5f81a512a6feea25bd89b4eec166277bc99c3a326c24986fc41d1c5913584ce6_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

5f81a512a6feea25bd89b4eec166277bc99c3a326c24986fc41d1c5913584ce6_NeikiAnalytics.exe
Size

7.4MB
MD5

d5b96e1e0631a1714682ab0f13f36410
SHA1

ed9806a21d3019b6a0a5b4bc20c61de607ba43f0
SHA256

5f81a512a6feea25bd89b4eec166277bc99c3a326c24986fc41d1c5913584ce6
SHA512

722d0a270b37dbe4d1f3559853c5b1723f293e512459e5370fe241e376b531449c04bdffa8a5d4b9862beea037fcc39d5873c1ecdc10172572d7435a7796a19f
SSDEEP

196608:etaiISvHbuLxsy6xCR0l1C7lt3eK27CxG:etaiISfbuL+yUCWlwJFeKs3

Score

1^/10

Malware Config

Signatures

Files

5f81a512a6feea25bd89b4eec166277bc99c3a326c24986fc41d1c5913584ce6_NeikiAnalytics.exe
.exe windows:6 windows x64 arch:x64

0df20990d6c7aa4cecda151490230d9c

Code Sign

0e:4d:67:f6:43:16:c9:2a:3b:7a:17:cc:46:97:6a:8f
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

28/07/2021, 00:00

Not After

27/07/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA256 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:be:28:33:f8:e8:ce:13:2c:34:85:f0:28:af:c6:68
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA256 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

06/09/2023, 00:00

Not After

05/09/2025, 23:59

Subject

SERIALNUMBER=2189948,CN=SCHNEIDER ELECTRIC USA\, INC.,OU=EV 3K Energy Management Automation Systems,O=SCHNEIDER ELECTRIC USA\, INC.,L=Andover,ST=Massachusetts,C=US,2.5.4.15=#131450726976617465206f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

38:63:de:f8
Certificate

Issuer

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Not Before

24/12/1999, 17:50

Not After

24/07/2029, 14:15

Subject

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

58:da:13:ff:00:00:00:00:51:ce:0d:f7
Certificate

Issuer

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Not Before

22/07/2015, 19:02

Not After

22/06/2029, 19:32

Subject

CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

07:d7:13:53:da:25:61:b4:61:e9:90:47:8a:4c:ce:04
Certificate

Issuer

CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

19/01/2024, 16:46

Not After

01/06/2029, 00:00

Subject

CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0b:41:3e:54:96:31:fe:8b:88:b4:f8:b2:c7:48:10:db:83:73:45:55:19:38:f2:3d:86:fe:50:1e:62:36:7c:6b
Signer

Actual PE Digest

0b:41:3e:54:96:31:fe:8b:88:b4:f8:b2:c7:48:10:db:83:73:45:55:19:38:f2:3d:86:fe:50:1e:62:36:7c:6b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\pginstaller_14.auto\postgres.windows-x64\Release\postgres\postgres.pdb

Imports

libssl-1_1-x64

SSL_CTX_set_default_passwd_cb
SSL_CTX_check_private_key
SSL_new
SSL_free
SSL_accept
SSL_read
SSL_write
SSL_CTX_ctrl
SSL_get_peer_certificate
SSL_get_version
TLS_method
SSL_shutdown
SSL_CTX_set_client_CA_list
SSL_get_certificate
SSL_CTX_load_verify_locations
OPENSSL_init_ssl
SSL_CTX_set_info_callback
SSL_CTX_set_verify
SSL_state_string_long
SSL_load_client_CA_file
SSL_CTX_use_certificate_chain_file
SSL_CTX_use_PrivateKey_file
SSL_get_error
SSL_CTX_set_cipher_list
SSL_CTX_new
SSL_CTX_free
SSL_CTX_get_cert_store
SSL_get_current_cipher
SSL_CIPHER_get_bits
SSL_CIPHER_get_name
SSL_set_bio
SSL_CTX_set_options

libcrypto-1_1-x64

BIO_meth_get_create
BIO_new_mem_buf
BIO_meth_set_ctrl
BIO_meth_set_create
BIO_meth_get_ctrl
BIO_s_mem
BIO_meth_get_destroy
BIO_meth_set_destroy
BIO_int_ctrl
BIO_s_socket
BIO_meth_set_callback_ctrl
BIO_printf
BN_free
BN_bn2dec
ASN1_INTEGER_to_BN
ASN1_STRING_print_ex
BIO_meth_set_gets
OBJ_nid2ln
OBJ_nid2sn
BIO_ctrl
OBJ_sn2nid
EVP_sha256
EVP_get_digestbyname
EC_KEY_new_by_curve_name
EC_KEY_free
BIO_meth_get_gets
BIO_meth_set_puts
BIO_meth_new
DH_free
BIO_meth_get_puts
BIO_meth_set_read
DH_check
X509_STORE_set_flags
X509_STORE_load_locations
X509_digest
BIO_meth_set_write
X509_free
BIO_meth_free
X509_get_signature_info
X509_get_serialNumber
BIO_write
X509_get_issuer_name
X509_get_subject_name
X509_NAME_print_ex
BIO_meth_get_callback_ctrl
X509_NAME_entry_count
X509_NAME_get_text_by_NID
X509_NAME_get_entry
X509_NAME_ENTRY_get_data
PEM_read_bio_DHparams
BIO_get_data
BIO_set_data
BIO_free
PEM_read_DHparams
ERR_put_error
ERR_get_error
ERR_clear_error
ERR_reason_error_string
EVP_MD_CTX_new
EVP_MD_CTX_free
BIO_new
EVP_DigestInit_ex
EVP_DigestUpdate
EVP_DigestFinal_ex
EVP_md5
EVP_sha1
EVP_sha224
EVP_sha384
EVP_sha512
HMAC_CTX_new
HMAC_CTX_free
HMAC_Init_ex
HMAC_Update
HMAC_Final
RAND_bytes
RAND_status
RAND_poll
BIO_set_flags
BIO_get_new_index
OBJ_obj2nid
CRYPTO_free
X509_NAME_ENTRY_get_object
BIO_clear_flags

libintl-9

libintl_gettext
libintl_ngettext
libintl_textdomain
libintl_dgettext
libintl_dngettext
libintl_bind_textdomain_codeset
libintl_bindtextdomain

icuin67

ucol_strcoll_67
ucol_getVersion_67
ucol_close_67
ucol_nextSortKeyPart_67
ucol_setAttribute_67
ucol_open_67
ucol_strcollUTF8_67
ucol_getSortKey_67

icuuc67

u_errorName_67
uloc_getDisplayName_67
uloc_getAvailable_67
uloc_countAvailable_67
u_islower_67
u_isupper_67
u_isdigit_67
u_isalpha_67
uloc_toLanguageTag_67
u_isalnum_67
u_ispunct_67
u_isgraph_67
u_isspace_67
u_isprint_67
uiter_setUTF8_67
ucnv_toUChars_67
ucnv_fromUChars_67
ucnv_open_67
u_versionToString_67
u_strToTitle_67
u_strToLower_67
u_strToUpper_67
u_toupper_67
u_tolower_67

libxml2

xmlXPathNewContext
xmlXPathCastNodeSetToString
xmlXPathCastNodeToString
xmlXPathCastNumberToString
xmlXPathCastBooleanToString
xmlXPathCastBooleanToNumber
xmlXPathFreeObject
xmlTextWriterWriteAttribute
xmlTextWriterWriteBinHex
xmlXPathCompile
xmlTextWriterWriteRaw
xmlTextWriterEndElement
xmlTextWriterStartElement
xmlFreeTextWriter
xmlNewTextWriterMemory
xmlNewStringInputStream
xmlCtxtReadMemory
xmlCtxtReadDoc
xmlGetExternalEntityLoader
xmlSetExternalEntityLoader
xmlFreeParserCtxt
xmlNewParserCtxt
xmlParseBalancedChunkMemory
xmlInitParser
__xmlStructuredErrorContext
__xmlGenericErrorContext
__xmlStructuredError
__xmlGenericError
xmlParserPrintFileContext
xmlSetStructuredErrorFunc
xmlSetGenericErrorFunc
xmlNodeDump
xmlFreeNode
xmlCopyNode
xmlFreeDoc
xmlNewDoc
xmlBufferLength
xmlBufferContent
xmlBufferFree
xmlBufferCreate
xmlCharInRange
xmlGetUTF8Char
xmlStrncmp
xmlStrcmp
xmlStrstr
xmlStrchr
xmlStrdup
xmlCheckVersion
xmlFree
xmlXPathCompiledEval
xmlXPathFreeCompExpr
xmlXPathRegisterNs
xmlIsBaseCharGroup
xmlIsCombiningGroup
xmlIsDigitGroup
xmlIsExtenderGroup
xmlXPathFreeContext
xmlTextWriterWriteBase64

liblz4

LZ4_compress_default
LZ4_decompress_safe
LZ4_compressBound
LZ4_decompress_safe_partial
LZ4_versionNumber

secur32

TranslateNameA
DeleteSecurityContext
AcceptSecurityContext
FreeCredentialsHandle
AcquireCredentialsHandleA
FreeContextBuffer

ws2_32

WSADuplicateSocketA
gethostbyname
ioctlsocket
bind
listen
WSAAccept
WSACloseEvent
WSAConnect
__WSAFDIsSet
WSAStartup
setsockopt
getsockopt
getsockname
WSASocketA
WSAIoctl
WSASend
WSARecv
WSAEventSelect
WSAGetLastError
sendto
recvfrom
closesocket
WSAEnumNetworkEvents
WSACreateEvent

wldap32

ord200
ord30
ord36
ord26
ord22
ord16
ord143
ord41
ord50
ord60
ord211
ord136
ord46
ord13
ord217

kernel32

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
SetEvent
GetFileInformationByHandleEx
GetFileInformationByHandle
GetModuleHandleExA
SetEnvironmentVariableA
GetFileType
LoadLibraryExA
GetShortPathNameA
CreateHardLinkA
CallNamedPipeA
OpenProcess
GetModuleHandleA
GetSystemTimeAsFileTime
GetProcessTimes
MoveFileExA
DeviceIoControl
RemoveDirectoryA
CreateDirectoryA
FindNextFileA
FindFirstFileA
FindClose
LocalFree
LocalAlloc
GetCurrentDirectoryA
WriteConsoleW
GetACP
GetStdHandle
EnumSystemLocalesEx
GetNLSVersionEx
GetLocaleInfoEx
WideCharToMultiByte
MultiByteToWideChar
WaitForMultipleObjects
VirtualQuery
CreatePipe
RegisterWaitForSingleObject
UnregisterWaitEx
MapViewOfFile
CreateProcessA
ResumeThread
GetExitCodeProcess
TerminateProcess
PostQueuedCompletionStatus
GetQueuedCompletionStatus
CreateIoCompletionPort
OpenFileMappingA
CreateFileMappingA
GetLargePageMinimum
UnmapViewOfFile
MapViewOfFileEx
VirtualAllocEx
VirtualFree
VirtualAlloc
Sleep
SetLastError
DuplicateHandle
GetFullPathNameA
CreateSemaphoreA
ReleaseSemaphore
WaitForSingleObjectEx
WaitForMultipleObjectsEx
SetConsoleCtrlHandler
CreateNamedPipeA
CreateThread
GetCurrentProcessId
CreateEventA
SleepEx
WaitForSingleObject
ResetEvent
InitializeSListHead
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
DisconnectNamedPipe
ConnectNamedPipe
WriteFile
ReadFile
FlushFileBuffers
GetTickCount
GetProcessId
GetCurrentThreadId
GetCurrentProcess
SetUnhandledExceptionFilter
GetFileAttributesA
CreateFileA
SetErrorMode
LoadLibraryA
FormatMessageA
GetProcAddress
FreeLibrary
GetLastError
CloseHandle
QueryPerformanceFrequency
QueryPerformanceCounter

advapi32

SetTokenInformation
LookupAccountSidA
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA
RegisterEventSourceA
ReportEventA
ReportEventW
AddAccessAllowedAceEx
AddAce
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
GetUserNameA
GetTokenInformation
InitializeAcl
GetLengthSid
GetAclInformation
GetAce

vcruntime140

wcsrchr
longjmp
strstr
__intrinsic_setjmp
__C_specific_handler
__std_type_info_destroy_list
strchr
memcmp
memcpy
memset
strrchr
memmove
memchr

api-ms-win-crt-math-l1-1-0

log
cos
pow
_fdopen
_fdclass
rint
atan2
atan
floor
ceil
ldexp
asin
sqrt
cosh
__setusermatherr
acos
sin
atanh
cbrt
sinh
exp
tan
acosh
asinh
tanh
fmod
_dclass
log10

api-ms-win-crt-string-l1-1-0

isxdigit
isspace
tolower
isalpha
strspn
strcmp
strncpy
strpbrk
strtok
strncmp
isupper
_toupper_l
isdigit
_tolower_l
toupper
towupper
towlower
iswctype
_towupper_l
_towlower_l
_isctype_l
islower
_wcsicmp
strxfrm
ispunct
isalnum
strcspn
wcscoll
_wcscoll_l
strcoll
isprint
_strcoll_l
_strdup
_strxfrm_l
strnlen
isgraph

api-ms-win-crt-utility-l1-1-0

bsearch

api-ms-win-crt-stdio-l1-1-0

_chsize
_lseek
_close
_read
_write
__stdio_common_vsprintf
_isatty
_dup2
_fseeki64
_dup
_setmode
_open_osfhandle
_get_osfhandle
_getcwd
_ftelli64
ftell
_fileno
puts
fclose
fwrite
fputc
_pclose
_popen
_commit
setvbuf
fputs
feof
__stdio_common_vsscanf
_set_fmode
ferror
fgets
fflush
fgetc
__p__commode
getc
clearerr
__acrt_iob_func
__stdio_common_vfscanf
freopen
fread

api-ms-win-crt-runtime-l1-1-0

_wassert
strerror
_getpid
perror
system
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
_cexit
_seh_filter_exe
_set_app_type
_get_initial_narrow_environment
_initterm
_initterm_e
_errno
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
exit
abort
_exit
terminate
_endthread
_beginthreadex

api-ms-win-crt-time-l1-1-0

_time64
wcsftime
_localtime64
_utime64

api-ms-win-crt-convert-l1-1-0

_wcstombs_l
mbstowcs
_atoi64
atol
strtof
atof
atoi
strtoul
strtol
strtod
wcstombs
_strtoui64

api-ms-win-crt-heap-l1-1-0

_set_new_mode
calloc
realloc
malloc
free

api-ms-win-crt-environment-l1-1-0

__p__environ
getenv
_putenv

api-ms-win-crt-locale-l1-1-0

__pctype_func
_create_locale
_configthreadlocale
setlocale
localeconv

api-ms-win-crt-multibyte-l1-1-0

_mbstowcs_l

api-ms-win-crt-filesystem-l1-1-0

_umask
_mkdir
_chmod
_rmdir
_chdir
_unlink
_access

Exports

Exports

ATExecChangeOwner
AbortBufferIO
AbortCurrentTransaction
AbortOutOfAnyTransaction
AbortStrongLockAcquire
AbsorbSyncRequests
AcceptInvalidationMessages
AcquireDeletionLock
AcquireExternalFD
AcquireRewriteLocks
ActivePortal
ActiveSnapshotSet
AddEnumLabel
AddFileToBackupManifest
AddInvertedQual
AddQual
AddRelationNewConstraints
AddSubscriptionRelState
AddToDataDirLockFile
AddUserToTokenDacl
AddWALInfoToBackupManifest
AddWaitEventToSet
AdjustTimeForTypmod
AdjustTimestampForTypmod
AdjustTimestampForTypmodError
AdvanceNextFullTransactionIdPastXid
AdvanceOldestClogXid
AdvanceOldestCommitTsXid
AfterTriggerBeginQuery
AfterTriggerBeginSubXact
AfterTriggerBeginXact
AfterTriggerEndQuery
AfterTriggerEndSubXact
AfterTriggerEndXact
AfterTriggerFireDeferred
AfterTriggerPendingOnRel
AfterTriggerSetState
AggCheckCallContext
AggGetAggref
AggGetTempMemoryContext
AggRegisterCallback
AggStateIsShared
AggregateCreate
AllocSetContextCreateInternal
AllocateDir
AllocateFile
AllocateSnapshotBuilder
AlterCollation
AlterConstraintNamespaces
AlterDatabase
AlterDatabaseOwner
AlterDatabaseSet
AlterDomainAddConstraint
AlterDomainDefault
AlterDomainDropConstraint
AlterDomainNotNull
AlterDomainValidateConstraint
AlterEnum
AlterEventTrigger
AlterEventTriggerOwner
AlterEventTriggerOwner_oid
AlterExtensionNamespace
AlterForeignDataWrapper
AlterForeignDataWrapperOwner
AlterForeignDataWrapperOwner_oid
AlterForeignServer
AlterForeignServerOwner
AlterForeignServerOwner_oid
AlterFunction
AlterObjectNamespace_oid
AlterObjectOwner_internal
AlterOpFamily
AlterOperator
AlterPolicy
AlterPublication
AlterPublicationOwner
AlterPublicationOwner_oid
AlterRelationNamespaceInternal
AlterRole
AlterRoleSet
AlterSchemaOwner
AlterSchemaOwner_oid
AlterSequence
AlterSetting
AlterStatistics
AlterSubscription
AlterSubscriptionOwner
AlterSubscriptionOwner_oid
AlterSystemSetConfigFile
AlterTSConfiguration
AlterTSDictionary
AlterTable
AlterTableCreateToastTable
AlterTableGetLockLevel
AlterTableGetRelOptionsLockLevel
AlterTableInternal
AlterTableLookupRelation
AlterTableMoveAll
AlterTableNamespace
AlterTableNamespaceInternal
AlterTableSpaceOptions
AlterType
AlterTypeNamespace
AlterTypeNamespaceInternal
AlterTypeNamespace_oid
AlterTypeOwner
AlterTypeOwnerInternal
AlterTypeOwner_oid
AlterUserMapping
ApplyContext
ApplyLauncherMain
ApplyLauncherRegister
ApplyLauncherShmemInit
ApplyLauncherShmemSize
ApplyLauncherWakeupAtCommit
ApplySetting
ApplyWorkerMain
ArchiveRecoveryRequested
ArrayCheckBounds
ArrayGetIntegerTypmods
ArrayGetNItems
ArrayGetOffset
ArrayGetOffset0
Array_nulls
AssignPostmasterChildSlot
AssignTypeArrayOid
AssignTypeMultirangeArrayOid
AssignTypeMultirangeOid
AsyncShmemInit
AsyncShmemSize
Async_Listen
Async_Notify
Async_Unlisten
Async_UnlistenAll
AtAbort_Notify
AtAbort_Portals
AtAbort_Twophase
AtCCI_RelationMap
AtCleanup_Portals
AtCommit_Notify
AtEOSubXact_Files
AtEOSubXact_HashTables
AtEOSubXact_Inval
AtEOSubXact_LargeObject
AtEOSubXact_Namespace
AtEOSubXact_Parallel
AtEOSubXact_PgStat
AtEOSubXact_RelationCache
AtEOSubXact_SPI
AtEOSubXact_on_commit_actions
AtEOXact_ApplyLauncher
AtEOXact_Buffers
AtEOXact_ComboCid
AtEOXact_Enum
AtEOXact_Files
AtEOXact_GUC
AtEOXact_HashTables
AtEOXact_Inval
AtEOXact_LargeObject
AtEOXact_LocalBuffers
AtEOXact_MultiXact
AtEOXact_Namespace
AtEOXact_Parallel
AtEOXact_PgStat
AtEOXact_RelationCache
AtEOXact_RelationMap
AtEOXact_SMgr
AtEOXact_SPI
AtEOXact_Snapshot
AtEOXact_on_commit_actions
AtPrepare_Locks
AtPrepare_MultiXact
AtPrepare_Notify
AtPrepare_PgStat
AtPrepare_PredicateLocks
AtPrepare_RelationMap
AtProcExit_LocalBuffers
AtStart_GUC
AtSubAbort_Notify
AtSubAbort_Portals
AtSubAbort_Snapshot
AtSubAbort_smgr
AtSubCleanup_Portals
AtSubCommit_Notify
AtSubCommit_Portals
AtSubCommit_Snapshot
AtSubCommit_smgr
AttachSerializableXact
AttachSession
AuthenticationTimeout
AutoVacLauncherMain
AutoVacWorkerFailed
AutoVacWorkerMain
AutoVacuumRequestWork
AutoVacuumShmemInit
AutoVacuumShmemSize
AutoVacuumUpdateDelay
AutoVacuumingActive
AutovacuumLauncherIAm
AutovacuumLauncherPid
AutovacuumWorkerIAm
AuxProcessResourceOwner
AuxiliaryPidGetProc
AuxiliaryProcessMain
AuxiliaryProcs
BTreeShmemInit
BTreeShmemSize
BackendIdGetProc
BackendIdGetTransactionIds
BackendPidGetProc
BackendPidGetProcWithLock
BackendStatusShmemSize
BackendWritebackContext
BackendXidGetPid
BackgroundWorkerBlockSignals
BackgroundWorkerEntry
BackgroundWorkerInitializeConnection
BackgroundWorkerInitializeConnectionByOid
BackgroundWorkerList
BackgroundWorkerShmemInit
BackgroundWorkerShmemSize
BackgroundWorkerStateChange
BackgroundWorkerStopNotifications
BackgroundWorkerUnblockSignals
BackgroundWriterMain
BackupInProgress
BarrierArriveAndDetach
BarrierArriveAndDetachExceptLast
BarrierArriveAndWait
BarrierAttach
BarrierDetach
BarrierInit
BarrierParticipants
BarrierPhase
BaseInit
BasicOpenFile
BasicOpenFilePerm
BecomeLockGroupLeader
BecomeLockGroupMember
BeginCommand
BeginCopyFrom
BeginCopyTo
BeginImplicitTransactionBlock
BeginInternalSubTransaction
BeginReportingGUCOptions
BeginTransactionBlock
BgBufferSync
BgWriterDelay
BipartiteMatch
BipartiteMatchFree
BlessTupleDesc
BlockSampler_HasMore
BlockSampler_Init
BlockSampler_Next
BootStrapCLOG
BootStrapCommitTs
BootStrapMultiXact
BootStrapSUBTRANS
BootStrapXLOG
BootstrapToastTable
BufFileAppend
BufFileClose
BufFileCreateShared
BufFileCreateTemp
BufFileDeleteShared
BufFileExportShared
BufFileOpenShared
BufFileRead
BufFileSeek
BufFileSeekBlock
BufFileSize
BufFileTell
BufFileTruncateShared
BufFileWrite
BufTableDelete
BufTableHashCode
BufTableInsert
BufTableLookup
BufTableShmemSize
BufferBlocks
BufferDescriptors
BufferGetBlockNumber
BufferGetLSNAtomic
BufferGetTag
BufferIOCVArray
BufferIsPermanent
BufferShmemSize
BufferUsageAccumDiff
BufmgrCommit
BuildDescForRelation
BuildDescFromLists
BuildDummyIndexInfo
BuildIndexInfo
BuildIndexValueDescription
BuildOnConflictExcludedTargetlist
BuildParamLogString
BuildRelationExtStatistics
BuildRestoreCommand
BuildSpeculativeIndexInfo
BuildTupleFromCStrings
BuildTupleHashTable
BuildTupleHashTableExt
CLOGShmemBuffers
CLOGShmemInit
CLOGShmemSize
CacheInvalidateCatalog
CacheInvalidateHeapTuple
CacheInvalidateRelcache
CacheInvalidateRelcacheAll
CacheInvalidateRelcacheByRelid
CacheInvalidateRelcacheByTuple
CacheInvalidateRelmap
CacheInvalidateSmgr
CacheMemoryContext
CacheRegisterRelcacheCallback
CacheRegisterSyscacheCallback
CachedPlanAllowsSimpleValidityCheck
CachedPlanGetTargetList
CachedPlanIsSimplyValid
CachedPlanIsValid
CachedPlanSetParentContext
CallStmtResultDesc
CallSyscacheCallbacks
CallerFInfoFunctionCall1
CallerFInfoFunctionCall2
CancelBackup
CancelDBBackends
CancelVirtualTransaction
CastCreate
CatCacheInvalidate
CatalogCacheFlushCatalog
CatalogCloseIndexes
CatalogOpenIndexes
CatalogSnapshotData
CatalogTupleDelete
CatalogTupleInsert
CatalogTupleInsertWithInfo
CatalogTupleUpdate
CatalogTupleUpdateWithInfo
CatalogTuplesMultiInsertWithInfo
ChangeToDataDir
ChangeVarNodes
CheckAttributeNamesTypes
CheckAttributeType
CheckClientConnectionPending
CheckCmdReplicaIdentity
CheckDateTokenTables
CheckDeadLockAlert
CheckExprStillValid
CheckForSerializableConflictIn
CheckForSerializableConflictOut
CheckForSerializableConflictOutNeeded
CheckFunctionValidatorAccess
CheckIndexCompatible
CheckLogicalDecodingRequirements
CheckLogrotateSignal
CheckPointBuffers
CheckPointCLOG
CheckPointCommitTs
CheckPointCompletionTarget
CheckPointLogicalRewriteHeap
CheckPointMultiXact
CheckPointPredicate
CheckPointRelationMap
CheckPointReplicationOrigin
CheckPointReplicationSlots
CheckPointSUBTRANS
CheckPointSnapBuild
CheckPointTimeout
CheckPointTwoPhase
CheckPointWarning
CheckPostmasterSignal
CheckPromoteSignal
CheckRecoveryConflictDeadlock
CheckRelationLockedByMe
CheckRelationTableSpaceMove
CheckSelectLocking
CheckSetNamespace
CheckSlotRequirements
CheckSubscriptionRelkind
CheckTableForSerializableConflictIn
CheckTableNotInUse
CheckValidResultRel
CheckXLogRemoved
CheckXidAlive
CheckpointWriteDelay
CheckpointerMain
CheckpointerShmemInit
CheckpointerShmemSize
ChooseConstraintName
ChoosePortalStrategy
ChooseRelationName
CleanQuerytext
ClientAuthInProgress
ClientAuthentication
ClientAuthentication_hook
ClientConnectionLost
ClosePipeStream
ClosePostmasterPorts
CloseTransientFile
CollationCreate
CollationGetCollid
CollationIsVisible
CommandCounterIncrement
CommandEndInvalidationMessages
CommandIsReadOnly
CommentObject
CommitDelay
CommitSiblings
CommitTransactionCommand
CommitTsParameterChange
CommitTsShmemBuffers
CommitTsShmemInit
CommitTsShmemSize
CommuteOpExpr
CompareIndexInfo
CompleteCachedPlan
CompleteCommitTsInitialization
CompressionNameToMethod
ComputeExtStatisticsRows
ConditionVariableBroadcast
ConditionVariableCancelSleep
ConditionVariableInit
ConditionVariablePrepareToSleep
ConditionVariableSignal
ConditionVariableSleep
ConditionVariableTimedSleep
ConditionalLockBuffer
ConditionalLockBufferForCleanup
ConditionalLockPage
ConditionalLockRelation
ConditionalLockRelationForExtension
ConditionalLockRelationOid
ConditionalLockTuple
ConditionalXactLockTableWait
ConfigFileName
ConfigReloadPending
ConstraintNameExists
ConstraintNameIsUsed
ConstraintSetParentConstraint
ConversionCreate
ConversionGetConid
ConversionIsVisible
ConvertTimeZoneAbbrevs
CopyArrayEls
CopyCachedPlan
CopyErrorData
CopyFrom
CopyFromErrorCallback
CopyGetAttnums
CopyIndexTuple
CopyOverrideSearchPath
CopyStatistics
CopyTriggerDesc
CountDBBackends
CountDBConnections
CountDBSubscriptions
CountOtherDBBackends
CountUserBackends
CreateAccessMethod
CreateAuxProcessResourceOwner
CreateCacheMemoryContext
CreateCachedPlan
CreateCast
CreateCheckPoint
CreateCommandTag
CreateComments
CreateConstraintEntry
CreateConversionCommand
CreateCopyDestReceiver
CreateDataDirLockFile
CreateDecodingContext
CreateDestReceiver
CreateEventTrigger
CreateExecutorState
CreateExprContext
CreateExtension
CreateFakeRelcacheEntry
CreateForeignDataWrapper
CreateForeignServer
CreateForeignTable
CreateFunction
CreateInitDecodingContext
CreateIntoRelDestReceiver
CreateLWLocks
CreateNewPortal
CreateOneShotCachedPlan
CreateParallelContext
CreatePartitionDirectory
CreatePolicy
CreatePortal
CreateProceduralLanguage
CreatePublication
CreateQueryDesc
CreateRestartPoint
CreateRole
CreateSQLFunctionDestReceiver
CreateSchemaCommand
CreateSharedBackendStatus
CreateSharedComments

Sections

.text
Size: 4.8MB - Virtual size: 4.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 62KB - Virtual size: 263KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 228KB - Virtual size: 228KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0df20990d6c7aa4cecda151490230d9c

Code Sign

0e:4d:67:f6:43:16:c9:2a:3b:7a:17:cc:46:97:6a:8fCertificate

Extended Key Usages

Key Usages

0a:be:28:33:f8:e8:ce:13:2c:34:85:f0:28:af:c6:68Certificate

Extended Key Usages

Key Usages

38:63:de:f8Certificate

Key Usages

58:da:13:ff:00:00:00:00:51:ce:0d:f7Certificate

Extended Key Usages

Key Usages

07:d7:13:53:da:25:61:b4:61:e9:90:47:8a:4c:ce:04Certificate

Extended Key Usages

Key Usages

0b:41:3e:54:96:31:fe:8b:88:b4:f8:b2:c7:48:10:db:83:73:45:55:19:38:f2:3d:86:fe:50:1e:62:36:7c:6bSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

libssl-1_1-x64

libcrypto-1_1-x64

libintl-9

icuin67

icuuc67

libxml2

liblz4

secur32

ws2_32

wldap32

kernel32

advapi32

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

Exports

Exports

Sections

.text Size: 4.8MB - Virtual size: 4.8MB

.rdata Size: 2.2MB - Virtual size: 2.2MB

.data Size: 62KB - Virtual size: 263KB

.pdata Size: 228KB - Virtual size: 228KB

.rsrc Size: 1KB - Virtual size: 1KB

0e:4d:67:f6:43:16:c9:2a:3b:7a:17:cc:46:97:6a:8f
Certificate

0a:be:28:33:f8:e8:ce:13:2c:34:85:f0:28:af:c6:68
Certificate

38:63:de:f8
Certificate

58:da:13:ff:00:00:00:00:51:ce:0d:f7
Certificate

07:d7:13:53:da:25:61:b4:61:e9:90:47:8a:4c:ce:04
Certificate

0b:41:3e:54:96:31:fe:8b:88:b4:f8:b2:c7:48:10:db:83:73:45:55:19:38:f2:3d:86:fe:50:1e:62:36:7c:6b
Signer

.text
Size: 4.8MB - Virtual size: 4.8MB

.rdata
Size: 2.2MB - Virtual size: 2.2MB

.data
Size: 62KB - Virtual size: 263KB

.pdata
Size: 228KB - Virtual size: 228KB

.rsrc
Size: 1KB - Virtual size: 1KB