40c93fb37de30427181fd14b25d95123082fcf514e80b1083f93fc2c0996549e_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

40c93fb37de30427181fd14b25d95123082fcf514e80b1083f93fc2c0996549e_NeikiAnalytics.exe
Size

6.4MB
MD5

e17c7540abd56f3e9709be4383c6bd30
SHA1

0e16faa78ec22294209a87882f30b604dd020e42
SHA256

40c93fb37de30427181fd14b25d95123082fcf514e80b1083f93fc2c0996549e
SHA512

232d5b6d41d69bfd752d6d78ad99194e278561d6b680b6335a74f66c4130bd3af1dffc69bed4fdbb89124caad23be2e9bb8748ef1ed86bd983cc53505b69d357
SSDEEP

98304:E2XswubXaFl7XVEaqx56LtbSeK78yYkVvkg7m8Etg1C9Y41WCpqc:jXswuuJE7W4IDkVvkgK9fVWCoc

Score

1^/10

Malware Config

Signatures

Files

40c93fb37de30427181fd14b25d95123082fcf514e80b1083f93fc2c0996549e_NeikiAnalytics.exe
.exe windows:5 windows x86 arch:x86

5c4fad4dece2e8e8a524c0c805907c43

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

19/09/2018, 00:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

28/07/2020, 00:00

Not After

18/03/2029, 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

31/05/2021, 06:43

Not After

17/09/2029, 06:43

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31
Certificate

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

02/11/2023, 08:32

Not After

30/10/2034, 08:32

Subject

CN=Certum Timestamp 2023,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19/05/2021, 05:32

Not After

18/05/2036, 05:32

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

29:c8:cb:43:1d:57:65:77:57:fb:47:fc
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

20/12/2022, 08:57

Not After

18/03/2025, 08:54

Subject

SERIALNUMBER=0104-01-157146,CN=FLEXTECH INC.,O=FLEXTECH INC.,STREET=Roppongi 6-10-1,L=Minato-ku,ST=Tokyo,C=JP,1.3.6.1.4.1.311.60.2.1.3=#13024a50,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

19/09/2018, 00:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

28/07/2020, 00:00

Not After

18/03/2029, 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

29:c8:cb:43:1d:57:65:77:57:fb:47:fc
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

20/12/2022, 08:57

Not After

18/03/2025, 08:54

Subject

SERIALNUMBER=0104-01-157146,CN=FLEXTECH INC.,O=FLEXTECH INC.,STREET=Roppongi 6-10-1,L=Minato-ku,ST=Tokyo,C=JP,1.3.6.1.4.1.311.60.2.1.3=#13024a50,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2023, 00:00

Not After

02/08/2034, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a1:6c:30:95:24:b0:42:ac:37:70:6d:ee:80:33:c1:a8:dd:68:e0:5b:b0:a1:03:87:40:bb:2c:e8:c2:45:4f:9c
Signer

Actual PE Digest

a1:6c:30:95:24:b0:42:ac:37:70:6d:ee:80:33:c1:a8:dd:68:e0:5b:b0:a1:03:87:40:bb:2c:e8:c2:45:4f:9c

Digest Algorithm

sha256

PE Digest Matches

false

15:c2:0a:38:82:fa:6d:c8:ba:61:51:94:f2:7c:19:ad:b0:95:1c:db
Signer

Actual PE Digest

15:c2:0a:38:82:fa:6d:c8:ba:61:51:94:f2:7c:19:ad:b0:95:1c:db

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

H:\baidu\netdisk\pc-international\output\pdb\YunUi.pdb

Imports

updateagent

update_agent_global_init
update_agent_global_cleanup
update_agent_setopt

bull140u

?AssertOut@BULL@@YAJPB_WH_N0@Z
?GuidToString@BULL@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@ABU_GUID@@@Z
?LoadModuleInfo@BULL@@YAJPB_W@Z
?CreateObjectNative@BULL@@YAJABU_GUID@@0PAPAX@Z
?XLogMonitor@BULL@@YAJ_KPB_W11@Z
?XLogV@BULL@@YAXIPB_W0PAD@Z
?MultiByteToWideChar@BULL@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@IPBD@Z
?_wtoui@@YAIPB_W@Z
?CreateGuid@BULL@@YA?AU_GUID@@XZ
?RegisterObject@BULL@@YAJABU_GUID@@0P6GJPAX0PAPAX@ZPB_W@Z
?Base64Decode@BULL@@YAJPA_WPAPAUIGeneralBuffer@1@@Z
?Base64Encode@BULL@@YAJPAUIGeneralBuffer@1@PAPA_WK@Z
?MD5@BULL@@YAJPAUIGeneralBuffer@1@PAPAU21@@Z
?KillTimer_s@BULL@@YAXK@Z
?KillTimer@BULL@@YAJK@Z
?SetTimer@BULL@@YAJK_NPAUICallbackTimer@1@KPAK@Z
?EnableNamedObject@BULL@@YAJPA_WABU_GUID@@@Z
?GetModuleVer@BULL@@YAJPA_WPAPA_W1@Z
?GetLogController@BULL@@YAJPAPAUILogController@1@@Z
?GetNamedObject@BULL@@YAJPA_WABU_GUID@@1PAPAX@Z

apputil

?TransformWStringToUtf8String@Misc@AppUtil@@YAJV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@AAV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@4@@Z
?CurlIsIPV6@Misc@AppUtil@@YAHABV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@Z
?GetValueByKey@HelpAppSetting@@YAJV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@0AAV23@H@Z
?GetValueByKey@HelpAppSetting@@YAJV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@0AA_J@Z
?VersionInfoDecode@Misc@AppUtil@@YAJPAPA_WH@Z
?GetChannelInfo@Misc@AppUtil@@YAJPAPA_W@Z
?GetTeraBoxTempPath@Misc@AppUtil@@YAJPAPA_W@Z
?IsAllAUPackageReady@Misc@AppUtil@@YAHAAH@Z
?IsAutoUpdate@Misc@AppUtil@@YAHXZ
GetInt64FromJsonDataShim
?GetUrl@HelpAppSetting@@YAJV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@HW4EDomainType@1@0AAV23@@Z
?SetValueByKey@HelpAppSetting@@YAJV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@00H@Z
?TransformUtf8BufferToBSTR@Misc@AppUtil@@YAJPAUIGeneralBuffer@BULL@@PAPA_W@Z
?GetCurrentLangId@Misc@AppUtil@@YAJAAK@Z
?CurURLDecode@Misc@AppUtil@@YAJPBDAAV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@@Z
?GetDomain@HelpAppSetting@@YAJW4EDomainType@1@AAV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@Z
?GetDomain@HelpAppSetting@@YAJAAV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@Z
?CurURLEncode@Misc@AppUtil@@YAJPBDAAV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@@Z
?Parse@JsonLib@@YAJPA_WPAPAUIGeneralArray@BULL@@@Z
?GetProxyInfo@HelpProxySetting@@YAJPAKPAPA_WPAG@Z
?SetProxyInfo@HelpProxySetting@@YAJKPA_WG@Z
?IsAutoRun@Misc@AppUtil@@YAHXZ
?SetAutoRun@Misc@AppUtil@@YAJH@Z
?SetValueByKey@HelpAppSetting@@YAJV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@0H@Z
?CurURLEncode@Misc@AppUtil@@YAJPB_WAAV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@Z
?JsonEncode@JsonLib@@YAJPAUIGeneralData@BULL@@AAV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@@Z
?IsNeedAutoUpdate@Misc@AppUtil@@YAHXZ
?GetLangDuiStringTableId@Misc@AppUtil@@YAJAAV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@Z
?GetUpdateLevel@Misc@AppUtil@@YAJPAH@Z
?GetForceUpdateContent@Misc@AppUtil@@YAJPAPA_W00@Z
?IsTeraBoxDomain@HelpAppSetting@@YAJV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@AAH@Z
?TransUidToString@Misc@AppUtil@@YAJV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@AAV34@@Z
?GetValueByKey@HelpAppSetting@@YAJV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@0AAH@Z
?GetUrl@HelpAppSetting@@YAJV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@HW4EDomainType@1@AAV23@@Z
?TransformUtf8StringToWString@Misc@AppUtil@@YAJV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@AAV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@4@@Z
?GetValueByKey@HelpAppSetting@@YAJV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@0AAI@Z
?Parse@JsonLib@@YAJPA_WPAPAUIGeneralData@BULL@@@Z
?TransformUtf8HttpMemoryBlockToBSTR@Misc@AppUtil@@YAJPAUIHttpMemoryBlock@BULL@@PAPA_W@Z

kernel32

GlobalUnlock
GlobalLock
GlobalAlloc
MulDiv
lstrcmpW
Sleep
GetDiskFreeSpaceExW
VerifyVersionInfoW
VerSetConditionMask
GetModuleHandleW
GetFileSize
ReadFile
WriteFile
lstrlenW
GetTempPathW
DeleteFileW
GlobalFree
GetDriveTypeW
SetThreadExecutionState
OpenProcess
VirtualAllocEx
ReadProcessMemory
VirtualFreeEx
LocalFree
WriteProcessMemory
CreateEventW
GetPrivateProfileIntW
VirtualAlloc
VirtualFree
FindClose
GetFullPathNameW
FindFirstFileW
FindNextFileW
GetExitCodeProcess
OpenMutexW
WaitForSingleObjectEx
ReleaseMutex
CreateMutexW
OpenFileMappingW
GetTempFileNameW
VirtualQuery
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
OpenEventW
SetEvent
GetSystemDirectoryW
GetLogicalDrives
WinExec
GetSystemTime
ExpandEnvironmentStringsW
GetSystemInfo
GetCurrentProcess
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
EncodePointer
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
LoadLibraryExA
VirtualProtect
LoadLibraryA
GetModuleHandleA
RemoveDirectoryW
DecodePointer
MoveFileExW
GetStdHandle
GetFileType
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleExW
DeleteFiber
ConvertFiberToThread
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
SetLastError
InitializeCriticalSection
FreeResource
lstrcpyW
DosDateTimeToFileTime
SetFilePointer
GetModuleFileNameW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
RaiseException
WideCharToMultiByte
GetLastError
GetTickCount
FreeLibrary
GetProcAddress
LoadLibraryW
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
WaitForSingleObject
CreateProcessW
GetThreadContext
Thread32Next
CloseHandle
SuspendThread
OpenThread
Thread32First
CreateToolhelp32Snapshot
GetCurrentProcessId
GetVersionExW
GetEnvironmentVariableW
GetCurrentThreadId
MultiByteToWideChar
SetUnhandledExceptionFilter
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
HeapDestroy
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
ResetEvent
SetErrorMode
LoadLibraryExW
lstrcmpiW
CreateFileW
HeapCreate

user32

MessageBeep
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
OemToCharBuffW
DestroyIcon
SetForegroundWindow
AttachThreadInput
GetActiveWindow
AllowSetForegroundWindow
CharLowerBuffW
PeekMessageW
LoadImageW
LoadIconW
UnregisterHotKey
SetClipboardData
SetActiveWindow
UnhookWinEvent
SetWinEventHook
ClipCursor
ShowCursor
GetCursorInfo
GetDoubleClickTime
GetShellWindow
GetForegroundWindow
FindWindowExW
UpdateWindow
GetWindowDC
RegisterHotKey
EnumChildWindows
RegisterClipboardFormatW
KillTimer
SetTimer
EmptyClipboard
ChangeClipboardChain
SetClipboardViewer
GetClipboardOwner
CloseClipboard
GetClipboardData
OpenClipboard
IsClipboardFormatAvailable
GetKeyState
UnionRect
SetRectEmpty
SetCursor
GetCursorPos
SystemParametersInfoW
TrackMouseEvent
GetWindowThreadProcessId
MonitorFromPoint
FindWindowW
DrawTextW
FrameRect
MapWindowPoints
GetMonitorInfoW
MonitorFromWindow
CopyRect
IsIconic
mouse_event
SetCursorPos
GetSystemMetrics
MapVirtualKeyA
EnableWindow
IsWindowEnabled
IsZoomed
GetWindowRect
ShowWindow
SendMessageTimeoutW
RegisterWindowMessageW
GetWindowTextLengthW
BeginPaint
EndPaint
TrackPopupMenu
AppendMenuW
InsertMenuW
DestroyMenu
CreatePopupMenu
IsMenu
EnableMenuItem
DrawIconEx
SetCaretPos
GetCaretBlinkTime
CreateCaret
EndMenu
SetLayeredWindowAttributes
PrintWindow
UpdateLayeredWindow
AnimateWindow
PostThreadMessageW
DispatchMessageW
TranslateMessage
GetMessageW
IsChild
GetFocus
PostMessageW
DefWindowProcW
CallWindowProcW
RegisterClassExW
GetClassInfoExW
LoadCursorW
CreateWindowExW
IsWindow
DestroyWindow
SetWindowLongW
GetWindowLongW
SendMessageW
SetWindowPos
GetParent
GetWindow
MessageBoxW
UnregisterClassW
SetRect
IsRectEmpty
PtInRect
GetClientRect
InvalidateRect
ClientToScreen
ScreenToClient
GetDC
OffsetRect
InflateRect
EqualRect
GetUserObjectInformationW
GetProcessWindowStation
GetDlgItem
GetClassNameW
GetSysColor
ReleaseDC
IntersectRect
SetCapture
SetFocus
GetMenuItemInfoW
SetWindowTextW
GetWindowTextW
MoveWindow
CharNextW
IsWindowVisible
DestroyAcceleratorTable
GetDesktopWindow
InvalidateRgn
FillRect
ReleaseCapture
CreateAcceleratorTableW
RedrawWindow
WaitForInputIdle

gdi32

CreateFontIndirectW
CreateBitmap
GetTextMetricsW
GetTextColor
GetTextExtentPoint32W
GetTextExtentPointW
CreateCompatibleBitmap
CreateCompatibleDC
CreateSolidBrush
SetBkColor
SetTextColor
CreateDIBitmap
GetObjectA
GetViewportOrgEx
LineTo
RoundRect
CreateDIBSection
ExtCreatePen
MoveToEx
TextOutW
SaveDC
RestoreDC
Rectangle
RectInRegion
GetObjectType
SelectObject
BitBlt
GetStockObject
GetClipRgn
ExcludeClipRect
CreateRectRgn
GetObjectW
GetDeviceCaps
GetClipBox
CreateRectRgnIndirect
OffsetViewportOrgEx
StretchBlt
GetRgnBox
GetCurrentObject
CombineRgn
SetViewportOrgEx
DeleteDC
CreatePen
ExtTextOutW
SetBkMode
ExtSelectClipRgn
SelectClipRgn
DeleteObject

comdlg32

GetSaveFileNameW
GetOpenFileNameW

advapi32

CryptGetUserKey
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
DeregisterEventSource
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
CryptSignHashW
CryptEnumProvidersW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegQueryValueExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegEnumKeyW
RegEnumValueW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
RegDeleteKeyW
RegisterEventSourceW

shell32

SHGetSpecialFolderPathW
SHGetDesktopFolder
SHGetPathFromIDListW
ord4
Shell_NotifyIconW
SHGetSpecialFolderLocation
DragFinish
SHChangeNotify
DragQueryFileW
SHAppBarMessage
ShellExecuteExW
SHBrowseForFolderW
ord2
SHGetMalloc
SHCreateDirectoryExW
SHFileOperationW
SHGetFolderPathW
ShellExecuteW
CommandLineToArgvW

ole32

CreateBindCtx
CLSIDFromString
CoCreateInstance
CoSetProxyBlanket
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoUninitialize
OleUninitialize
CoInitializeEx
OleInitialize
StringFromGUID2
OleLockRunning
CreateStreamOnHGlobal
CoGetClassObject
CLSIDFromProgID
RegisterDragDrop
RevokeDragDrop
ReleaseStgMedium
DoDragDrop
OleDuplicateData
StgCreateDocfile
CreateOleAdviseHolder
OleSetContainedObject
CoLoadLibrary
CoFreeLibrary

oleaut32

VariantClear
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetVartype
SafeArrayUnlock
SafeArrayLock
SafeArrayDestroy
SysStringLen
LoadRegTypeLi
LoadTypeLi
SysAllocStringLen
VarUI4FromStr
OleCreateFontIndirect
SysAllocStringByteLen
SysStringByteLen
VarBstrCmp
SysAllocString
SysFreeString
GetErrorInfo
VariantInit

shlwapi

SHDeleteKeyW
ord219
StrCmpLogicalW
StrToIntW
StrToIntExA
StrStrIW
PathAppendW

comctl32

InitCommonControlsEx

msvcp140

?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Xruntime_error@std@@YAXPBD@Z
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
?_Makeloc@_Locimp@locale@std@@CAPAV123@ABV_Locinfo@3@HPAV123@PBV23@@Z
??0_Locinfo@std@@QAE@HPBD@Z
?_New_Locimp@_Locimp@locale@std@@CAPAV123@_N@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z
?_Addfac@_Locimp@locale@std@@AAEXPAVfacet@23@I@Z
?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
?_Gettrue@_Locinfo@std@@QBEPBDXZ
?_Getfalse@_Locinfo@std@@QBEPBDXZ
?_Getlconv@_Locinfo@std@@QBEPBUlconv@@XZ
?id@?$numpunct@D@std@@2V0locale@2@A
?uncaught_exception@std@@YA_NXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z
??0_Lockit@std@@QAE@H@Z
??0_Locinfo@std@@QAE@PBD@Z
??1_Lockit@std@@QAE@XZ
??1_Locinfo@std@@QAE@XZ
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UAEXXZ
??1facet@locale@std@@MAE@XZ
??0facet@locale@std@@IAE@I@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?tolower@?$ctype@D@std@@QBEDD@Z
?tolower@?$ctype@D@std@@QBEPBDPADPBD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DPBUtm@@PBD3@Z
?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QAE?AVlocale@2@ABV32@@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??Bid@locale@std@@QAEIXZ
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ
?id@?$ctype@D@std@@2V0locale@2@A
_Strxfrm
_Strcoll
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?classic@locale@std@@SAABV12@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_BADOFF@std@@3_JB
?id@?$collate@D@std@@2V0locale@2@A

gdiplus

GdipLoadImageFromFile
GdipLoadImageFromStream
GdipCreateTexture2I
GdipDeleteBrush
GdipCloneBrush
GdiplusShutdown
GdiplusStartup
GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipSetImageAttributesWrapMode
GdipSetCompositingMode
GdipFillRectangleI
GdipDrawImageRectRectI
GdipImageRotateFlip
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipGetPropertyItemSize
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetSmoothingMode
GdipLoadImageFromStreamICM
GdipDeletePen
GdipDrawArcI
GdipCreateBitmapFromHBITMAP
GdipFree
GdipAlloc
GdipCloneImage
GdipDisposeImage
GdipSaveImageToFile
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipGetPropertyItem
GdipDrawImageRectI
GdipImageSelectActiveFrame
GdipCreatePen1
GdipLoadImageFromFileICM
GdipSetImageAttributesColorMatrix

crypt32

CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CertGetCertificateContextProperty
CertGetNameStringW
CertDuplicateCertificateContext

wintrust

WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
WTHelperGetProvCertFromChain
WinVerifyTrust

ws2_32

closesocket
WSASetLastError
send
recv
WSAGetLastError
WSACleanup

urlmon

UrlMkGetSessionOption
UrlMkSetSessionOption

psapi

EnumProcesses
GetModuleBaseNameW

wininet

InternetSetCookieExW
FindFirstUrlCacheEntryW
InternetSetCookieW
FindCloseUrlCache
DeleteUrlCacheEntryW
FindNextUrlCacheEntryW

winmm

PlaySoundW

vcruntime140

wcschr
memcpy
memset
__vcrt_InitializeCriticalSectionEx
__CxxFrameHandler3
_except_handler4_common
_CxxThrowException
memcmp
strrchr
strstr
__RTDynamicCast
memchr
strchr
__std_exception_copy
__std_exception_destroy
_purecall
wcsstr
wcsrchr
memmove
__std_terminate

api-ms-win-crt-runtime-l1-1-0

_controlfp_s
_invalid_parameter_noinfo_noreturn
_errno
_invalid_parameter_noinfo
_c_exit
strerror_s
_exit
_set_invalid_parameter_handler
terminate
strerror
raise
_initialize_onexit_table
_control87
_register_onexit_function
_crt_atexit
exit
_initterm_e
_initterm
_cexit
_get_wide_winmain_command_line
_seh_filter_exe
_set_app_type
_configure_wide_argv
_register_thread_local_exe_atexit_callback
_initialize_wide_environment
signal

api-ms-win-crt-string-l1-1-0

_wcsicmp
isspace
isblank
iswxdigit
isprint
isdigit
iswprint
wcscat_s
iswalpha
wcscspn
wcsspn
iswdigit
_wcsnicmp
wcsncmp
strncmp
iswalnum
wcstok
wcscpy_s
strnlen
strcpy
strcpy_s
_wcsdup
wcsncpy
wcscpy
_stricmp
_strnicmp
strncpy
strcspn
strspn
wmemcpy_s
wcscmp
wcsnlen
iswspace
_wcslwr_s
_wcsupr_s
strlen
wcslen
wcsncpy_s
strcmp
strcat

api-ms-win-crt-stdio-l1-1-0

fputs
__stdio_common_vsprintf_s
__stdio_common_vsprintf
__stdio_common_vsscanf
fgetc
_set_fmode
__p__commode
fputc
ungetc
fflush
setvbuf
_wfopen
fsetpos
_fseeki64
_setmode
fgetpos
ftell
fwrite
_get_stream_buffer_pointers
fclose
ferror
fopen
__acrt_iob_func
__stdio_common_vswscanf
_wfopen_s
__stdio_common_vfwprintf
__stdio_common_vswprintf_s
__stdio_common_vswprintf
fseek
__stdio_common_vsnwprintf_s
fread
__stdio_common_vfprintf
feof
_fileno
fgets

api-ms-win-crt-time-l1-1-0

_localtime64_s
wcsftime
_mktime64
_time64
_gmtime64_s

api-ms-win-crt-heap-l1-1-0

_callnewh
_set_new_mode
calloc
realloc
malloc
_recalloc
free

api-ms-win-crt-multibyte-l1-1-0

_mbsrchr
_mbsicmp
_mbslwr_s
_mbscmp

api-ms-win-crt-convert-l1-1-0

_wtoi64
_atoi64
atoi
wcstol
atof
strtoul
_wtoi
strtol

api-ms-win-crt-filesystem-l1-1-0

_stat64i32
_wfindnext64i32
_findclose
_wrmdir
_lock_file
_unlock_file
_wfindfirst64i32
_wremove
_waccess

api-ms-win-crt-utility-l1-1-0

div
srand
abs
rand
qsort
bsearch
labs

api-ms-win-crt-math-l1-1-0

ceil
_CIfmod
__setusermatherr
_except1
fabs
_libm_sse2_cos_precise
_libm_sse2_log10_precise
_libm_sse2_pow_precise
_libm_sse2_sin_precise

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-environment-l1-1-0

getenv

bcrypt

BCryptGenRandom

imm32

ImmAssociateContext
ImmReleaseContext
ImmGetContext

msimg32

GradientFill
AlphaBlend

Sections

.text
Size: 3.6MB - Virtual size: 3.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 148KB - Virtual size: 232KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 116B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: 916KB - Virtual size: 916KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 300KB - Virtual size: 299KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 241KB - Virtual size: 240KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5c4fad4dece2e8e8a524c0c805907c43

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6aCertificate

Key Usages

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54Certificate

Extended Key Usages

Key Usages

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27Certificate

Key Usages

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31Certificate

Extended Key Usages

Key Usages

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87Certificate

Extended Key Usages

Key Usages

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

29:c8:cb:43:1d:57:65:77:57:fb:47:fcCertificate

Extended Key Usages

Key Usages

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6aCertificate

Key Usages

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54Certificate

Extended Key Usages

Key Usages

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

29:c8:cb:43:1d:57:65:77:57:fb:47:fcCertificate

Extended Key Usages

Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

a1:6c:30:95:24:b0:42:ac:37:70:6d:ee:80:33:c1:a8:dd:68:e0:5b:b0:a1:03:87:40:bb:2c:e8:c2:45:4f:9cSigner

15:c2:0a:38:82:fa:6d:c8:ba:61:51:94:f2:7c:19:ad:b0:95:1c:dbSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

updateagent

bull140u

apputil

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msvcp140

gdiplus

crypt32

wintrust

ws2_32

urlmon

psapi

wininet

winmm

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-convert-l1-1-0

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31
Certificate

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

29:c8:cb:43:1d:57:65:77:57:fb:47:fc
Certificate

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

29:c8:cb:43:1d:57:65:77:57:fb:47:fc
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

a1:6c:30:95:24:b0:42:ac:37:70:6d:ee:80:33:c1:a8:dd:68:e0:5b:b0:a1:03:87:40:bb:2c:e8:c2:45:4f:9c
Signer

15:c2:0a:38:82:fa:6d:c8:ba:61:51:94:f2:7c:19:ad:b0:95:1c:db
Signer

.text
Size: 3.6MB - Virtual size: 3.6MB

.rdata
Size: 1.1MB - Virtual size: 1.1MB

.data
Size: 148KB - Virtual size: 232KB

.tls
Size: 512B - Virtual size: 9B

.gfids
Size: 512B - Virtual size: 116B

_RDATA
Size: 2KB - Virtual size: 1KB

.vmp0
Size: 916KB - Virtual size: 916KB

.reloc
Size: 300KB - Virtual size: 299KB

.rsrc
Size: 241KB - Virtual size: 240KB