ChsIME.pdb
Static task
static1
Behavioral task
behavioral1
Sample
73fec62abf6cb35db121f730dde95940_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
73fec62abf6cb35db121f730dde95940_NeikiAnalytics
-
Size
846KB
-
MD5
73fec62abf6cb35db121f730dde95940
-
SHA1
f3597d1b0bd278442bd6868189a2479f2ddf35ea
-
SHA256
03731717a5bc8596c55460623b2e4e75a12dc46e0ff37965b1c7455878f95b24
-
SHA512
badb026938e05fa9a93d527304bbe10d81d13c732e6dd774ca63924b5873e06c6986c34249d093fa10976f61f2a5e328cebea80b2c59d9313c3f782b1c706bc8
-
SSDEEP
3072:A9thwwLHJSVFjbTNR2DiEndLfg76Z7S2exJSJwh1btBt+1D/4g+6TzCSxsHmjFm8:ADhTLijv2DzdLfgOxzD/4gjTX6gmMH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 73fec62abf6cb35db121f730dde95940_NeikiAnalytics
Files
-
73fec62abf6cb35db121f730dde95940_NeikiAnalytics.exe windows:10 windows x64 arch:x64
f8f04a4edeeef9e4c3dae55ca37c62f5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
advapi32
EventWriteTransfer
RegSetKeyValueW
EventSetInformation
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegNotifyChangeKeyValue
RegCreateKeyExW
EventUnregister
EventRegister
kernel32
WaitForThreadpoolTimerCallbacks
WaitForSingleObject
GetCurrentThreadId
ReleaseMutex
FormatMessageW
GetLastError
ReleaseSRWLockExclusive
OutputDebugStringW
CloseThreadpoolTimer
AcquireSRWLockExclusive
WaitForSingleObjectEx
OpenSemaphoreW
CloseHandle
SetThreadpoolTimer
ReleaseSRWLockShared
CreateThreadpoolTimer
HeapAlloc
GetProcAddress
CreateMutexExW
AcquireSRWLockShared
DeleteCriticalSection
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
DebugBreak
IsDebuggerPresent
InitializeSRWLock
InitializeCriticalSection
GetStringTypeW
GetTickCount
WideCharToMultiByte
MultiByteToWideChar
InitOnceComplete
InitOnceBeginInitialize
OpenMutexW
EncodePointer
InitOnceExecuteOnce
DecodePointer
SetEvent
InitializeCriticalSectionAndSpinCount
ResetEvent
CreateEventExW
RaiseException
GetSystemTimeAsFileTime
QueryPerformanceCounter
SleepConditionVariableSRW
WakeAllConditionVariable
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
InitializeCriticalSectionEx
GetModuleFileNameA
CreateSemaphoreExW
HeapFree
SetLastError
EnterCriticalSection
ReleaseSemaphore
GetModuleHandleExW
LeaveCriticalSection
user32
RealGetWindowClassW
GetForegroundWindow
SystemParametersInfoW
SetCoalescableTimer
DispatchMessageW
TranslateMessage
KillTimer
PeekMessageW
MsgWaitForMultipleObjects
GetKeyState
LoadStringW
LoadImageW
GetSystemMetrics
SetProcessDPIAware
keybd_event
GetAncestor
msvcrt
??0exception@@QEAA@AEBQEBD@Z
_callnewh
malloc
memmove_s
_vsnprintf_s
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
_purecall
memcpy_s
?what@exception@@UEBAPEBDXZ
__CxxFrameHandler3
??3@YAXPEAX@Z
__getmainargs
_commode
?terminate@@YAXXZ
_lock
??0exception@@QEAA@AEBQEBDH@Z
__set_app_type
exit
_exit
_cexit
__setusermatherr
_CxxThrowException
memcpy
memmove
_XcptFilter
_vsnwprintf
??1type_info@@UEAA@XZ
_onexit
??_V@YAXPEAX@Z
_initterm
??1bad_cast@@UEAA@XZ
??0bad_cast@@QEAA@PEBD@Z
??0bad_cast@@QEAA@AEBV0@@Z
strcspn
localeconv
free
sprintf_s
_errno
setlocale
__uncaught_exception
__pctype_func
___lc_handle_func
___lc_codepage_func
calloc
___mb_cur_max_func
_ismbblead
abort
memset
_wcsdup
__crtLCMapStringW
_wsetlocale
memcmp
__C_specific_handler
_amsg_exit
_unlock
__dllonexit
_fmode
ole32
PropVariantClear
CoCreateInstance
CoInitialize
CoUninitialize
CoReleaseServerProcess
CoAddRefServerProcess
CoRevokeClassObject
CoResumeClassObjects
CoTaskMemFree
CoRegisterClassObject
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
SetRestrictedErrorInfo
RoTransformError
RoOriginateErrorW
api-ms-win-core-winrt-error-l1-1-1
RoGetMatchingRestrictedErrorInfo
RoReportFailedDelegate
IsErrorPropagationEnabled
ntdll
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfStateChangeNotification
RtlPublishWnfStateData
RtlCaptureContext
RtlQueryWnfStateData
RtlLookupFunctionEntry
RtlVirtualUnwind
shell32
ShellExecuteExW
msctf
TF_SetShowFloatingStatus
TF_GetShowFloatingStatus
oleaut32
SysAllocString
api-ms-win-core-winrt-l1-1-0
RoRevokeActivationFactories
RoRegisterActivationFactories
api-ms-win-core-winrt-string-l1-1-0
WindowsStringHasEmbeddedNull
WindowsGetStringRawBuffer
WindowsIsStringEmpty
WindowsCreateString
WindowsDeleteString
Sections
.text Size: 156KB - Virtual size: 155KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 53KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 623KB - Virtual size: 623KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ