Q:\cmd\d\out\binaries\amd64ret\bin\amd64\spyxx_amd64.pdb
Static task
static1
Behavioral task
behavioral1
Sample
200849839210f4944867f39119bd97f0_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
200849839210f4944867f39119bd97f0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
200849839210f4944867f39119bd97f0_NeikiAnalytics.exe
-
Size
1.4MB
-
MD5
200849839210f4944867f39119bd97f0
-
SHA1
aaac5045d4f8ca3508deaf805ebaf3c22b449394
-
SHA256
3c585c8d932019a4ef4b4374f0cf231dffcc6be03fdcddd234d5565c7f0c7c35
-
SHA512
ea740ff73885121bc97acd24352b0b34ad1acb4ec114111d35a5a69fa9a19b3b827cc91eef881acd31cca763747ef643df122c3048e42286cb2aefb61d34fb00
-
SSDEEP
24576:Wthsz5WNiZwqzG7a2sRjhm0Ijr/eax8JXO02q3A:ahs7zG3EjhMjSax84
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 200849839210f4944867f39119bd97f0_NeikiAnalytics.exe
Files
-
200849839210f4944867f39119bd97f0_NeikiAnalytics.exe.exe windows:6 windows x64 arch:x64
a3ac027601a5ff62808f9bea9200cf68
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
GetProcAddress
CreateMutexA
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
DecodePointer
ResetEvent
WaitForSingleObjectEx
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
OutputDebugStringW
GetSystemDirectoryW
LoadLibraryW
HeapSetInformation
GetModuleFileNameW
lstrcmpiW
LoadLibraryExW
GetUserDefaultUILanguage
GetFileAttributesW
SetLastError
WriteFile
CreateFileW
GlobalUnlock
GlobalLock
GlobalGetAtomNameW
IsDBCSLeadByte
HeapFree
HeapSize
HeapAlloc
GetProcessHeap
lstrlenW
EncodePointer
GetCurrentProcessId
OpenProcess
GetLastError
GetCurrentProcess
MultiByteToWideChar
WideCharToMultiByte
Sleep
GetModuleHandleW
CloseHandle
ReleaseMutex
WaitForSingleObject
SetEvent
LocalFree
CreateMutexW
SetThreadPriority
CreateEventW
MulDiv
InitializeCriticalSectionAndSpinCount
user32
ClientToScreen
WindowFromPoint
GetClientRect
GetCapture
UpdateWindow
SetCursor
SetCapture
GetWindowRgn
IsWindowVisible
GetWindow
PtInRect
ReleaseCapture
RedrawWindow
RegisterClassW
SendMessageW
SetDlgItemTextW
GetClassNameW
IsWindow
GetParent
SetWindowLongW
GetWindowLongW
MapWindowPoints
GetWindowThreadProcessId
EnableWindow
ReleaseDC
DrawTextW
GetSystemMetrics
ScreenToClient
GetWindowRect
GetDC
CreateWindowExW
RegisterClipboardFormatW
GetClassWord
DestroyWindow
LoadStringW
PostMessageW
DefWindowProcW
SetWindowsHookExA
MessageBoxW
IsIconic
LoadCursorW
GetSysColor
InvalidateRect
UnhookWindowsHookEx
GetWindowLongPtrW
GetClassInfoW
EnumWindows
EnumChildWindows
GetClipboardFormatNameW
UnpackDDElParam
SetWindowLongPtrW
LoadAcceleratorsW
IsChild
SystemParametersInfoW
GetSysColorBrush
FillRect
GetKeyState
DrawFocusRect
CreatePopupMenu
AppendMenuW
CallNextHookEx
LoadIconW
SetWindowPos
SetWindowPlacement
BringWindowToTop
SetForegroundWindow
ShowWindow
GetWindowTextW
SendMessageTimeoutW
GetWindowDC
GetDesktopWindow
SetWindowsHookExW
GetClassLongPtrA
IsWindowUnicode
GetClassLongPtrW
GetWindowWord
GetClassLongW
GetAncestor
GetWindowPlacement
OffsetRect
IsZoomed
GetFocus
gdi32
Rectangle
SetROP2
GetStockObject
CreatePen
GetTextMetricsW
GetTextExtentPoint32W
CreateHatchBrush
ExtTextOutW
GetObjectW
PtInRegion
CreateRectRgn
DeleteObject
SetBkMode
SelectObject
FrameRgn
GetDeviceCaps
CreateFontIndirectW
shell32
SHGetFolderPathW
advapi32
RegOpenKeyW
RegCreateKeyW
RegSetValueExW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
RegQueryInfoKeyW
LookupAccountSidW
GetTokenInformation
AdjustTokenPrivileges
PrivilegeCheck
OpenProcessToken
LookupPrivilegeValueW
GetSecurityDescriptorSacl
SetSecurityInfo
GetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
comdlg32
GetSaveFileNameW
oleaut32
SysAllocString
spyxxhk_amd64
ghhkRetHook
SpyxxCallWndRetProc
gmsgOtherProcessData
gopd
gfHookEnabled
gtidSpyxx
gpidSpyxx
gaaClasses
gfHookDisabled
gabMsgBuf
SpyxxGetMsgProc
ghhkMsgHook
SpyxxCallWndProc
ghhkCallHook
mfc140u
ord8733
ord10260
ord6557
ord8916
ord2966
ord8944
ord11899
ord3145
ord3967
ord2543
ord7394
ord3713
ord5916
ord1454
ord990
ord3598
ord5246
ord497
ord8730
ord10703
ord5750
ord6260
ord7228
ord14128
ord8949
ord3953
ord6314
ord7551
ord1503
ord878
ord1369
ord13679
ord12763
ord11081
ord6619
ord2396
ord2212
ord2270
ord1489
ord7173
ord979
ord1446
ord7389
ord10769
ord4722
ord9039
ord6313
ord4656
ord3756
ord6320
ord2475
ord3828
ord8917
ord11805
ord2628
ord6630
ord11770
ord8003
ord10965
ord10968
ord9200
ord9215
ord9205
ord9677
ord9682
ord9217
ord10807
ord10199
ord8614
ord8604
ord11435
ord10811
ord8702
ord10835
ord9738
ord11624
ord4721
ord286
ord2909
ord2903
ord10710
ord812
ord1333
ord1983
ord280
ord7068
ord4946
ord4181
ord12240
ord1633
ord8202
ord2715
ord6919
ord10074
ord8961
ord7254
ord549
ord972
ord1438
ord956
ord1425
ord1129
ord11790
ord8993
ord8173
ord13283
ord7541
ord8433
ord4878
ord7928
ord8866
ord11322
ord10067
ord6916
ord546
ord7251
ord4874
ord11232
ord10420
ord8907
ord5722
ord13351
ord8930
ord2510
ord4353
ord11864
ord3715
ord11763
ord7912
ord3081
ord8098
ord4872
ord5917
ord12142
ord1766
ord13361
ord5727
ord13359
ord5726
ord11119
ord5743
ord8521
ord9044
ord11493
ord11487
ord5189
ord3725
ord4443
ord11184
ord10093
ord3185
ord7539
ord8904
ord3811
ord11788
ord8928
ord11862
ord3714
ord8097
ord4873
ord1767
ord7432
ord13360
ord13358
ord5744
ord9043
ord11491
ord11484
ord3723
ord3098
ord11486
ord902
ord6862
ord469
ord1106
ord10665
ord5408
ord5981
ord8888
ord13697
ord2187
ord7241
ord2861
ord4964
ord12985
ord1905
ord8903
ord9942
ord5557
ord3728
ord4549
ord12341
ord12100
ord13023
ord2767
ord7395
ord2511
ord8093
ord13468
ord2779
ord8772
ord3735
ord10713
ord10956
ord12466
ord5376
ord12256
ord10941
ord9175
ord2662
ord12642
ord11775
ord3997
ord3947
ord14132
ord5196
ord10122
ord10411
ord10827
ord10828
ord9054
ord11432
ord9670
ord9159
ord6634
ord12963
ord12720
ord13568
ord438
ord1086
ord6083
ord3825
ord8441
ord4086
ord6361
ord3803
ord2479
ord13999
ord963
ord1429
ord12899
ord1501
ord12293
ord1988
ord4518
ord1987
ord290
ord7344
ord802
ord1323
ord3129
ord13758
ord2686
ord13761
ord8585
ord5152
ord6494
ord11797
ord11859
ord8095
ord11489
ord3260
ord4511
ord12289
ord14111
ord8050
ord5636
ord5607
ord539
ord1160
ord5709
ord5188
ord293
ord7169
ord9218
ord11804
ord5910
ord6606
ord1065
ord375
ord528
ord1149
ord7388
ord7785
ord3090
ord4724
ord5633
ord10080
ord7393
ord983
ord1450
ord7716
ord8159
ord804
ord1844
ord4445
ord7713
ord10124
ord2269
ord985
ord1452
ord6614
ord9941
ord5555
ord12606
ord11901
ord11933
ord7920
ord11929
ord11921
ord5706
ord3731
ord6122
ord14289
ord6123
ord14290
ord6121
ord14288
ord7719
ord12212
ord14088
ord11665
ord11664
ord2011
ord7668
ord12625
ord3949
ord4011
ord9089
ord14216
ord7650
ord14210
ord12223
ord12222
ord2439
ord5183
ord8023
ord12544
ord8084
ord12563
ord8058
ord11623
ord11621
ord10858
ord11022
ord10924
ord8668
ord11898
ord10689
ord6556
ord13199
ord5243
ord13134
ord13767
ord4357
ord265
ord2514
ord266
ord4335
ord7882
ord13955
ord2703
ord4726
ord12779
ord7366
ord8507
ord13864
ord10189
ord7367
ord12392
ord2344
ord6029
ord4875
ord4311
ord1389
ord910
ord1386
ord1424
ord6588
ord8900
ord11902
ord8826
ord2698
ord13401
ord6002
ord3164
ord4095
ord11813
ord8731
ord10704
ord11085
ord3951
ord3308
ord3307
ord3071
ord6000
ord13397
ord3212
ord3209
ord7913
ord2697
ord14360
ord9976
ord9978
ord9977
ord9975
ord9979
ord5451
ord11414
ord11415
ord8830
ord11771
ord3718
ord11625
ord14209
ord8656
ord11854
ord6729
ord10691
ord8947
ord3173
ord13513
ord11944
ord11940
ord1700
ord1722
ord1748
ord1734
ord1755
ord4776
ord4843
ord4788
ord4806
ord4800
ord4794
ord4853
ord4837
ord4782
ord4859
ord4814
ord4752
ord4767
ord4828
ord4360
ord9384
ord4352
ord2967
ord14211
ord7651
ord14217
ord6631
ord11406
ord13354
ord5723
ord2629
ord11806
ord3812
ord3279
ord3278
ord3172
ord11850
ord5080
ord5363
ord5552
ord2473
ord9041
ord5339
ord5582
ord5083
ord5229
ord5062
ord7460
ord7461
ord7450
ord5227
ord7922
ord9946
ord8901
ord6285
ord5240
ord13136
ord1667
ord1670
ord2370
ord8161
ord1033
ord296
ord10163
ord7233
ord9392
ord1089
ord446
ord1491
ord11622
ord9739
msvcp140
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z
?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?uncaught_exception@std@@YA_NXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__C_specific_handler
_purecall
memset
__current_exception_context
__current_exception
wcsstr
wcsrchr
wcschr
memcpy
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswscanf
__stdio_common_vswprintf_s
__stdio_common_vsprintf
__stdio_common_vswprintf
_set_fmode
__p__commode
api-ms-win-crt-convert-l1-1-0
_wtoi64
_itow_s
_wtoi
_wcstoui64
wcstoul
api-ms-win-crt-runtime-l1-1-0
_beginthread
_invalid_parameter_noinfo
_seh_filter_exe
_set_app_type
terminate
_configure_wide_argv
_errno
_get_wide_winmain_command_line
_initterm
_initterm_e
exit
_exit
_crt_atexit
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_endthread
_initialize_wide_environment
_initialize_onexit_table
_register_onexit_function
api-ms-win-crt-heap-l1-1-0
_set_new_mode
malloc
free
api-ms-win-crt-string-l1-1-0
_wcsnicmp
wcscat_s
_wcsicmp
wcsncpy_s
_wcsupr_s
wcscpy_s
wcscmp
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
_getmbcp
api-ms-win-crt-math-l1-1-0
__setusermatherr
Sections
.text Size: 397KB - Virtual size: 397KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 236KB - Virtual size: 235KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 117KB - Virtual size: 146KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 115KB - Virtual size: 115KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 592KB - Virtual size: 596KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE