C:\coretech\source\green\flitetranscoder\public\libraries\windows_x64\release\flitetranscoder.pdb
Static task
static1
Behavioral task
behavioral1
Sample
3bdee0e5c8c29d94504bfa0dd67f8250_NeikiAnalytics.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
3bdee0e5c8c29d94504bfa0dd67f8250_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
3bdee0e5c8c29d94504bfa0dd67f8250_NeikiAnalytics
-
Size
1.2MB
-
MD5
3bdee0e5c8c29d94504bfa0dd67f8250
-
SHA1
28b0185dd3680ca6d6d0b42ec36dd81373e8f081
-
SHA256
0499f894f89a425aa9e592c3d4ad5daec2581312adc5e8e4216303963afde23f
-
SHA512
022108ee71f965513c7df183042bd5f865fd7afabe027a588fb5b618194a254be60e26ea7644d90ed69138376edd51368ab791b80b20bfc06bef5606361ceb9e
-
SSDEEP
12288:NxNAp3ExA2Tp1bHdlAAZV2JugEU0zmBL3PvQKuND7++GxCXsYnaSe:NxN40Bp1jnAAT2JaUcY3PsNfB2CJi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3bdee0e5c8c29d94504bfa0dd67f8250_NeikiAnalytics
Files
-
3bdee0e5c8c29d94504bfa0dd67f8250_NeikiAnalytics.exe windows:6 windows x64 arch:x64
f37653588ef7b8f384a8c388328389a1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
aide
AIDELibDestroyWebPEncodeOptions
AIDELibCreateEncoderForPNG
AIDELibCreateGifEncodeOptions
AIDECreateLibInstance
AIDELibDestroyPngEncodeOptions
AIDEJpegEncodeOptionsSetUseClipping
AIDEPngEncodeOptionsSetForcedPaletteCreation
AIDEEncoderSetImageSize
AIDELibDestroyGifEncodeOptions
AIDEDestroyLibInstance
AIDEEncoderSetCommonColorBitDepth
AIDEWebPEncodeOptionsSetCompressionType
AIDELibCreatePngEncodeOptions
AIDELibCreateEncoderForGIF
AIDEJpegEncodeOptionsSetSave4WebQuality
AIDELibCreateEncoderForJPEG
AIDEEncoderSetICCProfile
AIDEEncoderSetColorSpace
AIDELibDestroyEncoder
AIDELibCreateWebPEncodeOptions
AIDEEncoderSetTransparencyType
AIDEWebPEncodeOptionsSetImageQuality
AIDELibCreateEncoderForWEBP
AIDELibDestroyOutputStream
AIDEEncoderWritePixelPartBuffers
AIDELibCreateJpegEncodeOptions
AIDEJpegEncodeOptionsSetEncodeMode
??1AIDEDimension@AIDE@@QEAA@XZ
??1AIDEOutputStreamCallBacks@AIDE@@QEAA@XZ
??0AIDEOutputStreamCallBacks@AIDE@@QEAA@XZ
AIDELibDestroyJpegEncodeOptions
AIDEEncoderSetPixelPartInfo
AIDEJpegEncodeOptionsSetEncodeMethod
AIDELibCreateOutputStream
??0AIDEDimension@AIDE@@QEAA@II@Z
kernel32
SizeofResource
LockResource
LoadResource
FindResourceW
GetModuleHandleW
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
RtlCaptureContext
msvcp140
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Xout_of_range@std@@YAXPEBD@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?uncaught_exception@std@@YA_NXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcpy
memcmp
memchr
memmove
__std_exception_copy
memset
__current_exception
__std_exception_destroy
_CxxThrowException
__C_specific_handler
__current_exception_context
_purecall
strchr
__std_terminate
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
_exit
_get_initial_narrow_environment
_initialize_narrow_environment
__p___argc
_errno
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_set_app_type
_invalid_parameter_noinfo_noreturn
_configure_narrow_argv
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
_seh_filter_exe
__p___argv
exit
api-ms-win-crt-stdio-l1-1-0
fflush
fputc
__p__commode
_set_fmode
_write
_close
_fileno
_setmode
_get_stream_buffer_pointers
_fseeki64
fread
fclose
fsetpos
ungetc
setvbuf
fgetpos
fwrite
fgetc
__acrt_iob_func
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
api-ms-win-crt-string-l1-1-0
strcmp
strncmp
isdigit
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-heap-l1-1-0
malloc
_set_new_mode
free
_callnewh
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Exports
Exports
??0PixelPartInfo@AIDE@@QEAA@XZ
??1PixelPartInfo@AIDE@@QEAA@XZ
??4AIDEDimension@AIDE@@QEAAAEAU01@AEBU01@@Z
??4AIDEFormatType@AIDE@@QEAAAEAU01@AEBU01@@Z
??4AIDEInputOutputStreamCallBacks@AIDE@@QEAAAEAU01@AEBU01@@Z
??4AIDEInputStreamCallBacks@AIDE@@QEAAAEAU01@AEBU01@@Z
??4AIDELayerSize@AIDE@@QEAAAEAU01@AEBU01@@Z
??4AIDELibInitCallBacks@AIDE@@QEAAAEAU01@AEBU01@@Z
??4AIDEOutputStreamCallBacks@AIDE@@QEAAAEAU01@AEBU01@@Z
??4AIDEPoint@AIDE@@QEAAAEAU01@AEBU01@@Z
??4AIDEProgressCallback@AIDE@@QEAAAEAU01@AEBU01@@Z
??4ComponentInfo@AIDE@@QEAAAEAU01@AEBU01@@Z
??4PaletteInfo@AIDE@@QEAAAEAU01@AEBU01@@Z
??4PixelPartInfo@AIDE@@QEAAAEAU01@AEBU01@@Z
?mVersion@AIDEInputOutputStreamCallBacks@AIDE@@2IB
?mVersion@AIDEInputStreamCallBacks@AIDE@@2IB
?mVersion@AIDELibInitCallBacks@AIDE@@2IB
?mVersion@AIDEOutputStreamCallBacks@AIDE@@2IB
?mVersion@AIDEProgressCallback@AIDE@@2IB
Sections
.text Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1.2MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE