D:\a\_work\1\s\\binaries\x86ret\bin\i386\link.pdb
Static task
static1
Behavioral task
behavioral1
Sample
87be763601b14b947589401c06c324c0_NeikiAnalytics.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
87be763601b14b947589401c06c324c0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
87be763601b14b947589401c06c324c0_NeikiAnalytics.exe
-
Size
2.4MB
-
MD5
87be763601b14b947589401c06c324c0
-
SHA1
0c09a1b6afef41f32d37e50dde312c0a8c603261
-
SHA256
177069bcbc1468deb1806bcb149e71b43a5a6e2331e7393fba15c8a1c5ce31df
-
SHA512
4a1121a3f78b391532448328ffa6c330bdcc238d786c7857713e4197fd12983781b76b19224cb2bafac926f92326370ddaa7edeec860799051ef3e080ee1ac98
-
SSDEEP
49152:zU/XJxujtSm55BLCArVQPjlTxG+8rnP1n/iykBUpLei7dGy:Ixgc+BOA5qjlTxcr+Utq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 87be763601b14b947589401c06c324c0_NeikiAnalytics.exe
Files
-
87be763601b14b947589401c06c324c0_NeikiAnalytics.exe.exe windows:6 windows x86 arch:x86
46ee605fe33e9be1dec28663b47cd43d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
advapi32
EventWrite
EventRegister
EventUnregister
RegGetValueW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegQueryValueExW
kernel32
FlushFileBuffers
CloseHandle
GetFileSize
FlushViewOfFile
UnmapViewOfFile
SetEndOfFile
LoadLibraryW
GetProcAddress
GetCurrentProcess
CreateFileMappingW
VirtualFree
MapViewOfFileEx
SetFilePointer
DeleteFileW
GetTempPathW
GetFileInformationByHandle
WideCharToMultiByte
GetFullPathNameW
GetACP
lstrcmpiW
ExitThread
FreeLibrary
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
GetCurrentThreadId
LeaveCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
SleepConditionVariableSRW
SwitchToThread
FormatMessageW
GetTickCount
QueryPerformanceCounter
QueryPerformanceFrequency
InitializeSListHead
InterlockedFlushSList
CreateThread
ResumeThread
WaitForSingleObject
ReadFile
InterlockedPopEntrySList
InterlockedPushEntrySList
CopyFileW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
LoadLibraryExW
GetEnvironmentVariableW
GetModuleHandleW
EncodePointer
DecodePointer
HeapAlloc
GetProcessHeap
HeapFree
GetUserDefaultUILanguage
FindFirstFileW
FindNextFileW
FindClose
CreateDirectoryW
VirtualQuery
GetSystemInfo
GetEnvironmentStringsW
SetProcessWorkingSetSize
GetCommandLineW
GetExitCodeProcess
CreateProcessW
GetModuleFileNameW
GetFileTime
RaiseFailFastException
SetErrorMode
SetConsoleCtrlHandler
GetCurrentDirectoryW
FreeEnvironmentStringsW
VirtualAlloc
SuspendThread
GetThreadContext
GetCPInfo
MultiByteToWideChar
GetFileType
GetConsoleMode
GetConsoleOutputCP
MapViewOfFile
GetConsoleScreenBufferInfo
SearchPathW
WaitForMultipleObjects
CreateMutexW
ReleaseMutex
CreateEventW
GetTickCount64
GetDriveTypeW
GetLastError
MoveFileExW
WriteFile
SetFilePointerEx
Sleep
GetFileSizeEx
ExitProcess
LoadResource
FindResourceExW
CreateFileW
WakeAllConditionVariable
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
SetEvent
ResetEvent
WaitForSingleObjectEx
GetCurrentProcessId
GetSystemTimeAsFileTime
IsDebuggerPresent
SetFileTime
GetSystemTime
LoadLibraryExA
CreateFileMappingA
GetFileInformationByHandleEx
AreFileApisANSI
FormatMessageA
SystemTimeToFileTime
TlsFree
TlsGetValue
SleepEx
CreateSemaphoreW
HeapDestroy
TlsAlloc
HeapValidate
RaiseException
IsDBCSLeadByte
InitializeCriticalSection
ReleaseSemaphore
VirtualProtect
TlsSetValue
HeapCreate
LCMapStringEx
LocalFree
SetLastError
GetFileAttributesExW
vcruntime140
memchr
_CxxThrowException
memcpy
__CxxFrameHandler3
memcmp
memmove
memset
__std_terminate
__std_exception_copy
_except_handler4_common
__std_exception_destroy
__current_exception_context
strchr
strstr
strrchr
wcsstr
__current_exception
_purecall
wcsrchr
wcschr
__unDName
__unDNameEx
api-ms-win-crt-string-l1-1-0
_wcsnicmp
iswspace
wcstok_s
strncmp
wcsncpy_s
isprint
strncat_s
wcspbrk
iswprint
_stricmp
_strnicmp
strncpy
isalnum
wcsncat_s
iswdigit
wcsncpy
toupper
towlower
isxdigit
isdigit
strcat_s
strcpy_s
strncpy_s
strcmp
_wcsicmp
iswascii
strlen
wcsnlen
wcscpy_s
wcscat_s
wcscspn
_wcsupr_s
wcsncmp
api-ms-win-crt-stdio-l1-1-0
setvbuf
__stdio_common_vsprintf_s
_open_osfhandle
__stdio_common_vfprintf
fopen
ftell
fseek
fwrite
fclose
_wfsopen
_wfdopen
fread
__stdio_common_vswprintf
fputs
__stdio_common_vsnprintf_s
fputwc
__stdio_common_vsscanf
fputws
__stdio_common_vswscanf
_filelength
_get_osfhandle
_fileno
__stdio_common_vsnwprintf_s
__acrt_iob_func
fflush
fgetws
__stdio_common_vfwprintf
__stdio_common_vswprintf_s
_isatty
getwchar
_set_fmode
__p__commode
api-ms-win-crt-runtime-l1-1-0
_exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_initialize_onexit_table
terminate
__p___argc
_beginthreadex
_invalid_parameter_noinfo_noreturn
_get_errno
_invalid_parameter_noinfo
_errno
__p___wargv
_register_onexit_function
_set_new_handler
_crt_atexit
__p__wpgmptr
__doserrno
_set_invalid_parameter_handler
_cexit
exit
_controlfp_s
_c_exit
_register_thread_local_exe_atexit_callback
_get_wpgmptr
api-ms-win-crt-convert-l1-1-0
_itoa_s
atoi
strtoul
atol
wcstol
_wtoi64
_ultoa_s
_wcstoui64
wcstoul
_ui64tow_s
_ultow_s
_itow_s
api-ms-win-crt-filesystem-l1-1-0
_wfullpath
_wsplitpath_s
_waccess
_wremove
_wstat64
_wmakepath_s
_wstat64i32
api-ms-win-crt-time-l1-1-0
_wctime64
_tzset
clock
_time64
api-ms-win-crt-environment-l1-1-0
_wgetenv_s
_wputenv_s
_wgetcwd
_wsearchenv_s
getenv
_wdupenv_s
api-ms-win-crt-utility-l1-1-0
qsort_s
bsearch
qsort
api-ms-win-crt-heap-l1-1-0
calloc
free
_set_new_mode
malloc
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
setlocale
___lc_codepage_func
api-ms-win-crt-conio-l1-1-0
__conio_common_vcprintf
_putwch
_cputws
_cputs
__conio_common_vcwprintf
api-ms-win-crt-math-l1-1-0
ceil
__setusermatherr
psapi
GetProcessMemoryInfo
msvcp140
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?width@ios_base@std@@QBE_JXZ
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGXZ
?gptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?sgetc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?snextc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEPAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ
?is@?$ctype@G@std@@QBE_NFG@Z
?width@ios_base@std@@QAE_J_J@Z
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXH_N@Z
?_Xinvalid_argument@std@@YAXPBD@Z
_Xtime_get_ticks
_Mtx_current_owns
_Cnd_timedwait
_Query_perf_frequency
_Query_perf_counter
_Cnd_do_broadcast_at_thread_exit
?__ExceptionPtrCopyException@@YAXPAXPBX1@Z
?__ExceptionPtrAssign@@YAXPAXPBX@Z
_Cnd_unregister_at_thread_exit
?_Rethrow_future_exception@std@@YAXVexception_ptr@1@@Z
?__ExceptionPtrToBool@@YA_NPBX@Z
?_Throw_future_error@std@@YAXABVerror_code@1@@Z
_Thrd_hardware_concurrency
_Thrd_id
_Thrd_join
?_Throw_Cpp_error@std@@YAXH@Z
_Thrd_detach
?_Syserror_map@std@@YAPBDH@Z
?__ExceptionPtrCreate@@YAXPAX@Z
?__ExceptionPtrCurrentException@@YAXPAX@Z
?__ExceptionPtrDestroy@@YAXPAX@Z
?__ExceptionPtrCopy@@YAXPAXPBX@Z
_Cnd_wait
_Mtx_init_in_situ
_Mtx_destroy_in_situ
_Cnd_register_at_thread_exit
_Cnd_broadcast
?setg@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG00@Z
_Cnd_signal
_Mtx_unlock
?_Throw_C_error@std@@YAXH@Z
?_Winerror_map@std@@YAHH@Z
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IAE@XZ
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAE@XZ
?_Xbad_alloc@std@@YAXXZ
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UAE@XZ
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JXZ
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXH@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPAG_J@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPBG_J@Z
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG00@Z
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEPAV12@PAG_J@Z
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAE@XZ
?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?epptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?egptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?eback@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?_Getcat@?$ctype@G@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG0@Z
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UAE@XZ
??Bios_base@std@@QBE_NXZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEHXZ
?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ
??Bid@locale@std@@QAEIXZ
?id@?$ctype@G@std@@2V0locale@2@A
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??0_Lockit@std@@QAE@H@Z
_Mtx_lock
??1_Lockit@std@@QAE@XZ
_Cnd_destroy_in_situ
_Cnd_init_in_situ
?_Xbad_function_call@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
tbbmalloc
scalable_malloc
scalable_realloc
scalable_free
Sections
.text Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 78KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 85KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 640KB - Virtual size: 644KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE