E:\zhanlue\rcimage\bin\x64\Release\pdb\2345PrinterApp.pdb
Static task
static1
Behavioral task
behavioral1
Sample
717f7c85ae3c1eb1d504452158f88490_NeikiAnalytics.dll
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
717f7c85ae3c1eb1d504452158f88490_NeikiAnalytics.dll
Resource
win10v2004-20240508-en
General
-
Target
717f7c85ae3c1eb1d504452158f88490_NeikiAnalytics.exe
-
Size
6.8MB
-
MD5
717f7c85ae3c1eb1d504452158f88490
-
SHA1
a12ae9c185c5f57e2a5764771b3bc0a294657e2f
-
SHA256
51af8e831f0b83d2f4538d2d7d91783c512420df85f8ff41e5451374cf936fcb
-
SHA512
3b24019ffee68a1f5b2324bbdea3b5f08380130b57f2b8cc9da279b9ced03c3dc977ddf2579c299300e12eed23473c501429f769b0fae4dbf961833653115b02
-
SSDEEP
98304:+p+zth1Fdam97bAQV+AgCFzBkWep3FRYjMO:6k1Fgm97bAQV+ABTkpBF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 717f7c85ae3c1eb1d504452158f88490_NeikiAnalytics.exe
Files
-
717f7c85ae3c1eb1d504452158f88490_NeikiAnalytics.exe.dll windows:5 windows x64 arch:x64
99161c664364226206f6fd9e94506c07
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
pdfium
FPDFText_ClosePage
FPDF_GetLastError
FPDF_LoadDocument
FPDFDOC_ExitFormFillEnvironment
FPDF_CloseDocument
FPDFDOC_InitFormFillEnvironment
FPDF_LoadCustomDocument
FPDF_GetDocPermissions
FPDF_GetSecurityHandlerRevision
FPDFBitmap_Destroy
FPDF_ClosePage
FPDF_LoadPage
FPDF_GetPageSizeByIndexF
FPDFBitmap_GetStride
FPDF_RenderPage
FPDF_FFLHasWidgetForm
FPDF_GetPageCount
FPDFBitmap_FillRect
FPDFBitmap_GetBuffer
FPDF_RenderPageBitmap
FPDF_FFLDraw
FPDFBitmap_Create
FPDF_DestroyLibrary
FPDF_InitLibrary
FPDFBitmap_GetHeight
FPDFBitmap_GetWidth
crypt32
CertGetCertificateContextProperty
CertDuplicateCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertFreeCertificateContext
ws2_32
closesocket
WSACleanup
send
recv
WSAGetLastError
WSASetLastError
kernel32
IsDebuggerPresent
InitializeCriticalSectionAndSpinCount
GetLastError
RaiseException
DecodePointer
DeleteCriticalSection
GlobalAlloc
GlobalFree
GlobalLock
lstrcpyW
GlobalUnlock
SetLastError
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
GetVersionExW
GetModuleHandleW
SizeofResource
GetCommandLineW
GetLongPathNameW
GetModuleFileNameW
SetErrorMode
MultiByteToWideChar
LoadLibraryW
LoadResource
OutputDebugStringW
GetProcAddress
LocalFree
FreeLibrary
lstrcmpiW
GetTickCount
LoadLibraryExW
SetUnhandledExceptionFilter
MulDiv
Sleep
InitializeCriticalSection
EncodePointer
GetACP
WideCharToMultiByte
FindFirstFileW
CreateFileW
GetFileAttributesExW
FindNextFileW
FindClose
FileTimeToSystemTime
WaitForSingleObject
ResumeThread
CloseHandle
ReadFile
WriteFile
SetFileTime
SetFilePointer
SetEndOfFile
GetFileSize
GetFileTime
CreateMutexW
ReleaseMutex
OpenMutexW
CreateDirectoryW
GetFullPathNameW
lstrlenW
GetTempPathW
GetFileAttributesW
SetFileAttributesW
DeleteFileW
GetCurrentDirectoryW
GetWindowsDirectoryW
MoveFileExW
GetTempFileNameW
CreateEventW
SetEvent
ResetEvent
HeapFree
OpenProcess
HeapAlloc
GetProcessHeap
LockResource
GetSystemInfo
QueryDosDeviceW
GetCurrentProcess
GetVolumeInformationW
GetDiskFreeSpaceW
GetLogicalDriveStringsW
ExpandEnvironmentStringsW
GetPrivateProfileStringW
CreateProcessW
GetExitCodeProcess
GetLocalTime
GetCurrentProcessId
GlobalMemoryStatusEx
QueryPerformanceCounter
RtlVirtualUnwind
TlsSetValue
TlsAlloc
TlsGetValue
TlsFree
GetNativeSystemInfo
GetStdHandle
GetEnvironmentVariableW
GetFileType
LoadLibraryA
SwitchToThread
ExitProcess
GetEnvironmentVariableA
lstrcmpA
GetModuleFileNameA
GetModuleHandleExA
WaitForSingleObjectEx
CreateEventA
GetProcessAffinityMask
GetCurrentThread
FormatMessageW
GetFileSizeEx
SetFilePointerEx
GetModuleHandleExW
DeleteFiber
GetSystemTimeAsFileTime
ConvertFiberToThread
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
InitializeSListHead
DeviceIoControl
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
VirtualAlloc
VirtualFree
LoadLibraryExA
RtlCaptureContext
RtlLookupFunctionEntry
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
OpenFileMappingW
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
WaitForMultipleObjects
FindResourceW
user32
SetRectEmpty
SetRect
LoadImageW
RedrawWindow
MessageBoxW
wsprintfW
GetWindowThreadProcessId
GetLastActivePopup
AttachThreadInput
GetForegroundWindow
SetForegroundWindow
FindWindowW
EqualRect
GetWindow
MonitorFromWindow
EndDialog
GetMessageW
DispatchMessageW
CharNextW
TranslateMessage
GetDesktopWindow
GetKeyState
SystemParametersInfoW
EnableWindow
GetSystemMetrics
GetWindowTextW
GetWindowTextA
IsWindowEnabled
DestroyWindow
IsWindowVisible
IsZoomed
SetScrollInfo
ShowScrollBar
GetScrollInfo
InflateRect
SetWindowTextW
ShowWindow
TranslateAcceleratorW
LoadIconW
SetWindowLongW
CreateWindowExW
RegisterClassExW
MoveWindow
GetClassInfoExW
CopyRect
TrackMouseEvent
LoadCursorW
SetCapture
SetCursor
DrawTextW
GetParent
ReleaseCapture
IsIconic
GetCursorPos
BeginPaint
EndPaint
GetWindowLongW
GetMenuItemInfoW
DefWindowProcW
CallWindowProcW
PostMessageW
MonitorFromPoint
GetWindowRect
SetWindowPos
GetMenuItemCount
LoadStringA
SetWindowLongPtrW
SendMessageW
MessageBeep
CreatePopupMenu
GetWindowLongPtrW
LoadStringW
GetActiveWindow
GetMonitorInfoW
PeekMessageW
MapWindowPoints
DestroyMenu
SetFocus
TrackPopupMenuEx
RemoveMenu
GetClientRect
GetDlgItem
AppendMenuW
KillTimer
PostQuitMessage
DialogBoxParamW
PtInRect
InvalidateRect
RegisterClipboardFormatW
IsWindow
GetDC
FillRect
IsRectEmpty
IntersectRect
ReleaseDC
OffsetRect
UnregisterClassW
UnionRect
GetProcessWindowStation
ScreenToClient
GetUserObjectInformationW
SetTimer
gdi32
GetDeviceCaps
IntersectClipRect
ExtSelectClipRgn
GetGraphicsMode
GdiFlush
GetFontUnicodeRanges
SaveDC
ModifyWorldTransform
GetCharWidth32W
GetTextMetricsW
GetFontData
GetGlyphIndicesW
RestoreDC
GetGlyphOutlineW
GetOutlineTextMetricsW
SetTextAlign
CreateRectRgn
CreateDIBitmap
StretchDIBits
GetTextColor
SetBrushOrgEx
SetArcDirection
SetStretchBltMode
SetROP2
SetDCPenColor
SetGraphicsMode
SetMapMode
CreateFontIndirectW
ExtTextOutW
SetWorldTransform
GetStockObject
SetDCBrushColor
SetBkColor
BitBlt
CreateCompatibleBitmap
CreateRectRgnIndirect
OffsetRgn
SetTextColor
ExtCreateRegion
GetClipBox
GetClipRgn
GetWorldTransform
DeleteDC
CreateBitmap
StretchBlt
SetBkMode
LineTo
CreatePen
Rectangle
SetViewportOrgEx
SelectClipRgn
MoveToEx
SelectObject
StartPage
CreateDIBSection
CreateCompatibleDC
AbortDoc
EndDoc
DeleteObject
CreateSolidBrush
StartDocW
EndPage
CreateDCW
winspool.drv
GetPrinterW
ord203
ClosePrinter
DeviceCapabilitiesW
OpenPrinterW
EnumPrintersW
DocumentPropertiesW
comdlg32
GetSaveFileNameW
GetOpenFileNameW
advapi32
RegCreateKeyExW
CryptGenRandom
CryptEnumProvidersW
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
RegDeleteValueW
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
GetSecurityInfo
ReportEventW
RegisterEventSourceW
DeregisterEventSource
GetUserNameW
RegCloseKey
RegQueryInfoKeyW
RegDeleteKeyW
shell32
SHGetFolderPathW
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetDesktopFolder
CommandLineToArgvW
ShellExecuteExW
DragFinish
DragQueryFileW
ole32
CoTaskMemFree
CreateStreamOnHGlobal
RevokeDragDrop
RegisterDragDrop
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
oleaut32
VarUI4FromStr
msvcp140
_Query_perf_frequency
?_Throw_Cpp_error@std@@YAXH@Z
_Cnd_init_in_situ
_Mtx_current_owns
_Cnd_signal
??0_Locinfo@std@@QEAA@PEBD@Z
??1_Locinfo@std@@QEAA@XZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??1_Facet_base@std@@UEAA@XZ
??Bid@locale@std@@QEAA_KXZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
??0facet@locale@std@@IEAA@_K@Z
??1facet@locale@std@@MEAA@XZ
?_Throw_C_error@std@@YAXH@Z
?is@?$ctype@_W@std@@QEBA_NF_W@Z
?tolower@?$ctype@_W@std@@QEBA_W_W@Z
?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
_Wcsxfrm
??_7facet@locale@std@@6B@
?id@?$collate@_W@std@@2V0locale@2@A
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?id@?$ctype@_W@std@@2V0locale@2@A
?_Xbad_alloc@std@@YAXXZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
_Wcscoll
??_7_Facet_base@std@@6B@
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_init_in_situ
_Cnd_do_broadcast_at_thread_exit
_Cnd_destroy
_Cnd_wait
_Mtx_init
_Thrd_start
_Thrd_id
_Query_perf_counter
_Thrd_detach
_Xtime_get_ticks
_Mtx_destroy
_Cnd_init
_Thrd_join
_Mtx_unlock
_Cnd_destroy_in_situ
?uncaught_exception@std@@YA_NXZ
_Cnd_timedwait
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@F@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
comctl32
_TrackMouseEvent
InitCommonControlsEx
msimg32
AlphaBlend
imm32
ImmAssociateContext
gdiplus
GdipDrawLinesI
GdipFree
GdipCreateStringFormat
GdipGetSmoothingMode
GdipCreateFontFromLogfontW
GdipGraphicsClear
GdipDeleteBrush
GdipCreateFromHDC
GdipCloneBrush
GdipFillRectangleI
GdipDeleteGraphics
GdipDrawString
GdipSetStringFormatFlags
GdipSetTextRenderingHint
GdipDeleteStringFormat
GdipDrawImageI
GdipAlloc
GdipDeleteFont
GdipSetStringFormatAlign
GdipGetImageHeight
GdipGetImageWidth
GdipDrawImageRectRectI
GdipDrawRectangleI
GdipSetSmoothingMode
GdipSetStringFormatTrimming
GdipCreateBitmapFromScan0
GdipSetStringFormatLineAlign
GdipSetCompositingMode
GdipGetRegionHRgn
GdipReleaseDC
GdipSaveGraphics
GdipBitmapUnlockBits
GdipGetDC
GdipCreateMatrix
GdipGetWorldTransform
GdipTransformPointsI
GdipGetImageGraphicsContext
GdipCreateRegion
GdipScaleWorldTransform
GdipSetClipRectI
GdipBitmapLockBits
GdipGetClipBoundsI
GdipCreateHBITMAPFromBitmap
GdipGetMatrixElements
GdipGetClip
GdipRestoreGraphics
GdipDeleteRegion
GdipDisposeImage
GdipTranslateWorldTransform
GdipDrawImagePointRectI
GdipDeleteMatrix
GdiplusStartup
GdiplusShutdown
GdipCreateBitmapFromStream
GdipGetImagePixelFormat
GdipCloneImage
GdipCloneBitmapAreaI
GdipSetImageAttributesColorMatrix
GdipAddPathArcI
GdipDrawImageRectRect
GdipDisposeImageAttributes
GdipDrawLineI
GdipDeletePath
GdipCreatePath
GdipFillPath
GdipCreatePen1
GdipAddPathLineI
GdipCreateImageAttributes
GdipDeletePen
GdipCreateSolidFill
dbghelp
MiniDumpWriteDump
bcrypt
BCryptDeriveKeyPBKDF2
BCryptEncrypt
BCryptDestroyKey
BCryptGetProperty
BCryptOpenAlgorithmProvider
BCryptGenRandom
BCryptFinishHash
BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptHashData
BCryptSetProperty
BCryptCreateHash
BCryptGenerateSymmetricKey
vcruntime140
__std_type_info_name
__RTtypeid
memcpy
memset
__std_terminate
strrchr
longjmp
__std_type_info_compare
_purecall
__std_exception_destroy
__std_exception_copy
strchr
wcsstr
wcschr
strstr
__C_specific_handler
wcsrchr
__RTDynamicCast
__CxxFrameHandler3
_CxxThrowException
__intrinsic_setjmp
__std_type_info_destroy_list
memcmp
memchr
memmove
api-ms-win-crt-heap-l1-1-0
realloc
malloc
free
calloc
_callnewh
_recalloc
api-ms-win-crt-runtime-l1-1-0
strerror
raise
_invalid_parameter_noinfo_noreturn
_invalid_parameter_noinfo
abort
exit
strerror_s
terminate
_initterm_e
_initterm
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
signal
_errno
_beginthreadex
_exit
api-ms-win-crt-string-l1-1-0
isxdigit
strncmp
isspace
isdigit
_strdup
_wcsdup
strcmp
_wcsicmp
wcsncpy
_wcsnicmp
_stricmp
tolower
toupper
_strnicmp
towupper
strcspn
towlower
strspn
strncpy
wcsncpy_s
strncpy_s
isalpha
api-ms-win-crt-stdio-l1-1-0
_write
_open
_read
_fileno
_setmode
fflush
fclose
_close
_lseeki64
__stdio_common_vswprintf_s
__stdio_common_vsprintf_s
__stdio_common_vswprintf
__stdio_common_vsscanf
fwrite
__stdio_common_vsnprintf_s
__stdio_common_vswscanf
ferror
__stdio_common_vfprintf
__acrt_iob_func
feof
fputs
__stdio_common_vsprintf
rewind
fgets
fopen
_wfopen
fseek
ftell
fread
api-ms-win-crt-math-l1-1-0
ceil
cos
cosf
atan2
acos
fmod
pow
sin
sinf
sqrt
floor
ldexp
frexp
modf
_dtest
round
tan
_hypot
api-ms-win-crt-utility-l1-1-0
srand
rand
qsort
api-ms-win-crt-time-l1-1-0
_localtime64
_time64
_gmtime64_s
_mktime64
api-ms-win-crt-filesystem-l1-1-0
_stat64i32
_splitpath_s
api-ms-win-crt-convert-l1-1-0
strtoul
strtod
strtol
wcstoul
atoi
atof
_wtoi
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-locale-l1-1-0
localeconv
Exports
Exports
ImagePrinterMain
Sections
.text Size: 5.0MB - Virtual size: 5.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 53KB - Virtual size: 614KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 215KB - Virtual size: 214KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 146KB - Virtual size: 146KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ