?RdvServiceMain@@YAXPEAX0K0K@Z
DllRegisterServer
DllUnregisterServer
VssServiceMain
Static task
static1
Behavioral task
behavioral1
Sample
6745978c50c4ce14af2e6479c0612730_NeikiAnalytics.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6745978c50c4ce14af2e6479c0612730_NeikiAnalytics.dll
Resource
win10v2004-20240426-en
Target
6745978c50c4ce14af2e6479c0612730_NeikiAnalytics.exe
Size
805KB
MD5
6745978c50c4ce14af2e6479c0612730
SHA1
8080772494082b8efb7715e4765cdce734e33121
SHA256
892bd8f267b61889bc3c7f43905e00f0e72633606d603ae64c48e8d099af975e
SHA512
c5029628698580175ed4791d7bc59605ca3b50add47dcf588107da76e6b308ebd7d5dc3f9bd582d792de71ab532a2ea7cdd77741c00ac6ceff38dac0657875b1
SSDEEP
24576:8ctgF+tumZl3NUzlRaw70jFtAGpSu4Tkmhexgg:8cOC3NyyvdST1hexR
Checks for missing Authenticode signature.
resource |
---|
6745978c50c4ce14af2e6479c0612730_NeikiAnalytics.exe |
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
CertFreeCertificateContext
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
FileTimeToSystemTime
GetFileInformationByHandle
GetFileSize
SetFilePointer
ReadFile
CreateFileW
CreateFileMappingW
MapViewOfFile
CloseHandle
WriteFile
UnmapViewOfFile
GetLocalTime
SystemTimeToFileTime
WideCharToMultiByte
GetTickCount
VirtualProtect
LoadLibraryW
EnterCriticalSection
InitializeCriticalSectionEx
GetLastError
DeleteCriticalSection
FormatMessageA
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
InitializeCriticalSection
RtlCaptureContext
LeaveCriticalSection
GetProcAddress
GetModuleHandleW
CreateEventW
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
OutputDebugStringW
IsDebuggerPresent
InitializeSListHead
CryptAcquireContextA
CryptReleaseContext
CryptGenRandom
_Mtx_unlock
_Cnd_init
_Cnd_destroy
_Cnd_init_in_situ
_Cnd_destroy_in_situ
_Cnd_wait
_Cnd_timedwait
_Cnd_signal
_Cnd_do_broadcast_at_thread_exit
?_Throw_C_error@std@@YAXH@Z
?_Throw_Cpp_error@std@@YAXH@Z
?uncaught_exception@std@@YA_NXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_J@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_K@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Random_device@std@@YAIXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?_BADOFF@std@@3_JB
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
_Tolower
_Toupper
??0_Locinfo@std@@QEAA@PEBD@Z
??1_Locinfo@std@@QEAA@XZ
?_Getctype@_Locinfo@std@@QEBA?AU_Ctypevec@@XZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
??Bid@locale@std@@QEAA_KXZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??0ctype_base@std@@QEAA@_K@Z
??1ctype_base@std@@UEAA@XZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z
_Query_perf_counter
_Query_perf_frequency
_Thrd_detach
_Thrd_sleep
_Mtx_current_owns
_Mtx_lock
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ
_Thrd_start
_Xtime_get_ticks
_Thrd_join
_Thrd_id
_Mtx_init
_Mtx_destroy
_Mtx_init_in_situ
_Mtx_destroy_in_situ
freeaddrinfo
__WSAFDIsSet
select
WSAStartup
WSACleanup
closesocket
recv
send
WSAGetLastError
connect
ioctlsocket
setsockopt
socket
getaddrinfo
__std_type_info_destroy_list
__std_exception_destroy
__std_exception_copy
memcmp
strchr
__vcrt_InitializeCriticalSectionEx
__CxxFrameHandler3
__std_terminate
memmove
memset
__C_specific_handler
strstr
wcsrchr
_purecall
memcpy
_CxxThrowException
memchr
_invalid_parameter_noinfo_noreturn
terminate
_initterm_e
_initterm
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_errno
strerror
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
calloc
malloc
free
_callnewh
isspace
strncpy
wcsncpy_s
wcsncat_s
strncpy_s
_wcsicmp
isalnum
tolower
strncat_s
isalpha
strlen
_wchmod
_gmtime64_s
_localtime64_s
_time64
fclose
__stdio_common_vsnprintf_s
fseek
__stdio_common_vsnwprintf_s
fread
fopen
ftell
__stdio_common_vsscanf
srand
rand
atoi
pow
?RdvServiceMain@@YAXPEAX0K0K@Z
DllRegisterServer
DllUnregisterServer
VssServiceMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ