6282417754c746425f4b4e65f40005dfb4de9a3c0810af55b72b3389bafcd914_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

6282417754c746425f4b4e65f40005dfb4de9a3c0810af55b72b3389bafcd914_NeikiAnalytics.exe
Size

3.0MB
MD5

6e755ae6d5272e5a34f966a4a3a0f340
SHA1

01c29729f9e5d8af40aee3232745f844f19f8f68
SHA256

6282417754c746425f4b4e65f40005dfb4de9a3c0810af55b72b3389bafcd914
SHA512

672fba7a8bf4606945ad55d3ef2d1ffdcbd54b0f1845226a85227bcd29debb1a8223d84c78957885d30d5f91d3052ef6b8a4fbd0ebffed7c14acc9da801e8248
SSDEEP

49152:3m8bPN4lKrbyCCAq2rbae10pD4YwSedU5ao+CdjSHR0YneJ8Mhm:3Gf2r+eTAdEChm

Score

1^/10

Malware Config

Signatures

Files

6282417754c746425f4b4e65f40005dfb4de9a3c0810af55b72b3389bafcd914_NeikiAnalytics.exe
.exe windows:6 windows x64 arch:x64

cfb2cff3135437db358ca689002646c7

Code Sign

33:00:00:05:57:cf:90:dd:c7:d1:c0:88:8c:00:00:00:00:05:57
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2023, 19:51

Not After

16/10/2024, 19:51

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:03:a5:41:11:e8:f0:7f:be:0b:75:00:00:00:00:03:a5
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2023, 19:51

Not After

16/10/2024, 19:51

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:26:3c:a3:cd:d8:5e:44:ec:f9:ed:33:c6:e4:52:38:f6:1f:be:4b:34:57:6e:ef:e8:27:32:a5:28:9c:a8:66
Signer

Actual PE Digest

0d:26:3c:a3:cd:d8:5e:44:ec:f9:ed:33:c6:e4:52:38:f6:1f:be:4b:34:57:6e:ef:e8:27:32:a5:28:9c:a8:66

Digest Algorithm

sha256

PE Digest Matches

false

0d:26:3c:a3:cd:d8:5e:44:ec:f9:ed:33:c6:e4:52:38:f6:1f:be:4b:34:57:6e:ef:e8:27:32:a5:28:9c:a8:66
Signer

Actual PE Digest

0d:26:3c:a3:cd:d8:5e:44:ec:f9:ed:33:c6:e4:52:38:f6:1f:be:4b:34:57:6e:ef:e8:27:32:a5:28:9c:a8:66

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\_work\1\s\src\_build\x64\Release\msteamsupdate.pdb

Imports

kernel32

GetLocaleInfoEx
CreateWaitableTimerW
CreateIoCompletionPort
SetWaitableTimer
GetQueuedCompletionStatus
MoveFileW
ReplaceFileW
GlobalMemoryStatusEx
CreateEventExW
GetLogicalProcessorInformation
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetProcessTimes
SetLastError
EnterCriticalSection
ReleaseSemaphore
WaitForMultipleObjects
LeaveCriticalSection
WaitForSingleObject
LCIDToLocaleName
LocaleNameToLCID
GetUserDefaultUILanguage
LoadLibraryW
InterlockedPushEntrySList
TrySubmitThreadpoolCallback
CreateSemaphoreExW
QueryPerformanceCounter
InitializeSListHead
IsProcessorFeaturePresent
TerminateProcess
GetLastError
UnhandledExceptionFilter
GetFileInformationByHandleEx
AreFileApisANSI
SetFileInformationByHandle
GetFileAttributesExW
CloseHandle
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
IsDebuggerPresent
FormatMessageW
OutputDebugStringW
FindNextFileW
FindFirstFileExW
FindClose
CreateDirectoryW
VerifyVersionInfoW
InitializeCriticalSectionAndSpinCount
GetSystemInfo
CreateEventW
SleepEx
ResetEvent
InitOnceBeginInitialize
InitOnceComplete
GetSystemDirectoryW
GetProductInfo
CreateMutexW
GetCurrentProcess
IsWow64Process
K32GetModuleFileNameExW
GetCurrentPackagePath
GetCurrentPackageId
SetUnhandledExceptionFilter
GetCurrentPackageFamilyName
GetCommandLineW
ReleaseSRWLockShared
AcquireSRWLockShared
CreateEventA
InitializeSRWLock
DebugBreak
FormatMessageA
LocalFree
CreateMutexExW
QueueUserAPC
OpenSemaphoreW
WaitForSingleObjectEx
TerminateThread
SetEvent
PostQueuedCompletionStatus
ReleaseMutex
GetCurrentThreadId

sqlite3

sqlite3_errmsg
sqlite3_result_null
sqlite3_result_text
sqlite3_get_auxdata
sqlite3_value_bytes
sqlite3_value_blob
sqlite3_create_function_v2
sqlite3_reset
sqlite3_finalize
sqlite3_column_bytes
sqlite3_column_text
sqlite3_column_int64
sqlite3_column_int
sqlite3_column_blob
sqlite3_step
sqlite3_clear_bindings
sqlite3_bind_text
sqlite3_bind_int64
sqlite3_bind_int
sqlite3_bind_blob
sqlite3_prepare_v2
sqlite3_set_auxdata
sqlite3_open_v2
sqlite3_free
sqlite3_changes
sqlite3_extended_result_codes
sqlite3_shutdown
sqlite3_initialize
sqlite3_temp_directory
sqlite3_exec
sqlite3_close_v2
sqlite3_close
sqlite3_soft_heap_limit64
sqlite3_vfs_find

wininet

InternetQueryOptionW
InternetSetOptionW
InternetSetStatusCallbackW
HttpOpenRequestA
HttpAddRequestHeadersA
HttpSendRequestW
HttpQueryInfoA
InternetCrackUrlA
InternetReadFile
InternetConnectA
InternetCloseHandle
InternetOpenW

shlwapi

ord219

boost_log-vc142-mt-x64-1_84

??3impl@attribute@v2_mt_nt62@log@boost@@SAXPEAX_K@Z
?destroy@public_data@record_view@v2_mt_nt62@log@boost@@SAXPEBU12345@@Z
??2impl@attribute@v2_mt_nt62@log@boost@@SAPEAX_K@Z
?get_logging_enabled@core@v2_mt_nt62@log@boost@@QEBA_NXZ
?get_id_from_string@attribute_name@v2_mt_nt62@log@boost@@CAIPEBD@Z
?push_record_move@core@v2_mt_nt62@log@boost@@AEAAXAEAVrecord@234@@Z
??1attribute_set@v2_mt_nt62@log@boost@@QEAA@XZ
?insert@attribute_value_set@v2_mt_nt62@log@boost@@QEAA?AU?$pair@Vconst_iterator@attribute_value_set@v2_mt_nt62@log@boost@@_N@std@@Vattribute_name@234@AEBVattribute_value@234@@Z
?release_compound@?$stream_provider@D@aux@v2_mt_nt62@log@boost@@SAXPEAUstream_compound@12345@@Z
?severity@default_attribute_names@aux@v2_mt_nt62@log@boost@@YA?AVattribute_name@345@XZ
?insert@attribute_set@v2_mt_nt62@log@boost@@QEAA?AU?$pair@V?$iter@$0A@@attribute_set@v2_mt_nt62@log@boost@@_N@std@@Vattribute_name@234@AEBVattribute@234@@Z
?channel@default_attribute_names@aux@v2_mt_nt62@log@boost@@YA?AVattribute_name@345@XZ
?allocate_compound@?$stream_provider@D@aux@v2_mt_nt62@log@boost@@SAPEAUstream_compound@12345@AEAVrecord@345@@Z
??0attribute_set@v2_mt_nt62@log@boost@@QEAA@XZ
?flush@core@v2_mt_nt62@log@boost@@QEAAXXZ
?add_global_attribute@core@v2_mt_nt62@log@boost@@QEAA?AU?$pair@V?$iter@$0A@@attribute_set@v2_mt_nt62@log@boost@@_N@std@@AEBVattribute_name@234@AEBVattribute@234@@Z
?get_id@this_process@aux@v2_mt_nt62@log@boost@@YA?AV?$id@Uprocess@aux@v2_mt_nt62@log@boost@@@2345@XZ
?get_id@this_thread@aux@v2_mt_nt62@log@boost@@YAAEBV?$id@Uthread@aux@v2_mt_nt62@log@boost@@@2345@XZ
?get_severity_level@aux@sources@v2_mt_nt62@log@boost@@YAAEA_KXZ
?set_filter@core@v2_mt_nt62@log@boost@@QEAAXAEBVfilter@234@@Z
?set_exception_handler@core@v2_mt_nt62@log@boost@@QEAAXAEBV?$light_function@$$A6AXXZ@aux@234@@Z
?remove_all_sinks@core@v2_mt_nt62@log@boost@@QEAAXXZ
?remove_sink@core@v2_mt_nt62@log@boost@@QEAAXAEBV?$shared_ptr@Vsink@sinks@v2_mt_nt62@log@boost@@@4@@Z
?add_sink@core@v2_mt_nt62@log@boost@@QEAAXAEBV?$shared_ptr@Vsink@sinks@v2_mt_nt62@log@boost@@@4@@Z
?consume@text_file_backend@sinks@v2_mt_nt62@log@boost@@QEAAXAEBVrecord_view@345@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??$put_integer@D@aux@v2_mt_nt62@log@boost@@YAXAEAV?$basic_ostringstreambuf@DU?$char_traits@D@std@@V?$allocator@D@2@@0123@IID@Z
?message@default_attribute_names@aux@v2_mt_nt62@log@boost@@YA?AVattribute_name@345@XZ
?flush@text_file_backend@sinks@v2_mt_nt62@log@boost@@QEAAXXZ
??$parse_date_time_format@D@aux@v2_mt_nt62@log@boost@@YAXPEBD0AEAU?$date_time_format_parser_callback@D@0123@@Z
?set_file_collector@text_file_backend@sinks@v2_mt_nt62@log@boost@@QEAAXAEBV?$shared_ptr@Ucollector@file@sinks@v2_mt_nt62@log@boost@@@5@@Z
?scan_for_files@text_file_backend@sinks@v2_mt_nt62@log@boost@@QEAA_KW4scan_method@file@2345@_N@Z
?construct@text_file_backend@sinks@v2_mt_nt62@log@boost@@AEAAXAEBVpath@filesystem@5@0H_KAEBV?$light_function@$$A6A_NXZ@aux@345@W4auto_newline_mode@2345@_N4@Z
?make_collector@aux@file@sinks@v2_mt_nt62@log@boost@@YA?AV?$shared_ptr@Ucollector@file@sinks@v2_mt_nt62@log@boost@@@6@AEBVpath@filesystem@6@_K11@Z
??1text_file_backend@sinks@v2_mt_nt62@log@boost@@QEAA@XZ
?find@attribute_value_set@v2_mt_nt62@log@boost@@QEBA?AVconst_iterator@1234@Vattribute_name@234@@Z
?end@attribute_value_set@v2_mt_nt62@log@boost@@QEBA?AVconst_iterator@1234@XZ
?attach_attribute_name_info@aux@v2_mt_nt62@log@boost@@YAXAEAVexception@4@AEBVattribute_name@234@@Z
?rollback@once_block_sentry@aux@v2_mt_nt62@log@boost@@AEAAXXZ
?commit@once_block_sentry@aux@v2_mt_nt62@log@boost@@QEAAXXZ
?enter_once_block@once_block_sentry@aux@v2_mt_nt62@log@boost@@AEBA_NXZ
?code_convert_impl@aux@v2_mt_nt62@log@boost@@YA_NPEB_W_KAEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@1AEBVlocale@6@@Z
??$?6DU?$char_traits@D@std@@@aux@v2_mt_nt62@log@boost@@YAAEAV?$basic_ostream@DU?$char_traits@D@std@@@std@@AEAV45@AEBV?$id@Uthread@aux@v2_mt_nt62@log@boost@@@0123@@Z
?line_id@default_attribute_names@aux@v2_mt_nt62@log@boost@@YA?AVattribute_name@345@XZ
??0attribute_set@v2_mt_nt62@log@boost@@QEAA@AEBV0123@@Z
?open_record@core@v2_mt_nt62@log@boost@@QEAA?AVrecord@234@AEBVattribute_set@234@@Z
?get_process_name@aux@v2_mt_nt62@log@boost@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?get@core@v2_mt_nt62@log@boost@@SA?AV?$shared_ptr@Vcore@v2_mt_nt62@log@boost@@@4@XZ

user32

TranslateMessage
PostQuitMessage
GetMessageW
PostThreadMessageW
DispatchMessageW

advapi32

RegCloseKey
RegDeleteValueW
EventWriteTransfer
EventRegister
CredFree
CredReadW
RegGetValueA
RegSetKeyValueW
EventUnregister
EventSetInformation
RegOpenKeyExW
RegQueryValueExW

ole32

CoInitializeEx
CoGetApartmentType
CoCreateInstance
CoInitialize
CoTaskMemFree
CoCreateFreeThreadedMarshaler
CoGetObjectContext
CoCreateGuid
CoTaskMemAlloc
CoRevokeClassObject
CoUninitialize
CoRegisterClassObject

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-sysinfo-l1-1-0

GetSystemTime
GetSystemTimeAsFileTime
GetVersionExW

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW
GetModuleHandleW
LoadLibraryExA
GetModuleFileNameA
GetModuleHandleExW
FreeLibrary
GetProcAddress

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformation

api-ms-win-core-version-l1-1-1

GetFileVersionInfoW

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-errorhandling-l1-1-0

RaiseException

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
InitializeCriticalSectionEx

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-sysinfo-l1-2-0

GetNativeSystemInfo

api-ms-win-core-kernel32-legacy-l1-1-0

GetSystemPowerStatus

iphlpapi

GetAdaptersInfo

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-winrt-l1-1-0

RoInitialize
RoUninitialize
RoGetActivationFactory
RoActivateInstance

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString
WindowsCreateStringReference
WindowsDeleteString

api-ms-win-core-file-l1-1-0

DeleteFileW
GetFileAttributesW
CreateFileW

msvcp140

?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
_Thrd_sleep
?__ExceptionPtrToBool@@YA_NPEBX@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?uncaught_exception@std@@YA_NXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??Bid@locale@std@@QEAA_KXZ
?uncaught_exceptions@std@@YAHXZ
?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?length@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1_K@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
?_Xbad_alloc@std@@YAXXZ
_Mtx_init_in_situ
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_unlock
?_Throw_C_error@std@@YAXH@Z
?_Xout_of_range@std@@YAXPEBD@Z
_Query_perf_counter
_Query_perf_frequency
?always_noconv@codecvt_base@std@@QEBA_NXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?_Xbad_function_call@std@@YAXXZ
_Cnd_init_in_situ
_Cnd_destroy_in_situ
_Xtime_get_ticks
_Thrd_detach
_Thrd_join
_Thrd_id
_Mtx_current_owns
_Cnd_wait
_Cnd_timedwait
_Cnd_broadcast
_Cnd_signal
_Cnd_do_broadcast_at_thread_exit
?_Throw_Cpp_error@std@@YAXH@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
_Mtx_trylock
_Thrd_yield
?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
?classic@locale@std@@SAAEBV12@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAN@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Random_device@std@@YAIXZ
??1_Locinfo@std@@QEAA@XZ
?_Xruntime_error@std@@YAXPEBD@Z
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
?_Makeloc@_Locimp@locale@std@@CAPEAV123@AEBV_Locinfo@3@HPEAV123@PEBV23@@Z
?_Getname@_Locinfo@std@@QEBAPEBDXZ
??0_Locinfo@std@@QEAA@HPEBD@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@_N@Z
?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?exceptions@ios_base@std@@QEAAXH@Z
??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
?_Winerror_map@std@@YAHH@Z
?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z
?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z
?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@V32@H@Z
?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@DD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??0_Locinfo@std@@QEAA@PEBD@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?id@?$ctype@D@std@@2V0locale@2@A
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?id@?$collate@D@std@@2V0locale@2@A
_Strxfrm
_Strcoll
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?tolower@?$ctype@D@std@@QEBADD@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?id@?$ctype@_W@std@@2V0locale@2@A
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?widen@?$ctype@_W@std@@QEBA_WD@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z
?widen@?$ctype@D@std@@QEBADD@Z
?narrow@?$ctype@D@std@@QEBADDD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?toupper@?$ctype@D@std@@QEBADD@Z

ws2_32

WSAStartup
WSACleanup

msi

ord70
ord190
ord88
ord32
ord141
ord8
ord160
ord92
ord169
ord159
ord131
ord118

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception
__current_exception_context
__RTDynamicCast
__std_type_info_compare
strstr
__std_terminate
__std_exception_copy
__std_exception_destroy
_purecall
memcpy
memmove
_CxxThrowException
memcmp
memset
memchr
__C_specific_handler
__std_type_info_name
strchr

api-ms-win-crt-runtime-l1-1-0

_beginthreadex
_crt_atexit
terminate
_invalid_parameter_noinfo_noreturn
_c_exit
strerror
_errno
_cexit
__p___argv
__p___argc
_invalid_parameter_noinfo
_exit
exit
_initterm_e
_initialize_onexit_table
_register_thread_local_exe_atexit_callback
_seh_filter_exe
_set_app_type
abort
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_register_onexit_function
_configure_narrow_argv

api-ms-win-crt-string-l1-1-0

strcmp
toupper
strncpy_s
isalpha
tolower
isalnum
_wcsicmp
iswspace
wcslen
strncpy
strlen

api-ms-win-crt-stdio-l1-1-0

_fseeki64
fwrite
setvbuf
ungetc
_set_fmode
fopen
__stdio_common_vswprintf
__p__commode
fseek
_get_stream_buffer_pointers
fclose
ftell
fputc
fflush
fgetc
fgetpos
rewind
_wfopen_s
fsetpos
__stdio_common_vsprintf_s
__stdio_common_vsscanf
__stdio_common_vsprintf
fread
__stdio_common_vsnprintf_s
fputs
fgets

api-ms-win-crt-heap-l1-1-0

_set_new_mode
free
_callnewh
_aligned_free
malloc
_aligned_malloc
realloc

api-ms-win-crt-filesystem-l1-1-0

_unlock_file
_lock_file
remove

api-ms-win-crt-time-l1-1-0

_gmtime64_s
_time64
_mkgmtime64
_gmtime64
_mktime64
_localtime64

api-ms-win-crt-math-l1-1-0

pow
_dsign
ceilf
ceil
__setusermatherr
log2
floor
_dtest

api-ms-win-crt-convert-l1-1-0

strtol
strtoll
wcstol
strtoull
strtod

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func
_configthreadlocale
localeconv

api-ms-win-crt-utility-l1-1-0

labs

zlib1

z_inflateInit2_
z_inflateEnd
z_inflate
z_deflateInit2_
z_deflateBound
z_deflateEnd
z_deflate

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
VerSetConditionMask

boost_log_setup-vc142-mt-x64-1_84

??$register_formatter_factory@D@v2_mt_nt62@log@boost@@YAXAEBVattribute_name@012@AEBV?$shared_ptr@U?$formatter_factory@D@v2_mt_nt62@log@boost@@@2@@Z

boost_thread-vc142-mt-x64-1_84

?get_tss_data@detail@boost@@YAPEAXPEBX@Z
?set_tss_data@detail@boost@@YAXPEBXP6AXP6AXPEAX@Z1@Z21_N@Z

shell32

SHGetKnownFolderPath
CommandLineToArgvW

api-ms-win-core-memory-l1-1-0

VirtualQuery
VirtualProtect

oleaut32

SysFreeString
SysStringLen
SysAllocString
SetErrorInfo
GetErrorInfo

Sections

.text
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 582KB - Virtual size: 582KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 153KB - Virtual size: 161KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 86KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 108KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cfb2cff3135437db358ca689002646c7

Code Sign

33:00:00:05:57:cf:90:dd:c7:d1:c0:88:8c:00:00:00:00:05:57Certificate

Extended Key Usages

61:0c:52:4c:00:00:00:00:00:03Certificate

Key Usages

33:00:00:03:a5:41:11:e8:f0:7f:be:0b:75:00:00:00:00:03:a5Certificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

0d:26:3c:a3:cd:d8:5e:44:ec:f9:ed:33:c6:e4:52:38:f6:1f:be:4b:34:57:6e:ef:e8:27:32:a5:28:9c:a8:66Signer

0d:26:3c:a3:cd:d8:5e:44:ec:f9:ed:33:c6:e4:52:38:f6:1f:be:4b:34:57:6e:ef:e8:27:32:a5:28:9c:a8:66Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

sqlite3

wininet

shlwapi

boost_log-vc142-mt-x64-1_84

user32

advapi32

ole32

api-ms-win-core-debug-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-version-l1-1-1

api-ms-win-core-version-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-kernel32-legacy-l1-1-0

iphlpapi

api-ms-win-core-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-file-l1-1-0

msvcp140

ws2_32

msi

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-utility-l1-1-0

zlib1

ntdll

boost_log_setup-vc142-mt-x64-1_84

boost_thread-vc142-mt-x64-1_84

shell32

api-ms-win-core-memory-l1-1-0

oleaut32

Sections

.text Size: 2.1MB - Virtual size: 2.1MB

.rdata Size: 582KB - Virtual size: 582KB

.data Size: 153KB - Virtual size: 161KB

.pdata Size: 86KB - Virtual size: 86KB

.didat Size: 512B - Virtual size: 88B

.rsrc Size: 108KB - Virtual size: 108KB

.reloc Size: 15KB - Virtual size: 14KB

33:00:00:05:57:cf:90:dd:c7:d1:c0:88:8c:00:00:00:00:05:57
Certificate

61:0c:52:4c:00:00:00:00:00:03
Certificate

33:00:00:03:a5:41:11:e8:f0:7f:be:0b:75:00:00:00:00:03:a5
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

0d:26:3c:a3:cd:d8:5e:44:ec:f9:ed:33:c6:e4:52:38:f6:1f:be:4b:34:57:6e:ef:e8:27:32:a5:28:9c:a8:66
Signer

0d:26:3c:a3:cd:d8:5e:44:ec:f9:ed:33:c6:e4:52:38:f6:1f:be:4b:34:57:6e:ef:e8:27:32:a5:28:9c:a8:66
Signer

.text
Size: 2.1MB - Virtual size: 2.1MB

.rdata
Size: 582KB - Virtual size: 582KB

.data
Size: 153KB - Virtual size: 161KB

.pdata
Size: 86KB - Virtual size: 86KB

.didat
Size: 512B - Virtual size: 88B

.rsrc
Size: 108KB - Virtual size: 108KB

.reloc
Size: 15KB - Virtual size: 14KB