c:\jenkins\workspace\Client\Client\Windows\release\Bin\X64\Release\ZoomOutlookIMPlugin.pdb
Static task
static1
Behavioral task
behavioral1
Sample
1f2f03bd598de962d4016b400ae8a8a0_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
1f2f03bd598de962d4016b400ae8a8a0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
1f2f03bd598de962d4016b400ae8a8a0_NeikiAnalytics.exe
-
Size
1.2MB
-
MD5
1f2f03bd598de962d4016b400ae8a8a0
-
SHA1
d6b307c1a0c24f94e70ad5cc1192ff7b992a9283
-
SHA256
336d62a08ee116c14b19371eaa0cd03f91af489f26c5b84897e9efd1ee468c85
-
SHA512
fdc6259ae5a438359a34eb1dc40267e20336fbfae0b5ea8f4f12574e6bbb14bbe57b0681a511b1d7732b83666928b56a584c0f5dfabd47f5950d1bb7452c00b4
-
SSDEEP
12288:YJi2k+aoLoFJV4x4j6XaJRiN+MTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:Wi2xaosFdCacSkQ/7Gb8NLEbeZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1f2f03bd598de962d4016b400ae8a8a0_NeikiAnalytics.exe
Files
-
1f2f03bd598de962d4016b400ae8a8a0_NeikiAnalytics.exe.exe windows:6 windows x64 arch:x64
4163f554b9e9357481d85d6228b02422
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
cmmlib
?IsExists@CFileName@Cmm@@QEBAHXZ
??1CFileName@Cmm@@UEAA@XZ
??_7CFileName@Cmm@@6B@
?cmm_str_convert@@YA_KHPEA_W_KPEBD1@Z
?cmm_str_convert@@YA_KHPEAD_KPEB_W1@Z
?_cstring_set@Cmm@@YAXAEAV?$CStringT@D@1@_KPEB_W1@Z
?length@?$CStringT@D@Cmm@@QEBA_KXZ
??0?$CStringT@D@Cmm@@QEAA@XZ
??0?$CStringT@D@Cmm@@QEAA@PEBD@Z
??1?$CStringT@D@Cmm@@UEAA@XZ
?c_str@?$CStringT@D@Cmm@@QEBAPEBDXZ
?GetBuffer@?$CStringT@D@Cmm@@QEAAPEAD_K@Z
?SetLength@?$CStringT@D@Cmm@@QEAAX_K@Z
?GetBuffer@?$CStringT@_W@Cmm@@QEAAPEA_W_K@Z
?SetLength@?$CStringT@_W@Cmm@@QEAAX_K@Z
?InSeconds@TimeDelta@Cmm@@QEBA_JXZ
?Now@Time@Cmm@@SA?AV12@XZ
??0CCmmArchiveObjHelper@Cmm@@QEAA@PEBD@Z
??1CCmmArchiveObjHelper@Cmm@@QEAA@XZ
?FlatternToMsg@CCmmMessageHelper@Cmm@@YAPEAVCmmMQ_Msg@2@PEAVCCmmArchiveObjHelper@2@H@Z
??0CCritical@Cmm@@QEAA@XZ
??1CCritical@Cmm@@QEAA@XZ
?Lock@CCritical@Cmm@@QEAAXXZ
?Unlock@CCritical@Cmm@@QEAAXXZ
?GetImp@CCmmArchiveServiceImp@Archive@Cmm@@SAAEAV123@XZ
?AddPackageDefine0@CCmmArchiveServiceImp@Archive@Cmm@@QEAAHPEBD@Z
?ParseMsg@?$CmmMessageTemplate_1@V?$CStringT@D@Cmm@@@Archive@Cmm@@UEAAHPEBVCmmMQ_Msg@3@@Z
?SetItem1@?$CmmMessageTemplate_1@V?$CStringT@D@Cmm@@@Archive@Cmm@@QEAAXAEBV?$CStringT@D@3@@Z
?GetItem1@?$CmmMessageTemplate_1@V?$CStringT@D@Cmm@@@Archive@Cmm@@QEAAAEAV?$CStringT@D@3@XZ
?SetItem2@?$CmmMessageTemplate_2@V?$CStringT@D@Cmm@@V12@@Archive@Cmm@@QEAAXAEBV?$CStringT@D@3@@Z
?GetItem2@?$CmmMessageTemplate_2@V?$CStringT@D@Cmm@@V12@@Archive@Cmm@@QEAAAEAV?$CStringT@D@3@XZ
?GetItem2@?$CmmMessageTemplate_2@V?$CStringT@D@Cmm@@H@Archive@Cmm@@QEAAAEAHXZ
?GetItem3@?$CmmMessageTemplate_3@V?$CStringT@D@Cmm@@HV12@@Archive@Cmm@@QEAAAEAV?$CStringT@D@3@XZ
?GetItem4@?$CmmMessageTemplate_4@V?$CStringT@D@Cmm@@HV12@V12@@Archive@Cmm@@QEAAAEAV?$CStringT@D@3@XZ
??0CSBMBMessage_Outlook_IMIntegration_GetContactInfo_Request@@QEAA@XZ
??1CSBMBMessage_Outlook_IMIntegration_GetContactInfo_Request@@UEAA@XZ
??0CSBMBMessage_Outlook_IMIntegration_GetContactInfo_Response@@QEAA@XZ
??1CSBMBMessage_Outlook_IMIntegration_GetContactInfo_Response@@UEAA@XZ
?ReadReg@CRegistryHelper@@SAHPEAUHKEY__@@PEB_W1PEAKK@Z
??1CSBMBMessage_Outlook_IMIntegration_StartVideo_Request@@UEAA@XZ
??0CSBMBMessage_Outlook_IMIntegration_StartChat_Request@@QEAA@XZ
??1CSBMBMessage_Outlook_IMIntegration_StartChat_Request@@UEAA@XZ
??0CSBMBMessage_Outlook_IMIntegration_StartAudio_Request@@QEAA@XZ
??1CSBMBMessage_Outlook_IMIntegration_StartAudio_Request@@UEAA@XZ
??0CSBMBMessage_Outlook_IMIntegration_SelfEmail_Response@@QEAA@XZ
??1CSBMBMessage_Outlook_IMIntegration_SelfEmail_Response@@UEAA@XZ
??0CSBMBMessage_Outlook_IMIntegration_PhotoChanged_Notification@@QEAA@XZ
??1CSBMBMessage_Outlook_IMIntegration_PhotoChanged_Notification@@UEAA@XZ
?DeleteValue@CRegistryHelper@@SAHPEAUHKEY__@@PEB_W1K@Z
??0Listener@Channel@ssb_ipc@@QEAA@XZ
??0CIPCChannelThread@ssb_ipc@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4ChannelMode@1@PEAVListener@Channel@1@H@Z
??1CIPCChannelThread@ssb_ipc@@UEAA@XZ
?IsServerGood@CIPCChannelThread@ssb_ipc@@QEAAHXZ
?Start@CIPCChannelThread@ssb_ipc@@QEAAHXZ
?Stop@CIPCChannelThread@ssb_ipc@@QEAAHXZ
?SendMessageW@CIPCChannelThread@ssb_ipc@@QEAAHPEAVCmmMQ_Msg@Cmm@@@Z
?GenChannelName@CIPCChannelThread@ssb_ipc@@SAXAEBV?$CStringT@_W@Cmm@@IAEAV34@@Z
?OnChannelDisconnected@Listener@Channel@ssb_ipc@@UEAAXH@Z
?ThreadProc@CIPCChannelThread@ssb_ipc@@UEAAIXZ
??H?$CStringT@_W@Cmm@@QEBA?AV01@AEBV01@@Z
?find@?$CStringT@_W@Cmm@@QEBA_K_W_K@Z
?substr@?$CStringT@_W@Cmm@@QEBA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_K0@Z
??A?$CStringT@_W@Cmm@@QEBA_W_K@Z
?Find@?$CStringT@_W@Cmm@@QEBAPEA_WPEB_W_K@Z
?Replace@?$CStringT@_W@Cmm@@QEAAXPEB_W0@Z
??0CFileName@Cmm@@QEAA@XZ
?GetSpecialDirectory@CFileName@Cmm@@QEAAXW4SpecialFolder@12@H@Z
??0CmmCryptoUtil@@QEAA@XZ
??1CmmCryptoUtil@@UEAA@XZ
?WriteReg@CRegistryHelper@@SAHPEAUHKEY__@@PEB_W1AEBV?$CStringT@_W@Cmm@@K@Z
?ReadReg@CRegistryHelper@@SAHPEAUHKEY__@@PEB_W1AEAV?$CStringT@_W@Cmm@@K@Z
?Mid@?$CStringT@_W@Cmm@@QEBA?AV?$CRangeT@PEB_W@2@_K0@Z
?IsEmpty@?$CStringT@_W@Cmm@@QEBAHXZ
?CompareNoCase@?$CStringT@_W@Cmm@@QEBAHPEB_W@Z
?Compare@?$CStringT@_W@Cmm@@QEBAHAEBV12@@Z
?Compare@?$CStringT@_W@Cmm@@QEBAHPEB_W@Z
?Format@?$CStringT@_W@Cmm@@QEAAXPEB_WZZ
??Y?$CStringT@_W@Cmm@@QEAAAEAV01@AEBV01@@Z
??Y?$CStringT@_W@Cmm@@QEAAAEAV01@PEB_W@Z
??4?$CStringT@_W@Cmm@@QEAAAEAV01@V?$CRangeT@PEB_W@1@@Z
??4?$CStringT@_W@Cmm@@QEAAAEAV01@$$QEAV01@@Z
??4?$CStringT@_W@Cmm@@QEAAAEAV01@AEBV01@@Z
??4?$CStringT@_W@Cmm@@QEAAAEAV01@PEB_W@Z
??0?$CStringT@_W@Cmm@@QEAA@PEB_W@Z
??H?$CStringT@_W@Cmm@@QEBA?AV01@PEB_W@Z
??0?$CStringT@_W@Cmm@@QEAA@$$QEAV01@@Z
??0?$CStringT@_W@Cmm@@QEAA@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
??0?$CStringT@_W@Cmm@@QEAA@AEBV01@@Z
??0?$CStringT@_W@Cmm@@QEAA@XZ
?length@?$CStringT@_W@Cmm@@QEBA_KXZ
??1Listener@Channel@ssb_ipc@@UEAA@XZ
?WriteReg@CRegistryHelper@@SAHPEAUHKEY__@@PEB_W1KK@Z
?find@?$CStringT@_W@Cmm@@QEBA_KPEB_W_K@Z
?c_str@?$CStringT@_W@Cmm@@QEBAPEB_WXZ
??1?$CStringT@_W@Cmm@@UEAA@XZ
??0CSBMBMessage_Outlook_IMIntegration_StartVideo_Request@@QEAA@XZ
kernel32
ExitProcess
CreateFileW
GetFileSize
ReadFile
SetLastError
GetCurrentThreadId
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
GetCommandLineW
HeapAlloc
HeapFree
GetProcessHeap
SetEvent
CreateMutexW
CreateEventW
Sleep
CreateThread
OpenProcess
VirtualProtect
ReleaseSemaphore
WriteFile
TerminateProcess
WaitForMultipleObjects
InitializeCriticalSection
SetFilePointer
ResumeThread
GetModuleHandleA
CreateToolhelp32Snapshot
Process32NextW
CreateFileA
Process32FirstW
GetWindowsDirectoryW
VerSetConditionMask
CreateSemaphoreW
FlushInstructionCache
VerifyVersionInfoW
CreateDirectoryA
SetDllDirectoryW
VirtualQuery
FlushFileBuffers
CreateDirectoryW
SetErrorMode
GetPrivateProfileStringW
DeleteFileW
GetTempFileNameW
ProcessIdToSessionId
LocalFree
GetCurrentProcessId
GetBinaryTypeW
GetSystemDirectoryW
GetProcessId
LoadLibraryExA
VirtualFree
VirtualAlloc
InterlockedPushEntrySList
InterlockedPopEntrySList
EncodePointer
OutputDebugStringW
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
WaitForSingleObjectEx
ResetEvent
InitializeCriticalSectionAndSpinCount
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetExitCodeProcess
GetCurrentProcess
WaitForSingleObject
CloseHandle
FindFirstFileW
FindClose
MultiByteToWideChar
lstrcmpiW
SizeofResource
LoadResource
LoadLibraryExW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
FreeLibrary
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
GetLastError
RaiseException
DecodePointer
FindResourceW
user32
SetTimer
DestroyWindow
IsWindow
CreateWindowExW
GetClassInfoExW
RegisterClassExW
CallWindowProcW
PostQuitMessage
PeekMessageW
SetWindowLongPtrW
GetClassInfoW
RegisterClassW
DefWindowProcW
UnregisterClassW
CharNextW
KillTimer
MessageBoxW
CharUpperW
PostThreadMessageW
DispatchMessageW
TranslateMessage
GetWindowLongPtrW
LoadCursorW
GetMessageW
GetUserObjectInformationA
GetProcessWindowStation
advapi32
LookupAccountNameW
ConvertSidToStringSidW
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegQueryValueExW
OpenProcessToken
AllocateAndInitializeSid
CreateRestrictedToken
CreateWellKnownSid
DuplicateTokenEx
FreeSid
GetTokenInformation
ImpersonateLoggedOnUser
RevertToSelf
SetTokenInformation
RegGetValueW
shell32
SHGetSpecialFolderPathW
ShellExecuteExW
SHGetSpecialFolderPathA
ole32
StringFromGUID2
CoInitialize
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoUninitialize
CLSIDFromProgID
CoResumeClassObjects
CreateStreamOnHGlobal
CoRegisterClassObject
CoRevokeClassObject
CoAddRefServerProcess
CoReleaseServerProcess
CoCreateInstance
oleaut32
RegisterTypeLi
VariantCopyInd
VariantInit
SafeArrayRedim
SafeArrayCreate
SysAllocStringByteLen
SysStringByteLen
VariantCopy
VariantClear
SafeArrayGetLBound
SafeArrayGetUBound
SysAllocString
LoadRegTypeLi
LoadTypeLi
VarUI4FromStr
SafeArrayGetVartype
SafeArrayCopy
SafeArrayUnlock
SafeArrayLock
SafeArrayDestroy
SysStringLen
SysFreeString
UnRegisterTypeLi
msvcp140
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?_Xbad_function_call@std@@YAXXZ
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
_Wcscoll
_Wcsxfrm
??0_Locinfo@std@@QEAA@PEBD@Z
??1_Locinfo@std@@QEAA@XZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
??Bid@locale@std@@QEAA_KXZ
??0facet@locale@std@@IEAA@_K@Z
??1facet@locale@std@@MEAA@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?is@?$ctype@_W@std@@QEBA_NF_W@Z
?tolower@?$ctype@_W@std@@QEBA_W_W@Z
?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?id@?$ctype@_W@std@@2V0locale@2@A
?id@?$collate@_W@std@@2V0locale@2@A
?uncaught_exception@std@@YA_NXZ
shlwapi
PathCombineW
PathIsRelativeW
PathAppendW
PathFileExistsW
PathRemoveFileSpecW
psapi
GetModuleFileNameExW
EnumProcessModules
GetModuleInformation
wintrust
WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
WTHelperGetProvCertFromChain
WinVerifyTrust
crypt32
CertGetNameStringW
wtsapi32
WTSFreeMemory
WTSQuerySessionInformationW
vcruntime140
__std_terminate
strchr
__std_exception_copy
__std_exception_destroy
_CxxThrowException
memcpy
memmove
memset
_purecall
wcsstr
memcmp
__C_specific_handler
__current_exception_context
__current_exception
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
terminate
_initialize_onexit_table
_errno
_crt_atexit
_cexit
_seh_filter_exe
_set_app_type
_invalid_parameter_noinfo
_invalid_parameter_noinfo_noreturn
_initialize_wide_environment
_get_wide_winmain_command_line
_initterm
_initterm_e
exit
_exit
_resetstkoflw
_c_exit
_register_thread_local_exe_atexit_callback
_register_onexit_function
_configure_wide_argv
api-ms-win-crt-heap-l1-1-0
malloc
calloc
free
realloc
_set_new_mode
_callnewh
_recalloc
api-ms-win-crt-string-l1-1-0
_wcsicmp
towupper
wcsncpy_s
strcat_s
towlower
wcsnlen
wcscpy_s
wcscat_s
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
__stdio_common_vswprintf_s
api-ms-win-crt-filesystem-l1-1-0
_wstat64i32
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
zcrashreport64
ord7
Sections
.text Size: 211KB - Virtual size: 211KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 152KB - Virtual size: 151KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 52KB - Virtual size: 55KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 192KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 572KB - Virtual size: 576KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE