e:\jpcad\work\jpcad\BIN\release\AMBSTR.pdb
Static task
static1
Behavioral task
behavioral1
Sample
28e023d79ee0786077975f6fe1cad0f0_NeikiAnalytics.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
28e023d79ee0786077975f6fe1cad0f0_NeikiAnalytics.dll
Resource
win10v2004-20240508-en
General
-
Target
28e023d79ee0786077975f6fe1cad0f0_NeikiAnalytics
-
Size
104KB
-
MD5
28e023d79ee0786077975f6fe1cad0f0
-
SHA1
e43ff10b5b838b87b6c3730b889f9b8bbd54e59d
-
SHA256
c4e7800fffe4f4734d34c17654a4bd4b05f2844f0605f544c82212ec10de96d9
-
SHA512
b99f95bfd059f2bfb86de5179d521237e987c5839ad0284642c43feb93a8be7fd368f7b15c8cc1cb25cba083f42c04eb5d78d26dc96058cc1c8cadb85e1d99b1
-
SSDEEP
1536:k+Z5AJrYuB27XIbbWBick2eMshEynlTznk7ZqdAd3aYit3vi6s17bOwW6RykK:DAJrE4Q7k2RshEiotNo3a6C7bOwW6EV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 28e023d79ee0786077975f6fe1cad0f0_NeikiAnalytics
Files
-
28e023d79ee0786077975f6fe1cad0f0_NeikiAnalytics.dll windows:4 windows x86 arch:x86
cdf15ca8abcf9f719566721e384bad20
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
user32
SetWindowTextW
GetSysColor
SetWindowPos
GetWindowRect
GetDlgItem
CallNextHookEx
UnhookWindowsHookEx
MessageBoxW
GetWindowTextW
GetDC
SendMessageA
ReleaseDC
GetClassNameA
SetWindowsHookExA
GetForegroundWindow
msvcr80
strtok
_strdup
_encode_pointer
_malloc_crt
_encoded_null
_decode_pointer
_initterm
_initterm_e
_adjust_fdiv
__CppXcptFilter
_unlock
__dllonexit
_lock
_onexit
_crt_debugger_hook
__clean_type_info_names_internal
_except_handler4_common
_stricmp
?_type_info_dtor_internal_method@type_info@@QAEXXZ
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
??3@YAXPAX@Z
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBDH@Z
strstr
_findfirst64i32
_findnext64i32
fgetc
fopen
fclose
memcpy
qsort
realloc
fputc
strchr
putc
memset
strrchr
__CxxFrameHandler3
free
malloc
strncpy
bsearch
_amsg_exit
?terminate@@YAXXZ
kernel32
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetModuleFileNameA
GetCurrentDirectoryA
GetFullPathNameA
FindFirstFileA
FindClose
GetCurrentThreadId
MultiByteToWideChar
GetLastError
GetSystemTimeAsFileTime
gdi32
TranslateCharsetInfo
SelectObject
CreateFontIndirectA
GetObjectA
GetTextExtentPoint32W
Exports
Exports
?GetCharSet@@YAHXZ
?GetCntrlStr@@YAPBDHPAX@Z
?GetStr@@YAPBDH@Z
?InitStrings@@YAHHPBD0@Z
?SetApp@@YAXPAUHWND__@@PBD@Z
?StrMessageBox@@YAHPBDI@Z
Sections
.text Size: 36KB - Virtual size: 33KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 48KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 130KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ