d:\Office\Source\groove\bin\ReleaseSym\DRAT.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2c209fd16ed603ba9484853f4d4942a0_NeikiAnalytics.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
2c209fd16ed603ba9484853f4d4942a0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
2c209fd16ed603ba9484853f4d4942a0_NeikiAnalytics.exe
-
Size
789KB
-
MD5
2c209fd16ed603ba9484853f4d4942a0
-
SHA1
343bff544ba8352beed65dcc6b89d14005776bd3
-
SHA256
06d5b51ba499a8722f93be3e05b362b48a2230b19632466d8d9cb8d6bd8abf36
-
SHA512
1efe903ade8533b609a0101718e1baaa1a7f96bdfbe7c6ce9646a697813cec8822bceb69cdf5c4e2793d3f7c0323140a3250e7eceddc708946b3b4fb220829a4
-
SSDEEP
12288:Af+94HcZYAMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:A6SpSkQ/7Gb8NLEbeZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2c209fd16ed603ba9484853f4d4942a0_NeikiAnalytics.exe
Files
-
2c209fd16ed603ba9484853f4d4942a0_NeikiAnalytics.exe.exe windows:4 windows x86 arch:x86
988aefaa709d592451f1efd698fe20a5
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
comctl32
InitCommonControlsEx
kernel32
EnterCriticalSection
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
FlushFileBuffers
CreateFileA
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetDriveTypeA
GetCurrentDirectoryA
MultiByteToWideChar
GetOEMCP
GetACP
GetCPInfo
GetConsoleMode
GetConsoleCP
SetFilePointer
RtlUnwind
GetFileType
SetHandleCount
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleFileNameA
GetStdHandle
WriteFile
ExitProcess
HeapSize
GetProcAddress
GetProcessHeap
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
VirtualProtect
InterlockedIncrement
InitializeCriticalSection
InterlockedDecrement
GetModuleHandleW
GetCurrentThreadId
SetEvent
CloseHandle
CreateEventW
AddAtomW
DeleteCriticalSection
FindFirstFileW
FindClose
FindNextFileW
RaiseException
SetLastError
FlushInstructionCache
GetCurrentProcess
lstrlenW
LeaveCriticalSection
GetModuleHandleA
InterlockedExchange
GetLastError
LocalAlloc
FreeLibrary
LoadLibraryA
GetVersionExA
InterlockedCompareExchange
HeapFree
HeapAlloc
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
HeapReAlloc
GetFullPathNameW
GetCommandLineA
GetStartupInfoA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapDestroy
HeapCreate
Sleep
user32
LoadImageW
RegisterWindowMessageW
GetClassNameW
PostMessageW
GetDlgItem
ShowWindow
GetWindow
SetFocus
SendMessageW
EnableWindow
GetDC
ReleaseDC
SetWindowTextW
PostQuitMessage
LoadBitmapW
MessageBoxW
IsDialogMessageW
DestroyWindow
GetWindowPlacement
SetWindowPlacement
SetCursor
CreateDialogParamW
LoadCursorW
SetWindowLongW
SetDlgItemTextW
GetWindowTextLengthW
GetWindowTextW
IsWindow
UpdateWindow
GetMessageW
TranslateMessage
DispatchMessageW
PostThreadMessageW
UnregisterClassA
gdi32
DeleteDC
CreateCompatibleDC
GetTextExtentPoint32W
comdlg32
CommDlgExtendedError
GetOpenFileNameW
shell32
SHBrowseForFolderW
SHGetMalloc
SHGetPathFromIDListW
ole32
OleUninitialize
OleInitialize
CoCreateInstance
groovenew
?GrooveNew@@YAPAXI@Z
?GrooveDelete@@YAXPAX@Z
grooveutil
??0GCSmartExceptionFilter@@QAE@_N@Z
?Uninit@GCMso@@SGX_N@Z
?Init@GCMso@@SGXXZ
??1GCSmartInvalidParameterHandler@@QAE@XZ
??0GCSmartInvalidParameterHandler@@QAE@_N@Z
??1GCSmartTerminateHandler@@QAE@XZ
??0GCSmartTerminateHandler@@QAE@_N@Z
??1GCSmartExceptionTranslator@@UAE@XZ
??0GCSmartExceptionTranslator@@QAE@_N0@Z
?InitThread@GCMso@@SGXXZ
?Initialize@GCErrorServices@@SGXJJ@Z
?HandleAllErrorCatch@@YGXXZ
?Append@GCStackStrBase@@QAEX_W@Z
?ms_GlobalPointersInitializationSemaphore@GCUtilDLL@@2VGCReentrantSemaphore@@A
?FindOneOf@raw_GCStr@@SG_NPB_W0AAKPA_W@Z
?First@raw_GCStr@@SG?AVGCStrRetVal@@PB_WK@Z
?Format@GCStr@@QAAJPB_WZZ
?AllocateHashTable@@YGPAXK@Z
?ToPowerOf2@@YGKK@Z
?Compare@GCStr@@QBEJPB_W@Z
?Hash@@YGKPBEKK@Z
?DeallocateHashTable@@YGXPAXK@Z
?SetFromResource@GCStackStrBase@@QAEXKQAUHINSTANCE__@@@Z
?CompareNoCase@raw_GCStr@@SGJPB_W0@Z
?CreateInstanceNoRelease@GCIPtrBase@@IAEXABU_GUID@@0K@Z
?QueryInterfaceNoRelease@GCIPtrBase@@IAEXABU_GUID@@PAUIUnknown@@@Z
??1GCSmartExceptionFilter@@QAE@XZ
?int_RawError@GCError@@CG?AV1@KJ@Z
?LongToString@raw_GCStr@@SGXJPAVGCStackStrBase@@J@Z
??0GCStr@@QAE@PB_W@Z
?MessageFormat@GCStackStrBase@@QAEJKQB_W000ABVGCLocale@@QAUHINSTANCE__@@@Z
??1GCLocale@@QAE@XZ
?GetDefault@GCLocale@@SG?BV1@XZ
?_Release@GCStr@@AAEXXZ
?Equals@GCStr@@QBE_NPB_W@Z
?Set@GCStr@@QAEXPB_W@Z
?int_Win32Error@GCError@@CG?AV1@KK@Z
?int_DeallocateBufferIfNecessary@GCStackStrBase@@AAEXAAPA_W@Z
?Append@GCStackStrBase@@QAEXQB_WK@Z
?Equals@raw_GCStr@@SG_NPB_W0@Z
?Last@raw_GCStr@@SGXPB_WKPAVGCStackStrBase@@@Z
?Length@raw_GCStr@@SGKABVGCStackStrBase@@@Z
?SetFromResource@GCStr@@QAEXKQAUHINSTANCE__@@@Z
?GetWorkAreaRect@GCWindowHelpers@@SG_NAAUtagRECT@@_NQAUHWND__@@PBU2@PBUtagPOINT@@@Z
?FindLastChar@raw_GCStr@@SG_NPB_W_WAAK@Z
?GetBrandedApplicationName@GCMso@@SGPB_WXZ
?GetHandle@GCGrooveResourceModule@@SGPAUHINSTANCE__@@XZ
?Set@GCStackStrBase@@QAEXQB_WK@Z
?HandleMessageMapErrorCatch@@YGXKIJ@Z
?Empty@GCIPtrBase@@QAEXXZ
??1GCError@@QAE@XZ
??0GCError@@QAE@XZ
?Set@GCError@@QAEXJPAUIUnknown@@ABU_GUID@@@Z
?int_COMError@GCError@@CG?AV1@JPAUIUnknown@@ABU_GUID@@11@Z
?EndErrorBlock@GCCriticalErrorInfo@@SGXXZ
?StartErrorBlock@GCCriticalErrorInfo@@SGX_N@Z
?InitCOM@GCMso@@SGXXZ
?UninitCOM@GCMso@@SGXXZ
?HandleAllCriticalErrorCatch@@YGXXZ
?TraceShutDown@GCCSM@@SGXXZ
?TerminateGrooveProcess@GCError@@SGXPBV1@K_NJPBU_EXCEPTION_POINTERS@@@Z
??1GCAnyIPtr@@QAE@XZ
?Append@GCStr@@QAEXPB_W@Z
?Set@GCErrorInfo@@SGXPAUIErrorInfo@@@Z
?Throw@GCError@@QBEXXZ
atl80
ord44
ord64
ord43
Sections
.text Size: 94KB - Virtual size: 94KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 648KB - Virtual size: 652KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE