Q:\cmd\f\out\binaries\x86ret\bin\i386\spyxx.pdb
Static task
static1
Behavioral task
behavioral1
Sample
4ecfb803f320b6d066357d09635135b0_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
4ecfb803f320b6d066357d09635135b0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
4ecfb803f320b6d066357d09635135b0_NeikiAnalytics.exe
-
Size
1.2MB
-
MD5
4ecfb803f320b6d066357d09635135b0
-
SHA1
9ea411214e120bdf8a4d5fa461a9ac9aeadd8a32
-
SHA256
a8b2d73f653da1364e85285e4f9be537c87a979c5f0e1e9b89567b880fa8b097
-
SHA512
2317cd9a63dcf0762b885aa2d16d28973e0216f5d9038b4887c8546642f037efd9217402cf1864e10004d54b0c8067da6c8e41e6bf2bbbd998bacb09abb9b06d
-
SSDEEP
24576:/gdK93Mjmw8jIYDfyJJHwyyU7QJm8yPtYhn0PTt3eIM:993Mjr8jIYjyJVJyNfyPtYuTt3eIM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4ecfb803f320b6d066357d09635135b0_NeikiAnalytics.exe
Files
-
4ecfb803f320b6d066357d09635135b0_NeikiAnalytics.exe.exe windows:6 windows x86 arch:x86
0fd68e226d1538eea85b8efb55f5719e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetProcAddress
CreateMutexA
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
DecodePointer
InitializeCriticalSectionAndSpinCount
ResetEvent
WaitForSingleObjectEx
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
OutputDebugStringW
GetSystemDirectoryW
LoadLibraryW
HeapSetInformation
GetModuleFileNameW
LoadLibraryExW
GetUserDefaultUILanguage
GetFileAttributesW
SetLastError
WriteFile
CreateFileW
GlobalUnlock
GlobalLock
GlobalGetAtomNameW
IsDBCSLeadByte
HeapFree
HeapSize
HeapAlloc
GetProcessHeap
lstrlenW
GetCurrentProcessId
EncodePointer
OpenProcess
GetLastError
GetCurrentProcess
MultiByteToWideChar
WideCharToMultiByte
Sleep
GetModuleHandleW
CloseHandle
ReleaseMutex
WaitForSingleObject
SetEvent
LocalFree
lstrcmpiW
CreateMutexW
SetThreadPriority
CreateEventW
MulDiv
IsProcessorFeaturePresent
user32
SendMessageW
InvalidateRect
PtInRect
GetWindow
IsWindowVisible
GetWindowRgn
SetCapture
SetCursor
UpdateWindow
GetCapture
ClientToScreen
SetDlgItemTextW
GetClassNameW
DrawFocusRect
IsWindow
GetParent
SetWindowLongW
GetWindowLongW
MapWindowPoints
GetWindowThreadProcessId
EnableWindow
ReleaseDC
DrawTextW
GetSystemMetrics
ScreenToClient
GetWindowRect
GetDC
WindowFromPoint
CreatePopupMenu
AppendMenuW
CallNextHookEx
LoadIconW
IsIconic
IsZoomed
OffsetRect
GetWindowPlacement
GetAncestor
GetClassLongW
GetWindowWord
ReleaseCapture
LoadCursorW
GetSysColor
GetFocus
GetClientRect
RedrawWindow
RegisterClassW
CreateWindowExW
RegisterClipboardFormatW
GetClassWord
DestroyWindow
LoadStringW
PostMessageW
DefWindowProcW
SetWindowsHookExA
MessageBoxW
UnhookWindowsHookEx
GetClassInfoW
EnumWindows
EnumChildWindows
GetClipboardFormatNameW
UnpackDDElParam
LoadAcceleratorsW
IsChild
SystemParametersInfoW
GetSysColorBrush
FillRect
IsWindowUnicode
SetWindowPos
SetWindowPlacement
BringWindowToTop
SetForegroundWindow
ShowWindow
GetWindowTextW
SendMessageTimeoutW
GetWindowDC
GetDesktopWindow
SetWindowsHookExW
GetClassLongA
GetKeyState
gdi32
FrameRgn
CreateHatchBrush
Rectangle
SetROP2
GetStockObject
CreatePen
GetTextMetricsW
GetTextExtentPoint32W
GetDeviceCaps
ExtTextOutW
GetObjectW
CreateRectRgn
DeleteObject
SetBkMode
SelectObject
PtInRegion
CreateFontIndirectW
shell32
SHGetFolderPathW
advapi32
GetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
RegCreateKeyW
RegOpenKeyW
RegSetValueExW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
RegQueryInfoKeyW
LookupAccountSidW
GetTokenInformation
AdjustTokenPrivileges
PrivilegeCheck
OpenProcessToken
LookupPrivilegeValueW
SetSecurityInfo
comdlg32
GetSaveFileNameW
oleaut32
SysAllocString
spyxxhk
gopd
ghhkRetHook
_SpyxxCallWndRetProc@12
gmsgOtherProcessData
_SpyxxCallWndProc@12
ghhkMsgHook
_SpyxxGetMsgProc@12
gabMsgBuf
gfHookDisabled
gaaClasses
gfHookEnabled
ghhkCallHook
gtidSpyxx
gpidSpyxx
mfc140u
ord5425
ord13544
ord6802
ord11000
ord12216
ord8977
ord11235
ord11333
ord11169
ord11932
ord11935
ord11933
ord11934
ord6309
ord9042
ord10570
ord6803
ord9225
ord3054
ord9253
ord12217
ord3238
ord4108
ord2594
ord7654
ord3833
ord6129
ord1476
ord1002
ord3696
ord5428
ord509
ord9039
ord11014
ord5962
ord6499
ord7487
ord14507
ord9258
ord4094
ord6560
ord7820
ord1525
ord890
ord1391
ord14047
ord13087
ord11392
ord6865
ord2439
ord2246
ord2304
ord1511
ord7432
ord991
ord1468
ord7649
ord11080
ord4882
ord9348
ord6559
ord4815
ord3882
ord6566
ord2522
ord3957
ord9226
ord12123
ord2681
ord6876
ord12088
ord8304
ord11276
ord11279
ord9509
ord9524
ord9514
ord9986
ord9991
ord9526
ord11118
ord10509
ord8923
ord9139
ord11746
ord11122
ord9011
ord11146
ord10047
ord10048
ord4881
ord286
ord2996
ord2990
ord11021
ord824
ord1355
ord2006
ord280
ord7327
ord5109
ord4323
ord12559
ord1655
ord8505
ord2778
ord7178
ord10383
ord9270
ord7514
ord561
ord984
ord1460
ord968
ord1447
ord1151
ord12108
ord9302
ord8476
ord13628
ord7810
ord8738
ord5039
ord8225
ord9175
ord11633
ord10376
ord7175
ord558
ord7511
ord5035
ord11543
ord10730
ord9216
ord5934
ord13700
ord9239
ord2557
ord4495
ord12182
ord3835
ord12081
ord8209
ord3174
ord8401
ord5033
ord6130
ord12460
ord1788
ord13710
ord5939
ord13708
ord5938
ord11430
ord5955
ord8831
ord9353
ord11804
ord11798
ord5369
ord3845
ord4587
ord11495
ord10402
ord3278
ord7808
ord9213
ord3940
ord12106
ord9237
ord12180
ord3834
ord8400
ord5034
ord1789
ord7692
ord13709
ord13707
ord5956
ord9352
ord11802
ord11795
ord3843
ord3191
ord11797
ord914
ord7121
ord481
ord1128
ord10976
ord5609
ord6199
ord9197
ord14065
ord2215
ord7501
ord2945
ord5127
ord13312
ord1928
ord9212
ord10251
ord5765
ord3849
ord4703
ord12660
ord12418
ord13352
ord13471
ord7655
ord2558
ord8395
ord13832
ord2858
ord9081
ord3857
ord11024
ord11267
ord12786
ord5577
ord12575
ord11252
ord9484
ord2718
ord12964
ord12093
ord4138
ord4088
ord14511
ord5377
ord10431
ord10721
ord11138
ord11139
ord9363
ord11743
ord9979
ord9468
ord6880
ord13289
ord13042
ord13935
ord450
ord1108
ord2520
ord3954
ord8746
ord4227
ord6607
ord3932
ord2526
ord14377
ord975
ord1451
ord13224
ord1523
ord12612
ord2011
ord4672
ord2010
ord290
ord7604
ord814
ord1345
ord3222
ord14128
ord2750
ord14131
ord8894
ord5322
ord6740
ord12115
ord12177
ord8398
ord11800
ord3353
ord4664
ord12608
ord14490
ord8352
ord5845
ord5816
ord551
ord1182
ord5921
ord5368
ord293
ord7428
ord9527
ord12122
ord6123
ord6852
ord1078
ord376
ord540
ord1171
ord7648
ord8072
ord3183
ord4884
ord5842
ord10389
ord7653
ord995
ord1472
ord7997
ord8462
ord816
ord1866
ord4589
ord7992
ord10433
ord2303
ord997
ord1474
ord6860
ord10250
ord5763
ord12928
ord12219
ord12251
ord8217
ord12247
ord12239
ord5918
ord3852
ord6349
ord14668
ord6350
ord14669
ord6348
ord14667
ord8000
ord12531
ord14466
ord11983
ord11982
ord2034
ord7941
ord12947
ord4090
ord4152
ord9398
ord14595
ord7922
ord14589
ord12542
ord12541
ord2486
ord5357
ord8324
ord12865
ord8386
ord12884
ord8360
ord14137
ord12089
ord3838
ord11936
ord14588
ord8965
ord12172
ord6978
ord11002
ord9256
ord3266
ord13878
ord12262
ord12258
ord1722
ord1744
ord1770
ord1756
ord1777
ord4936
ord5003
ord4948
ord4966
ord4960
ord4954
ord5013
ord4997
ord4942
ord5019
ord4974
ord4912
ord4927
ord4988
ord4502
ord9693
ord4494
ord3055
ord14590
ord7923
ord14596
ord6877
ord11717
ord13703
ord5935
ord2682
ord12124
ord3941
ord3372
ord3371
ord3265
ord12168
ord5249
ord5549
ord5760
ord9350
ord5525
ord5790
ord5252
ord5411
ord5228
ord7722
ord7723
ord7712
ord5409
ord8219
ord10255
ord4499
ord265
ord2562
ord266
ord4477
ord8171
ord14327
ord2766
ord4886
ord13103
ord7626
ord8817
ord14234
ord10498
ord7627
ord12711
ord2383
ord6248
ord5036
ord4453
ord1411
ord922
ord1408
ord1446
ord6834
ord9209
ord12220
ord9135
ord2761
ord13756
ord6220
ord3257
ord4236
ord12131
ord9040
ord11015
ord11396
ord4092
ord3404
ord3403
ord3164
ord6218
ord13752
ord3305
ord3302
ord8210
ord2760
ord14785
ord10285
ord10287
ord10286
ord10284
ord10288
ord5652
ord11725
ord2843
ord9210
ord6531
ord5422
ord13473
ord1689
ord1692
ord8464
ord1045
ord296
ord10472
ord7493
ord9701
ord1111
ord2409
ord458
ord1513
ord11726
ord8913
msvcp140
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z
?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
vcruntime140
_purecall
wcschr
wcsrchr
wcsstr
_except_handler4_common
__CxxFrameHandler3
__current_exception_context
memset
__current_exception
memcpy
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf_s
__p__commode
__stdio_common_vswscanf
_set_fmode
__stdio_common_vsprintf
__stdio_common_vswprintf
api-ms-win-crt-convert-l1-1-0
_itow_s
_wtoi
wcstoul
api-ms-win-crt-runtime-l1-1-0
_beginthread
_crt_atexit
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
_invalid_parameter_noinfo
_exit
_initialize_onexit_table
_initterm_e
_initterm
_get_wide_winmain_command_line
_initialize_wide_environment
_configure_wide_argv
_register_onexit_function
_set_app_type
_seh_filter_exe
terminate
_controlfp_s
_errno
_endthread
exit
api-ms-win-crt-heap-l1-1-0
malloc
free
_set_new_mode
api-ms-win-crt-string-l1-1-0
_wcsicmp
_wcsnicmp
wcsncpy_s
wcscpy_s
wcscat_s
_wcsupr_s
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
_getmbcp
api-ms-win-crt-math-l1-1-0
__setusermatherr
Sections
.text Size: 430KB - Virtual size: 429KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 61KB - Virtual size: 79KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 115KB - Virtual size: 115KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 616KB - Virtual size: 620KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE