d:\codes\baiduan\basic\kvoutput\binrelease\BDMNet.pdb
Static task
static1
Behavioral task
behavioral1
Sample
6e0df5295ef8c2cc28b3ff779696ef70_NeikiAnalytics.dll
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
6e0df5295ef8c2cc28b3ff779696ef70_NeikiAnalytics.dll
Resource
win10v2004-20240508-en
General
-
Target
6e0df5295ef8c2cc28b3ff779696ef70_NeikiAnalytics.exe
-
Size
1.1MB
-
MD5
6e0df5295ef8c2cc28b3ff779696ef70
-
SHA1
19d4db821d1dcafc66659210b8abacfb4d7e016d
-
SHA256
14c2e0139dc6faa364b062a8488dd7d006e0d9e441fbe2818fdb32bcf09ef16f
-
SHA512
1b77786e92963f6263f858cbe196196972d73cec1d68f716ab3217c18776413eda5589a4d8382ccb8667977e2d5cad94a707a813f25740dbf3e629d84427f537
-
SSDEEP
12288:GgXCgKKvtQbAf9ocoJt/WltkDNe9Pmcs8E2NXyJP9zR41hLbfFcDYdvTtTpTQTth:GgSgKC2gFMmtkR/N4hLJcAgB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 6e0df5295ef8c2cc28b3ff779696ef70_NeikiAnalytics.exe
Files
-
6e0df5295ef8c2cc28b3ff779696ef70_NeikiAnalytics.exe.dll windows:4 windows x86 arch:x86
3d1d44d9a4f7f55ed21ef4cd48bd9b4a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ws2_32
WSAAddressToStringA
getsockopt
freeaddrinfo
htonl
ntohs
getaddrinfo
htons
ntohl
shutdown
WSARecv
select
__WSAFDIsSet
accept
WSASetLastError
WSAGetLastError
getsockname
WSASend
inet_addr
ioctlsocket
bind
setsockopt
WSASocketW
WSAStartup
listen
WSACleanup
closesocket
connect
winmm
timeGetTime
kernel32
SetStdHandle
GetLocaleInfoW
WriteConsoleA
IsValidLocale
EnumSystemLocalesA
GetStringTypeExA
GetConsoleOutputCP
WriteConsoleW
LoadLibraryA
CreateThread
CreateWaitableTimerA
SetWaitableTimer
SystemTimeToFileTime
ResumeThread
OpenEventA
ReleaseSemaphore
FormatMessageA
LocalFree
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetEndOfFile
LeaveCriticalSection
Sleep
InterlockedExchange
GetLastError
TlsGetValue
TlsFree
TlsAlloc
CreateEventA
InterlockedDecrement
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
SetEvent
InterlockedIncrement
EnterCriticalSection
DeleteCriticalSection
CloseHandle
InterlockedExchangeAdd
GetCurrentThreadId
ResetEvent
QueueUserAPC
SleepEx
WaitForMultipleObjects
CreateEventW
TlsSetValue
TerminateThread
HeapFree
GetProcessHeap
HeapAlloc
GetProcAddress
GetVersionExW
GetCurrentProcess
WideCharToMultiByte
GetModuleHandleW
GetTickCount
LoadLibraryW
MultiByteToWideChar
GetModuleFileNameA
VirtualQuery
GetSystemTimeAsFileTime
GetCurrentProcessId
DeviceIoControl
CreateFileW
GetSystemDirectoryW
FreeLibrary
FindClose
FindFirstFileW
WriteFile
GetFileSize
CreateMutexW
ReleaseMutex
CopyFileW
DeleteFileW
ReadFile
CreateFileA
InitializeCriticalSection
InterlockedCompareExchange
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitThread
GetUserDefaultLCID
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
FindFirstFileA
CreateDirectoryW
GetDriveTypeW
GetCommandLineA
GetVersionExA
RaiseException
RtlUnwind
LCMapStringA
LCMapStringW
GetCPInfo
GetModuleHandleA
ExitProcess
SetLastError
GetStdHandle
HeapSize
GetACP
GetOEMCP
IsValidCodePage
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
SetFilePointer
SetHandleCount
GetFileType
GetStartupInfoA
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetFullPathNameA
GetCurrentDirectoryA
GetFullPathNameW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
GetTimeZoneInformation
advapi32
RegQueryValueExW
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegOpenKeyExW
shell32
SHGetSpecialFolderPathW
netapi32
Netbios
user32
LoadStringA
Exports
Exports
CreateHeartbeatService
CreateHttpRpc
CreateRpc
CreateRpc2
GetNetStatics
GetProxySetting
IsIEProxySet
SetCustomSoftID
SetProxySetting
TestProxySetting
Sections
.text Size: 832KB - Virtual size: 828KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 184KB - Virtual size: 183KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 32KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 2B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 80KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ