E:\projects\zerofox\x64\Release\Release\zerofox.pdb
Static task
static1
Behavioral task
behavioral1
Sample
6759ab8d04144b49a8cadd351cc334a0_NeikiAnalytics.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
6759ab8d04144b49a8cadd351cc334a0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
6759ab8d04144b49a8cadd351cc334a0_NeikiAnalytics.exe
-
Size
30KB
-
MD5
6759ab8d04144b49a8cadd351cc334a0
-
SHA1
27d6d8772cd17762030159b6baebf8277737ba3c
-
SHA256
71fc28ac7dd2d5ef9d116aa0853b487844343756ac580e509099d9cfdaea2042
-
SHA512
635f699e1a281f37853f228e10d13a5b614e8ce13091108de8977a03fc7e35321ca362b646ce7eddc7d204483cca26fd94dd117dda0acc1e2c501630daf0b612
-
SSDEEP
768:9fwuxAAxC9G1FxyrmGIU0f1OpVyKIOrYTE:euZB1FDRNf6VeOM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 6759ab8d04144b49a8cadd351cc334a0_NeikiAnalytics.exe
Files
-
6759ab8d04144b49a8cadd351cc334a0_NeikiAnalytics.exe.exe windows:5 windows x64 arch:x64
221933ab9eeb967b0bbe8c49edccc6b0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
mswsock
EnumProtocolsA
psapi
EnumProcesses
EnumProcessModules
GetModuleFileNameExA
wininet
InternetCloseHandle
InternetOpenA
HttpOpenRequestA
InternetReadFile
InternetConnectA
HttpSendRequestA
ws2_32
WSAStartup
inet_ntoa
gethostname
WSAGetLastError
gethostbyname
advapi32
OpenProcessToken
RegCloseKey
RegOpenKeyExA
RegDeleteKeyA
RegSetValueExA
GetLengthSid
IsValidSecurityDescriptor
FreeSid
AddAccessAllowedAce
SetSecurityDescriptorOwner
AllocateAndInitializeSid
InitializeAcl
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
DuplicateToken
AccessCheck
SetSecurityDescriptorGroup
OpenThreadToken
msvcp100
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?unshift@?$codecvt@DDH@std@@QEBAHAEAHPEAD1AEAPEAD@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?out@?$codecvt@DDH@std@@QEBAHAEAHPEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDH@std@@QEBAHAEAHPEBD1AEAPEBDPEAD3AEAPEAD@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?_Decref@facet@locale@std@@QEAAPEAV123@XZ
?_Incref@facet@locale@std@@QEAAXXZ
??Bid@locale@std@@QEAA_KXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
?_Getcat@?$codecvt@DDH@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?id@?$codecvt@DDH@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Xlength_error@std@@YAXPEBD@Z
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Xout_of_range@std@@YAXPEBD@Z
?_BADOFF@std@@3_JB
msvcr100
??1exception@std@@UEAA@XZ
??0exception@std@@QEAA@AEBQEBD@Z
??0exception@std@@QEAA@AEBV01@@Z
memmove
_unlock_file
ungetc
fgetpos
_fseeki64
fflush
fgetc
fsetpos
strncpy
setvbuf
_lock_file
??_V@YAXPEAX@Z
rand
srand
??3@YAXPEAX@Z
memcpy_s
fwrite
fclose
_time64
??2@YAPEAX_K@Z
__CxxFrameHandler3
_amsg_exit
__getmainargs
__C_specific_handler
_XcptFilter
_exit
_ismbblead
_cexit
exit
_acmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_commode
_fmode
__set_app_type
_unlock
__dllonexit
_lock
_onexit
__crt_debugger_hook
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
?what@exception@std@@UEBAPEBDXZ
??0bad_cast@std@@QEAA@AEBV01@@Z
??0bad_cast@std@@QEAA@PEBD@Z
??1bad_cast@std@@UEAA@XZ
fputc
strerror
malloc
_CxxThrowException
sprintf
_snprintf
vsprintf
strncat
memset
memcpy
free
kernel32
lstrlenA
Sleep
GetStartupInfoW
EncodePointer
DecodePointer
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
CloseHandle
SetErrorMode
CreateProcessA
GetLastError
GetCurrentThreadId
OutputDebugStringA
LocalFree
lstrcpyA
GetCurrentProcess
GetCurrentThread
ExpandEnvironmentStringsA
OpenProcess
LocalAlloc
FormatMessageA
GetVersionExA
CopyFileA
GetModuleFileNameA
Sections
.text Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1024B - Virtual size: 816B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 696B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 262B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ