31e671d12346d1351e10c3b0970e27e660edae8073e8cd024a6b30327d08522e_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

31e671d12346d1351e10c3b0970e27e660edae8073e8cd024a6b30327d08522e_NeikiAnalytics.exe
Size

1.5MB
MD5

b783801f44171cba7efd560907c89000
SHA1

b375ecc06c567a3a7f89dd99efbf9bb4dd265f16
SHA256

31e671d12346d1351e10c3b0970e27e660edae8073e8cd024a6b30327d08522e
SHA512

2cd34c70d8a54c718e180e6d9b366c9bb43bd53cd96ca48a75e9b754994e1ee4575bfcd28d4588c08a208bd1d39946696d64d5a34a5d65f34e49caf7b02fadb9
SSDEEP

24576:4SrfdzHUHc2k4W9bY2ZWDS9m82bl0MbW2CLYCl3jISXNx32vnTYMk9WQ/4mR2N7:4+VUy5bYO9mFbl3RC7V32vnTYMk9WQ/m

Score

1^/10

Malware Config

Signatures

Files

31e671d12346d1351e10c3b0970e27e660edae8073e8cd024a6b30327d08522e_NeikiAnalytics.exe
.dll windows:6 windows x86 arch:x86

fd6ebf0aa0823e6be3ee88e304e5089d

Code Sign

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

13/01/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:4d:67:f6:43:16:c9:2a:3b:7a:17:cc:46:97:6a:8f
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

28/07/2021, 00:00

Not After

27/07/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA256 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:91:39:39:16:23:33:2d:43:e3:98:d1:0d:0a:da:f9
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA256 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

22/02/2024, 00:00

Not After

17/07/2024, 23:59

Subject

SERIALNUMBER=4969967,CN=Zoom Video Communications\, Inc.,O=Zoom Video Communications\, Inc.,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

13/01/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:4d:67:f6:43:16:c9:2a:3b:7a:17:cc:46:97:6a:8f
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

28/07/2021, 00:00

Not After

27/07/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA256 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:91:39:39:16:23:33:2d:43:e3:98:d1:0d:0a:da:f9
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA256 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

22/02/2024, 00:00

Not After

17/07/2024, 23:59

Subject

SERIALNUMBER=4969967,CN=Zoom Video Communications\, Inc.,O=Zoom Video Communications\, Inc.,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:14:7e:04:64:6a:33:e6:05:df:75:1d:e3:86:1f:f0:4b:a8:30:15
Signer

Actual PE Digest

45:14:7e:04:64:6a:33:e6:05:df:75:1d:e3:86:1f:f0:4b:a8:30:15

Digest Algorithm

sha1

PE Digest Matches

true

3d:79:de:e2:45:33:f0:18:7a:da:fd:1e:eb:4d:9a:57:2b:45:25:5f:b7:1d:d5:57:15:dc:6c:30:ef:e5:a6:bc
Signer

Actual PE Digest

3d:79:de:e2:45:33:f0:18:7a:da:fd:1e:eb:4d:9a:57:2b:45:25:5f:b7:1d:d5:57:15:dc:6c:30:ef:e5:a6:bc

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\jenkins\workspace\Client\Client\Windows_VDI\release\Bin\Release\XmppDll.pdb

Imports

cmmlib

?c_str@?$CStringT@_W@Cmm@@QBEPB_WXZ
?length@?$CStringT@_W@Cmm@@QBEIXZ
??0?$CStringT@D@Cmm@@QAE@XZ
??1?$CStringT@D@Cmm@@UAE@XZ
?GetStr@CmmGUID@Cmm@@QAEAAV?$CStringT@_W@2@H@Z
?IsEmpty@?$CStringT@D@Cmm@@QBEHXZ
?StringToInt@Cmm@@YAHABV?$CStringT@_W@1@AAH@Z
??0?$CStringT@_W@Cmm@@QAE@PB_W@Z
??0?$CStringT@_W@Cmm@@QAE@XZ
??1?$CStringT@_W@Cmm@@UAE@XZ
??0CTime@Cmm@@QAE@HHHHHHHH@Z
?FromTimeT@Time@Cmm@@SA?AV12@_J@Z
?IsEmpty@?$CStringT@_W@Cmm@@QBEHXZ
?StringToUInt@Cmm@@YAHABV?$CStringT@_W@1@AAI@Z
?StringToInt64@Cmm@@YAHABV?$CStringT@D@1@AA_J@Z
??4?$CStringT@_W@Cmm@@QAEAAV01@$$QAV01@@Z
?length@?$CStringT@D@Cmm@@QBEIXZ
?SetLength@?$CStringT@D@Cmm@@QAEXI@Z
?GetBuffer@?$CStringT@D@Cmm@@QAEPADI@Z
?cmm_str_convert@@YAIHPADIPB_WI@Z
?cmm_str_convert@@YAIHPA_WIPBDI@Z
?GetBuffer@?$CStringT@_W@Cmm@@QAEPA_WI@Z
?SetLength@?$CStringT@_W@Cmm@@QAEXI@Z
??0?$CStringT@_W@Cmm@@QAE@$$QAV01@@Z
?find@?$CStringT@D@Cmm@@QBEIDI@Z
?rfind@?$CStringT@D@Cmm@@QBEIDI@Z
?size@?$CStringT@D@Cmm@@QBEIXZ
?substr@?$CStringT@D@Cmm@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@II@Z
??0?$CStringT@D@Cmm@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??4?$CStringT@D@Cmm@@QAEAAV01@PBD@Z
??4?$CStringT@D@Cmm@@QAEAAV01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??4?$CStringT@_W@Cmm@@QAEAAV01@PB_W@Z
?AssignOther@?$CStringT@_W@Cmm@@QAEAAV12@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?AssignOther@?$CStringT@_W@Cmm@@QAEAAV12@ABV?$CStringT@D@2@@Z
?GetMinLogLevel@logging@@YAHXZ
??1LogMessage@logging@@QAE@XZ
??0LogMessage@logging@@QAE@PBDHH@Z
??1CCmmPerfTelemetryStacks@@QAE@XZ
??0CCmmPerfTelemetryStacks@@QAE@ABV?$CStringT@D@Cmm@@0H@Z
CmmAlloc
??1CCmmPerfTelemetryEventWStack@@QAE@XZ
??0CCmmPerfTelemetryEventWStack@@QAE@W4ZoomLogSubEvent@@ABV?$map@W4ZoomLogTagName@@V?$CStringT@D@Cmm@@U?$less@W4ZoomLogTagName@@@std@@V?$allocator@U?$pair@$$CBW4ZoomLogTagName@@V?$CStringT@D@Cmm@@@std@@@5@@std@@H@Z
CmmFree
?Int64ToString@Cmm@@YAH_JAAV?$CStringT@D@1@@Z
?ToTimeTInMS@Time@Cmm@@QBE_JXZ
?MM_Svr_Now@Time@Cmm@@SA?AV12@XZ
?Now@Time@Cmm@@SA?AV12@XZ
??0?$CStringT@D@Cmm@@QAE@ABV01@@Z
??H?$CStringT@D@Cmm@@QBE?AV01@ABV01@@Z
??4?$CStringT@D@Cmm@@QAEAAV01@ABV01@@Z
??Y?$CStringT@D@Cmm@@QAEAAV01@PBD@Z
??Y?$CStringT@D@Cmm@@QAEAAV01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??Y?$CStringT@D@Cmm@@QAEAAV01@ABV01@@Z
?GetLength@?$CStringT@D@Cmm@@QBEIXZ
??1CCritical@Cmm@@QAE@XZ
??0CCritical@Cmm@@QAE@XZ
??8?$CStringT@_W@Cmm@@QBE_NABV01@@Z
?empty@?$CStringT@_W@Cmm@@QBE_NXZ
??0?$CStringT@_W@Cmm@@QAE@ABV01@@Z
?clear@?$CStringT@_W@Cmm@@QAEXXZ
??4?$CStringT@_W@Cmm@@QAEAAV01@ABV01@@Z
??0?$CStringT@D@Cmm@@QAE@$$QAV01@@Z
??M?$CStringT@_W@Cmm@@QBE_NABV01@@Z
?clear@?$CStringT@D@Cmm@@QAEXXZ
?InSeconds@TimeDelta@Cmm@@QBE_JXZ
?InMilliseconds@TimeDelta@Cmm@@QBE_JXZ
?MM_Now@Time@Cmm@@SA?AV12@XZ
?c_str@?$CStringT@D@Cmm@@QBEPBDXZ
?IntToString@Cmm@@YAXHAAV?$CStringT@_W@1@@Z
?Unlock@CCritical@Cmm@@QAEXXZ
?Lock@CCritical@Cmm@@QAEXXZ
??4?$CStringT@D@Cmm@@QAEAAV01@V?$CRangeT@PBD@1@@Z
??0?$CStringT@_W@Cmm@@QAE@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
??H?$CStringT@_W@Cmm@@QBE?AV01@ABV01@@Z
?append@?$CStringT@_W@Cmm@@QAEAAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV12@@Z
??Y?$CStringT@_W@Cmm@@QAEAAV01@PB_W@Z
??Y?$CStringT@_W@Cmm@@QAEAAV01@ABV01@@Z
?Find@?$CStringT@_W@Cmm@@QBEPA_WPB_WI@Z
??4?$CStringT@D@Cmm@@QAEAAV01@$$QAV01@@Z
?Compare@?$CStringT@_W@Cmm@@QBEHPB_W@Z
??9?$CStringT@_W@Cmm@@QBE_NABV01@@Z
?CompareNoCase@?$CStringT@_W@Cmm@@QBEHABV12@@Z
?bMetricsEnabled_@CCmmPerfTelemetry@@0HA
?FromTimeTInMS@Time@Cmm@@SA?AV12@_J@Z
?CmmStringFromInt64@Cmm@@YA?AV?$CStringT@D@1@_J@Z
?MakeLower@?$CStringT@_W@Cmm@@QAEXXZ
??8?$CStringT@_W@Cmm@@QBE_NPB_W@Z
?GetGmtTm@CTime@Cmm@@QBEXAAUtm@@@Z
??0CTime@Cmm@@QAE@AAUtm@@H@Z
?StringToUInt64@Cmm@@YAHABV?$CStringT@_W@1@AA_K@Z
?find@?$CStringT@D@Cmm@@QBEIPBDI@Z
?StringToInt@Cmm@@YAHABV?$CStringT@D@1@AAH@Z
?ToTimeT@Time@Cmm@@QBE_JXZ
?GetLength@?$CStringT@_W@Cmm@@QBEIXZ
?UInt64ToString@Cmm@@YAX_KAAV?$CStringT@_W@1@@Z
?UInt64ToString@Cmm@@YAX_KAAV?$CStringT@D@1@@Z
?IntToString@Cmm@@YAXHAAV?$CStringT@D@1@@Z
?StringToInt64@Cmm@@YAHABV?$CStringT@_W@1@AA_J@Z
?cmm_str_convert@@YAIHPADIHPBDI@Z
??M?$CStringT@D@Cmm@@QBE_NABV01@@Z
??4?$CStringT@_W@Cmm@@QAEAAV01@V?$CRangeT@PB_W@1@@Z
??9?$CStringT@D@Cmm@@QBE_NPBD@Z
?Trim@?$CStringT@D@Cmm@@QAEXXZ
?find@?$CStringT@_W@Cmm@@QBEIPB_WI@Z
?substr@?$CStringT@_W@Cmm@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@II@Z
??4?$CStringT@_W@Cmm@@QAEAAV01@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
??O?$CStringT@_W@Cmm@@QBE_NABV01@@Z
?StringToUInt64@Cmm@@YAHABV?$CStringT@D@1@AA_K@Z
?find@?$CStringT@_W@Cmm@@QBEI_WI@Z
?CompareNoCase@?$CStringT@_W@Cmm@@QBEHPB_W@Z
?Compare@?$CStringT@D@Cmm@@QBEHPBD@Z
?asString@Value@Json@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?isString@Value@Json@@QBE_NXZ
??0Value@Json@@QAE@W4ValueType@1@@Z
??1Value@Json@@QAE@XZ
??0Reader@Json@@QAE@XZ
?parse@Reader@Json@@QAE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAVValue@2@_N@Z
?isMemberWithValidFormat@Value@Json@@QBE_NPBD@Z
??AValue@Json@@QAEAAV01@PBD@Z
?Assign@?$CStringT@D@Cmm@@QAEXPBDI@Z
?AssignOther@?$CStringT@D@Cmm@@QAEAAV12@PB_W@Z
??8?$CStringT@D@Cmm@@QBE_NPBD@Z
?CompareNoCase@?$CStringT@D@Cmm@@QBEHPBD@Z
?asInt@Value@Json@@QBEHXZ
?isInt@Value@Json@@QBE_NXZ
?asInt64@Value@Json@@QBE_JXZ
?isInt64@Value@Json@@QBE_NXZ
?asCString@Value@Json@@QBEPBDXZ
?isEqual@ValueIteratorBase@Json@@IBE_NABV12@@Z
?increment@ValueIteratorBase@Json@@IAEXXZ
?deref@ValueIteratorBase@Json@@IAEAAVValue@2@XZ
?isArray@Value@Json@@QBE_NXZ
?begin@Value@Json@@QAE?AVValueIterator@2@XZ
?end@Value@Json@@QAE?AVValueIterator@2@XZ
?removeMember@Value@Json@@QAEXPBD@Z
??0FastWriter@Json@@QAE@XZ
?write@FastWriter@Json@@UAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABVValue@2@@Z
?getFormattedErrorMessages@Reader@Json@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
??1Writer@Json@@UAE@XZ
??0?$CStringT@D@Cmm@@QAE@PBDI@Z
?StringToBool@Cmm@@YAHABV?$CStringT@_W@1@AAH@Z
?AssignOther@?$CStringT@_W@Cmm@@QAEAAV12@PBD@Z
?AssignOther@?$CStringT@D@Cmm@@QAEAAV12@ABV?$CStringT@_W@2@@Z
??0?$CStringT@D@Cmm@@QAE@PBD@Z
??1CmmGUID@Cmm@@QAE@XZ
?MM_InitWithServerTime@Time@Cmm@@SAXABV12@@Z
??0CmmGUID@Cmm@@QAE@XZ

ws2_32

connect
ntohs
socket
send
getprotobyname
getsockname
WSAStartup
select
WSAGetLastError
setsockopt
htons
recv
gethostbyname
WSACleanup
__WSAFDIsSet
closesocket
inet_ntoa

libcrypto-3-zm

EVP_EncodeBlock
EVP_DecodeBlock

tp

?new_instance@socket_ctx_t@ssb@@SAPAV12@PBCIIPAVmsg_db_t@2@@Z
?add_ssl_ctx@socket_ctx_t@ssb@@QAEXPAVssl_context_t@2@@Z
?load_ca@ssl_ctx_t@ssb@@QAEHPBC0@Z
?new_instance@async_socket_it@ssb@@SAPAV12@PAVsocket_ctx_t@2@PAVthread_wrapper_t@2@@Z
?get_display_addr@socket_ctx_t@ssb@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_N@Z
?decrement@?$ref_count_t@Unull_lock@ssb@@@ssb@@UAEIXZ
?get_count@?$ref_count_t@Unull_lock@ssb@@@ssb@@UAEIXZ
??0?$ref_count_t@Unull_lock@ssb@@@ssb@@QAE@XZ
?dump@socket_ctx_t@ssb@@QBEXXZ
?set_verify_method@ssl_ctx_t@ssb@@QAEX_N@Z
?increment@?$ref_count_t@Unull_lock@ssb@@@ssb@@UAEIXZ
?on_self_destroy@?$ref_count_t@Unull_lock@ssb@@@ssb@@MAEXXZ
??1?$ref_count_t@Unull_lock@ssb@@@ssb@@MAE@XZ
?on_connect_exx@async_socket_sink_it@ssb@@UAEXHPAVasync_socket_it@2@PAVthread_wrapper_t@2@PAVsocket_ctx_t@2@AAV_uuid_t@2@@Z
?on_monitor@async_socket_sink_it@ssb@@UAEHPADI@Z
?is_living@async_socket_sink_it@ssb@@UBE_NXZ
??1async_socket_sink_it@ssb@@UAE@XZ
?length@msg_db_t@ssb@@QBEIXZ
?get_cert_info@ssl_ctx_t@ssb@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
??0async_socket_sink_it@ssb@@QAE@XZ
?new_instance@proxy_ctx_t@ssb@@SAPAV12@W4PROXY_TYPE@12@PBCG1PAV12@@Z
?append@proxy_ctx_t@ssb@@QAEHPAV12@@Z
?new_instance@ssl_context_t@ssb@@SAPAV12@HHPAC00PBCPAPBC222I@Z
??0async_socket_param_t@ssb@@QAE@I@Z
?on_connect_ex@async_socket_sink_it@ssb@@UAEXHPAVasync_socket_it@2@PAVthread_wrapper_t@2@PAVsocket_ctx_t@2@@Z
?on_error@async_socket_sink_it@ssb@@UAEXHHPAVasync_socket_it@2@@Z
?set_opt@async_socket_sink_it@ssb@@UAEHHPAX@Z
?get_opt@async_socket_sink_it@ssb@@UAEHHPAX@Z

util

?release@msg_db_t@ssb@@QAEPAV12@XZ
?write@msg_db_t@ssb@@QAEHPBCIPAI@Z
?read@msg_db_t@ssb@@QAEHPACIPAI_N@Z
?new_instance@msg_db_t@ssb@@SAPAV12@I@Z
get_cur_pid
crc_16
?find_by_type@thread_mgr_t@ssb@@QBEPAVthread_wrapper_t@2@I@Z
?instance@thread_mgr_t@ssb@@SAPAV12@XZ

kernel32

DeleteCriticalSection
FileTimeToSystemTime
MultiByteToWideChar
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
TryEnterCriticalSection
UnhandledExceptionFilter
CloseHandle
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
GetProcAddress
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent

msvcp140

??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@I@Z
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z
?_Xinvalid_argument@std@@YAXPBD@Z
?_Xbad_function_call@std@@YAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?uncaught_exception@std@@YA_NXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z

secur32

FreeCredentialsHandle
InitializeSecurityContextA
AcquireCredentialsHandleW
QueryContextAttributesW
DeleteSecurityContext
DecryptMessage
InitializeSecurityContextW
FreeContextBuffer
EncryptMessage

crypt32

CertGetCertificateChain
CertFreeCertificateChain
CertVerifyCertificateChainPolicy
CertNameToStrA

vcruntime140

__RTDynamicCast
__std_type_info_destroy_list
memcmp
memcpy
memmove
memset
_CxxThrowException
__current_exception_context
__current_exception
wcsstr
memchr
strstr
__CxxFrameHandler3
__std_terminate
__std_exception_copy
__std_exception_destroy
_purecall
strchr
wcschr
_except_handler4_common

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_errno
_initterm
terminate
_cexit
_crt_atexit
_execute_onexit_table
_invalid_parameter_noinfo_noreturn
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll

api-ms-win-crt-heap-l1-1-0

_callnewh
realloc
calloc
malloc
free

api-ms-win-crt-utility-l1-1-0

rand
srand

api-ms-win-crt-time-l1-1-0

_mktime64
_time64

api-ms-win-crt-string-l1-1-0

strncmp
tolower
isdigit

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf

api-ms-win-crt-convert-l1-1-0

strtol
atoi

api-ms-win-crt-math-l1-1-0

ceil

Exports

Exports

?CreateXmppClient@ssb_xmpp@@YAPAVISSBXmppClient@1@XZ
?DestroyXmppClient@ssb_xmpp@@YAXPAVISSBXmppClient@1@@Z

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 277KB - Virtual size: 276KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 54KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 104KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fd6ebf0aa0823e6be3ee88e304e5089d

Code Sign

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31Certificate

Extended Key Usages

Key Usages

0e:4d:67:f6:43:16:c9:2a:3b:7a:17:cc:46:97:6a:8fCertificate

Extended Key Usages

Key Usages

0c:91:39:39:16:23:33:2d:43:e3:98:d1:0d:0a:da:f9Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31Certificate

Extended Key Usages

Key Usages

0e:4d:67:f6:43:16:c9:2a:3b:7a:17:cc:46:97:6a:8fCertificate

Extended Key Usages

Key Usages

0c:91:39:39:16:23:33:2d:43:e3:98:d1:0d:0a:da:f9Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

45:14:7e:04:64:6a:33:e6:05:df:75:1d:e3:86:1f:f0:4b:a8:30:15Signer

3d:79:de:e2:45:33:f0:18:7a:da:fd:1e:eb:4d:9a:57:2b:45:25:5f:b7:1d:d5:57:15:dc:6c:30:ef:e5:a6:bcSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

cmmlib

ws2_32

libcrypto-3-zm

tp

util

kernel32

msvcp140

secur32

crypt32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

Exports

Exports

Sections

.text Size: 1.0MB - Virtual size: 1.0MB

.rdata Size: 277KB - Virtual size: 276KB

.data Size: 54KB - Virtual size: 57KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 104KB - Virtual size: 104KB

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31
Certificate

0e:4d:67:f6:43:16:c9:2a:3b:7a:17:cc:46:97:6a:8f
Certificate

0c:91:39:39:16:23:33:2d:43:e3:98:d1:0d:0a:da:f9
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31
Certificate

0e:4d:67:f6:43:16:c9:2a:3b:7a:17:cc:46:97:6a:8f
Certificate

0c:91:39:39:16:23:33:2d:43:e3:98:d1:0d:0a:da:f9
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

45:14:7e:04:64:6a:33:e6:05:df:75:1d:e3:86:1f:f0:4b:a8:30:15
Signer

3d:79:de:e2:45:33:f0:18:7a:da:fd:1e:eb:4d:9a:57:2b:45:25:5f:b7:1d:d5:57:15:dc:6c:30:ef:e5:a6:bc
Signer

.text
Size: 1.0MB - Virtual size: 1.0MB

.rdata
Size: 277KB - Virtual size: 276KB

.data
Size: 54KB - Virtual size: 57KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 104KB - Virtual size: 104KB