Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
b04b9117a3ee505b6318cac0a53d505a27f50e778a3b9383c2dea14e77ef91e5_NeikiAnalytics.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
b04b9117a3ee505b6318cac0a53d505a27f50e778a3b9383c2dea14e77ef91e5_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
Target
b04b9117a3ee505b6318cac0a53d505a27f50e778a3b9383c2dea14e77ef91e5_NeikiAnalytics.exe
Size
597KB
MD5
49d7cb34455b3004fd9dae6374cbeff0
SHA1
162fcee307b3f0f3d705e2b35086e8a698a4d7ee
SHA256
b04b9117a3ee505b6318cac0a53d505a27f50e778a3b9383c2dea14e77ef91e5
SHA512
beca08bef9f8ec1f089e187f4669c3d3f542f108faf46dbc2cd6bf38ab61d7e3e240bf266ea9f88c2779ab45f904c84eb23f66628ea61931e9485c63c9aedb48
SSDEEP
12288:7xjou1qjhptExwTvoGU+ExJ97otcYsbUpRiNqHK88c:7xP6FTvoGBExJ97bbAHT
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
c:\jenkins\workspace\Client\Client\Windows\release\Bin\Release\ZoomOutlookIMPlugin.pdb
?IsExists@CFileName@Cmm@@QBEHXZ
??1CFileName@Cmm@@UAE@XZ
??_7CFileName@Cmm@@6B@
?cmm_str_convert@@YAIHPA_WIPBDI@Z
?cmm_str_convert@@YAIHPADIPB_WI@Z
?_cstring_set@Cmm@@YAXAAV?$CStringT@D@1@IPB_WI@Z
?length@?$CStringT@D@Cmm@@QBEIXZ
??0?$CStringT@D@Cmm@@QAE@XZ
??0?$CStringT@D@Cmm@@QAE@PBD@Z
??1?$CStringT@D@Cmm@@UAE@XZ
?c_str@?$CStringT@D@Cmm@@QBEPBDXZ
?GetBuffer@?$CStringT@D@Cmm@@QAEPADI@Z
?SetLength@?$CStringT@D@Cmm@@QAEXI@Z
?GetBuffer@?$CStringT@_W@Cmm@@QAEPA_WI@Z
?SetLength@?$CStringT@_W@Cmm@@QAEXI@Z
?InSeconds@TimeDelta@Cmm@@QBE_JXZ
?Now@Time@Cmm@@SA?AV12@XZ
??0CCmmArchiveObjHelper@Cmm@@QAE@PBD@Z
??1CCmmArchiveObjHelper@Cmm@@QAE@XZ
?FlatternToMsg@CCmmMessageHelper@Cmm@@YAPAVCmmMQ_Msg@2@PAVCCmmArchiveObjHelper@2@H@Z
??0CCritical@Cmm@@QAE@XZ
??1CCritical@Cmm@@QAE@XZ
?Lock@CCritical@Cmm@@QAEXXZ
?Unlock@CCritical@Cmm@@QAEXXZ
?GetImp@CCmmArchiveServiceImp@Archive@Cmm@@SAAAV123@XZ
?AddPackageDefine0@CCmmArchiveServiceImp@Archive@Cmm@@QAEHPBD@Z
?ParseMsg@?$CmmMessageTemplate_1@V?$CStringT@D@Cmm@@@Archive@Cmm@@UAEHPBVCmmMQ_Msg@3@@Z
?SetItem1@?$CmmMessageTemplate_1@V?$CStringT@D@Cmm@@@Archive@Cmm@@QAEXABV?$CStringT@D@3@@Z
?GetItem1@?$CmmMessageTemplate_1@V?$CStringT@D@Cmm@@@Archive@Cmm@@QAEAAV?$CStringT@D@3@XZ
?SetItem2@?$CmmMessageTemplate_2@V?$CStringT@D@Cmm@@V12@@Archive@Cmm@@QAEXABV?$CStringT@D@3@@Z
?GetItem2@?$CmmMessageTemplate_2@V?$CStringT@D@Cmm@@V12@@Archive@Cmm@@QAEAAV?$CStringT@D@3@XZ
?GetItem2@?$CmmMessageTemplate_2@V?$CStringT@D@Cmm@@H@Archive@Cmm@@QAEAAHXZ
?GetItem3@?$CmmMessageTemplate_3@V?$CStringT@D@Cmm@@HV12@@Archive@Cmm@@QAEAAV?$CStringT@D@3@XZ
?GetItem4@?$CmmMessageTemplate_4@V?$CStringT@D@Cmm@@HV12@V12@@Archive@Cmm@@QAEAAV?$CStringT@D@3@XZ
??0CSBMBMessage_Outlook_IMIntegration_GetContactInfo_Request@@QAE@XZ
??1CSBMBMessage_Outlook_IMIntegration_GetContactInfo_Request@@UAE@XZ
??0CSBMBMessage_Outlook_IMIntegration_GetContactInfo_Response@@QAE@XZ
??1CSBMBMessage_Outlook_IMIntegration_GetContactInfo_Response@@UAE@XZ
?ReadReg@CRegistryHelper@@SAHPAUHKEY__@@PB_W1PAKK@Z
??1CSBMBMessage_Outlook_IMIntegration_StartVideo_Request@@UAE@XZ
??0CSBMBMessage_Outlook_IMIntegration_StartChat_Request@@QAE@XZ
??1CSBMBMessage_Outlook_IMIntegration_StartChat_Request@@UAE@XZ
??0CSBMBMessage_Outlook_IMIntegration_StartAudio_Request@@QAE@XZ
??1CSBMBMessage_Outlook_IMIntegration_StartAudio_Request@@UAE@XZ
??0CSBMBMessage_Outlook_IMIntegration_SelfEmail_Response@@QAE@XZ
??1CSBMBMessage_Outlook_IMIntegration_SelfEmail_Response@@UAE@XZ
??0CSBMBMessage_Outlook_IMIntegration_PhotoChanged_Notification@@QAE@XZ
??1CSBMBMessage_Outlook_IMIntegration_PhotoChanged_Notification@@UAE@XZ
?DeleteValue@CRegistryHelper@@SAHPAUHKEY__@@PB_W1K@Z
??0Listener@Channel@ssb_ipc@@QAE@XZ
??0CIPCChannelThread@ssb_ipc@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4ChannelMode@1@PAVListener@Channel@1@H@Z
??1CIPCChannelThread@ssb_ipc@@UAE@XZ
?IsServerGood@CIPCChannelThread@ssb_ipc@@QAEHXZ
?Start@CIPCChannelThread@ssb_ipc@@QAEHXZ
?Stop@CIPCChannelThread@ssb_ipc@@QAEHXZ
?SendMessageW@CIPCChannelThread@ssb_ipc@@QAEHPAVCmmMQ_Msg@Cmm@@@Z
?GenChannelName@CIPCChannelThread@ssb_ipc@@SAXABV?$CStringT@_W@Cmm@@IAAV34@@Z
?OnChannelDisconnected@Listener@Channel@ssb_ipc@@UAEXH@Z
?ThreadProc@CIPCChannelThread@ssb_ipc@@UAEIXZ
??H?$CStringT@_W@Cmm@@QBE?AV01@ABV01@@Z
?find@?$CStringT@_W@Cmm@@QBEI_WI@Z
?substr@?$CStringT@_W@Cmm@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@II@Z
??A?$CStringT@_W@Cmm@@QBE_WI@Z
?Find@?$CStringT@_W@Cmm@@QBEPA_WPB_WI@Z
?Replace@?$CStringT@_W@Cmm@@QAEXPB_W0@Z
??0CFileName@Cmm@@QAE@XZ
?GetSpecialDirectory@CFileName@Cmm@@QAEXW4SpecialFolder@12@H@Z
??0CmmCryptoUtil@@QAE@XZ
??1CmmCryptoUtil@@UAE@XZ
?WriteReg@CRegistryHelper@@SAHPAUHKEY__@@PB_W1ABV?$CStringT@_W@Cmm@@K@Z
?ReadReg@CRegistryHelper@@SAHPAUHKEY__@@PB_W1AAV?$CStringT@_W@Cmm@@K@Z
?Mid@?$CStringT@_W@Cmm@@QBE?AV?$CRangeT@PB_W@2@II@Z
?IsEmpty@?$CStringT@_W@Cmm@@QBEHXZ
?CompareNoCase@?$CStringT@_W@Cmm@@QBEHPB_W@Z
?Compare@?$CStringT@_W@Cmm@@QBEHABV12@@Z
?Compare@?$CStringT@_W@Cmm@@QBEHPB_W@Z
?Format@?$CStringT@_W@Cmm@@QAAXPB_WZZ
??Y?$CStringT@_W@Cmm@@QAEAAV01@ABV01@@Z
??Y?$CStringT@_W@Cmm@@QAEAAV01@PB_W@Z
??4?$CStringT@_W@Cmm@@QAEAAV01@V?$CRangeT@PB_W@1@@Z
??4?$CStringT@_W@Cmm@@QAEAAV01@$$QAV01@@Z
??4?$CStringT@_W@Cmm@@QAEAAV01@ABV01@@Z
??4?$CStringT@_W@Cmm@@QAEAAV01@PB_W@Z
??H?$CStringT@_W@Cmm@@QBE?AV01@PB_W@Z
??0?$CStringT@_W@Cmm@@QAE@$$QAV01@@Z
??0?$CStringT@_W@Cmm@@QAE@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
??0?$CStringT@_W@Cmm@@QAE@ABV01@@Z
??0?$CStringT@_W@Cmm@@QAE@XZ
??0?$CStringT@_W@Cmm@@QAE@PB_W@Z
?length@?$CStringT@_W@Cmm@@QBEIXZ
??1Listener@Channel@ssb_ipc@@UAE@XZ
?WriteReg@CRegistryHelper@@SAHPAUHKEY__@@PB_W1KK@Z
?find@?$CStringT@_W@Cmm@@QBEIPB_WI@Z
?c_str@?$CStringT@_W@Cmm@@QBEPB_WXZ
??1?$CStringT@_W@Cmm@@UAE@XZ
??0CSBMBMessage_Outlook_IMIntegration_StartVideo_Request@@QAE@XZ
ExitProcess
CreateFileW
GetFileSize
ReadFile
SetLastError
GetCurrentThreadId
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
GetCommandLineW
HeapAlloc
HeapFree
GetProcessHeap
SetEvent
CreateMutexW
CreateEventW
Sleep
CreateThread
OpenProcess
VirtualProtect
ReleaseSemaphore
WriteFile
TerminateProcess
WaitForMultipleObjects
InitializeCriticalSection
SetFilePointer
ResumeThread
GetModuleHandleA
CreateToolhelp32Snapshot
Process32NextW
CreateFileA
Process32FirstW
GetWindowsDirectoryW
VerSetConditionMask
CreateSemaphoreW
FlushInstructionCache
VerifyVersionInfoW
CreateDirectoryA
SetDllDirectoryW
VirtualQuery
FlushFileBuffers
CreateDirectoryW
SetErrorMode
GetPrivateProfileStringW
DeleteFileW
GetTempFileNameW
ProcessIdToSessionId
LocalFree
OutputDebugStringW
IsWow64Process
GetCurrentProcessId
GetBinaryTypeW
GetSystemDirectoryW
GetProcessId
LoadLibraryExA
VirtualFree
VirtualAlloc
InterlockedPushEntrySList
InterlockedPopEntrySList
EncodePointer
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
WaitForSingleObjectEx
ResetEvent
InitializeCriticalSectionAndSpinCount
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetExitCodeProcess
GetCurrentProcess
WaitForSingleObject
FindFirstFileW
FindClose
MultiByteToWideChar
lstrcmpiW
FindResourceW
SizeofResource
LoadResource
LoadLibraryExW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
FreeLibrary
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
GetLastError
RaiseException
DecodePointer
CloseHandle
CallWindowProcW
GetClassInfoW
PostQuitMessage
PeekMessageW
KillTimer
GetMessageW
GetUserObjectInformationA
MessageBoxW
GetProcessWindowStation
CharUpperW
SetTimer
DestroyWindow
IsWindow
GetClassInfoExW
SetWindowLongW
RegisterClassExW
RegisterClassW
DefWindowProcW
UnregisterClassW
CharNextW
CreateWindowExW
TranslateMessage
DispatchMessageW
PostThreadMessageW
LoadCursorW
GetWindowLongW
GetTokenInformation
ConvertSidToStringSidW
LookupAccountNameW
RegGetValueW
SetTokenInformation
RevertToSelf
ImpersonateLoggedOnUser
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegQueryValueExW
OpenProcessToken
AllocateAndInitializeSid
CreateRestrictedToken
CreateWellKnownSid
DuplicateTokenEx
FreeSid
ShellExecuteExW
SHGetKnownFolderPath
SHGetSpecialFolderPathA
SHGetSpecialFolderPathW
StringFromGUID2
CreateStreamOnHGlobal
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoUninitialize
CoInitialize
CLSIDFromProgID
CoRegisterClassObject
CoRevokeClassObject
CoResumeClassObjects
CoAddRefServerProcess
CoReleaseServerProcess
CoCreateInstance
VariantCopyInd
VariantInit
SafeArrayRedim
SafeArrayCreate
SysAllocStringByteLen
SysStringByteLen
VariantCopy
VariantClear
SafeArrayGetLBound
SafeArrayGetUBound
SysAllocString
LoadRegTypeLi
RegisterTypeLi
VarUI4FromStr
SafeArrayGetVartype
SafeArrayCopy
SafeArrayUnlock
SafeArrayLock
SafeArrayDestroy
SysStringLen
SysFreeString
LoadTypeLi
UnRegisterTypeLi
?_Xout_of_range@std@@YAXPBD@Z
?_Xbad_function_call@std@@YAXXZ
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
_Wcscoll
_Wcsxfrm
??0_Locinfo@std@@QAE@PBD@Z
??1_Locinfo@std@@QAE@XZ
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ
?c_str@?$_Yarn@D@std@@QBEPBDXZ
??Bid@locale@std@@QAEIXZ
??0facet@locale@std@@IAE@I@Z
??1facet@locale@std@@MAE@XZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?is@?$ctype@_W@std@@QBE_NF_W@Z
?tolower@?$ctype@_W@std@@QBE_W_W@Z
?tolower@?$ctype@_W@std@@QBEPB_WPA_WPB_W@Z
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UAEXXZ
?id@?$ctype@_W@std@@2V0locale@2@A
?id@?$collate@_W@std@@2V0locale@2@A
?uncaught_exception@std@@YA_NXZ
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
PathRemoveFileSpecW
PathFileExistsW
PathCombineW
PathIsRelativeW
PathAppendW
GetModuleFileNameExW
EnumProcessModules
GetModuleInformation
WTHelperGetProvCertFromChain
WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
WinVerifyTrust
CertGetNameStringW
WTSFreeMemory
WTSQuerySessionInformationW
__current_exception_context
__current_exception
_except_handler4_common
wcsstr
__std_terminate
strchr
__std_exception_copy
__std_exception_destroy
_CxxThrowException
__CxxFrameHandler3
memcpy
memmove
memset
_purecall
_controlfp_s
_c_exit
_errno
_exit
exit
_invalid_parameter_noinfo
_resetstkoflw
_initterm_e
_initterm
_register_thread_local_exe_atexit_callback
terminate
_initialize_onexit_table
_register_onexit_function
_invalid_parameter_noinfo_noreturn
_crt_atexit
_cexit
_seh_filter_exe
_set_app_type
_configure_wide_argv
_initialize_wide_environment
_get_wide_winmain_command_line
_set_new_mode
malloc
realloc
_callnewh
calloc
free
_recalloc
_wcsicmp
towupper
_wcsnicmp
wcsncpy_s
wcsnlen
strcat_s
towlower
wcscpy_s
wcscat_s
__p__commode
_set_fmode
__stdio_common_vswprintf_s
_wstat64i32
__setusermatherr
_configthreadlocale
ord7
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ