d:\Office\Source\groove\Bin\ReleaseSym\GrooveClean.pdb
Static task
static1
Behavioral task
behavioral1
Sample
6b89ed27f4c4ac1fdb4a12de63b8dad0_NeikiAnalytics.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
6b89ed27f4c4ac1fdb4a12de63b8dad0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
6b89ed27f4c4ac1fdb4a12de63b8dad0_NeikiAnalytics.exe
-
Size
1.2MB
-
MD5
6b89ed27f4c4ac1fdb4a12de63b8dad0
-
SHA1
b569b2453ae7f373f474fe5b0e43e91cae029ba2
-
SHA256
d392a16d44ce394453e0034141f8703e253e1ba6700e3d949c40c1a164190958
-
SHA512
cda2dfd03ca5d4e4e274e540cd128076a6507745081eddedc5615ff43ef0b6b24473ad033ffd23165cc1e0ceca52318105ade1cec71c7589e5a64c02833b1994
-
SSDEEP
12288:K5eSMIO74u8k7UtnzPgGeB0dPoIlaNyF/ofCVGGfX134R9kMKy:Met/HU9zPjeidP1Yi/dGyA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 6b89ed27f4c4ac1fdb4a12de63b8dad0_NeikiAnalytics.exe
Files
-
6b89ed27f4c4ac1fdb4a12de63b8dad0_NeikiAnalytics.exe.exe windows:4 windows x86 arch:x86
a1f92f31d1bcb097592c5cdced465dd8
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
InterlockedExchange
InterlockedCompareExchange
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
UnhandledExceptionFilter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
RaiseException
WideCharToMultiByte
lstrlenW
Sleep
AddAtomW
FindNextFileW
RemoveDirectoryW
FindFirstFileW
GetCurrentProcess
GetLastError
DeleteFileW
LocalFree
FindClose
CloseHandle
user32
RegisterWindowMessageW
advapi32
SetNamedSecurityInfoW
SetEntriesInAclW
AllocateAndInitializeSid
AdjustTokenPrivileges
LookupPrivilegeValueW
FreeSid
OpenProcessToken
ole32
CoInitialize
CoUninitialize
msvcr80
_controlfp_s
_invoke_watson
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
_crt_debugger_hook
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
__initenv
exit
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
__dllonexit
_encode_pointer
_unlock
wcslen
memcpy_s
calloc
_recalloc
free
memset
printf
__CxxFrameHandler3
_adjust_fdiv
_CxxThrowException
groovenew
?GrooveNew@@YAPAXI@Z
?GrooveDelete@@YAXPAX@Z
grooveutil
?Uninit@GCMso@@SGX_N@Z
?int_DeallocateBufferIfNecessary@GCStackStrBase@@AAEXAAPA_W@Z
?InitThread@GCMso@@SGXXZ
??0GCSmartExceptionTranslator@@QAE@_N0@Z
??1GCSmartExceptionTranslator@@UAE@XZ
??0GCSmartTerminateHandler@@QAE@_N@Z
??1GCSmartTerminateHandler@@QAE@XZ
?StartErrorBlock@GCCriticalErrorInfo@@SGX_N@Z
??0GCStr@@QAE@PBDW4ExplicitConvert@0@@Z
?_Release@GCStr@@AAEXXZ
?ToLower@raw_GCStr@@SG?AVGCStrRetVal@@PB_W@Z
?CompareNoCase@raw_GCStr@@SGJPB_W0@Z
?Equals@raw_GCStr@@SG_NPB_W0@Z
??0GCStr@@QAE@PB_W@Z
?Append@GCStr@@QAEXPB_W@Z
?Hash@@YGKPBEKK@Z
?EndErrorBlock@GCCriticalErrorInfo@@SGXXZ
??0GCSmartExceptionFilter@@QAE@_N@Z
??1GCSmartExceptionFilter@@QAE@XZ
??0GCSmartInvalidParameterHandler@@QAE@_N@Z
??1GCSmartInvalidParameterHandler@@QAE@XZ
?ConcatStrings@raw_GCStr@@SA?AVGCStrRetVal@@KPB_W0ZZ
?int_COMError@GCError@@CG?AV1@JPAUIUnknown@@ABU_GUID@@11@Z
?AllocateHashTable@@YGPAXK@Z
?ToPowerOf2@@YGKK@Z
?Compare@GCStr@@QBEJPB_W@Z
?ConcatStrings@GCStackStrBase@@QAAKKQB_W0ZZ
?Set@GCStr@@QAEXPB_W@Z
?DeallocateHashTable@@YGXPAXK@Z
?Throw@GCError@@QBEXXZ
?int_RawError@GCError@@CG?AV1@KJ@Z
??1GCError@@QAE@XZ
?Append@GCStackStrBase@@QAEXQB_WK@Z
?QueryInterfaceNoRelease@GCIPtrBase@@IAEXABU_GUID@@PAUIUnknown@@@Z
?CreateInstanceNoRelease@GCIPtrBase@@IAEXABU_GUID@@0K@Z
?Set@GCErrorInfo@@SGXPAUIErrorInfo@@@Z
??1GCAnyIPtr@@QAE@XZ
?HandleAllErrorCatch@@YGXXZ
??0GCStr@@QAE@ABV0@@Z
Sections
.text Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1004B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE