C:\Users\Indah-PC\Documents\LS\Hijack.pdb
Static task
static1
Behavioral task
behavioral1
Sample
ba1e142fbd6b681ddd0bf7b4d2f2f020_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
ba1e142fbd6b681ddd0bf7b4d2f2f020_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
General
-
Target
ba1e142fbd6b681ddd0bf7b4d2f2f020_NeikiAnalytics
-
Size
387KB
-
MD5
ba1e142fbd6b681ddd0bf7b4d2f2f020
-
SHA1
b43e53ca8e3f5d81766ff0d9436a3ea9d9ea814e
-
SHA256
7fedfee3ac9e093cbe0063a283f15388a37fb7788f60f375f7de1af8dfb5ec11
-
SHA512
ccaddcaefdd2f2cd5cd3792b65b8e9bec4b4141045ac6c27478aed5e99578b3cbda0a10aaa998035adad044d62fe61f15876172d692979f51a7dc825558f5bfa
-
SSDEEP
12288:H01KJyW/XJw6+6SEvkFpb6r+JCcdXc4YiWaos:ghWu66Gr+JCcdX+aos
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ba1e142fbd6b681ddd0bf7b4d2f2f020_NeikiAnalytics
Files
-
ba1e142fbd6b681ddd0bf7b4d2f2f020_NeikiAnalytics.exe windows:5 windows x86 arch:x86
1dadae6937f252824e85bb8a33bed07d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
wldap32
ord33
ord79
ord301
ord32
ord200
ord30
ord26
ord50
ord143
ord217
ord211
ord22
ord27
ord41
ord46
ord60
ord35
ord45
crypt32
CertEnumCertificatesInStore
CertCreateCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChainEngine
CertFreeCertificateChain
CertFindExtension
CryptDecodeObjectEx
CertFreeCertificateContext
CryptQueryObject
CertFindCertificateInStore
CertCloseStore
CryptStringToBinaryA
CertOpenStore
PFXImportCertStore
CertAddCertificateContextToStore
ws2_32
WSAEventSelect
WSACloseEvent
getsockopt
WSACreateEvent
WSAGetLastError
send
closesocket
ntohs
WSASetLastError
htons
sendto
bind
recvfrom
accept
getsockname
listen
socket
htonl
freeaddrinfo
getaddrinfo
setsockopt
WSAIoctl
recv
connect
select
__WSAFDIsSet
getpeername
gethostname
ioctlsocket
WSAEnumNetworkEvents
normaliz
IdnToAscii
kernel32
EncodePointer
DecodePointer
InterlockedExchange
InterlockedCompareExchange
HeapSetInformation
UnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
GetFileSizeEx
SleepEx
VerSetConditionMask
VerifyVersionInfoW
MoveFileExA
WideCharToMultiByte
MultiByteToWideChar
GetEnvironmentVariableA
GetStdHandle
GetFileType
WaitForMultipleObjects
PeekNamedPipe
ReadFile
GetCurrentProcessId
QueryPerformanceCounter
LoadLibraryA
GetSystemDirectoryA
FreeLibrary
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
FormatMessageW
GetSystemTime
SetFileAttributesA
CopyFileA
SetLastError
SetConsoleTitleA
CreateFileA
SetPriorityClass
GetCurrentProcess
GetLastError
DeviceIoControl
GetVersionExA
CloseHandle
Process32First
OpenProcess
GetProcAddress
Process32Next
GetModuleHandleA
CreateToolhelp32Snapshot
lstrlenA
SystemTimeToFileTime
WaitForSingleObject
GetTickCount
SetFileTime
GetVolumeInformationA
Sleep
GetConsoleWindow
Beep
TerminateProcess
DeleteFileA
user32
ShowWindow
advapi32
CryptImportKey
CryptEncrypt
CryptDestroyKey
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptGenRandom
CryptAcquireContextA
CryptDestroyHash
CryptReleaseContext
msvcp100
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Decref@facet@locale@std@@QAEPAV123@XZ
?_Incref@facet@locale@std@@QAEXXZ
??Bid@locale@std@@QAEIXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
?_BADOFF@std@@3_JB
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?uncaught_exception@std@@YA_NXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?id@?$codecvt@DDH@std@@2V0locale@2@A
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z
msvcr100
strstr
ftell
strcspn
qsort
strpbrk
atoi
_fstat64
_lseeki64
strspn
_gmtime64
fgets
_open
_stat64
_access
_strtoi64
_beginthreadex
strftime
__CxxFrameHandler3
_unlock
__dllonexit
_lock
_onexit
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
__initenv
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_commode
_fmode
__set_app_type
_crt_debugger_hook
_except_handler4_common
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
_strdup
_unlink
_read
_write
_close
_fdopen
_CxxThrowException
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABV01@@Z
memmove
memchr
isalnum
??3@YAXPAX@Z
??2@YAPAXI@Z
sprintf
free
isspace
malloc
vsprintf_s
tolower
isprint
strncpy
printf
fputc
rename
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@PBD@Z
??0bad_cast@std@@QAE@ABV01@@Z
_unlock_file
scanf
ungetc
fgetpos
_fseeki64
fflush
system
fgetc
fsetpos
fopen
setvbuf
_lock_file
rand
strcpy_s
srand
memcpy_s
fwrite
strrchr
_localtime64
strcat_s
fclose
_time64
exit
memcpy
strchr
fread
__iob_func
calloc
realloc
memset
wcstombs
__sys_errlist
__sys_nerr
_errno
strtoul
strtol
strncmp
sscanf
fputs
fseek
feof
wininet
InternetOpenUrlA
Sections
.text Size: 306KB - Virtual size: 306KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 57KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 448B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ