t:\cag\x86\ship\0\mstore.pdb
Static task
static1
Behavioral task
behavioral1
Sample
3e0af2d4c9b787cbd051a1e89a7c8390_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
3e0af2d4c9b787cbd051a1e89a7c8390_NeikiAnalytics.exe
-
Size
703KB
-
MD5
3e0af2d4c9b787cbd051a1e89a7c8390
-
SHA1
2c34a6873f10a2cfd5b68671ba47829e5616a43c
-
SHA256
5397d94b322df39b14159a2508e9725899ff65aaa4c9b95d5854770bc6f5cf59
-
SHA512
dde6d3c1e3263e7af3d22ac12b1bc84064bf6dc2d701366039b0c85b44e186189327ada75827cce931a0172f637aaf823cfccd41d0418b529cea0ea5f5281039
-
SSDEEP
12288:GCKHJx523hmKGVlM41NTnXENcMduaD3aawgPwCnQ3MHv8CI4OJ1bbPHHcFb+KKqC:GCK4YRVldlnXfH9gPwCn7vOb7HHcp/CB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 3e0af2d4c9b787cbd051a1e89a7c8390_NeikiAnalytics.exe
Files
-
3e0af2d4c9b787cbd051a1e89a7c8390_NeikiAnalytics.exe.exe windows:4 windows x86 arch:x86
c6ca57d8b4ca36e8ffb0550836159034
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
msvcr80
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_controlfp_s
_invoke_watson
_crt_debugger_hook
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
_except_handler4_common
?terminate@@YAXXZ
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
fopen_s
fwprintf_s
fclose
vsprintf_s
wcscpy_s
vswprintf_s
__CxxFrameHandler3
_wtoi
malloc
free
memcpy_s
_CxxThrowException
wcsncpy_s
_recalloc
_vsnwprintf
swscanf_s
wcsrchr
memset
kernel32
GetStartupInfoW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
LocalAlloc
InterlockedCompareExchange
HeapAlloc
HeapFree
GetTempPathA
GetTempFileNameA
CreateProcessA
GetProcessHeap
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
VirtualProtect
FormatMessageA
LocalFree
GetSystemDirectoryW
GetVersionExA
GetThreadLocale
GetLocaleInfoA
InterlockedExchange
GetCommandLineW
ExitProcess
GetTickCount
LoadLibraryA
GetACP
LoadLibraryExW
FindResourceW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetFileAttributesW
GetVersion
RaiseException
CloseHandle
WaitForSingleObject
InitializeCriticalSection
DeleteCriticalSection
LoadLibraryW
GetLastError
SetLastError
GetModuleFileNameW
OutputDebugStringA
SetEvent
CreateThread
CreateEventW
GetCurrentThreadId
AddAtomW
SetErrorMode
FreeLibrary
Sleep
lstrlenW
lstrcmpiW
MultiByteToWideChar
SizeofResource
LoadResource
user32
DestroyIcon
GetSystemMetrics
GetAsyncKeyState
GetParent
LoadCursorW
LoadCursorA
GetClassNameW
EnableWindow
SystemParametersInfoW
PostQuitMessage
KillTimer
IsIconic
GetWindowRect
OffsetRect
SetTimer
GetWindowPlacement
SetWindowPos
DispatchMessageW
GetCursorPos
DestroyWindow
FillRect
BeginPaint
IsWindow
MessageBoxW
UnregisterClassA
MessageBoxA
ShowWindow
UpdateWindow
LoadAcceleratorsW
PeekMessageW
WaitMessage
TranslateAcceleratorW
TranslateMessage
RegisterClassExW
SendMessageW
GetMessageW
PostThreadMessageW
RegisterWindowMessageW
MoveWindow
GetClientRect
SendMessageA
GetWindowLongW
SetWindowLongW
SetFocus
GetFocus
MessageBeep
SetRect
CharNextW
EndPaint
LoadIconW
SetCursor
advapi32
RegQueryInfoKeyW
RegOpenKeyExA
RegQueryValueExA
RegQueryValueExW
RegEnumKeyExW
RegDeleteKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
ole32
OleUninitialize
CoRegisterMessageFilter
OleGetClipboard
OleFlushClipboard
OleSetClipboard
RegisterDragDrop
RevokeDragDrop
StringFromGUID2
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoRegisterClassObject
CoRevokeClassObject
CoCreateInstance
oleaut32
SysFreeString
VariantClear
SafeArrayDestroy
SysAllocString
SysStringLen
SysAllocStringLen
VarUI4FromStr
Sections
.text Size: 108KB - Virtual size: 107KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 576KB - Virtual size: 580KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE