D:\T\BuildResults\bin\Release\plug_ins\SendMail.pdb
Static task
static1
Behavioral task
behavioral1
Sample
553b05bd8056a2dc064da5d61741c710_NeikiAnalytics.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
553b05bd8056a2dc064da5d61741c710_NeikiAnalytics.dll
Resource
win10v2004-20240426-en
General
-
Target
553b05bd8056a2dc064da5d61741c710_NeikiAnalytics
-
Size
781KB
-
MD5
553b05bd8056a2dc064da5d61741c710
-
SHA1
444bbe9d826b0b9f0c79b6774cbd395596b63357
-
SHA256
5baa34e323954e70a903f2c7d43d18af955e88fcca7af228e267f0cfe04488f4
-
SHA512
e8b1542dc085eb75fb37eb62c6e86c710c72647163d1548fad5535b7bd62cc2be310fe68b006c3b72b8434e4053fbcbeb368da93484e31e7e594a130fe09c298
-
SSDEEP
24576:kEg6d1LfZKq0mXMUu+uFIRm6dfgjzThi:kE5LByXp+pInTk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 553b05bd8056a2dc064da5d61741c710_NeikiAnalytics
Files
-
553b05bd8056a2dc064da5d61741c710_NeikiAnalytics.dll windows:6 windows x86 arch:x86
b1f21c30ede3052415c3148bfdcafcb5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
version
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
kernel32
DisconnectNamedPipe
SetNamedPipeHandleState
GetOverlappedResult
SetEvent
ResetEvent
CreateEventA
WaitForMultipleObjects
LocalFree
WaitNamedPipeA
DisableThreadLibraryCalls
GetFileSize
SetFilePointer
lstrcatA
MultiByteToWideChar
WideCharToMultiByte
Sleep
ExpandEnvironmentStringsA
GetModuleFileNameA
FreeResource
LoadResource
LockResource
SizeofResource
FindResourceA
lstrcpyA
FindAtomW
OutputDebugStringA
InitializeSListHead
WriteFile
QueryPerformanceCounter
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateEventW
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
CreateProcessW
GetCurrentThread
CreateSemaphoreA
LocalAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
LoadLibraryExA
VirtualQuery
VirtualProtect
GetSystemInfo
GetLastError
ReadFile
FlushFileBuffers
CreateFileA
GetCurrentProcessId
GetTickCount
GetCurrentThreadId
GetCurrentProcess
CloseHandle
DeleteCriticalSection
InitializeCriticalSectionEx
RaiseException
lstrlenA
LoadLibraryW
LoadLibraryA
GetProcAddress
GetModuleHandleW
GetModuleHandleA
GetModuleFileNameW
FreeLibrary
GetSystemDirectoryA
SetLastError
OutputDebugStringW
user32
GetFocus
FindWindowA
MoveWindow
SetFocus
SetPropW
GetWindowRect
TranslateMessage
DispatchMessageA
PeekMessageA
GetMessageA
EnableWindow
IsWindowEnabled
GetParent
wsprintfA
GetPropW
advapi32
ConvertStringSecurityDescriptorToSecurityDescriptorA
ConvertSidToStringSidA
GetTokenInformation
OpenThreadToken
RegQueryValueExA
RegOpenKeyExA
OpenProcessToken
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListA
ole32
CoCreateInstance
oleaut32
SafeArrayAccessData
SafeArrayDestroy
SysFreeString
SysAllocString
msvcp140
?id@?$ctype@D@std@@2V0locale@2@A
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_K@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?uncaught_exception@std@@YA_NXZ
?_Xbad_alloc@std@@YAXXZ
??Bid@locale@std@@QAEIXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
vcruntime140
_except_handler4_common
strstr
strchr
strrchr
memchr
memcmp
__std_type_info_destroy_list
__std_exception_destroy
__std_exception_copy
memmove
memcpy
__std_terminate
__CxxFrameHandler3
memset
_purecall
_CxxThrowException
api-ms-win-crt-string-l1-1-0
wcsncpy_s
wcscat_s
strlen
strcpy
tolower
strpbrk
wcslen
strcmp
strtok_s
isalpha
_stricmp
wcscpy_s
isspace
isxdigit
isdigit
_strnicmp
strncmp
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswscanf
__stdio_common_vsnwprintf_s
__stdio_common_vsprintf_s
__stdio_common_vsprintf
__stdio_common_vsnprintf_s
api-ms-win-crt-runtime-l1-1-0
_cexit
_initterm
_initterm_e
_crt_atexit
_execute_onexit_table
_set_invalid_parameter_handler
_errno
_register_onexit_function
_initialize_onexit_table
_invalid_parameter_noinfo_noreturn
_invalid_parameter_noinfo
_initialize_narrow_environment
_seh_filter_dll
_configure_narrow_argv
api-ms-win-crt-convert-l1-1-0
wcstombs_s
atoi
_itoa_s
_wtoi
api-ms-win-crt-math-l1-1-0
pow
floor
api-ms-win-crt-heap-l1-1-0
free
malloc
_callnewh
api-ms-win-crt-multibyte-l1-1-0
_mbstowcs_s_l
_mbsstr
api-ms-win-crt-locale-l1-1-0
_free_locale
_create_locale
api-ms-win-crt-time-l1-1-0
_localtime64
_time64
_gmtime64
Exports
Exports
?ASstrcpy_safe@@YAPADPADPBD@Z
PlugInMain
SendExec
Sections
.text Size: 324KB - Virtual size: 323KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 73KB - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.didat Size: 512B - Virtual size: 28B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 54KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 323KB - Virtual size: 324KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ