z:\build\build\src\obj-firefox\toolkit\crashreporter\client\crashreporter.pdb
Static task
static1
Behavioral task
behavioral1
Sample
4720508de2c060c7d4184e84faf5dc50_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4720508de2c060c7d4184e84faf5dc50_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
4720508de2c060c7d4184e84faf5dc50_NeikiAnalytics
-
Size
770KB
-
MD5
4720508de2c060c7d4184e84faf5dc50
-
SHA1
ba83e2a1105a9ce1bb5782c1f051683ba8ffda19
-
SHA256
4750014f2719c3a100074a1b0e70ec91aebd2e9c3d78858a64f0ba8d8edca366
-
SHA512
6fcc036d7f00e5d9b8e6250ec0daf6ff8e60010f8be63df22e6d974fbc3de79f72e9fa1dbfc3aa210251368f92543350bc75f26f96cfe7f15e7361763d7d57bd
-
SSDEEP
12288:DMOyLvfTEKIPo2f3p6UjKvDhFwOz0/QGoFiYldaFMi9nEE8h+9oRWk:JGfTEKWoip66KfwOI4GofidEE8h+9o4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4720508de2c060c7d4184e84faf5dc50_NeikiAnalytics
Files
-
4720508de2c060c7d4184e84faf5dc50_NeikiAnalytics.exe windows:6 windows x64 arch:x64
c3dd245f5a2be8da86f762686d4b0524
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
nss3
HASH_Destroy
HASH_Create
HASH_Update
HASH_End
HASH_Begin
NSS_Initialize
kernel32
FormatMessageW
GetLastError
LockResource
GlobalAlloc
DeleteFileW
GlobalFree
CloseHandle
LoadLibraryW
CreateThread
LoadResource
FindResourceW
GetProcAddress
GlobalLock
LocalFree
VerSetConditionMask
CreateProcessW
GetModuleHandleW
FreeLibrary
WideCharToMultiByte
VerifyVersionInfoW
GlobalUnlock
MoveFileW
CreateEventW
GetSystemTimeAsFileTime
GetCurrentProcess
GetFileAttributesW
GetCurrentThreadId
SetEvent
ResetEvent
GetCurrentProcessId
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
WaitForSingleObjectEx
SetUnhandledExceptionFilter
GetSystemTime
IsDebuggerPresent
TerminateProcess
IsProcessorFeaturePresent
WaitForSingleObject
FindClose
GetModuleFileNameW
FindNextFileW
FindFirstFileW
CompareFileTime
SizeofResource
CreateDirectoryW
GetStartupInfoW
QueryPerformanceCounter
InitializeSListHead
MultiByteToWideChar
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
user32
BeginPaint
ChildWindowFromPoint
EndPaint
GetWindowTextW
DialogBoxParamW
GetSysColorBrush
CheckDlgButton
DrawTextW
IsClipboardFormatAvailable
GetDlgItem
InvalidateRect
EnableWindow
GetClientRect
CallWindowProcW
PostMessageW
GetWindowRect
GetFocus
GetDC
MessageBoxW
GetPropW
SetWindowLongPtrW
FillRect
SendMessageW
EndDialog
RemovePropW
SetWindowTextW
GetWindowLongPtrW
ShowWindow
OpenClipboard
SetTimer
CloseClipboard
SetDlgItemTextW
MapWindowPoints
GetDlgItemTextW
SendDlgItemMessageW
GetSysColor
DialogBoxIndirectParamW
IsWindowEnabled
MoveWindow
IsDlgButtonChecked
SetFocus
SetPropW
GetClipboardData
LoadIconW
gdi32
GetStockObject
GetTextExtentPoint32W
SetBkMode
SelectObject
SetTextColor
advapi32
RegCreateKeyW
RegSetValueExW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegOpenKeyW
RegDeleteValueW
RegCreateKeyExW
comctl32
InitCommonControlsEx
ole32
CoCreateGuid
shell32
SHGetFolderPathW
wininet
InternetConnectW
InternetCloseHandle
InternetReadFile
InternetCrackUrlW
HttpQueryInfoW
InternetOpenW
InternetQueryDataAvailable
HttpSendRequestW
HttpOpenRequestW
HttpAddRequestHeadersW
shlwapi
PathAppendW
msvcp140
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAN@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Xout_of_range@std@@YAXPEBD@Z
?_BADOFF@std@@3_JB
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Xlength_error@std@@YAXPEBD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
vcruntime140
memcpy
memset
_CxxThrowException
__std_exception_destroy
__std_exception_copy
__vcrt_InitializeCriticalSectionEx
__C_specific_handler
__CxxFrameHandler3
__std_terminate
memmove
memchr
wcsrchr
_purecall
strstr
memcmp
api-ms-win-crt-runtime-l1-1-0
__p___wargv
_invalid_parameter_noinfo_noreturn
terminate
_invalid_parameter_noinfo
__p___argc
_register_thread_local_exe_atexit_callback
_c_exit
_exit
_initterm_e
_initterm
exit
_get_wide_winmain_command_line
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_errno
abort
api-ms-win-crt-stdio-l1-1-0
setvbuf
fputc
ungetc
__stdio_common_vfscanf
fputs
fgets
fwrite
_wfopen_s
__stdio_common_vswprintf_s
fgetpos
fflush
_set_fmode
_fseeki64
__stdio_common_vfprintf
__stdio_common_vsprintf_s
__p__commode
fclose
_get_stream_buffer_pointers
fgetc
fsetpos
__stdio_common_vsprintf
api-ms-win-crt-heap-l1-1-0
_set_new_mode
free
malloc
_callnewh
api-ms-win-crt-time-l1-1-0
strftime
_gmtime64
_localtime64
_time64
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
api-ms-win-crt-environment-l1-1-0
_putenv
getenv
_wgetenv
api-ms-win-crt-string-l1-1-0
wcsncpy_s
_strdup
wcscmp
api-ms-win-crt-math-l1-1-0
_dtest
ceilf
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-convert-l1-1-0
wcstol
api-ms-win-crt-utility-l1-1-0
rand
Sections
.text Size: 135KB - Virtual size: 135KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 33KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 568KB - Virtual size: 572KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE