ahclient.pdb
Static task
static1
Behavioral task
behavioral1
Sample
9783168085fa4af76415934510833940_NeikiAnalytics.dll
Resource
win7-20240221-en
General
-
Target
9783168085fa4af76415934510833940_NeikiAnalytics
-
Size
619KB
-
MD5
9783168085fa4af76415934510833940
-
SHA1
ee9f50394216df9d2b44b421c9054af71242af81
-
SHA256
6825e9bfdcbcdb5f8d87170b9faa4ef89706ca22da3a56305ccb40bf9cf89c84
-
SHA512
3c5334bfb158e283af7193ef32cd3d4807abd3d9da74606a75c3538e801dbfff92c78c2415bac174fac6f9e11325b72b626f05483ac0cf6c2ec8bb600460d594
-
SSDEEP
12288:EX1J9BArIkxbc5KPwFwq9YDT1qEvPI5RViY4+Y7ed:FrYKYFwBvoGWd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9783168085fa4af76415934510833940_NeikiAnalytics
Files
-
9783168085fa4af76415934510833940_NeikiAnalytics.dll windows:6 windows x86 arch:x86
b9bfa6b29e46ccb96c534654d4c10040
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
wininet
HttpQueryInfoA
HttpSendRequestA
HttpOpenRequestA
InternetSetOptionA
InternetConnectA
InternetCloseHandle
InternetOpenA
InternetCrackUrlA
HttpSendRequestW
shlwapi
AssocQueryStringW
kernel32
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
HeapFree
GetProcessHeap
CreateSemaphoreA
CreateEventA
GetModuleHandleA
GetTickCount
CloseHandle
WaitForSingleObjectEx
ReleaseSemaphore
DuplicateHandle
GetProcAddress
GetCurrentProcess
SetEvent
FreeLibrary
RaiseException
GetLastError
GlobalFree
MultiByteToWideChar
GetModuleHandleW
GetStdHandle
GetEnvironmentVariableW
FindFirstFileW
GetFileAttributesExW
ReadFile
CreatePipe
WaitForSingleObject
GetExitCodeProcess
CreateProcessW
GetModuleFileNameW
GlobalAlloc
WideCharToMultiByte
LocalFree
SystemTimeToFileTime
ResetEvent
WaitForMultipleObjectsEx
VirtualQuery
FormatMessageA
LoadLibraryA
HeapAlloc
OpenEventA
SetWaitableTimer
InitializeSListHead
CreateEventW
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
QueryPerformanceFrequency
Sleep
GetCurrentProcessId
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
CreateWaitableTimerA
QueryPerformanceCounter
user32
wsprintfW
advapi32
RegOpenKeyExA
RegCloseKey
RegQueryValueExA
shell32
SHGetFolderPathW
ole32
OleRun
CLSIDFromProgID
CoCreateInstance
CLSIDFromString
CoInitialize
oleaut32
GetErrorInfo
VariantChangeType
VariantCopy
SysAllocString
SysFreeString
VariantInit
VariantClear
msvcp140
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
??Bid@locale@std@@QAEIXZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?_BADOFF@std@@3_JB
?id@?$ctype@D@std@@2V0locale@2@A
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Xinvalid_argument@std@@YAXPBD@Z
?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QAE?AVlocale@2@ABV32@@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?exceptions@ios_base@std@@QAEXH@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z
?uncaught_exceptions@std@@YAHXZ
?_Syserror_map@std@@YAPBDH@Z
winhttp
WinHttpConnect
WinHttpCloseHandle
WinHttpOpen
WinHttpReadData
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpQueryAuthSchemes
WinHttpSetCredentials
WinHttpSendRequest
WinHttpAddRequestHeaders
WinHttpOpenRequest
WinHttpSetTimeouts
WinHttpQueryDataAvailable
vcruntime140
__std_exception_destroy
_CxxThrowException
__CxxFrameHandler3
memcpy
memset
__std_exception_copy
memchr
__vcrt_InitializeCriticalSectionEx
__std_type_info_destroy_list
_except_handler4_common
__vcrt_GetModuleFileNameW
__vcrt_LoadLibraryExW
__std_terminate
__RTDynamicCast
__std_type_info_name
wcsstr
_purecall
memmove
api-ms-win-crt-runtime-l1-1-0
_execute_onexit_table
_crt_atexit
_cexit
_register_onexit_function
_initterm_e
_initialize_onexit_table
_seh_filter_dll
strerror
_errno
_wassert
_configure_narrow_argv
terminate
_invalid_parameter_noinfo_noreturn
_initterm
_invalid_parameter_noinfo
_initialize_narrow_environment
api-ms-win-crt-heap-l1-1-0
_callnewh
malloc
free
api-ms-win-crt-string-l1-1-0
wcscpy_s
toupper
isspace
wcscat_s
wcsncat_s
wcsncpy_s
wcslen
strlen
strcpy_s
strcat_s
tolower
api-ms-win-crt-convert-l1-1-0
strtoul
_itoa
atoi
api-ms-win-crt-time-l1-1-0
_gmtime64
_localtime64
_time64
api-ms-win-crt-stdio-l1-1-0
fflush
fclose
_get_stream_buffer_pointers
_wfopen_s
ungetc
__stdio_common_vsprintf
setvbuf
fgetc
fwrite
_fseeki64
fsetpos
__stdio_common_vsprintf_s
fputc
fgetpos
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
api-ms-win-crt-math-l1-1-0
_except1
Exports
Exports
AdobeHelpEncodeURIComponent
DisplayAdobeHelpClientPage
GetAdobeHelpClientOnlineStatus
GetAdobeHelpClientVersion
InitializeAdobeHelpClient
OpenURL
ReleaseURLMemory
SearchHelp
SearchHelpv2
Sections
.text Size: 248KB - Virtual size: 247KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 59KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 303KB - Virtual size: 304KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ