D:\builds\build-sourcemod-msvc12\windows-1.11\OUTPUT\core\sourcemod.2.tf2\sourcemod.2.tf2.pdb
Static task
static1
Behavioral task
behavioral1
Sample
8024f894a77c57dfb1e5663e6ea15f6c3b120c604bb86cfa785332396419257b_NeikiAnalytics.dll
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
8024f894a77c57dfb1e5663e6ea15f6c3b120c604bb86cfa785332396419257b_NeikiAnalytics.dll
Resource
win10v2004-20240508-en
General
-
Target
8024f894a77c57dfb1e5663e6ea15f6c3b120c604bb86cfa785332396419257b_NeikiAnalytics.exe
-
Size
482KB
-
MD5
11f8e8668dac94cd5990e562d1e58a00
-
SHA1
3bba12b38e820cb53367236bcc728a1c43e06122
-
SHA256
8024f894a77c57dfb1e5663e6ea15f6c3b120c604bb86cfa785332396419257b
-
SHA512
50ceee775f1e5b4b945a4debabafd079550d6d24595c7dbf8db65efdb6d8d99237c4d48c505c4199c803312f52d4aae63eb00c9d383ecf4d8b3b2f014911e757
-
SSDEEP
12288:/yVdo9lsIQT76eNI5B7l0JiSjGiKtAy9:KVgGjeHnSj+h
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8024f894a77c57dfb1e5663e6ea15f6c3b120c604bb86cfa785332396419257b_NeikiAnalytics.exe
Files
-
8024f894a77c57dfb1e5663e6ea15f6c3b120c604bb86cfa785332396419257b_NeikiAnalytics.exe.dll windows:5 windows x86 arch:x86
12699dc7a7056ff6b91e598f4c5a0553
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
FreeLibrary
GetProcAddress
GetLastError
FormatMessageA
LoadLibraryA
GetFileAttributesA
ReadConsoleW
ReadFile
SetEndOfFile
SetFilePointerEx
HeapReAlloc
HeapSize
CreateFileW
GetConsoleMode
GetConsoleCP
FlushFileBuffers
SetStdHandle
CreateDirectoryW
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
GetCurrentThreadId
MultiByteToWideChar
WideCharToMultiByte
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
CloseHandle
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
EncodePointer
RtlUnwind
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
RaiseException
InterlockedFlushSList
SetLastError
GetStdHandle
GetFileType
GetModuleFileNameA
GetModuleHandleExW
WriteConsoleW
ExitProcess
HeapFree
HeapAlloc
GetACP
GetStringTypeW
LCMapStringW
WriteFile
DecodePointer
FindClose
FindFirstFileExA
FindNextFileA
tier0
MemAllocScratch
AssertValidStringPtr
_AssertValidWritePtr
_AssertValidReadPtr
g_VProfCurrentProfile
?OutputReport@CVProfile@@QAEXHPBDH@Z
?Pause@CVProfile@@QAEXXZ
?ExitScope@CVProfile@@QAEXXZ
?EnterScope@CVProfile@@QAEXPBDH0_NH@Z
?ExitScope@CVProfNode@@QAE_NXZ
?EnterScope@CVProfNode@@QAEXXZ
?Resume@CVProfNode@@QAEXXZ
g_pMemAlloc
Warning
GetSpewOutputFunc
SpewOutputFunc
MemFreeScratch
DevMsg
?DevMsg@@YAXPBDZZ
vstdlib
RandomFloat
RandomInt
KeyValuesSystem
RandomSeed
Exports
Exports
CreateInterface
cvar
Sections
.text Size: 347KB - Virtual size: 346KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 95KB - Virtual size: 95KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 14KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 240B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 856B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ