C:\Rorce\saved\Sauce\x64\Release\dma.pdb
Static task
static1
Behavioral task
behavioral1
Sample
08aaf25736fc0c6afd633ad661264820_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
08aaf25736fc0c6afd633ad661264820_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
08aaf25736fc0c6afd633ad661264820_NeikiAnalytics.exe
-
Size
1.4MB
-
MD5
08aaf25736fc0c6afd633ad661264820
-
SHA1
6a72348b1378f952f0656e7e7c57e8c1343cd4d0
-
SHA256
eed262737ce024caa55378415fe89bc3d2578a2ec51d890c26b4b86d7b4d54e8
-
SHA512
5ed66aee58b357df58b57f12ce9e0fd6a285f958cb4d029727ba93883c2244baeee25683de13ff6ba6ce4cab9b1c3d8060a0f091c857b91f849357049d186617
-
SSDEEP
24576:JQ5eXLShEastNi5EjJnAbAzOCP6PxnPN1OqwhnHDc+OlHRhs6:JQ5e7haRgJS4P65nfwls
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 08aaf25736fc0c6afd633ad661264820_NeikiAnalytics.exe
Files
-
08aaf25736fc0c6afd633ad661264820_NeikiAnalytics.exe.exe windows:6 windows x64 arch:x64
e6f61a0cbc7c66d5241324d353473756
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
ws2_32
WSACleanup
bind
closesocket
WSAStartup
inet_addr
socket
recvfrom
htonl
htons
sendto
ntohl
gethostname
freeaddrinfo
getaddrinfo
select
__WSAFDIsSet
ioctlsocket
listen
accept
WSAIoctl
WSASetLastError
setsockopt
ntohs
getsockopt
getsockname
getpeername
connect
WSAGetLastError
send
recv
d3d9
Direct3DCreate9Ex
ntdll
RtlCaptureContext
RtlLookupFunctionEntry
VerSetConditionMask
RtlVirtualUnwind
dwmapi
DwmExtendFrameIntoClientArea
kernel32
QueryPerformanceCounter
SetLastError
GetLastError
UnmapViewOfFile
GetModuleFileNameW
FormatMessageA
LocalFree
EnterCriticalSection
LeaveCriticalSection
SleepEx
GetSystemDirectoryA
VerifyVersionInfoA
GetTickCount
MoveFileExA
WaitForSingleObjectEx
GetEnvironmentVariableA
GetFileType
PeekNamedPipe
WaitForMultipleObjects
GetFileSizeEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
GetProcAddress
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
QueryPerformanceFrequency
GetModuleHandleA
GlobalUnlock
GlobalLock
OutputDebugStringW
GlobalFree
GlobalAlloc
GetCurrentThread
LoadLibraryA
GetModuleFileNameA
SetCommState
SetCommTimeouts
GetPrivateProfileIntA
WideCharToMultiByte
GetModuleHandleW
Beep
CreateThread
WritePrivateProfileStringA
CloseHandle
GetCommState
CreateFileA
Sleep
MultiByteToWideChar
SetupComm
GetCommTimeouts
CreateFileW
PurgeComm
WriteFile
GetStdHandle
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
VirtualProtect
ReadFile
MapViewOfFile
CreateFileMappingW
GetCurrentProcess
DeleteCriticalSection
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
FreeLibrary
HeapAlloc
HeapDestroy
IsDebuggerPresent
user32
SetWindowLongA
PeekMessageA
FindWindowA
GetCursorPos
DefWindowProcA
CreateWindowExA
SetLayeredWindowAttributes
LoadIconA
GetDesktopWindow
RegisterClassExA
UpdateWindow
DispatchMessageA
GetSystemMetrics
GetAsyncKeyState
LoadCursorA
GetWindowRect
SetClipboardData
GetClipboardData
TranslateMessage
ShowWindow
EmptyClipboard
CloseClipboard
OpenClipboard
ReleaseDC
SetCursorPos
IsIconic
SetForegroundWindow
ReleaseCapture
GetClientRect
SetWindowLongW
SetCursor
SetCapture
BringWindowToTop
SetFocus
GetForegroundWindow
GetMonitorInfoA
TrackMouseEvent
IsChild
ClientToScreen
GetCapture
WindowFromPoint
SetWindowTextW
ScreenToClient
EnumDisplayMonitors
MonitorFromWindow
SetWindowPos
GetDC
DestroyWindow
AdjustWindowRectEx
GetWindowLongW
MessageBoxA
gdi32
GetDeviceCaps
vmm
VMMDLL_ConfigSet
VMMDLL_Map_GetModuleFromNameU
VMMDLL_InitializePlugins
VMMDLL_VfsReadW
VMMDLL_Initialize
VMMDLL_MemReadEx
VMMDLL_PidGetFromName
VMMDLL_ProcessGetProcAddressU
VMMDLL_Scatter_Initialize
VMMDLL_Scatter_PrepareEx
VMMDLL_Scatter_CloseHandle
VMMDLL_Scatter_Clear
VMMDLL_ConfigGet
VMMDLL_VfsListU
VMMDLL_Scatter_ExecuteRead
VMMDLL_ProcessGetModuleBaseW
msvcp140
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_K@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
_Query_perf_frequency
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Throw_Cpp_error@std@@YAXH@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$ctype@D@std@@2V0locale@2@A
?_Xlength_error@std@@YAXPEBD@Z
_Cnd_do_broadcast_at_thread_exit
_Query_perf_counter
_Thrd_detach
setupapi
SetupDiGetDeviceRegistryPropertyA
SetupDiGetClassDevsA
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
imm32
ImmGetContext
ImmReleaseContext
ImmSetCompositionWindow
normaliz
IdnToAscii
wldap32
ord79
ord143
ord217
ord46
ord211
ord60
ord45
ord50
ord41
ord22
ord26
ord27
ord32
ord33
ord35
ord301
ord200
ord30
crypt32
CryptQueryObject
CertCreateCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
CertOpenStore
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertFreeCertificateChainEngine
rpcrt4
RpcStringFreeA
UuidToStringA
UuidCreate
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
wcsstr
__std_exception_copy
strstr
strchr
_CxxThrowException
__std_terminate
__std_exception_destroy
memchr
memcmp
memcpy
memmove
memset
strrchr
__current_exception
__current_exception_context
__C_specific_handler
_purecall
api-ms-win-crt-runtime-l1-1-0
_set_app_type
_getpid
_exit
system
terminate
_initterm_e
_initterm
_get_initial_narrow_environment
_errno
_seh_filter_exe
_cexit
_invalid_parameter_noinfo_noreturn
_resetstkoflw
_configure_narrow_argv
_invalid_parameter_noinfo
_initialize_narrow_environment
__sys_nerr
strerror
_initialize_onexit_table
exit
__p___argc
abort
_register_onexit_function
_crt_atexit
_beginthreadex
_register_thread_local_exe_atexit_callback
_c_exit
__p___argv
api-ms-win-crt-stdio-l1-1-0
_wfopen
fgets
_set_fmode
_pclose
_popen
__stdio_common_vfprintf
__acrt_iob_func
_get_stream_buffer_pointers
fopen
_fseeki64
fread
fsetpos
fputs
ungetc
setvbuf
fgetpos
feof
__stdio_common_vsscanf
__stdio_common_vsprintf
__p__commode
fwrite
_read
_write
_close
_open
__stdio_common_vsnprintf_s
_lseeki64
fgetc
__stdio_common_vsprintf_s
fputc
fseek
ftell
fclose
fflush
api-ms-win-crt-heap-l1-1-0
realloc
malloc
_set_new_mode
calloc
free
_callnewh
api-ms-win-crt-math-l1-1-0
cos
cosf
fmodf
ceilf
__setusermatherr
pow
acosf
powf
sin
sinf
_dclass
atan2
sqrt
sqrtf
asin
tanf
api-ms-win-crt-time-l1-1-0
_time64
_localtime64_s
_gmtime64
api-ms-win-crt-convert-l1-1-0
strtod
strtoll
strtoull
strtol
atof
atoi
strtoul
api-ms-win-crt-utility-l1-1-0
qsort
rand
srand
api-ms-win-crt-filesystem-l1-1-0
_stat64
_access
_unlink
_fstat64
_lock_file
_unlock_file
api-ms-win-crt-locale-l1-1-0
localeconv
_configthreadlocale
api-ms-win-crt-string-l1-1-0
strncmp
strncpy
strcspn
strspn
strcmp
tolower
strpbrk
isupper
_strdup
toupper
advapi32
CryptGenRandom
OpenProcessToken
AddAccessAllowedAce
CryptGetHashParam
CryptAcquireContextA
ConvertSidToStringSidA
CopySid
SetSecurityInfo
IsValidSid
InitializeAcl
GetTokenInformation
GetLengthSid
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptReleaseContext
shell32
ShellExecuteA
Sections
.text Size: 874KB - Virtual size: 873KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 162KB - Virtual size: 161KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 381KB - Virtual size: 580KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 33KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ