D:\anthill3\var\jobs\projects\31077_314047\infra_ecl\standalone\win64\DiagClientInfod.pdb
Static task
static1
Behavioral task
behavioral1
Sample
df19ba575b35dcaf6d24081ffb4a0610_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
df19ba575b35dcaf6d24081ffb4a0610_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
df19ba575b35dcaf6d24081ffb4a0610_NeikiAnalytics.exe
-
Size
1.9MB
-
MD5
df19ba575b35dcaf6d24081ffb4a0610
-
SHA1
6bf40e97367d063ec087d7b00354c2c278ecc9e7
-
SHA256
89072a138740e3ac536b82e6f5b2eb3dc5de275a1e97e4c11c1cd9f92c277b54
-
SHA512
ef057f14afac8b8768f75f690fdf35381e5841f2bc98195d4a0cab106cae610fee20ef02e48653390e021c647d322662e7d4870a55f32eb73c4980c923f04580
-
SSDEEP
24576:zoh9kluoBxgXBCuHHa+aXtrod/xXZdYDJzucPYqAUKC/OsjEvtpr1+Et/1xqPKaL:Aa+amZySqADALELr0EpOKakc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource df19ba575b35dcaf6d24081ffb4a0610_NeikiAnalytics.exe
Files
-
df19ba575b35dcaf6d24081ffb4a0610_NeikiAnalytics.exe.exe windows:6 windows x64 arch:x64
d65ad9def686dbc9945b79d36da169df
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
GetCurrentProcessId
GetCurrentThread
ExitThread
CreateProcessA
GetThreadContext
OpenProcess
FreeLibrary
GetModuleFileNameA
GetModuleHandleA
GetCurrentProcess
LoadLibraryA
GetStartupInfoA
QueryDosDeviceA
K32EnumProcesses
K32EnumProcessModules
K32GetModuleBaseNameA
QueryPerformanceCounter
QueryPerformanceFrequency
Sleep
GetLastError
SetUnhandledExceptionFilter
CloseHandle
CheckRemoteDebuggerPresent
WaitForDebugEvent
ContinueDebugEvent
IsDebuggerPresent
CreateDirectoryA
GetProcAddress
FlushConsoleInputBuffer
LoadLibraryW
GlobalMemoryStatus
GetTickCount
WriteFile
GetFileType
GetStdHandle
GetModuleHandleW
GetModuleFileNameW
VirtualQuery
GetProcessHeap
HeapFree
HeapAlloc
WideCharToMultiByte
MultiByteToWideChar
LoadLibraryExW
RaiseException
GetSystemTimeAsFileTime
GetCurrentThreadId
IsProcessorFeaturePresent
DecodePointer
EncodePointer
GetCommandLineA
user32
GetProcessWindowStation
MessageBoxW
ReleaseDC
GetWindowThreadProcessId
GetShellWindow
GetDC
GetUserObjectInformationW
advapi32
RegisterEventSourceW
ReportEventW
GetUserNameA
DeregisterEventSource
shell32
SHGetFolderPathA
msvcp120d
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??Bid@locale@std@@QEAA_KXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?in@?$codecvt@DDH@std@@QEBAHAEAHPEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDH@std@@QEBAHAEAHPEBD1AEAPEBDPEAD3AEAPEAD@Z
?unshift@?$codecvt@DDH@std@@QEBAHAEAHPEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDH@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?_BADOFF@std@@3_JB
?id@?$codecvt@DDH@std@@2V0locale@2@A
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getpfirst@_Container_base12@std@@QEBAPEAPEAU_Iterator_base12@2@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
?_Swap_all@_Container_base12@std@@QEAAXAEAU12@@Z
??2@YAPEAX_KAEBU_DebugHeapTag_t@std@@PEADH@Z
??3@YAXPEAXAEBU_DebugHeapTag_t@std@@PEADH@Z
?_DebugHeapTag_func@std@@YAAEBU_DebugHeapTag_t@1@XZ
??0_Container_base12@std@@QEAA@XZ
?_Debug_message@std@@YAXPEB_W0I@Z
?_Orphan_all@_Container_base12@std@@QEAAXXZ
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
??0id@locale@std@@QEAA@_K@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Winerror_map@std@@YAPEBDH@Z
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?uncaught_exception@std@@YA_NXZ
?good@ios_base@std@@QEBA_NXZ
?flags@ios_base@std@@QEBAHXZ
?width@ios_base@std@@QEBA_JXZ
?width@ios_base@std@@QEAA_J_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??1_Container_base12@std@@QEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
msvcr120d
_CrtDbgReportW
__iob_func
fflush
fgetc
malloc
fprintf
fputc
fsetpos
_fseeki64
fwrite
setvbuf
ungetc
_lock_file
_unlock_file
_errno
memchr
memcmp
memcpy_s
strcpy
strcat
strcmp
strerror
strncmp
strrchr
strstr
??0bad_cast@std@@QEAA@PEBD@Z
_stat64i32
_access
_mkdir
??0bad_cast@std@@QEAA@AEBV01@@Z
free
??1bad_cast@std@@UEAA@XZ
clock
_strnicmp
_putenv
_strdup
_strlwr
_chdir
_lock
_unlock
_calloc_dbg
__dllonexit
__C_specific_handler
_onexit
__crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
__crtCaptureCurrentContext
__crtCapturePreviousContext
_XcptFilter
_amsg_exit
__getmainargs
__set_app_type
_CrtSetCheckCount
_exit
_cexit
_configthreadlocale
__setusermatherr
_initterm_e
_initterm
__initenv
_fmode
_commode
_CRT_RTC_INITW
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
__crtSetUnhandledExceptionFilter
wcscpy_s
_wmakepath_s
_wsplitpath_s
getenv
exit
sprintf
rewind
printf
ftell
fseek
fread
fopen
fclose
_invalid_parameter
?what@exception@std@@UEBAPEBDXZ
??1exception@std@@UEAA@XZ
??0exception@std@@QEAA@AEBQEBD@Z
memset
wcsstr
_vsnprintf
_vsnwprintf
raise
feof
ferror
fgets
_fileno
_wfopen
_setmode
isdigit
strchr
strncpy
isspace
isalnum
realloc
_lrotl
_lrotr
qsort
_localtime64
_time64
isxdigit
atoi
sscanf
isupper
tolower
strtol
strtoul
_stricmp
_gmtime64
signal
fputs
_getch
__CxxFrameHandler3
_CxxThrowException
memmove
strlen
memcpy
_hypot
??3@YAXPEAX@Z
??2@YAPEAX_K@Z
_purecall
??0exception@std@@QEAA@AEBV01@@Z
fgetpos
gdi32
DeleteObject
CreateCompatibleBitmap
GetDeviceCaps
GetDIBits
GetObjectW
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 273KB - Virtual size: 273KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 195KB - Virtual size: 210KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 54KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 180KB - Virtual size: 180KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ