e:\DISK F\mtd\MTD2012\mtd2011\BINRELEASE\mtd.pdb
Static task
static1
Behavioral task
behavioral1
Sample
1fcdbe93414bd29d8ea4d3cc01c758c0_NeikiAnalytics.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
1fcdbe93414bd29d8ea4d3cc01c758c0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
1fcdbe93414bd29d8ea4d3cc01c758c0_NeikiAnalytics.exe
-
Size
341KB
-
MD5
1fcdbe93414bd29d8ea4d3cc01c758c0
-
SHA1
dd3271eec8a5f0f35a262629f53dc2fd70faddd9
-
SHA256
82ad8b45f329de81e149e79f1b3601b64354ac1e235ced4041af7d1fa5dfc335
-
SHA512
36f1655359b030c28f33c6f1e421854653d2db945a47762e0350b9abda3c9989945eca8280d2978659f53307ef976604d32d1b4d1d57ddac32e3c57cea53838a
-
SSDEEP
6144:k/qp6ItJHCwfyJ6Zlclu7Oi36Hcr1w/4guqa07:3HtJCwKJ6ZlL3r
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1fcdbe93414bd29d8ea4d3cc01c758c0_NeikiAnalytics.exe
Files
-
1fcdbe93414bd29d8ea4d3cc01c758c0_NeikiAnalytics.exe.exe windows:5 windows x86 arch:x86
80126f637e5d84f519f06f4a0820a24f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
libcurl
curl_global_cleanup
curl_easy_cleanup
curl_easy_strerror
curl_easy_perform
curl_easy_setopt
curl_slist_append
curl_version_info
curl_easy_init
curl_global_init
gdiplus
GdipReleaseDC
GdipGetDC
GdipResetPath
GdipFillPath
GdipGetPathGradientPointCount
GdipSetPathGradientSurroundColorsWithCount
GdipSetPathGradientCenterColor
GdipSetPathGradientCenterPointI
GdipCloneBrush
GdipAlloc
GdipFree
GdipDeleteBrush
GdipCreatePathGradientFromPath
GdipAddPathRectangleI
GdiplusStartup
GdipDeletePath
GdipAddPathPolygonI
GdipCreatePath
GdipDeleteGraphics
GdipCreateFromHDC
GdiplusShutdown
mfc90
ord2900
ord798
ord4727
ord3479
ord2495
ord2483
ord2364
ord1037
ord4516
ord712
ord464
ord2480
ord6527
ord3920
ord314
ord821
ord1607
ord4481
ord1603
ord4434
ord4409
ord6783
ord4159
ord6781
ord4733
ord2251
ord2206
ord6018
ord4165
ord1046
ord5533
ord6721
ord5813
ord4199
ord2087
ord3209
ord5657
ord5659
ord4333
ord4981
ord5663
ord5646
ord6001
ord3110
ord4890
ord3659
ord2447
ord1098
ord6793
ord6062
ord942
ord1555
ord781
ord580
ord793
ord589
ord4029
ord4952
ord1258
ord3730
ord2588
ord2327
ord3528
ord777
ord3643
ord4646
ord1720
ord2283
ord2568
ord2698
ord941
ord744
ord524
ord5753
ord3179
ord5520
ord663
ord404
ord2481
ord4617
ord2360
ord4993
ord3987
ord639
ord374
ord2672
ord6148
ord945
ord5924
ord4507
ord5615
ord5152
ord5309
ord2208
ord1810
ord1809
ord1678
ord3344
ord6388
ord1496
ord4650
ord4668
ord3506
ord5636
ord6291
ord4760
ord1062
ord6584
ord6740
ord3627
ord4529
ord2899
ord6559
ord1938
ord1108
ord5835
ord2691
ord899
ord4392
ord1611
ord305
ord3213
ord3579
ord300
ord266
ord265
ord6494
ord1252
ord817
ord820
ord310
ord1045
ord6760
ord6557
ord2069
ord1137
ord6170
ord6079
ord4116
ord4513
ord2263
ord2470
ord2587
ord6074
ord1358
ord1357
ord6048
ord3534
ord2106
ord316
ord601
ord2539
ord1183
ord3477
ord636
ord367
ord613
ord2592
ord337
ord4030
ord789
ord586
ord611
ord595
ord3480
ord4667
ord4895
ord4334
ord2886
ord800
ord3757
ord1276
ord1668
ord3346
ord6391
ord4057
ord4067
ord4066
ord2759
ord2888
ord2769
ord3135
ord2961
ord4714
ord3107
ord2978
ord2766
ord5633
ord1728
ord1791
ord1792
ord2139
ord5608
ord1446
ord3218
ord6356
ord5389
ord3671
ord6782
ord4160
ord6784
ord1644
ord2368
ord2375
ord2625
ord2607
ord2605
ord2623
ord2635
ord2612
ord2628
ord2633
ord2616
ord2618
ord2620
ord2614
ord2630
ord2610
ord969
ord965
ord967
ord963
ord958
ord5666
ord5668
ord6446
ord1729
ord4688
ord5139
ord3732
ord5647
ord4589
ord6780
ord5497
ord2074
ord5585
ord4638
ord1497
ord4331
ord1752
ord1755
msvcr90
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
?terminate@@YAXXZ
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
_invoke_watson
_controlfp_s
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
_ismbblead
sprintf
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABV01@@Z
_invalid_parameter_noinfo
_decode_pointer
_beginthreadex
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBD@Z
wcschr
_stricmp
_setmbcp
__CxxFrameHandler3
memcpy
memset
ceil
_mktime64
__argv
__argc
strrchr
_localtime64_s
_time64
_mbsstr
_splitpath
strncmp
isalnum
isprint
isspace
tolower
atoi
toupper
strstr
exit
malloc
sscanf
free
strncpy
_CxxThrowException
kernel32
GetVolumeInformationA
FindResourceA
LoadResource
LockResource
SizeofResource
WinExec
lstrlenA
lstrcatA
lstrcpyA
GetTempPathA
GetWindowsDirectoryA
GetModuleFileNameA
GetVersionExA
GetLastError
CreateProcessA
InterlockedCompareExchange
CloseHandle
WaitForSingleObject
ResetEvent
CreateEventA
SetEvent
GetPrivateProfileStringA
MultiByteToWideChar
WideCharToMultiByte
Sleep
QueryPerformanceCounter
QueryPerformanceFrequency
SetPriorityClass
GetCurrentProcess
GetPriorityClass
GetSystemInfo
ResumeThread
TerminateProcess
SetFileAttributesA
GetFileSize
ReadFile
GetTempFileNameA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
DeviceIoControl
GetStartupInfoA
InterlockedExchange
GetVersion
DeleteFileA
FreeLibrary
GlobalAlloc
GlobalFree
MulDiv
GlobalUnlock
GlobalLock
CreateFileA
user32
SetRectEmpty
IsRectEmpty
DrawStateA
GetIconInfo
LoadImageA
ReleaseCapture
InvalidateRect
UpdateWindow
PtInRect
SetCapture
SendMessageA
GetCursorPos
ScreenToClient
SetCursor
DrawFocusRect
LoadCursorA
SetTimer
BringWindowToTop
SetWindowRgn
PeekMessageA
TranslateMessage
DispatchMessageA
MessageBoxW
GetKeyState
KillTimer
MessageBoxA
IsWindow
SetWindowLongA
InflateRect
ReleaseDC
MessageBeep
SystemParametersInfoA
DrawTextW
OffsetRect
SetRect
FillRect
GetWindowLongA
GetFocus
GetCapture
WindowFromPoint
DrawEdge
ClientToScreen
GetNextDlgGroupItem
PostMessageA
GetSysColor
GetWindowRect
CopyRect
GetClientRect
GetParent
DestroyIcon
GetDC
EnableWindow
gdi32
SetStretchBltMode
SetDIBitsToDevice
CreateSolidBrush
DeleteDC
SelectObject
GetDeviceCaps
GetStockObject
CreateFontIndirectA
CreateEllipticRgn
GetTextExtentPoint32A
GetObjectA
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
DeleteObject
advapi32
RegQueryValueExA
RegQueryValueA
RegCloseKey
RegOpenKeyExA
shell32
ShellExecuteA
comctl32
_TrackMouseEvent
ole32
CoUninitialize
CoInitializeSecurity
CoInitialize
CoCreateInstance
CreateStreamOnHGlobal
oleaut32
OleLoadPicture
SystemTimeToVariantTime
VariantTimeToSystemTime
msvcp90
?uncaught_exception@std@@YA_NXZ
??$?6DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?ends@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
winmm
timeGetTime
Sections
.text Size: 102KB - Virtual size: 102KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 181KB - Virtual size: 180KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ