P:\intermoutput\3\360UCenter\Release\360UDetail.pdb
Static task
static1
Behavioral task
behavioral1
Sample
00a6af19933f055bdad5f93cc0616ac0_NeikiAnalytics.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
00a6af19933f055bdad5f93cc0616ac0_NeikiAnalytics.dll
Resource
win10v2004-20240426-en
General
-
Target
00a6af19933f055bdad5f93cc0616ac0_NeikiAnalytics.exe
-
Size
1.1MB
-
MD5
00a6af19933f055bdad5f93cc0616ac0
-
SHA1
63877559ea0e20a96d6d4a6b125863eff2ba4d85
-
SHA256
8a9eeb6d116ae553ca81d74e77cb86ec3eeee69b8b4eb757f4be77c7b7ade156
-
SHA512
ce6f033089c9310aa0fb8f8bf047a85ca401494c7b332efa8b4161370e3bf86205aeb9f63b1aef861114038c87ece343daaf818f31ff3477c8a2ba00e0f0b090
-
SSDEEP
24576:OGbET7Tj/GsKn3xNc2eb/+kNeC3DKU8Ik7/fnO:OGb8SsKBNcnNea+UhU/fnO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 00a6af19933f055bdad5f93cc0616ac0_NeikiAnalytics.exe
Files
-
00a6af19933f055bdad5f93cc0616ac0_NeikiAnalytics.exe.dll windows:5 windows x86 arch:x86
8a96d5d9f980f36bc3530668032d5127
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
wininet
InternetSetCookieW
kernel32
CopyFileW
CreateProcessW
GlobalFree
WriteFile
GetTempPathW
GetTickCount
GetTempFileNameW
FindClose
FindFirstFileW
FindNextFileW
GetFileSize
Sleep
RaiseException
GetFileAttributesW
SetEnvironmentVariableA
CompareStringW
CompareStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetStringTypeW
GetStringTypeA
LCMapStringA
GetLocaleInfoA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
FlushFileBuffers
GetStartupInfoA
GetFileType
SetHandleCount
GetConsoleMode
GetConsoleCP
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetPrivateProfileIntW
InitializeCriticalSectionAndSpinCount
GetModuleFileNameA
GetStdHandle
HeapCreate
GetCommandLineA
ExitThread
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
ExitProcess
RtlUnwind
TlsFree
TlsAlloc
ReleaseMutex
OpenThread
TlsSetValue
SetEnvironmentVariableW
TlsGetValue
CreateMutexW
GetEnvironmentVariableW
GetSystemTime
LocalFree
FormatMessageW
OutputDebugStringW
GetFileSizeEx
SetFilePointerEx
SetEndOfFile
LocalFileTimeToFileTime
GetSystemTimeAsFileTime
SystemTimeToFileTime
CreateFileA
lstrlenA
HeapSize
HeapReAlloc
HeapDestroy
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
IsBadWritePtr
GlobalAlloc
GlobalLock
GlobalUnlock
lstrcmpW
WaitForMultipleObjects
TerminateThread
ResumeThread
SuspendThread
SetEvent
WaitForSingleObject
InterlockedExchange
WideCharToMultiByte
CreateThread
GetCurrentDirectoryW
SetCurrentDirectoryW
lstrcpynW
GetVersionExW
SetLastError
MulDiv
DeleteFileW
GetCurrentProcess
FlushInstructionCache
FindResourceExW
LockResource
GetModuleFileNameW
EnterCriticalSection
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
MultiByteToWideChar
lstrcmpiW
GetModuleHandleW
InterlockedDecrement
InterlockedIncrement
lstrlenW
GetProcAddress
FreeLibrary
GetCurrentThreadId
CreateEventW
GetLastError
ReadFile
SetFilePointer
GetCurrentProcessId
CreateFileW
DeviceIoControl
CloseHandle
LoadLibraryW
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
GetModuleHandleA
user32
SetWindowPos
MoveWindow
SetWindowTextW
GetWindowLongW
SetWindowLongW
ShowWindow
BringWindowToTop
DestroyWindow
CharNextW
UnregisterClassA
GetActiveWindow
GetClientRect
SendMessageW
MessageBoxW
MapWindowPoints
ReleaseCapture
SetTimer
KillTimer
GetDlgItem
wsprintfW
SendMessageTimeoutW
GetMonitorInfoW
MonitorFromWindow
GetWindowRect
GetWindow
IntersectRect
InflateRect
GetWindowDC
TrackMouseEvent
IsIconic
UpdateLayeredWindow
GetCursorPos
SetCursor
EqualRect
IsRectEmpty
DisableProcessWindowsGhosting
PtInRect
ScrollWindow
OffsetRect
SetRectEmpty
CopyRect
GetWindowTextLengthW
GetWindowTextW
CreateAcceleratorTableW
DestroyAcceleratorTable
GetDesktopWindow
FillRect
GetParent
GetClassNameW
SetCapture
InvalidateRgn
ReleaseDC
GetDC
ScreenToClient
ClientToScreen
GetSysColor
CallWindowProcW
DefWindowProcW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
PostQuitMessage
GetFocus
IsDialogMessageW
IsChild
SetFocus
PostMessageW
RegisterWindowMessageW
SetDlgItemTextW
UpdateWindow
EndPaint
BeginPaint
DrawTextW
SetRect
FindWindowW
GetSystemMetrics
LoadImageW
CreateDialogParamW
RegisterClassExW
RedrawWindow
IsWindowVisible
InvalidateRect
CreateWindowExW
EnableWindow
LoadCursorW
GetClassInfoExW
IsWindow
gdi32
GetPixel
SetPixel
SetStretchBltMode
StretchBlt
Rectangle
CreatePen
CreateDCW
GetDIBits
GetTextExtentPoint32W
GetBitmapBits
CreateFontIndirectW
SetBkColor
CreateDIBSection
SetViewportOrgEx
GetStockObject
GetObjectW
GetDeviceCaps
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
SetTextColor
SelectObject
CreateSolidBrush
DeleteDC
SetBkMode
DeleteObject
ExtTextOutW
SetBitmapBits
RealizePalette
SelectPalette
comdlg32
GetSaveFileNameW
GetOpenFileNameW
advapi32
RegQueryValueExA
RegDeleteKeyW
RegQueryValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
shell32
ShellExecuteW
ole32
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree
StringFromGUID2
OleLockRunning
CoGetClassObject
CLSIDFromProgID
CLSIDFromString
CreateStreamOnHGlobal
OleInitialize
OleUninitialize
CoUninitialize
CoInitializeEx
CoInitialize
oleaut32
SysStringByteLen
SysAllocStringByteLen
SafeArrayGetLBound
SafeArrayGetUBound
OleCreateFontIndirect
LoadTypeLi
LoadRegTypeLi
SafeArrayCreate
SafeArrayAccessData
SafeArrayUnaccessData
DispCallFunc
SysAllocString
SysAllocStringLen
VarUI4FromStr
VariantInit
VariantClear
SysFreeString
SysStringLen
VariantChangeType
shlwapi
SHSetValueW
ord176
PathAppendW
PathFindFileNameW
PathIsDirectoryW
PathIsRelativeW
PathRemoveFileSpecW
PathCombineW
PathFileExistsW
SHGetValueW
comctl32
_TrackMouseEvent
msimg32
TransparentBlt
AlphaBlend
Exports
Exports
??0CxExifInfo@CxImageJPG@@QAE@PAUtag_ExifInfo@1@@Z
??0CxFile@@QAE@ABV0@@Z
??0CxFile@@QAE@XZ
??0CxIOFile@@QAE@ABV0@@Z
??0CxIOFile@@QAE@PAU_iobuf@@@Z
??0CxMemFile@@QAE@ABV0@@Z
??0CxMemFile@@QAE@PAEK@Z
??1CxExifInfo@CxImageJPG@@QAE@XZ
??1CxFile@@UAE@XZ
??1CxIOFile@@UAE@XZ
??1CxMemFile@@UAE@XZ
??4CxExifInfo@CxImageJPG@@QAEAAV01@ABV01@@Z
??4CxFile@@QAEAAV0@ABV0@@Z
??4CxIOFile@@QAEAAV0@ABV0@@Z
??4CxMemFile@@QAEAAV0@ABV0@@Z
??_7CxFile@@6B@
??_7CxIOFile@@6B@
??_7CxMemFile@@6B@
??_FCxExifInfo@CxImageJPG@@QAEXXZ
??_FCxIOFile@@QAEXXZ
??_FCxMemFile@@QAEXXZ
?Alloc@CxMemFile@@IAE_NK@Z
?Close@CxIOFile@@UAE_NXZ
?Close@CxMemFile@@UAE_NXZ
?ConvertAnyFormat@CxExifInfo@CxImageJPG@@IAENPAXH@Z
?DecodeExif@CxExifInfo@CxImageJPG@@QAE_NPAVCxFile@@H@Z
?DiscardAllButExif@CxExifInfo@CxImageJPG@@QAEXXZ
?EncodeExif@CxExifInfo@CxImageJPG@@QAE_NPAVCxFile@@@Z
?Eof@CxIOFile@@UAE_NXZ
?Eof@CxMemFile@@UAE_NXZ
?Error@CxIOFile@@UAEJXZ
?Error@CxMemFile@@UAEJXZ
?FindSection@CxExifInfo@CxImageJPG@@IAEPAXH@Z
?Flush@CxIOFile@@UAE_NXZ
?Flush@CxMemFile@@UAE_NXZ
?Free@CxMemFile@@IAEXXZ
?Get16m@CxExifInfo@CxImageJPG@@IAEHPAX@Z
?Get16u@CxExifInfo@CxImageJPG@@IAEHPAX@Z
?Get32s@CxExifInfo@CxImageJPG@@IAEJPAX@Z
?Get32u@CxExifInfo@CxImageJPG@@IAEKPAX@Z
?GetBuffer@CxMemFile@@QAEPAE_N@Z
?GetC@CxIOFile@@UAEJXZ
?GetC@CxMemFile@@UAEJXZ
?GetS@CxIOFile@@UAEPADPADH@Z
?GetS@CxMemFile@@UAEPADPADH@Z
?Open@CxIOFile@@QAE_NPB_W0@Z
?Open@CxMemFile@@QAE_NXZ
?ProcessExifDir@CxExifInfo@CxImageJPG@@IAE_NPAE0IQAUtag_ExifInfo@2@QAPAEH@Z
?PutC@CxFile@@UAE_NE@Z
?PutC@CxIOFile@@UAE_NE@Z
?PutC@CxMemFile@@UAE_NE@Z
?Read@CxIOFile@@UAEIPAXII@Z
?Read@CxMemFile@@UAEIPAXII@Z
?Scanf@CxIOFile@@UAEJPBDPAX@Z
?Scanf@CxMemFile@@UAEJPBDPAX@Z
?Seek@CxIOFile@@UAE_NJH@Z
?Seek@CxMemFile@@UAE_NJH@Z
?Size@CxIOFile@@UAEJXZ
?Size@CxMemFile@@UAEJXZ
?Tell@CxIOFile@@UAEJXZ
?Tell@CxMemFile@@UAEJXZ
?Write@CxIOFile@@UAEIPBXII@Z
?Write@CxMemFile@@UAEIPBXII@Z
?process_COM@CxExifInfo@CxImageJPG@@IAEXPBEH@Z
?process_EXIF@CxExifInfo@CxImageJPG@@IAE_NPAEI@Z
?process_SOFn@CxExifInfo@CxImageJPG@@IAEXPBEH@Z
CreateInterface
Sections
.text Size: 577KB - Virtual size: 576KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 105KB - Virtual size: 105KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 68KB - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 328KB - Virtual size: 328KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 41KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ