resumable_session_callback
SSL_CTX_set_num_tickets
SSL_CTX_set_options
SSL_CTX_set_post_handshake_auth
SSL_CTX_set_psk_client_callback
SSL_CTX_set_psk_find_session_callback
SSL_CTX_set_psk_server_callback
SSL_CTX_set_psk_use_session_callback
SSL_CTX_set_purpose
SSL_CTX_set_quiet_shutdown
SSL_CTX_set_record_padding_callback
SSL_CTX_set_record_padding_callback_arg
SSL_CTX_set_recv_max_early_data
SSL_CTX_set_security_callback
SSL_CTX_set_security_level
SSL_CTX_set_session_id_context
SSL_CTX_set_session_ticket_cb
SSL_CTX_set_srp_cb_arg
SSL_CTX_set_srp_client_pwd_callback
SSL_CTX_set_srp_password
SSL_CTX_set_srp_strength
SSL_CTX_set_srp_username
SSL_CTX_set_srp_username_callback
SSL_CTX_set_srp_verify_param_callback
SSL_CTX_set_ssl_version
SSL_CTX_set_stateless_cookie_generate_cb
SSL_CTX_set_stateless_cookie_verify_cb
SSL_CTX_set_timeout
SSL_CTX_set_tlsext_max_fragment_length
SSL_CTX_set_tlsext_use_srtp
SSL_CTX_set_tmp_dh_callback
SSL_CTX_set_trust
SSL_CTX_set_verify
SSL_CTX_set_verify_depth
SSL_CTX_up_ref
SSL_CTX_use_PrivateKey
SSL_CTX_use_PrivateKey_ASN1
SSL_CTX_use_PrivateKey_file
SSL_CTX_use_RSAPrivateKey
SSL_CTX_use_RSAPrivateKey_ASN1
SSL_CTX_use_RSAPrivateKey_file
SSL_CTX_use_cert_and_key
SSL_CTX_use_certificate
SSL_CTX_use_certificate_ASN1
SSL_CTX_use_certificate_chain_file
SSL_CTX_use_certificate_file
SSL_CTX_use_psk_identity_hint
SSL_CTX_use_serverinfo
SSL_CTX_use_serverinfo_ex
SSL_CTX_use_serverinfo_file
SSL_SESSION_dup
SSL_SESSION_free
SSL_SESSION_get0_alpn_selected
SSL_SESSION_get0_cipher
SSL_SESSION_get0_hostname
SSL_SESSION_get0_id_context
SSL_SESSION_get0_peer
SSL_SESSION_get0_ticket
SSL_SESSION_get0_ticket_appdata
SSL_SESSION_get_compress_id
SSL_SESSION_get_ex_data
SSL_SESSION_get_id
SSL_SESSION_get_master_key
SSL_SESSION_get_max_early_data
SSL_SESSION_get_max_fragment_length
SSL_SESSION_get_protocol_version
SSL_SESSION_get_ticket_lifetime_hint
SSL_SESSION_get_time
SSL_SESSION_get_timeout
SSL_SESSION_has_ticket
SSL_SESSION_is_resumable
SSL_SESSION_new
SSL_SESSION_print
SSL_SESSION_print_fp
SSL_SESSION_print_keylog
SSL_SESSION_set1_alpn_selected
SSL_SESSION_set1_hostname
SSL_SESSION_set1_id
SSL_SESSION_set1_id_context
SSL_SESSION_set1_master_key
SSL_SESSION_set1_ticket_appdata
SSL_SESSION_set_cipher
SSL_SESSION_set_ex_data
SSL_SESSION_set_max_early_data
SSL_SESSION_set_protocol_version
SSL_SESSION_set_time
SSL_SESSION_set_timeout
SSL_SESSION_up_ref
SSL_SRP_CTX_free
SSL_SRP_CTX_init
SSL_accept
SSL_add1_host
SSL_add1_to_CA_list
SSL_add_client_CA
SSL_add_dir_cert_subjects_to_stack
SSL_add_file_cert_subjects_to_stack
SSL_add_ssl_module
SSL_alert_desc_string
SSL_alert_desc_string_long
SSL_alert_type_string
SSL_alert_type_string_long
SSL_alloc_buffers
SSL_bytes_to_cipher_list
SSL_callback_ctrl
SSL_certs_clear
SSL_check_chain
SSL_check_private_key
SSL_clear
SSL_clear_options
SSL_client_hello_get0_ciphers
SSL_client_hello_get0_compression_methods
SSL_client_hello_get0_ext
SSL_client_hello_get0_legacy_version
SSL_client_hello_get0_random
SSL_client_hello_get0_session_id
SSL_client_hello_get1_extensions_present
SSL_client_hello_isv2
SSL_client_version
SSL_config
SSL_connect
SSL_copy_session_id
SSL_ct_is_enabled
SSL_ctrl
SSL_dane_clear_flags
SSL_dane_enable
SSL_dane_set_flags
SSL_dane_tlsa_add
SSL_do_handshake
SSL_dup
SSL_dup_CA_list
SSL_enable_ct
SSL_export_keying_material
SSL_export_keying_material_early
SSL_extension_supported
SSL_free
SSL_free_buffers
SSL_get0_CA_list
SSL_get0_alpn_selected
SSL_get0_dane
SSL_get0_dane_authority
SSL_get0_dane_tlsa
SSL_get0_next_proto_negotiated
SSL_get0_param
SSL_get0_peer_CA_list
SSL_get0_peer_scts
SSL_get0_peername
SSL_get0_security_ex_data
SSL_get0_verified_chain
SSL_get1_session
SSL_get1_supported_ciphers
SSL_get_SSL_CTX
SSL_get_all_async_fds
SSL_get_certificate
SSL_get_changed_async_fds
SSL_get_cipher_list
SSL_get_ciphers
SSL_get_client_CA_list
SSL_get_client_ciphers
SSL_get_client_random
SSL_get_current_cipher
SSL_get_current_compression
SSL_get_current_expansion
SSL_get_default_passwd_cb
SSL_get_default_passwd_cb_userdata
SSL_get_default_timeout
SSL_get_early_data_status
SSL_get_error
SSL_get_ex_data
SSL_get_ex_data_X509_STORE_CTX_idx
SSL_get_fd
SSL_get_finished
SSL_get_info_callback
SSL_get_key_update_type
SSL_get_max_early_data
SSL_get_num_tickets
SSL_get_options
SSL_get_peer_cert_chain
SSL_get_peer_certificate
SSL_get_peer_finished
SSL_get_peer_signature_type_nid
SSL_get_pending_cipher
SSL_get_privatekey
SSL_get_psk_identity
SSL_get_psk_identity_hint
SSL_get_quiet_shutdown
SSL_get_rbio
SSL_get_read_ahead
SSL_get_record_padding_callback_arg
SSL_get_recv_max_early_data
SSL_get_rfd
SSL_get_security_callback
SSL_get_security_level
SSL_get_selected_srtp_profile
SSL_get_server_random
SSL_get_servername
SSL_get_servername_type
SSL_get_session
SSL_get_shared_ciphers
SSL_get_shared_sigalgs
SSL_get_shutdown
SSL_get_sigalgs
SSL_get_signature_type_nid
SSL_get_srp_N
SSL_get_srp_g
SSL_get_srp_userinfo
SSL_get_srp_username
SSL_get_srtp_profiles
SSL_get_ssl_method
SSL_get_state
SSL_get_verify_callback
SSL_get_verify_depth
SSL_get_verify_mode
SSL_get_verify_result
SSL_get_version
SSL_get_wbio
SSL_get_wfd
SSL_has_matching_session_id
SSL_has_pending
SSL_in_before
SSL_in_init
SSL_is_dtls
SSL_is_init_finished
SSL_is_server
SSL_key_update
SSL_load_client_CA_file
SSL_new
SSL_peek
SSL_peek_ex
SSL_pending
SSL_read
SSL_read_early_data
SSL_read_ex
SSL_renegotiate
SSL_renegotiate_abbreviated
SSL_renegotiate_pending
SSL_rstate_string
SSL_rstate_string_long
SSL_select_next_proto
SSL_session_reused
SSL_set0_CA_list
SSL_set0_rbio
SSL_set0_security_ex_data
SSL_set0_wbio
SSL_set1_host
SSL_set1_param
SSL_set_SSL_CTX
SSL_set_accept_state
SSL_set_allow_early_data_cb
SSL_set_alpn_protos
SSL_set_bio
SSL_set_block_padding
SSL_set_cert_cb
SSL_set_cipher_list
SSL_set_ciphersuites
SSL_set_client_CA_list
SSL_set_connect_state
SSL_set_ct_validation_callback
SSL_set_debug
SSL_set_default_passwd_cb
SSL_set_default_passwd_cb_userdata
SSL_set_default_read_buffer_len
SSL_set_ex_data
SSL_set_fd
SSL_set_generate_session_id
SSL_set_hostflags
SSL_set_info_callback
SSL_set_max_early_data
SSL_set_msg_callback
SSL_set_not_resumable_session_callback
SSL_set_num_tickets
SSL_set_options
SSL_set_post_handshake_auth
SSL_set_psk_client_callback
SSL_set_psk_find_session_callback
SSL_set_psk_server_callback
SSL_set_psk_use_session_callback
SSL_set_purpose
SSL_set_quiet_shutdown
SSL_set_read_ahead
SSL_set_record_padding_callback
SSL_set_record_padding_callback_arg
SSL_set_recv_max_early_data
SSL_set_rfd
SSL_set_security_callback
SSL_set_security_level
SSL_set_session
SSL_set_session_id_context
SSL_set_session_secret_cb
SSL_set_session_ticket_ext
SSL_set_session_ticket_ext_cb
SSL_set_shutdown
SSL_set_srp_server_param
SSL_set_srp_server_param_pw
SSL_set_ssl_method
SSL_set_tlsext_max_fragment_length
SSL_set_tlsext_use_srtp
SSL_set_tmp_dh_callback
SSL_set_trust
SSL_set_verify
SSL_set_verify_depth
SSL_set_verify_result
SSL_set_wfd
SSL_shutdown
SSL_srp_server_param_with_username
SSL_state_string
SSL_state_string_long
SSL_stateless
SSL_up_ref
SSL_use_PrivateKey
SSL_use_PrivateKey_ASN1
SSL_use_PrivateKey_file
SSL_use_RSAPrivateKey
SSL_use_RSAPrivateKey_ASN1
SSL_use_RSAPrivateKey_file
SSL_use_cert_and_key
SSL_use_certificate
SSL_use_certificate_ASN1
SSL_use_certificate_chain_file
SSL_use_certificate_file
SSL_use_psk_identity_hint
SSL_verify_client_post_handshake
SSL_version
SSL_waiting_for_async
SSL_want
SSL_write
SSL_write_early_data
SSL_write_ex
TLS_client_method
TLS_method
TLS_server_method
TLSv1_1_client_method
TLSv1_1_method
TLSv1_1_server_method
TLSv1_2_client_method
TLSv1_2_method
TLSv1_2_server_method
TLSv1_client_method
TLSv1_method
TLSv1_server_method
d2i_SSL_SESSION
i2d_SSL_SESSION

Sections

.text
Size: 378KB - Virtual size: 377KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 79KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/4
Size: 1024B - Virtual size: 752B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/19
Size: 242KB - Virtual size: 241KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/31
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/45
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/57
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/70
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/81
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/92
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

241c39c01a4e86dc2813ef26b7983219

Code Sign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cdCertificate

Extended Key Usages

Key Usages

4e:26:ee:16:3d:0f:ce:45:51:d1:b5:c6Certificate

Extended Key Usages

Key Usages

38:63:de:f8Certificate

Key Usages

58:da:13:ff:00:00:00:00:51:ce:0d:f7Certificate

Extended Key Usages

Key Usages

56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1fCertificate

Extended Key Usages

Key Usages

8c:0b:6d:40:22:c4:de:99:9b:4b:b4:01:4c:b0:4f:f7:4d:e8:5a:2d:f8:d1:6e:27:a8:4d:da:38:cc:79:f7:2cSigner

Headers

DLL Characteristics

File Characteristics

Imports

libcrypto-1_1-x64

kernel32

msvcrt

Exports

Exports

Sections

.text Size: 378KB - Virtual size: 377KB

.data Size: 14KB - Virtual size: 13KB

.rdata Size: 79KB - Virtual size: 78KB

.pdata Size: 14KB - Virtual size: 13KB

.xdata Size: 12KB - Virtual size: 11KB

.bss Size: - Virtual size: 2KB

.edata Size: 16KB - Virtual size: 16KB

.idata Size: 19KB - Virtual size: 19KB

.CRT Size: 512B - Virtual size: 88B

.tls Size: 512B - Virtual size: 104B

.rsrc Size: 1024B - Virtual size: 944B

.reloc Size: 5KB - Virtual size: 4KB

/4 Size: 1024B - Virtual size: 752B

/19 Size: 242KB - Virtual size: 241KB

/31 Size: 8KB - Virtual size: 7KB

/45 Size: 8KB - Virtual size: 7KB

/57 Size: 2KB - Virtual size: 2KB

/70 Size: 1KB - Virtual size: 1KB

/81 Size: 11KB - Virtual size: 11KB

/92 Size: 1KB - Virtual size: 1KB

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

4e:26:ee:16:3d:0f:ce:45:51:d1:b5:c6
Certificate

38:63:de:f8
Certificate

58:da:13:ff:00:00:00:00:51:ce:0d:f7
Certificate

56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f
Certificate

8c:0b:6d:40:22:c4:de:99:9b:4b:b4:01:4c:b0:4f:f7:4d:e8:5a:2d:f8:d1:6e:27:a8:4d:da:38:cc:79:f7:2c
Signer

.text
Size: 378KB - Virtual size: 377KB

.data
Size: 14KB - Virtual size: 13KB

.rdata
Size: 79KB - Virtual size: 78KB

.pdata
Size: 14KB - Virtual size: 13KB

.xdata
Size: 12KB - Virtual size: 11KB

.bss
Size: - Virtual size: 2KB

.edata
Size: 16KB - Virtual size: 16KB

.idata
Size: 19KB - Virtual size: 19KB

.CRT
Size: 512B - Virtual size: 88B

.tls
Size: 512B - Virtual size: 104B

.rsrc
Size: 1024B - Virtual size: 944B

.reloc
Size: 5KB - Virtual size: 4KB

/4
Size: 1024B - Virtual size: 752B

/19
Size: 242KB - Virtual size: 241KB

/31
Size: 8KB - Virtual size: 7KB

/45
Size: 8KB - Virtual size: 7KB

/57
Size: 2KB - Virtual size: 2KB

/70
Size: 1KB - Virtual size: 1KB

/81
Size: 11KB - Virtual size: 11KB

/92
Size: 1KB - Virtual size: 1KB