\\cpbufs\transfer\aataneja\ReaderPOC\ReaderSolution\ReaderPOC\Release\ReaderPOC.pdb
Static task
static1
Behavioral task
behavioral1
Sample
1a77fa470266696e8968d0d84d7957e0_NeikiAnalytics.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
1a77fa470266696e8968d0d84d7957e0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
1a77fa470266696e8968d0d84d7957e0_NeikiAnalytics.exe
-
Size
1.3MB
-
MD5
1a77fa470266696e8968d0d84d7957e0
-
SHA1
ce8c560a353380279504b9789ef99edef0ebcf48
-
SHA256
110aeafcee56a9c950023bfe3c23e1bb54c6d769fdfa15badf795f237e433467
-
SHA512
101a49638cb39a3d1f4f9a5d4ed2ca39286d6e5ef38a32ab5fbf2af521fcb39937d484fb844217d0384b7d973e082e81682fee0dcbf10fd30854d8581c6ec04c
-
SSDEEP
24576:d2zEYytjjqNSlhvpfQiIhKPtehfQwM9qySkbgedDUYxH5nczaKg+aTTsdVbqd0wT:dPtjtQiIhUyQj1SkFdDxxH5wNaTT7VT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1a77fa470266696e8968d0d84d7957e0_NeikiAnalytics.exe
Files
-
1a77fa470266696e8968d0d84d7957e0_NeikiAnalytics.exe.exe windows:6 windows x86 arch:x86
99779933d13e7f3a0c46176caa0baa44
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
msi
ord205
ord70
kernel32
CreateFileMappingA
GetProcAddress
UnlockFile
HeapDestroy
HeapCompact
HeapAlloc
LoadLibraryW
GetSystemInfo
CloseHandle
HeapReAlloc
DeleteFileW
DeleteFileA
GetVersionExA
LoadLibraryA
CreateFileA
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
FormatMessageW
GetTempPathA
Sleep
MultiByteToWideChar
HeapSize
HeapValidate
UnmapViewOfFile
GetVersionExW
GetFileAttributesW
CreateFileW
WaitForSingleObject
CreateMutexW
GetTempPathW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
LocalFree
HeapFree
HeapCreate
ReadFile
AreFileApisANSI
InterlockedCompareExchange
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionEx
RaiseException
DecodePointer
FindNextFileW
GetModuleFileNameW
FindClose
GetCurrentProcess
CreateEventW
GetModuleHandleW
TlsSetValue
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
LockFileEx
GetFileSize
GetCurrentProcessId
GetProcessHeap
SystemTimeToFileTime
FreeLibrary
WideCharToMultiByte
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
TlsGetValue
GetTickCount
FlushFileBuffers
GetLastError
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
WriteConsoleW
TlsFree
EncodePointer
GetFullPathNameW
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetConsoleCP
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeZoneInformation
ReadConsoleW
GetConsoleMode
SetFilePointerEx
GetFileSizeEx
GetFileType
GetModuleHandleExW
ExitProcess
GetStdHandle
LoadLibraryExW
TlsAlloc
SwitchToThread
InitializeCriticalSectionAndSpinCount
SetLastError
GetStringTypeW
LCMapStringW
GetLocaleInfoW
GetCPInfo
UnhandledExceptionFilter
RtlUnwind
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetCurrentThreadId
WaitForSingleObjectEx
ResetEvent
SetEvent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
CompareStringW
advapi32
OpenServiceW
OpenSCManagerW
CloseServiceHandle
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
shell32
SHGetFolderPathW
SHCreateDirectoryExW
SHGetFolderPathAndSubDirW
SHGetPathFromIDListW
SHGetFolderLocation
SHGetSpecialFolderPathW
ole32
CoTaskMemFree
CoCreateInstance
CoCreateGuid
CLSIDFromString
CLSIDFromProgID
CoUninitialize
CoInitialize
StringFromGUID2
OleRun
oleaut32
SysAllocString
SysFreeString
VariantClear
VariantCopy
GetErrorInfo
VariantInit
shlwapi
PathFileExistsA
PathAppendW
PathFileExistsW
PathIsDirectoryW
Sections
.text Size: 606KB - Virtual size: 606KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 133KB - Virtual size: 132KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 588KB - Virtual size: 592KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE