G:\Checkpoints\TPDrv\headgit1\Install\WinNT5\SynTPEnhService\SynTPEnhService\x64\Release\SynTPEnhService.pdb
Static task
static1
Behavioral task
behavioral1
Sample
3bd9eea540f7793882db79134782a3f0_NeikiAnalytics.exe
Resource
win7-20231129-en
General
-
Target
3bd9eea540f7793882db79134782a3f0_NeikiAnalytics.exe
-
Size
1.4MB
-
MD5
3bd9eea540f7793882db79134782a3f0
-
SHA1
cae69043ae36461932488e46becf893b02fc8b0f
-
SHA256
ced290f1ecb715c502856371f25e0bf4ee69d70b21fad3a26f19b7cd9a7e8acc
-
SHA512
8353d86c418dc784e5f0ad1539000af7782f7963ca842ddc26394f88dcd00ae7e5a295da94145e27c242eead382c61cc5de75b91788c05920be4fb23e8e4c0be
-
SSDEEP
12288:Mb/Is165y0ZwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDtL:MzIP53OsqjnhMgeiCl7G0nehbGZpbD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3bd9eea540f7793882db79134782a3f0_NeikiAnalytics.exe
Files
-
3bd9eea540f7793882db79134782a3f0_NeikiAnalytics.exe.exe windows:5 windows x64 arch:x64
0c16afb21ad0938c51a551e1f8b686c5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
lstrlenW
LockResource
MultiByteToWideChar
GetExitCodeProcess
GetModuleFileNameW
GetProcessId
WaitForMultipleObjects
QueueUserWorkItem
GetFileAttributesW
SizeofResource
LoadResource
FindResourceW
FindResourceExW
CreateThread
ReleaseMutex
ResetEvent
GetOverlappedResult
WaitForMultipleObjectsEx
SetEvent
WaitForSingleObject
CreateMutexW
CloseHandle
DeleteCriticalSection
DecodePointer
CreateEventW
ReadFileEx
HeapSize
GetLastError
RaiseException
FlushFileBuffers
DisconnectNamedPipe
CreateFileW
ReadFile
HeapDestroy
Sleep
InitializeCriticalSectionAndSpinCount
WriteFile
GetProcessHeap
CreateNamedPipeW
ConnectNamedPipe
HeapFree
HeapAlloc
GetCurrentProcess
HeapReAlloc
SetEndOfFile
ReadConsoleW
WriteConsoleW
SetStdHandle
SetFilePointerEx
GetConsoleMode
GetConsoleCP
LCMapStringW
LoadLibraryExW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetFileType
GetStdHandle
GetStringTypeW
GetModuleHandleW
GetProcAddress
TerminateProcess
GetCurrentThreadId
GetModuleHandleExW
IsWow64Process
EnterCriticalSection
LeaveCriticalSection
ExpandEnvironmentStringsW
IsDebuggerPresent
OutputDebugStringW
EncodePointer
IsProcessorFeaturePresent
GetCommandLineW
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
ExitProcess
WideCharToMultiByte
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
advapi32
RegCreateKeyW
RegCreateKeyExW
ControlService
ChangeServiceConfigW
QueryServiceStatus
OpenServiceW
OpenSCManagerW
DeleteService
CloseServiceHandle
CreateServiceW
ReportEventW
SetServiceStatus
DeregisterEventSource
RegisterServiceCtrlHandlerExW
StartServiceCtrlDispatcherW
RegisterEventSourceW
AdjustTokenPrivileges
DuplicateTokenEx
LookupPrivilegeValueW
SetTokenInformation
CreateProcessAsUserW
OpenProcessToken
RegSetValueExW
RegCloseKey
RegQueryValueExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExW
setupapi
SetupDiDestroyDeviceInfoList
SetupCloseInfFile
SetupDiCallClassInstaller
SetupDiEnumDeviceInfo
SetupGetLineByIndexW
SetupGetLineTextW
SetupGetLineCountW
SetupOpenInfFileW
SetupDiGetDeviceRegistryPropertyW
SetupDiSetClassInstallParamsW
SetupDiGetClassDevsW
SetupDiGetINFClassW
userenv
DestroyEnvironmentBlock
CreateEnvironmentBlock
wtsapi32
WTSEnumerateSessionsW
WTSFreeMemory
WTSQueryUserToken
Sections
.text Size: 122KB - Virtual size: 121KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 56KB - Virtual size: 55KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1.2MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE