t:\modi\x86\ship\0\mspocrdc.pdb
Static task
static1
Behavioral task
behavioral1
Sample
4f111f62b7630989dbe2b5306224b280_NeikiAnalytics.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
4f111f62b7630989dbe2b5306224b280_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
4f111f62b7630989dbe2b5306224b280_NeikiAnalytics.exe
-
Size
636KB
-
MD5
4f111f62b7630989dbe2b5306224b280
-
SHA1
db4e3653b547f3afd08932b33157cedcb18b54db
-
SHA256
b086c0bb187c94d9c388786476fe01aa865a3205604568e0c01de74cb8b96247
-
SHA512
e1443b1f0ab7a071352bb7074fcb6e16f79bf9dc7acdcf3d5ef49415d0d1e3c2a892163932178677bdb2270c148039dc5b73b4284b97a66b914a85c42ee82398
-
SSDEEP
12288:dRZ9lJKQ1uBeAMlwesHU8wqy2VYCIbvpOBlU1RlgIDMCZgjtGlxHZ9/I:ZE1SwPHU8X31PfU17DhZy0lxHZ9/I
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4f111f62b7630989dbe2b5306224b280_NeikiAnalytics.exe
Files
-
4f111f62b7630989dbe2b5306224b280_NeikiAnalytics.exe.exe windows:4 windows x86 arch:x86
adfbd721708e2f2ac421966841e3ff3c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetCurrentProcessId
GetCurrentThreadId
SetEvent
GetExitCodeThread
WaitForSingleObjectEx
CreateEventW
CloseHandle
WaitForSingleObject
ExitThread
CopyFileW
MoveFileExW
DeleteFileW
CreateProcessW
GetFileAttributesW
GetTempFileNameW
GetTempPathW
LoadResource
WideCharToMultiByte
GetStringTypeExW
GetSystemTimeAsFileTime
GetSystemTime
LoadLibraryExW
GetTempPathA
GetTempFileNameA
CreateProcessA
GetProcessHeap
GetTickCount
QueryPerformanceCounter
VirtualProtect
LoadLibraryA
FormatMessageA
SizeofResource
MultiByteToWideChar
FreeLibrary
lstrcmpiW
LeaveCriticalSection
EnterCriticalSection
GetModuleFileNameW
GetModuleHandleW
GetLastError
DeleteCriticalSection
InitializeCriticalSection
RaiseException
HeapFree
FindResourceW
LocalFree
GetLocalTime
lstrlenW
LocalAlloc
GetUserDefaultLCID
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoW
InterlockedCompareExchange
Sleep
LoadLibraryW
GetProcAddress
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
HeapAlloc
InterlockedExchange
user32
MessageBoxA
RemovePropW
GetPropW
SetPropW
GetWindowLongW
SetWindowLongW
GetWindowLongA
IsWindowUnicode
TranslateMessage
PeekMessageW
UnregisterClassA
CharNextW
LoadStringW
DispatchMessageW
GetMessageW
PostThreadMessageW
WaitForInputIdle
SendMessageTimeoutW
GetSystemMetrics
FindWindowW
IsCharAlphaW
IsCharAlphaNumericW
advapi32
RegQueryValueExA
GetUserNameA
GetUserNameW
RegQueryValueExW
RegQueryInfoKeyW
RegDeleteValueW
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteKeyW
RegOpenKeyExA
iprop
PropVariantClear
ole32
CoRevokeClassObject
CoInitialize
CoUninitialize
StringFromGUID2
CoTaskMemAlloc
StringFromCLSID
OleInitialize
CoCreateInstance
CoRegisterClassObject
CoTaskMemFree
CoTaskMemRealloc
oleaut32
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysAllocString
SysFreeString
SysStringLen
msvcr80
memmove_s
_beginthreadex
_invalid_parameter_noinfo
_wsplitpath_s
_wmakepath_s
_itow_s
_vsnprintf
_vsnwprintf
wcsrchr
vswprintf_s
vsprintf_s
fclose
fwprintf_s
fopen_s
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
??0exception@std@@QAE@ABV01@@Z
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
__set_app_type
_except_handler4_common
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
_crt_debugger_hook
_invoke_watson
_controlfp_s
?_type_info_dtor_internal_method@type_info@@QAEXXZ
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
wcstok_s
_wcsicmp
memset
_recalloc
??_U@YAPAXI@Z
memcpy_s
_wcmdln
malloc
??2@YAPAXI@Z
__CxxFrameHandler3
wcscat_s
wcsncpy_s
wcscpy_s
_CxxThrowException
free
??3@YAXPAX@Z
_time64
rand
srand
_wtol
??_V@YAXPAX@Z
msvcp80
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
mspgimme
SetupGimme
EPLoadMSO
Sections
.text Size: 63KB - Virtual size: 62KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 568KB - Virtual size: 572KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE