D:\a\php-ftw\php-ftw\php\vs16\x64\obj\Release\phpdbg.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2560ae00ad4379c3c316e9fe7ef38aa585bb51d1b53b784f0afaa9044da9349e_NeikiAnalytics.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
2560ae00ad4379c3c316e9fe7ef38aa585bb51d1b53b784f0afaa9044da9349e_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
2560ae00ad4379c3c316e9fe7ef38aa585bb51d1b53b784f0afaa9044da9349e_NeikiAnalytics.exe
-
Size
241KB
-
MD5
399b2d58951ac375e0c8b00a67917b40
-
SHA1
94770f3d00fc5aacbd5c3fa5c3f3711e97b9c543
-
SHA256
2560ae00ad4379c3c316e9fe7ef38aa585bb51d1b53b784f0afaa9044da9349e
-
SHA512
b9f8bfd11cecaef1c670ff52592b043e36e21fbda6daecfcb468944847bfc18337a348d33c88f4aab051d3e80cd2dbe2e861575534cb36461389555289d4a1ae
-
SSDEEP
6144:UoYA7ghuerM0r2HlqUHAmsSOu864K2TxO2GpCjf1pvi:ulhuaM0KFZHd4nfnq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2560ae00ad4379c3c316e9fe7ef38aa585bb51d1b53b784f0afaa9044da9349e_NeikiAnalytics.exe
Files
-
2560ae00ad4379c3c316e9fe7ef38aa585bb51d1b53b784f0afaa9044da9349e_NeikiAnalytics.exe.exe windows:6 windows x64 arch:x64
21058bff249c563b4556ad29d4ba3a46
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
php8
zend_mm_set_heap
zend_hash_update@@24
zend_hash_next_index_insert@@16
zend_hash_apply@@16
zend_print_zval
zend_is_auto_global
zend_rsrc_list_get_rsrc_type
zend_get_type_by_const
zend_stream_fixup
zend_message_dispatcher
zend_get_executed_scope
zend_is_executing
zend_compile_file
ap_php_vasprintf
gettimeofday
zend_str_tolower_copy@@24
zend_dump_op_array
zend_dump_op_line
zend_llist_apply
gc_possible_root@@8
zval_ptr_dtor
zend_stream_init_filename
zend_destroy_file_handle
php_win32_error_to_msg
php_win32_error_msg_free
php_win32_ioutil_fopen_w
zend_print_zval_r
zval_get_long_func@@16
zend_objects_store_del@@8
function_add_ref
zend_user_exception_handler
zend_exception_restore
zend_throw_exception_internal
zend_get_exception_base
zend_clear_exception
zend_exception_error
zend_is_unwind_exit
zend_vm_call_opcode_handler@@8
zend_generator_check_placeholder_frame
zend_alter_ini_entry
zend_generator_update_root
execute_ex
zend_eval_stringl
zend_timeout@@0
zend_next_free_module
zend_register_module_ex
zend_startup_module_ex
zend_update_property_string
zend_read_property_ex
add_next_index_long
add_next_index_string
add_next_index_stringl
zend_call_function
zend_call_known_function
popen
pclose
zend_ini_string_ex
virtual_chdir_file
php_build_argv
zend_append_version_info
zend_register_extension
php_stream_open_for_zend_ex
zend_empty_string
module_registry
zend_ce_generator
zend_extensions
zend_memory_peak_usage
_zend_handle_numeric_str_ex@@24
instanceof_function_slow@@16
zend_is_auto_global_str
zend_lookup_class
zend_fetch_class_by_name
expand_filepath
php_addcslashes
_ecalloc@@16
zend_hash_index_add_empty_element@@16
zend_print_flat_zval_r
zend_long_to_str@@8
zend_write
_php_stream_get_url_stream_wrappers_hash
_php_stream_open_wrapper_ex
_php_stream_fopen_from_fd
_php_stream_set_option
_php_stream_free
php_stream_context_get_option
php_output_write
php_output_deactivate
php_output_activate
zend_argument_value_error
zend_wrong_parameters_none_error@@0
zend_parse_parameters
zend_get_executed_lineno
zend_get_executed_filename
zend_function_dtor
destroy_op_array
zend_objects_store_mark_destructed@@8
zend_is_true@@8
zval_get_string_func@@8
convert_to_long@@8
get_zend_version
zend_strpprintf
_zend_bailout
php_win32_ioutil_stat_ex_w
php_win32_ioutil_normalize_path_w
php_win32_cp_conv_ascii_to_w
php_win32_cp_conv_cur_to_w
php_win32_cp_conv_utf8_to_w
php_win32_cp_conv_to_w
php_win32_cp_get_by_id
php_win32_cp_use_unicode
php_win32_code_to_errno
_zend_new_array@@8
zend_hash_index_find@@16
zend_hash_str_find@@24
zend_hash_find@@16
zend_hash_del@@16
zend_hash_add_empty_element@@16
zend_hash_index_update@@24
zend_hash_index_add_new@@24
zend_hash_add_new@@24
zend_memory_usage
zend_hash_clean@@8
zend_hash_destroy@@8
_zend_hash_init@@32
zend_mm_get_custom_handlers
is_zend_mm
zend_spprintf
output_globals
zend_known_strings
smart_str_realloc@@16
smart_str_erealloc@@16
zend_generator_freeze_call_stack
zend_generator_restore_call_stack
zend_fetch_debug_backtrace
php_printf
rc_dtor_func@@8
zend_hash_internal_pointer_reset_ex@@16
zend_hash_move_forward_ex@@16
ap_php_asprintf
_erealloc@@16
zend_compile_string
php_addcslashes_str
tsrm_realpath
_php_stream_stat_path
zend_rebuild_symbol_table
zend_execute
zend_get_opcode_name@@8
zend_string_tolower_ex@@16
zend_str_tolower_dup@@16
zend_hash_internal_pointer_end_ex@@16
zend_hash_get_current_data_ex@@16
zend_hash_index_del@@16
zend_hash_str_del@@24
zend_hash_index_add@@24
zend_hash_str_add@@32
zend_mm_set_custom_handlers
zend_mm_get_heap
zend_hash_str_update@@32
_zend_mm_realloc@@24
zend_hash_add@@24
_zend_mm_free@@16
zend_string_concat3
zend_hash_func@@16
_zend_mm_alloc@@16
_estrndup@@16
php_import_environment_variables
sapi_globals
sapi_module
core_globals
zend_execute_ex
executor_globals
compiler_globals
php_free_shutdown_functions
php_ini_builder_define
php_ini_builder_unquoted
php_ini_builder_prepend
zend_vm_kind
__zend_malloc
_estrdup@@8
php_module_shutdown
php_module_startup
php_request_shutdown
php_request_startup
php_getopt
php_register_variable
sapi_deactivate
sapi_shutdown
sapi_startup
zend_register_constant
_efree@@8
zend_register_string_constant
_emalloc@@8
zend_mm_startup_ex
zend_register_long_constant
zend_strndup@@16
zend_error
zend_generator_update_current
php_module_shutdown_wrapper
kernel32
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetLastError
UnhandledExceptionFilter
GetACP
GetLastError
FreeLibrary
GetProcAddress
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
LoadLibraryA
GetStdHandle
GetConsoleScreenBufferInfo
VirtualProtect
IsProcessorFeaturePresent
GetCurrentThreadId
GetSystemTimeAsFileTime
GetCurrentProcessId
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
QueryPerformanceCounter
vcruntime140
memcmp
strchr
memcpy
memchr
strstr
longjmp
__C_specific_handler
__intrinsic_setjmp
__current_exception_context
memset
__current_exception
memmove
api-ms-win-crt-runtime-l1-1-0
_set_errno
signal
_errno
_seh_filter_exe
terminate
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_set_app_type
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
__p___argv
__p___argc
_configure_narrow_argv
_exit
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
api-ms-win-crt-heap-l1-1-0
free
malloc
realloc
_set_new_mode
calloc
api-ms-win-crt-stdio-l1-1-0
__p__commode
__p__fmode
__acrt_iob_func
clearerr
_dup
fflush
fclose
fputs
feof
_set_fmode
_open
_write
_setmode
_read
_lseek
_close
__stdio_common_vsprintf
__stdio_common_vfprintf
fwrite
ftell
fseek
fread
fopen
_fileno
fgets
ferror
api-ms-win-crt-string-l1-1-0
isspace
strtok
isdigit
_strnicmp
wcsncmp
_strdup
strncmp
strcmp
api-ms-win-crt-convert-l1-1-0
strtoul
atoi
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-math-l1-1-0
__setusermatherr
_dclass
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-filesystem-l1-1-0
_chdir
Exports
Exports
OPENSSL_Applink
_phpdbg_asprintf
phpdbg_activate_err_buf
phpdbg_ask_user_permission
phpdbg_check_caught_ex
phpdbg_clear_breakpoints
phpdbg_clear_param
phpdbg_consume_stdin_line
phpdbg_copy_param
phpdbg_current_file
phpdbg_delete_breakpoint
phpdbg_destroy_input
phpdbg_disable_breakpoint
phpdbg_disable_breakpoints
phpdbg_enable_breakpoint
phpdbg_enable_breakpoints
phpdbg_export_breakpoints
phpdbg_export_breakpoints_to_string
phpdbg_find_breakbase
phpdbg_find_breakbase_ex
phpdbg_find_breakpoint
phpdbg_free_err_buf
phpdbg_get_color
phpdbg_get_colors
phpdbg_get_element
phpdbg_get_function
phpdbg_get_param_type
phpdbg_get_prompt
phpdbg_get_terminal_height
phpdbg_get_terminal_width
phpdbg_hash_param
phpdbg_hit_breakpoint
phpdbg_is_addr
phpdbg_is_class_method
phpdbg_is_empty
phpdbg_is_numeric
phpdbg_load_module_or_extension
phpdbg_log_internal
phpdbg_match_param
phpdbg_mixed_read
phpdbg_mixed_write
phpdbg_out_internal
phpdbg_output_err_buf
phpdbg_param_debug
phpdbg_param_tostring
phpdbg_parse_variable
phpdbg_parse_variable_with_arg
phpdbg_print
phpdbg_print_breakpoint
phpdbg_print_breakpoints
phpdbg_read_input
phpdbg_reset_breakpoints
phpdbg_resolve_op_array_break
phpdbg_resolve_op_array_breaks
phpdbg_resolve_opline_break
phpdbg_resolve_path
phpdbg_resolve_pending_file_break
phpdbg_resolve_pending_file_break_ex
phpdbg_set_async_io
phpdbg_set_breakpoint_at
phpdbg_set_breakpoint_expression
phpdbg_set_breakpoint_file
phpdbg_set_breakpoint_file_opline
phpdbg_set_breakpoint_function_opline
phpdbg_set_breakpoint_method
phpdbg_set_breakpoint_method_opline
phpdbg_set_breakpoint_opcode
phpdbg_set_breakpoint_opline
phpdbg_set_breakpoint_opline_ex
phpdbg_set_breakpoint_symbol
phpdbg_set_color
phpdbg_set_color_ex
phpdbg_set_prompt
phpdbg_stack_execute
phpdbg_stack_free
phpdbg_stack_push
phpdbg_stack_resolve
phpdbg_stack_separate
phpdbg_stack_verify
phpdbg_trim
phpdbg_vprint
phpdbg_watchpoint_parse_input
Sections
.text Size: 142KB - Virtual size: 141KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 82KB - Virtual size: 82KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ