FXSSVC.pdb
Static task
static1
Behavioral task
behavioral1
Sample
47031fd2d7db1400270ea14b0f3f1640_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
47031fd2d7db1400270ea14b0f3f1640_NeikiAnalytics.exe
-
Size
1.2MB
-
MD5
47031fd2d7db1400270ea14b0f3f1640
-
SHA1
3b3cc064209d0b8f29a8a9c40f5ab8dd17967df0
-
SHA256
fe99cf6ec8a18feb0f3b5813c7b065ac75432da0c6d464cc72b139bd37c42cd6
-
SHA512
1549f55128c3f1768951514f47dcae3fec3201cb10c352f69885f6dd302ca698a8049f47ebacb272968264820bb0ded45e1477c7833a1ef456c41bdb55263df0
-
SSDEEP
24576:QHgBr4Lrh/OyKGVDewWUZ2QZl2BlsRjhm0Ijr/eax8JXO02q3A:QH6EZ/Oy9qN22Qf2BlEjhMjSax84
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 47031fd2d7db1400270ea14b0f3f1640_NeikiAnalytics.exe
Files
-
47031fd2d7db1400270ea14b0f3f1640_NeikiAnalytics.exe.exe windows:10 windows x64 arch:x64
c24bad8157bbc60bc945224943c0d15c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
advapi32
TraceMessage
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
ConvertStringSidToSidW
RegCloseKey
RegDeleteValueW
EqualSid
RegOpenKeyExW
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
StartServiceCtrlDispatcherW
DestroyPrivateObjectSecurity
RegisterServiceCtrlHandlerW
SetServiceStatus
GetLengthSid
IsValidSid
LogonUserW
DuplicateToken
MapGenericMask
AccessCheckAndAuditAlarmW
RegCreateKeyExW
IsValidSecurityDescriptor
GetSecurityDescriptorControl
GetSecurityDescriptorLength
RegSetValueExW
MakeSelfRelativeSD
OpenProcessToken
CreatePrivateObjectSecurity
RegQueryValueExW
OpenThreadToken
GetTokenInformation
SetPrivateObjectSecurity
GetPrivateObjectSecurity
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteKeyW
ReportEventW
RegisterEventSourceW
CheckTokenMembership
PerfSetCounterRefValue
PerfStopProvider
PerfStartProviderEx
PerfCreateInstance
PerfSetCounterSetInfo
RegDeleteKeyExW
RevertToSelf
ImpersonateLoggedOnUser
SetSecurityDescriptorDacl
RegNotifyChangeKeyValue
GetSecurityDescriptorDacl
QueryServiceStatus
SetSecurityDescriptorOwner
CloseServiceHandle
OpenSCManagerW
AllocateAndInitializeSid
SetEntriesInAclW
ControlService
GetSecurityDescriptorOwner
EnumDependentServicesW
FreeSid
InitializeSecurityDescriptor
OpenServiceW
SetSecurityDescriptorGroup
RegEnumKeyW
LookupPrivilegeValueW
AdjustTokenPrivileges
CopySid
LookupAccountSidW
LookupAccountNameW
DeregisterEventSource
kernel32
DelayLoadFailureHook
ResolveDelayLoadedAPI
LoadLibraryExW
lstrlenA
MulDiv
GetModuleFileNameW
OpenEventW
GetTimeFormatW
EnumUILanguagesW
GetLocaleInfoEx
GetStringTypeExW
OutputDebugStringW
GetSystemDirectoryW
GetFileType
GetTempFileNameW
GetFileInformationByHandle
CreateFileW
GetTempPathW
GetDateFormatW
WideCharToMultiByte
MultiByteToWideChar
ExpandEnvironmentStringsW
CompareStringW
GetVersionExW
InitializeCriticalSectionAndSpinCount
HeapDestroy
SetWaitableTimer
CancelWaitableTimer
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
OutputDebugStringA
TerminateProcess
UnhandledExceptionFilter
GetStartupInfoW
GetLastError
LoadLibraryW
GetProcessHeap
HeapCreate
lstrcmpiW
GetProcAddress
SetLastError
FileTimeToSystemTime
UnmapViewOfFile
CloseHandle
FindFirstFileW
FindClose
LocalFree
GetSystemTimeAsFileTime
DeleteFileW
FindNextFileW
EnterCriticalSection
LeaveCriticalSection
SetEvent
WaitForMultipleObjects
WaitForSingleObject
CreateEventW
GetFileAttributesW
RemoveDirectoryW
CreateDirectoryW
CopyFileW
Sleep
VirtualFree
GetFileSize
WriteFile
ReadFile
PostQueuedCompletionStatus
LocalAlloc
CreateSemaphoreW
InitializeCriticalSection
HeapSetInformation
GetVersion
DeleteCriticalSection
SetErrorMode
SetUnhandledExceptionFilter
CreateThread
GetComputerNameW
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
GetFileSizeEx
FileTimeToLocalFileTime
lstrcmpW
ResetEvent
GetSystemTimeAdjustment
GetModuleHandleW
CreateWaitableTimerW
GetExitCodeThread
GetCurrentThread
HeapFree
GetCurrentProcess
HeapAlloc
ReleaseSemaphore
GetFullPathNameW
SetFilePointer
GetFileTime
GetSystemTime
MoveFileW
SystemTimeToFileTime
SetFileTime
FormatMessageW
GetLocalTime
SetThreadExecutionState
GetQueuedCompletionStatus
CreateIoCompletionPort
FreeLibrary
msvcrt
??0exception@@QEAA@AEBQEBD@Z
memmove
_wcsicmp
memmove_s
??0exception@@QEAA@AEBV0@@Z
?what@exception@@UEBAPEBDXZ
__CxxFrameHandler3
_wcsnicmp
swscanf
wcschr
realloc
wcsrchr
_vsnwprintf
iswalpha
memcmp
memcpy
memset
_wsplitpath_s
memcpy_s
__C_specific_handler
??1exception@@UEAA@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
_commode
_fmode
_wcmdln
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
_CxxThrowException
??0exception@@QEAA@AEBQEBDH@Z
malloc
free
_callnewh
_purecall
qsort
_ltow
wcsstr
_itow
wcsncmp
wcsspn
??0exception@@QEAA@XZ
swscanf_s
_wcsnset
wcscmp
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
shlwapi
SHCopyKeyW
ord487
rpcrt4
RpcRevertToSelfEx
RpcBindingServerFromClient
RpcStringBindingParseW
RpcBindingFree
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcStringFreeW
RpcBindingSetAuthInfoExW
NdrClientCall3
NdrServerCall2
NdrServerCallAll
I_RpcBindingIsClientLocal
RpcBindingToStringBindingW
RpcBindingSetOption
RpcBindingInqAuthClientW
RpcServerUseProtseqEpW
RpcServerRegisterIfEx
RpcServerRegisterAuthInfoW
RpcServerUnregisterIf
RpcServerListen
RpcMgmtStopServerListening
RpcServerUnregisterIfEx
RpcImpersonateClient
RpcRevertToSelf
RpcMgmtWaitServerListen
I_RpcExceptionFilter
tapi32
lineClose
lineShutdown
lineNegotiateAPIVersion
lineHandoffW
lineDeallocateCall
lineGetLineDevStatus
lineOpenW
lineSetStatusMessages
lineInitializeExW
lineSetAppPriorityW
lineTranslateAddressW
lineGetCountryW
lineGetCallInfoW
lineGetDevCapsW
gdi32
SaveDC
SelectObject
StartPage
PlayEnhMetaFile
SetEnhMetaFileBits
CreateDCW
SetWindowOrgEx
CreateRectRgnIndirect
GetEnhMetaFileHeader
SetWindowExtEx
DeleteEnhMetaFile
SetViewportExtEx
GetDeviceCaps
DeleteDC
SetTextColor
SetBkMode
SelectClipRgn
RestoreDC
LPtoDP
DeleteObject
SetMapMode
CreateFontIndirectW
StartDocW
EndPage
EndDoc
EnableEUDC
winspool.drv
EnumPrintersW
FindNextPrinterChangeNotification
FindFirstPrinterChangeNotification
FindClosePrinterChangeNotification
GetPrinterW
SetPrinterW
DocumentPropertiesW
ClosePrinter
OpenPrinterW
user32
DrawTextW
SendMessageW
FindWindowW
LoadStringW
ole32
IIDFromString
CLSIDFromString
CoUninitialize
CoInitializeEx
CoTaskMemFree
CoCreateInstance
OleRun
StringFromIID
FreePropVariantArray
StgOpenStorageEx
StringFromGUID2
oleaut32
GetErrorInfo
SysStringByteLen
SysAllocString
SysStringLen
VariantClear
SysFreeString
SysAllocStringByteLen
shell32
SHGetFolderPathAndSubDirW
SHGetFolderPathW
SHSetLocalizedName
crypt32
CryptUnprotectData
CryptProtectData
CryptHashMessage
credui
CredUIParseUserNameW
fxstiff
TiffRecoverGoodPages
TiffAddMsTags
MergeTiffFiles
TiffClose
TiffOpen
TiffPostProcessFast
FXSTIFFInitialize
TiffExtractFirstPage
GetMsTagFileTime
GetMsTagDwordLong
GetMsTagString
MemoryMapTiffFile
MmrAddBranding
ntdll
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlValidRelativeSecurityDescriptor
WinSqmIncrementDWORD
RtlIpv4StringToAddressExW
RtlIpv6StringToAddressExW
Sections
.text Size: 491KB - Virtual size: 491KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 96KB - Virtual size: 95KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 15KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 568KB - Virtual size: 572KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE