D:\adwsf\axa\I Follow You\x64\Release\I Follow You.pdb
Static task
static1
Behavioral task
behavioral1
Sample
23e48e66e83a6f7510297a2162ddb588a4051a005f2acd72f55266bbf4b5c738_NeikiAnalytics.dll
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
23e48e66e83a6f7510297a2162ddb588a4051a005f2acd72f55266bbf4b5c738_NeikiAnalytics.dll
Resource
win10v2004-20240611-en
General
-
Target
23e48e66e83a6f7510297a2162ddb588a4051a005f2acd72f55266bbf4b5c738_NeikiAnalytics.exe
-
Size
2.2MB
-
MD5
9dd391dfe4daa7fc9413ceae15300b30
-
SHA1
c2395c9886c7aea7db7f95403ddcb1c64f3a505d
-
SHA256
23e48e66e83a6f7510297a2162ddb588a4051a005f2acd72f55266bbf4b5c738
-
SHA512
60c83c6c3cdd3daf36bcf0bba42e964552abd8c959523fabf444060552e59b257499d47ed23fc8acacceb2d2fde99cbf2893cda8279dd81598b8e86bf052c4a8
-
SSDEEP
49152:HkRciBfPMEvA2LhzPQcYurtF2BHU+ytDJmBlSF:E9r
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 23e48e66e83a6f7510297a2162ddb588a4051a005f2acd72f55266bbf4b5c738_NeikiAnalytics.exe
Files
-
23e48e66e83a6f7510297a2162ddb588a4051a005f2acd72f55266bbf4b5c738_NeikiAnalytics.exe.dll windows:6 windows x64 arch:x64
85f47e6ecf29e6a77afdefee95948a73
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
FindNextFileA
CreatePipe
FindClose
LocalAlloc
FreeLibraryAndExitThread
GetModuleHandleA
OpenProcess
CreateToolhelp32Snapshot
GetTempPathA
CopyFileA
GetLastError
GetFileAttributesA
CreateFileA
FileTimeToSystemTime
LoadLibraryA
DeleteFileA
GlobalAlloc
Process32Next
GlobalFree
CloseHandle
CreateThread
HeapAlloc
GetLocalTime
GetProcAddress
LocalFree
GetFileSize
ExitProcess
GetProcessHeap
FreeLibrary
SystemTimeToTzSpecificLocalTime
CreateProcessA
CreateDirectoryA
GetProcessTimes
IsDebuggerPresent
CheckRemoteDebuggerPresent
MultiByteToWideChar
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
EnterCriticalSection
GetFullPathNameW
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
LeaveCriticalSection
TerminateProcess
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateMutexW
WaitForSingleObject
CreateFileW
GetFileAttributesW
GetCurrentThreadId
UnmapViewOfFile
HeapValidate
HeapSize
Sleep
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
WaitForSingleObjectEx
DeleteFileW
HeapReAlloc
RaiseException
GetSystemInfo
LoadLibraryW
HeapCompact
HeapDestroy
UnlockFile
LockFileEx
DeleteCriticalSection
GetCurrentProcessId
SystemTimeToFileTime
WideCharToMultiByte
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
InitializeSListHead
SleepConditionVariableSRW
WakeAllConditionVariable
DeviceIoControl
WriteFile
GetCurrentProcess
HeapFree
FindFirstFileA
Process32First
GetFileSizeEx
GetModuleFileNameA
InitializeCriticalSection
ReadFile
GetLocaleInfoEx
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileInformationByHandleEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
user32
MessageBoxA
ReleaseDC
GetDC
gdi32
BitBlt
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
GetDIBits
GetDeviceCaps
DeleteDC
DeleteObject
GetObjectA
msvcp140
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
?good@ios_base@std@@QEBA_NXZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?tolower@?$ctype@D@std@@QEBADD@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
??Bid@locale@std@@QEAA_KXZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
_Strcoll
?_Syserror_map@std@@YAPEBDH@Z
?id@?$collate@D@std@@2V0locale@2@A
?_Xlength_error@std@@YAXPEBD@Z
?id@?$ctype@D@std@@2V0locale@2@A
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Winerror_map@std@@YAHH@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?uncaught_exceptions@std@@YAHXZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
_Strxfrm
winhttp
WinHttpConnect
WinHttpReadData
WinHttpOpen
WinHttpReceiveResponse
WinHttpQueryDataAvailable
WinHttpCloseHandle
WinHttpSendRequest
WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpWriteData
WinHttpQueryHeaders
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception
memcmp
memcpy
memmove
__std_type_info_destroy_list
memset
strchr
__std_exception_destroy
memchr
__C_specific_handler
__std_terminate
_CxxThrowException
__current_exception_context
strrchr
__std_exception_copy
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
exit
_cexit
_errno
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
terminate
abort
_invalid_parameter_noinfo_noreturn
_endthreadex
_beginthreadex
api-ms-win-crt-heap-l1-1-0
free
realloc
_msize
_callnewh
malloc
api-ms-win-crt-convert-l1-1-0
strtoll
api-ms-win-crt-stdio-l1-1-0
fflush
_wfopen_s
fclose
_fseeki64
fread
_ftelli64
__stdio_common_vsprintf_s
fwrite
_wfreopen_s
api-ms-win-crt-string-l1-1-0
strncmp
isspace
isalnum
strcmp
strspn
strcspn
api-ms-win-crt-multibyte-l1-1-0
_mbsicmp
api-ms-win-crt-environment-l1-1-0
_dupenv_s
api-ms-win-crt-filesystem-l1-1-0
_wstat64
api-ms-win-crt-time-l1-1-0
_time64
_localtime64_s
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-math-l1-1-0
ceilf
Exports
Exports
DF109
DllMain
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 983KB - Virtual size: 982KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 53KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ