D:\DCB\CBT_Main\BuildResults\bin\Release\plug_ins\SendMail.pdb
Static task
static1
Behavioral task
behavioral1
Sample
9d8767b72e4e68d30d503258bcbd1a50_NeikiAnalytics.dll
Resource
win7-20240508-en
General
-
Target
9d8767b72e4e68d30d503258bcbd1a50_NeikiAnalytics.exe
-
Size
2.4MB
-
MD5
9d8767b72e4e68d30d503258bcbd1a50
-
SHA1
9b1d66e2a5353cfd50e3dadf643ee8172f011bb1
-
SHA256
ceb5eaae6019c0ef3a4baccafceb05b3bdcb1a6d5d161e3cb57a80a4dfc71a62
-
SHA512
5603ea8e0c2294b1ec84efccd07a5f6e40cda4989615094e71c3e9ef4c7017be8b82f4d4a72fed6646d6412f33a91052b72f3730a9f61519f171ae25a51dffce
-
SSDEEP
49152:31Rdn+D02tml5JZgGQIFPVnpToN0K0emNv0yDV8/JK:31R9+Dkl5JvnnpTomtDV8/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9d8767b72e4e68d30d503258bcbd1a50_NeikiAnalytics.exe
Files
-
9d8767b72e4e68d30d503258bcbd1a50_NeikiAnalytics.exe.dll windows:6 windows x86 arch:x86
cecb7412faf32c6fa0dc9dafb8bfb27f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
version
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
kernel32
DisconnectNamedPipe
SetNamedPipeHandleState
GetOverlappedResult
SetEvent
ResetEvent
CreateEventA
WaitForMultipleObjects
LocalFree
WaitNamedPipeA
SetCurrentDirectoryA
GetCurrentDirectoryA
DisableThreadLibraryCalls
GetFileSize
SetFilePointer
lstrcatA
MultiByteToWideChar
WideCharToMultiByte
Sleep
ExpandEnvironmentStringsA
GetModuleFileNameA
FreeResource
LoadResource
LockResource
SizeofResource
FindResourceA
lstrcpyA
FindAtomW
VirtualQuery
SystemTimeToFileTime
FindClose
FindFirstFileW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LocalAlloc
CreateSemaphoreA
GetCurrentProcess
GetCurrentThread
CreateProcessW
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
WaitForSingleObjectEx
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentThreadId
InitializeSListHead
OutputDebugStringW
CloseHandle
WriteFile
ReadFile
FlushFileBuffers
CreateFileA
GetCurrentProcessId
GetTickCount
GetSystemTime
DeleteCriticalSection
InitializeCriticalSectionEx
RaiseException
lstrlenA
LoadLibraryW
LoadLibraryA
GetProcAddress
GetModuleHandleW
GetModuleHandleA
GetModuleFileNameW
FreeLibrary
GetSystemDirectoryA
SetLastError
GetLastError
OutputDebugStringA
GetSystemInfo
VirtualProtect
LoadLibraryExA
SwitchToFiber
DeleteFiber
ReadConsoleW
CreateFiber
GetModuleHandleExW
FindNextFileW
GetStdHandle
GetEnvironmentVariableW
GetFileType
ConvertFiberToThread
ConvertThreadToFiber
GetConsoleMode
SetConsoleMode
ReadConsoleA
user32
IsWindowEnabled
EnableWindow
PeekMessageA
DispatchMessageA
TranslateMessage
SetPropW
GetProcessWindowStation
GetUserObjectInformationW
GetMessageA
MessageBoxW
GetParent
FindWindowA
GetPropW
GetFocus
SetFocus
MoveWindow
GetWindowRect
wsprintfA
advapi32
ReportEventW
RegisterEventSourceW
DeregisterEventSource
ConvertSidToStringSidA
GetTokenInformation
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
OpenThreadToken
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorA
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListA
ole32
CoCreateInstance
oleaut32
SysAllocString
SysFreeString
SafeArrayAccessData
SafeArrayDestroy
msvcp140
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?_BADOFF@std@@3_JB
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?uncaught_exception@std@@YA_NXZ
??Bid@locale@std@@QAEIXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_K@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?id@?$ctype@D@std@@2V0locale@2@A
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
vcruntime140
wcsstr
_purecall
memset
__std_type_info_destroy_list
_except_handler4_common
strstr
__std_exception_destroy
__std_exception_copy
strchr
strrchr
memchr
_CxxThrowException
memcmp
memmove
memcpy
__std_terminate
__CxxFrameHandler3
api-ms-win-crt-string-l1-1-0
strcspn
_strnicmp
strtok_s
strpbrk
tolower
strlen
strncpy
strcmp
wcslen
isalpha
wcscat_s
strncmp
_stricmp
isspace
isdigit
strspn
wcsncpy_s
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
__stdio_common_vsnwprintf_s
__stdio_common_vsprintf_s
fputs
__stdio_common_vsnprintf_s
__stdio_common_vswscanf
fopen
fclose
_wfopen
__stdio_common_vsscanf
__stdio_common_vfprintf
__acrt_iob_func
__stdio_common_vswprintf
_setmode
fwrite
ftell
fseek
fread
_fileno
fgets
fflush
feof
ferror
api-ms-win-crt-runtime-l1-1-0
_seh_filter_dll
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_initterm_e
_set_invalid_parameter_handler
signal
_configure_narrow_argv
_invalid_parameter_noinfo
_errno
raise
_initialize_narrow_environment
strerror_s
_cexit
_initterm
_crt_atexit
_invalid_parameter_noinfo_noreturn
_exit
api-ms-win-crt-convert-l1-1-0
atoi
strtol
strtoul
_itoa_s
_wtoi
wcstombs_s
api-ms-win-crt-math-l1-1-0
floor
_except1
api-ms-win-crt-heap-l1-1-0
_callnewh
free
malloc
realloc
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-multibyte-l1-1-0
_mbsstr
_mbstowcs_s_l
api-ms-win-crt-locale-l1-1-0
_free_locale
_create_locale
api-ms-win-crt-filesystem-l1-1-0
_stat64i32
api-ms-win-crt-time-l1-1-0
_gmtime64
_gmtime64_s
_localtime64
_time64
api-ms-win-crt-utility-l1-1-0
qsort
Exports
Exports
?ASstrcpy_safe@@YAPADPADPBD@Z
PlugInMain
SendExec
Sections
.text Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 459KB - Virtual size: 459KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 19KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.didat Size: 512B - Virtual size: 124B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 54KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 374KB - Virtual size: 376KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ