E:\Work\Torch\29.3.adblockplus\Client\src\build\Release\torch.exe.pdb
Static task
static1
Behavioral task
behavioral1
Sample
03cd2258ddf0d96744198ec96d498060_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
03cd2258ddf0d96744198ec96d498060_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
03cd2258ddf0d96744198ec96d498060_NeikiAnalytics
-
Size
894KB
-
MD5
03cd2258ddf0d96744198ec96d498060
-
SHA1
34825734c0c49d35803381c66d1a78cc0e7b6ba4
-
SHA256
3ef010c19b87d0b325ab5b03a016de7d115bc50ebd7b2a51e4777ebca29509c0
-
SHA512
635b196b43e6f0e01f62070eb2fa21dab68eee868ee893471d20c908c8af06d3165937c234002a184fa16fbefdbabe422db9f4b3e05e08c17680d5127cc85826
-
SSDEEP
24576:+VOhCZEanG/Zf1hCJ+pFubvVZQ7C+V0LxG:47LG/Z/C2uDVZH80w
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 03cd2258ddf0d96744198ec96d498060_NeikiAnalytics
Files
-
03cd2258ddf0d96744198ec96d498060_NeikiAnalytics.exe windows:5 windows x86 arch:x86
88aed2adc79bdf48b1ceff9a4390fc53
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
shlwapi
PathRemoveFileSpecW
PathFileExistsW
kernel32
LoadLibraryA
SetCurrentDirectoryW
LoadLibraryExW
GetModuleFileNameW
GetTempPathW
GetEnvironmentVariableW
CreateProcessW
CloseHandle
GetLastError
GetModuleHandleW
OutputDebugStringA
DuplicateHandle
GetExitCodeProcess
WaitForSingleObject
SizeofResource
LockResource
LoadResource
FindResourceW
GetCurrentProcessId
GetTickCount
ReleaseMutex
SetLastError
CreateMutexW
SetFilePointer
CreateFileW
WriteFile
FormatMessageA
CreateEventW
ExpandEnvironmentStringsW
SetEnvironmentVariableW
lstrlenW
LocalAlloc
GetUserDefaultLangID
GetFileAttributesW
CreateDirectoryW
GetLongPathNameW
GetCurrentDirectoryW
ReadFile
QueryDosDeviceW
MapViewOfFile
CreateFileMappingW
GetProcessTimes
OpenProcess
GetProcessId
SetInformationJobObject
HeapSetInformation
ResumeThread
AssignProcessToJobObject
GetStdHandle
SetHandleInformation
GetNativeSystemInfo
GetVersionExW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetLocaleInfoW
GetUserDefaultUILanguage
VirtualProtect
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
IsDebuggerPresent
RaiseException
GetCurrentThreadId
CreateThread
SetEndOfFile
FlushFileBuffers
InterlockedExchangeAdd
UnregisterWaitEx
RegisterWaitForSingleObject
GetSystemDirectoryW
GetWindowsDirectoryW
GetModuleHandleExW
InterlockedExchange
TlsGetValue
TlsFree
TlsSetValue
TlsAlloc
GetQueuedCompletionStatus
CreateIoCompletionPort
PostQueuedCompletionStatus
ResetEvent
SetEvent
WaitForMultipleObjects
ReleaseSemaphore
VirtualQueryEx
InterlockedDecrement
FreeLibrary
RtlCaptureContext
CreateSemaphoreW
InitializeCriticalSection
GetThreadContext
SuspendThread
WaitNamedPipeW
TransactNamedPipe
SetNamedPipeHandleState
WriteProcessMemory
VirtualProtectEx
TerminateJobObject
SignalObjectAndWait
GetProcessHandleCount
VirtualFree
GetFileType
CreateJobObjectW
CreateNamedPipeW
OpenEventW
SearchPathW
DebugBreak
ReadProcessMemory
GetComputerNameExW
WideCharToMultiByte
GetStringTypeW
MultiByteToWideChar
EncodePointer
DecodePointer
UnhandledExceptionFilter
HeapFree
ExitProcess
GetStartupInfoW
GetConsoleCP
GetConsoleMode
HeapAlloc
GetProcessHeap
GetFullPathNameW
HeapReAlloc
SetStdHandle
LCMapStringW
GetCPInfo
RtlUnwind
IsProcessorFeaturePresent
HeapCreate
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
HeapSize
GetTimeZoneInformation
WriteConsoleW
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetDriveTypeW
CompareStringW
VirtualAllocEx
VirtualFreeEx
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
CreateRemoteThread
GetModuleHandleA
FormatMessageW
LocalFree
GetEnvironmentVariableA
GetCommandLineW
SetEnvironmentVariableA
LoadLibraryW
GetProcAddress
InitializeCriticalSectionAndSpinCount
InterlockedIncrement
user32
MessageBoxW
GetUserObjectInformationW
GetThreadDesktop
SetProcessWindowStation
CreateDesktopW
GetProcessWindowStation
CreateWindowStationW
CloseDesktop
wsprintfW
FindWindowExW
IsWindow
SendMessageTimeoutW
AllowSetForegroundWindow
GetWindowThreadProcessId
CloseWindowStation
CharUpperW
userenv
GetProfileType
wtsapi32
WTSFreeMemory
WTSQuerySessionInformationW
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
winmm
timeGetTime
advapi32
CreateProcessAsUserW
OpenProcessToken
GetTokenInformation
ConvertSidToStringSidW
RegCreateKeyExW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
RegQueryInfoKeyW
RegQueryValueExW
RegDisablePredefinedCache
RevertToSelf
SetTokenInformation
GetLengthSid
ConvertStringSidToSidW
SetThreadToken
GetUserNameW
SetEntriesInAclW
GetSecurityInfo
CreateWellKnownSid
CopySid
LookupPrivilegeValueW
EqualSid
DuplicateToken
DuplicateTokenEx
CreateRestrictedToken
Exports
Exports
CrashForException
DumpProcess
DumpProcessWithoutCrash
InjectDumpForHangDebugging
InjectDumpProcessWithoutCrash
SetActiveURL
SetClientId
SetCommandLine2
SetCrashKeyValuePair
SetExperimentList3
SetExtensionID
SetGpuInfo
SetNumberOfExtensions
SetNumberOfViews
SetPrinterInfo
Sections
.text Size: 433KB - Virtual size: 432KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 180KB - Virtual size: 179KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 7KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 2B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 207KB - Virtual size: 206KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 61KB - Virtual size: 62KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ehgggjo Size: 4KB - Virtual size: 80KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE