muirct.pdb
Static task
static1
General
-
Target
503a62dcc426ac5e5c0a73b21b6dbb50_NeikiAnalytics
-
Size
720KB
-
MD5
503a62dcc426ac5e5c0a73b21b6dbb50
-
SHA1
09a38b6718881df0282ef4320e2c6ec006782b97
-
SHA256
babefe73864eb24264458cad4ce99dfc559fe502618cb2f50cab4e743edbdc06
-
SHA512
921ad9a0b6467beb624e6dff9c75ca2c14b2bac15e0bd2a459083eb7f2bf634e79095bbbe79378803d9e811e9c4a2ff18b9995763daa763390be7627d5eba8c7
-
SSDEEP
12288:t7hU1vpJJaJKQ1uBeAMlwesHU8wqy2VYCIbvpOBlU1RlgIDMCZgjtGlxHZ9/I:/U1Vv1SwPHU8X31PfU17DhZy0lxHZ9/I
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 503a62dcc426ac5e5c0a73b21b6dbb50_NeikiAnalytics
Files
-
503a62dcc426ac5e5c0a73b21b6dbb50_NeikiAnalytics.exe windows:10 windows x64 arch:x64
3064221fc9208288e0016821c0f93774
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
advapi32
IsTextUnicode
kernel32
CreateDirectoryW
SizeofResource
LocalAlloc
GetFileAttributesW
SetFileAttributesW
GetLastError
LockResource
DeleteFileW
HeapSetInformation
LoadResource
LocalFree
FreeLibrary
CopyFileW
LoadLibraryExW
HeapCreate
HeapFree
HeapAlloc
HeapDestroy
GetProcessHeap
FormatMessageW
GetFullPathNameW
EnumResourceTypesW
WriteFile
EnumResourceNamesW
CreateFileW
GetVersionExW
UnmapViewOfFile
CloseHandle
EnumResourceLanguagesW
LoadLibraryW
FindResourceExW
UpdateResourceW
GetProcAddress
GetModuleHandleW
BeginUpdateResourceW
CreateFileMappingW
MapViewOfFile
ReadFile
GetFileSizeEx
MultiByteToWideChar
Sleep
VirtualProtect
GetTempFileNameW
_lread
MoveFileExW
GlobalLock
GlobalFree
_llseek
GetTempPathW
SetLastError
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
OutputDebugStringA
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GlobalUnlock
_lwrite
_lclose
msvcrt
_exit
_cexit
__setusermatherr
_initterm
_errno
_fmode
_commode
?terminate@@YAXXZ
_lock
_unlock
__dllonexit
_onexit
memcpy
memset
__wgetmainargs
memcmp
exit
_amsg_exit
_XcptFilter
_CxxThrowException
__set_app_type
_callnewh
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
__CxxFrameHandler
??1type_info@@UEAA@XZ
bsearch
wcsncpy
__iob_func
wcsncmp
towupper
_wcsnicmp
wcsstr
strncmp
strtoul
wcschr
toupper
towlower
_vsnwprintf
malloc
free
fwprintf
vfwprintf
wcsrchr
_purecall
wcstoul
_wcsicmp
__C_specific_handler
wcscmp
imagehlp
MapFileAndCheckSumW
bcrypt
BCryptHashData
BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptCloseAlgorithmProvider
BCryptFinishHash
BCryptDestroyHash
BCryptCreateHash
user32
CharLowerW
ntdll
RtlLookupFunctionEntry
RtlAllocateHeap
RtlFreeHeap
RtlCaptureContext
RtlVirtualUnwind
Sections
.text Size: 91KB - Virtual size: 91KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 53KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 568KB - Virtual size: 572KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE