ShaderCompileWorker-SSL.pdb
Static task
static1
Behavioral task
behavioral1
Sample
5e77ecf1e7ac92d98b8b0dd842cf3c6c762c18aff86fb3f9ac742082ae7bc252_NeikiAnalytics.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
5e77ecf1e7ac92d98b8b0dd842cf3c6c762c18aff86fb3f9ac742082ae7bc252_NeikiAnalytics.dll
Resource
win10v2004-20240611-en
General
-
Target
5e77ecf1e7ac92d98b8b0dd842cf3c6c762c18aff86fb3f9ac742082ae7bc252_NeikiAnalytics.exe
-
Size
2.7MB
-
MD5
9084a685281aa995d02b1a90b4f5a3b0
-
SHA1
dd7726460843955fda93882875626d3e60367af3
-
SHA256
5e77ecf1e7ac92d98b8b0dd842cf3c6c762c18aff86fb3f9ac742082ae7bc252
-
SHA512
7a89ceda77a6d79271f0819cd5e64faf4b1301ffdcc963cc46a9b09f6126ec26af465195941e61781c9e0fa6b6aa45a705d8a2960b01ad5ef4703ea4f4d3524a
-
SSDEEP
49152:zGtlqxLVwASO/dIU6i5lhRqDvliVAJL9S8KfEHVM2bnEkk/oH89FXMXhRyP0kh:Lq+8tSIZSFcxRzk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5e77ecf1e7ac92d98b8b0dd842cf3c6c762c18aff86fb3f9ac742082ae7bc252_NeikiAnalytics.exe
Files
-
5e77ecf1e7ac92d98b8b0dd842cf3c6c762c18aff86fb3f9ac742082ae7bc252_NeikiAnalytics.exe.dll windows:6 windows x64 arch:x64
2d35ff4ef4e4ce99d0e83544837749b2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
shadercompileworker-core
?GCoreObjectArrayForDebugVisualizers@@3PEAVFChunkedFixedUObjectArray@@EA
?GCoreComplexObjectPathDebug@@3PEAUFStoredObjectPathDebug@Private@CoreUObject@UE@@EA
?GCoreObjectHandlePackageDebug@@3PEAUFObjectHandlePackageDebugData@Private@CoreUObject@UE@@EA
?Stricmp@FGenericPlatformStricmp@@SAHPEB_W0@Z
?IsEnsureAllowed@FGenericPlatformMisc@@SA_NXZ
?CheckVerifyFailedImpl2@FDebug@@SA_NPEBD0HPEB_WZZ
?EnsureFailed@Private@Assert@UE@@YA_NAEAU?$atomic@_N@std@@PEBUFStaticEnsureRecord@123@ZZ
?Malloc@FMemory@@SAPEAX_KI@Z
?Realloc@FMemory@@SAPEAXPEAX_KI@Z
?Free@FMemory@@SAXPEAX@Z
?QuantizeSize@FMemory@@SA_K_KI@Z
?OnInvalidArrayNum@Private@Core@UE@@YAX_K@Z
?ResizeAllocation@ForAnyElementType@?$TSizedHeapAllocator@$0CA@UFMemory@@@@QEAAXHH_K@Z
?ResizeAllocation@ForAnyElementType@?$TSizedHeapAllocator@$0CA@UFMemory@@@@QEAAXHH_KI@Z
??4FString@@QEAAAEAV0@PEB_W@Z
?AssignRange@FString@@AEAAXPEB_WH@Z
?RemoveAt@FString@@QEAAXHHW4EAllowShrinking@@@Z
?ConcatFF@FString@@CA?AV1@$$QEAV1@AEBV1@@Z
?ConcatFC@FString@@CA?AV1@$$QEAV1@PEB_W@Z
?Find@FString@@QEBAHPEB_WHW4Type@ESearchCase@@W42ESearchDir@@H@Z
?PrintfImpl@FString@@CA?AV1@PEB_WZZ
?EndsWith@FString@@QEBA_NPEB_WHW4Type@ESearchCase@@@Z
?GEngineIni@@3VFString@@A
?GConfig@@3PEAVFConfigCacheIni@@EA
??$Decode@_W@FBase64@@SA_NPEB_WIPEAEW4EBase64Mode@@@Z
?GetDecodedDataSize@FBase64@@SAIAEBVFString@@@Z
?Encode@FBase64@@SA?AVFString@@PEBEIW4EBase64Mode@@@Z
?LoadModuleChecked@FModuleManager@@QEAAAEAVIModuleInterface@@VFName@@@Z
?Get@FModuleManager@@SAAEAV1@XZ
?GetArray@FConfigCacheIni@@QEAAHPEB_W0AEAV?$TArray@VFString@@V?$TSizedDefaultAllocator@$0CA@@@@@AEBVFString@@@Z
?GetBool@FConfigCacheIni@@QEAA_NPEB_W0AEA_NAEBVFString@@@Z
?GetString@FConfigCacheIni@@QEAA_NPEB_W0AEAVFString@@AEBV2@@Z
?FileExists@FPaths@@SA_NAEBVFString@@@Z
?ProjectContentDir@FPaths@@SA?AVFString@@XZ
?EngineContentDir@FPaths@@SA?AVFString@@XZ
?GCoreObjectIndexToPackedObjectRefDebug@@3PEB_KEB
?ParseIntoArray@FString@@QEBAHAEAV?$TArray@VFString@@V?$TSizedDefaultAllocator@$0CA@@@@@PEB_W_N@Z
??0FName@@QEAA@PEB_WW4EFindName@@@Z
??0FName@@QEAA@PEBDW4EFindName@@@Z
?GetBlocks@FNameDebugVisualizer@@SAPEAPEAEXZ
?Get@IFileManager@@SAAEAV1@XZ
?Get@FCommandLine@@SAPEB_WXZ
?Param@FParse@@SA_NPEB_W0@Z
?GetReadersTls@FMRSWRecursiveAccessDetector@@CAAEAV?$TArray@UFReaderNum@FMRSWRecursiveAccessDetector@@V?$TSizedInlineAllocator@$03$0CA@V?$TSizedDefaultAllocator@$0CA@@@@@@@XZ
?GetDestructionSentinelStackTls@FMRSWRecursiveAccessDetector@@CAAEAV?$TArray@PEAUFDestructionSentinel@FMRSWRecursiveAccessDetector@@V?$TSizedInlineAllocator@$03$0CA@V?$TSizedDefaultAllocator@$0CA@@@@@@@XZ
?ThreadStackWalkAndDump@FWindowsPlatformStackWalk@@SAXPEAD_KHI@Z
?StackWalkAndDump@FWindowsPlatformStackWalk@@SAXPEAD_KHPEAX@Z
?IsInGameThread@@YA_NXZ
??1FScopedBootTiming@@QEAA@XZ
??0FScopedBootTiming@@QEAA@PEBD@Z
?BasicLog@Private@Logging@UE@@YAXAEBUFLogCategoryBase@@PEBUFStaticBasicLogRecord@123@ZZ
??1FLogCategoryBase@@QEAA@XZ
??0FLogCategoryBase@@QEAA@AEBVFName@@W4Type@ELogVerbosity@@1@Z
??0FString@@QEAA@PEB_W@Z
ws2_32
send
WSASetLastError
socket
WSAGetLastError
ntohs
getaddrinfo
freeaddrinfo
recv
closesocket
setsockopt
listen
connect
getsockname
bind
getnameinfo
accept
WSACleanup
WSAStartup
gethostbyname
getsockopt
ioctlsocket
kernel32
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
DisableThreadLibraryCalls
WakeAllConditionVariable
InitializeSListHead
ReadConsoleW
ReadConsoleA
SetConsoleMode
GetConsoleMode
LoadLibraryW
LoadLibraryA
FreeLibrary
CloseHandle
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
ConvertThreadToFiber
ConvertFiberToThread
GetProcAddress
GetModuleHandleW
WriteFile
GetFileType
GetEnvironmentVariableW
GetStdHandle
RtlVirtualUnwind
FormatMessageW
WideCharToMultiByte
MultiByteToWideChar
FindNextFileW
FindFirstFileW
FindClose
CreateFiber
DeleteFiber
SwitchToFiber
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
GetCurrentThreadId
SetLastError
GetLastError
GetSystemTime
SystemTimeToFileTime
EnterCriticalSection
user32
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
advapi32
DeregisterEventSource
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
CryptSignHashW
CryptEnumProvidersW
RegisterEventSourceW
crypt32
CertGetCertificateContextProperty
CertFreeCertificateContext
CertDuplicateCertificateContext
CertFindCertificateInStore
CertOpenStore
CertOpenSystemStoreW
CertGetNameStringW
CertEnumCertificatesInStore
CertCloseStore
bcrypt
BCryptGenRandom
vcruntime140
wcsstr
__C_specific_handler
__current_exception
__current_exception_context
__std_type_info_destroy_list
strrchr
memchr
strchr
memset
_purecall
strstr
memcmp
memcpy
memmove
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-stdio-l1-1-0
fflush
fgets
__stdio_common_vfprintf
__acrt_iob_func
fopen
_wfopen
fclose
_fileno
__stdio_common_vswprintf
__stdio_common_vsprintf
__stdio_common_vsscanf
_setmode
fwrite
ftell
ferror
feof
fputs
fseek
fread
api-ms-win-crt-time-l1-1-0
_time64
_gmtime64_s
api-ms-win-crt-string-l1-1-0
strspn
strcmp
strncmp
_strnicmp
strcspn
_stricmp
_strdup
strncpy
isspace
api-ms-win-crt-runtime-l1-1-0
signal
strerror_s
terminate
_initterm_e
_initterm
_cexit
_exit
_crt_at_quick_exit
raise
_errno
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_execute_onexit_table
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-convert-l1-1-0
strtoul
strtol
atoi
api-ms-win-crt-heap-l1-1-0
realloc
malloc
free
api-ms-win-crt-filesystem-l1-1-0
_stat64i32
api-ms-win-crt-environment-l1-1-0
getenv
Exports
Exports
??0FSslManager@@IEAA@XZ
?CreateSslContext@FSslManager@@UEAAPEAUssl_ctx_st@@AEBUFSslContextCreateOptions@@@Z
?DestroySslContext@FSslManager@@UEAAXPEAUssl_ctx_st@@@Z
?Get@FSslModule@@SAAEAV1@XZ
?InitializeSsl@FSslManager@@UEAA_NXZ
?LogSsl@@3UFLogCategoryLogSsl@@A
?ShutdownSsl@FSslManager@@UEAAXXZ
?VerifySslCertificates@FSslCertificateDelegates@@2V?$TDelegate@$$A6A_NAEBVFString@@AEBV?$TArray@UFCertInfo@FSslCertificateDelegates@@V?$TSizedDefaultAllocator@$0CA@@@@@@ZUFDefaultDelegateUserPolicy@@@@A
InitializeModule
Sections
.text Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.uedbg Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 649KB - Virtual size: 649KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 22KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 115KB - Virtual size: 114KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ