default-browser-agent.pdb
Static task
static1
Behavioral task
behavioral1
Sample
0a7ff7e413caea0d94302df3e7314c30_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
0a7ff7e413caea0d94302df3e7314c30_NeikiAnalytics.exe
-
Size
1.2MB
-
MD5
0a7ff7e413caea0d94302df3e7314c30
-
SHA1
7bb0095358da81741bf6b10496039158cc27ff74
-
SHA256
41955e596cadae5cd87a9baa96c2dda5d6f65b9512aa5f3fdee4c1f49f03de80
-
SHA512
8beddfe1da3661d0564835a84766211012686255def8ea4515caa3c36e5b89502fafefb61f8a82f5e14067c8a1f63fd50cdf8e7cd0194ed539ba1cea70d10b34
-
SSDEEP
24576:j+XJ08u8WGi7/uk7aPCgQn652gOOwPt/sBlDqgZQd6XKtiMJYiPUl:j+ZmMi7W+FyS/snji6attJM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0a7ff7e413caea0d94302df3e7314c30_NeikiAnalytics.exe
Files
-
0a7ff7e413caea0d94302df3e7314c30_NeikiAnalytics.exe.exe windows:10 windows x86 arch:x86
908400f4953dc4cf83c62d2e85d999c1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
advapi32
ConvertSidToStringSidW
DeregisterEventSource
GetTokenInformation
GetUserNameW
OpenProcessToken
RegCloseKey
RegCreateKeyExW
RegDeleteKeyValueW
RegDeleteKeyW
RegDeleteTreeW
RegDeleteValueW
RegEnumValueW
RegGetValueW
RegOpenKeyExW
RegQueryInfoKeyW
RegSetKeyValueW
RegSetValueExW
RegisterEventSourceW
ReportEventW
SystemFunction036
bcrypt
BCryptCloseAlgorithmProvider
BCryptCreateHash
BCryptDestroyHash
BCryptFinishHash
BCryptGenRandom
BCryptHashData
BCryptOpenAlgorithmProvider
crypt32
CryptBinaryToStringW
kernel32
AcquireSRWLockExclusive
AcquireSRWLockShared
CloseHandle
CompareStringOrdinal
CreateEventW
CreateMutexA
CreateMutexW
CreateProcessW
DeleteCriticalSection
EnterCriticalSection
FileTimeToSystemTime
FormatMessageW
GetConsoleMode
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetEnvironmentVariableW
GetFileAttributesW
GetLastError
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetStdHandle
GetSystemDirectoryW
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetUserDefaultLocaleName
GetVersionExW
HeapAlloc
HeapFree
HeapReAlloc
InitOnceBeginInitialize
InitOnceComplete
InitializeCriticalSectionAndSpinCount
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
K32GetModuleFileNameExW
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalFree
MultiByteToWideChar
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReleaseMutex
ReleaseSRWLockExclusive
ReleaseSRWLockShared
ResetEvent
RtlCaptureContext
SetEvent
SetLastError
SetUnhandledExceptionFilter
Sleep
SystemTimeToFileTime
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VerSetConditionMask
VerifyVersionInfoW
VirtualAlloc
VirtualFree
WaitForSingleObject
WaitForSingleObjectEx
WideCharToMultiByte
WriteConsoleW
lstrlenW
netapi32
NetApiBufferFree
NetUserGetInfo
ole32
CoCreateGuid
CoCreateInstance
CoInitializeEx
CoTaskMemAlloc
CoTaskMemFree
CoUninitialize
PropVariantClear
StringFromGUID2
oleaut32
SysAllocString
SysFreeString
VariantClear
rpcrt4
UuidCreate
shell32
SHChangeNotify
SHGetKnownFolderPath
ShellExecuteExW
shlwapi
AssocQueryStringW
PathAppendW
PathCombineW
PathRemoveFileSpecW
msvcp140
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??0_Lockit@std@@QAE@H@Z
??0ios_base@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??1_Lockit@std@@QAE@XZ
??1ios_base@std@@UAE@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAN@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_N@Z
??Bid@locale@std@@QAEIXZ
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Raise_handler@std@@3P6AXABVexception@stdext@@@ZA
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?fail@ios_base@std@@QBE_NXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?good@ios_base@std@@QBE_NXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
user32
CharLowerW
wininet
HttpAddRequestHeadersW
HttpOpenRequestW
HttpQueryInfoA
HttpQueryInfoW
HttpSendRequestW
InternetCloseHandle
InternetConnectW
InternetOpenW
InternetReadFile
ntdll
NtWriteFile
RtlNtStatusToDosError
vcruntime140
_CxxThrowException
__CxxFrameHandler3
__current_exception
__current_exception_context
__std_exception_copy
__std_exception_destroy
_except_handler4_common
_purecall
memchr
memcmp
memcpy
memmove
memset
wcschr
api-ms-win-crt-runtime-l1-1-0
__p___argc
__p___wargv
_c_exit
_cexit
_configure_wide_argv
_controlfp_s
_crt_atexit
_exit
_get_initial_wide_environment
_initialize_onexit_table
_initialize_wide_environment
_initterm
_initterm_e
_invalid_parameter_noinfo_noreturn
_invoke_watson
_register_onexit_function
_register_thread_local_exe_atexit_callback
_seh_filter_exe
_set_app_type
abort
exit
terminate
api-ms-win-crt-stdio-l1-1-0
__p__commode
__stdio_common_vsnwprintf_s
__stdio_common_vsprintf
__stdio_common_vswprintf
_fseeki64
_get_stream_buffer_pointers
_set_fmode
_wfopen
fclose
fflush
fgetc
fgetpos
fputc
fread
fseek
fsetpos
ftell
fwrite
setvbuf
ungetc
api-ms-win-crt-math-l1-1-0
__setusermatherr
_dtest
ceil
modf
api-ms-win-crt-heap-l1-1-0
_callnewh
_set_new_mode
free
malloc
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-time-l1-1-0
_gmtime64_s
_time64
wcsftime
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
api-ms-win-crt-string-l1-1-0
_wcsnicmp
strcmp
strcpy
strlen
wcscat_s
wcscmp
wcscpy
wcscpy_s
wcslen
wcspbrk
api-ms-win-crt-convert-l1-1-0
wcstol
Exports
Exports
?Unused@mozilla@@3Uunused_t@1@B
gMozillaPoisonBase
gMozillaPoisonSize
gMozillaPoisonValue
gWinEventLogSourceName
Sections
.text Size: 373KB - Virtual size: 372KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 263KB - Virtual size: 262KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.00cfg Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 580KB - Virtual size: 584KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE