C:\Users\kali\Documents\GitHub\Revived-Raum\RevivedRaum\Release\Raum_core.pdb
Static task
static1
Behavioral task
behavioral1
Sample
396e9ef4e68913ba924ada29f0fb0260_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
396e9ef4e68913ba924ada29f0fb0260_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
General
-
Target
396e9ef4e68913ba924ada29f0fb0260_NeikiAnalytics
-
Size
214KB
-
MD5
396e9ef4e68913ba924ada29f0fb0260
-
SHA1
31b61709cd8cc3f3411f14b6a031c77b8c9ce4ed
-
SHA256
c7e19b2f6e6f9821a5556529e92619f5c9d03df5fffe1f637d99424850185b87
-
SHA512
63a984e820dc01a33b2fd8fcaeb0ba033b5fe38174a526d7bb5f1121c418fc405ff79336a80418d12235fee2ed26cc408a6e8529961dad1d99e2e078295dbd7c
-
SSDEEP
3072:MPCSgEQ5iPrzbswmm+f9WrpUl/lyeV+l76wYDJFrWlxnk1:TEQ8Pvb5GloQWhk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 396e9ef4e68913ba924ada29f0fb0260_NeikiAnalytics
Files
-
396e9ef4e68913ba924ada29f0fb0260_NeikiAnalytics.exe windows:5 windows x86 arch:x86
df158a8bf0ec5041ce8dcc4c3f4f44d1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
EnterCriticalSection
LeaveCriticalSection
DeleteFileA
GetTickCount
Sleep
CreateFileA
WriteFile
CloseHandle
CreateMutexA
GetLastError
GetModuleFileNameA
WaitForSingleObject
InitializeCriticalSectionAndSpinCount
CreateDirectoryA
SetFileAttributesA
ExitProcess
FindFirstFileA
SetLastError
FindNextFileA
CreateProcessA
CreateToolhelp32Snapshot
Process32First
Process32Next
TerminateProcess
GetCurrentProcess
InterlockedDecrement
WideCharToMultiByte
SetEndOfFile
CreateFileW
SetEnvironmentVariableA
ReadConsoleW
WriteConsoleW
SetStdHandle
LoadLibraryW
OutputDebugStringW
SetFilePointer
HeapReAlloc
GetOEMCP
IsValidCodePage
GetACP
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCurrentProcessId
QueryPerformanceCounter
FlushFileBuffers
SetFilePointerEx
InterlockedIncrement
EncodePointer
DecodePointer
DeleteCriticalSection
MultiByteToWideChar
GetStringTypeW
lstrlenA
LocalFree
HeapFree
GetSystemTimeAsFileTime
IsDebuggerPresent
IsProcessorFeaturePresent
CreateThread
GetCurrentThreadId
ExitThread
GetProcAddress
LoadLibraryExW
GetCommandLineA
RaiseException
RtlUnwind
HeapAlloc
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
GetModuleFileNameW
GetModuleHandleExW
AreFileApisANSI
HeapSize
GetProcessHeap
GetFileType
GetConsoleCP
GetConsoleMode
ReadFile
user32
GetCursorPos
ole32
CoInitializeSecurity
CoUninitialize
CoSetProxyBlanket
CoCreateInstance
CoInitializeEx
oleaut32
SysAllocString
SysFreeString
VariantClear
ws2_32
socket
gethostbyname
htons
connect
WSAStartup
closesocket
recv
send
WSACleanup
WSAGetLastError
Sections
.text Size: 127KB - Virtual size: 127KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 42KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ