General

Malware Config

Signatures

Files

• 77d501c0fcc8cf3c7b0e4c4e7e64bb70_NeikiAnalytics.exe

  .exe windows:6 windows x64 arch:x64

  88aac23f5141acd5d3fcc18999868875

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  PDB Paths

  D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\pgocvt.pdb

  Imports

  vcruntime140_1

  __CxxFrameHandler4

  vcruntime140

  _CxxThrowException

  __std_exception_copy

  __std_exception_destroy

  memcpy

  wcschr

  __current_exception_context

  __current_exception

  __C_specific_handler

  wcsrchr

  memset

  api-ms-win-crt-runtime-l1-1-0

  _initialize_onexit_table

  _register_thread_local_exe_atexit_callback

  _c_exit

  _cexit

  __p___argc

  _register_onexit_function

  _exit

  _initterm_e

  _initterm

  _get_initial_wide_environment

  _initialize_wide_environment

  _configure_wide_argv

  __p___wargv

  _set_app_type

  _seh_filter_exe

  __p__wpgmptr

  exit

  _crt_atexit

  _errno

  terminate

  api-ms-win-crt-stdio-l1-1-0

  _fileno

  fclose

  _wfsopen

  _get_osfhandle

  __stdio_common_vsnwprintf_s

  _chsize_s

  ftell

  fwrite

  putchar

  fputs

  __acrt_iob_func

  fflush

  _set_fmode

  __p__commode

  fseek

  __stdio_common_vswprintf_s

  __stdio_common_vswscanf

  api-ms-win-crt-time-l1-1-0

  _time64

  _tzset

  api-ms-win-crt-heap-l1-1-0

  free

  calloc

  _callnewh

  _set_new_mode

  malloc

  api-ms-win-crt-string-l1-1-0

  wcscmp

  _wcsdup

  wcsncpy_s

  wcstok_s

  wcscpy_s

  wcsncat_s

  _wcsicmp

  api-ms-win-crt-filesystem-l1-1-0

  _wsplitpath_s

  _wmakepath_s

  api-ms-win-crt-environment-l1-1-0

  _wdupenv_s

  _wgetcwd

  api-ms-win-crt-math-l1-1-0

  __setusermatherr

  api-ms-win-crt-locale-l1-1-0

  _configthreadlocale

  pgodb140

  ?SzUtf8DupWz@PogoDbUtil@@SAPEADPEBG@Z

  ?GetMachineId@PogoDbUtil@@SAKPEBG@Z

  ?GetErrorText@PogoDbUtil@@SAPEBGW4POGODB_ERROR@@@Z

  ?NewPgdObject@PogoDbUtil@@SAPEAVPogoDbInterface@@XZ

  ?FreeMemory@PogoDbUtil@@SAXPEAX@Z

  ?GetMachineName@PogoDbUtil@@SAPEBGK@Z

  ?GetMachineAttributes@PogoDbUtil@@SAPEAUtagPGDMACHINEATTR@@K@Z

  ?DeletePgdObject@PogoDbUtil@@SAPEAVPogoDbInterface@@PEAV2@@Z

  kernel32

  RtlVirtualUnwind

  GetCurrentProcessId

  GetCurrentThreadId

  GetSystemTimeAsFileTime

  InitializeSListHead

  RtlCaptureContext

  RtlLookupFunctionEntry

  IsDebuggerPresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsProcessorFeaturePresent

  FormatMessageW

  LocalFree

  GetConsoleMode

  GetConsoleOutputCP

  GetCPInfo

  WideCharToMultiByte

  WriteFile

  GetFileType

  GetUserDefaultUILanguage

  LoadResource

  LoadLibraryExW

  GetProcAddress

  GetModuleFileNameW

  FindResourceExW

  GetProcessHeap

  HeapFree

  HeapAlloc

  DecodePointer

  EncodePointer

  FindNextFileW

  FindFirstFileW

  FindClose

  SetLastError

  GetLastError

  GetEnvironmentVariableW

  TerminateProcess

  GetCurrentProcess

  GetModuleHandleW

  QueryPerformanceCounter

  api-ms-win-crt-convert-l1-1-0

  wcstoul

  _itow_s

  wcstol

  _wtoi64

  api-ms-win-crt-conio-l1-1-0

  _cputws

  Sections

  .text

  Size: 16KB - Virtual size: 16KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 10KB - Virtual size: 9KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 1024B - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 18KB - Virtual size: 17KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 568KB - Virtual size: 572KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE