Windows.UI.Immersive.pdb
Static task
static1
Behavioral task
behavioral1
Sample
4f06af3bedf774d99679e4ba8fb42d64cbd9c803974835e15ed0f9603cd423f4_NeikiAnalytics.dll
Resource
win10v2004-20240611-en
General
-
Target
4f06af3bedf774d99679e4ba8fb42d64cbd9c803974835e15ed0f9603cd423f4_NeikiAnalytics.exe
-
Size
1.1MB
-
MD5
cfef7403e0cff5e84092a8181c9a8750
-
SHA1
b8569aa8ccacb7a8479d4412b46248d61ddcc098
-
SHA256
4f06af3bedf774d99679e4ba8fb42d64cbd9c803974835e15ed0f9603cd423f4
-
SHA512
e8cdaecc94d847631b329aa9eeecbb0374bdd745505cdd865cf08056789580877a9bdaeb5a5786fb7919fe47b297dadb02619608e49f9125500ac89a5ae8b5dd
-
SSDEEP
24576:+klfl1O1XQpnwSxL8XFxXYxOdRHFFFRHE:+kxl1O1Xe3xAXFKxObFRHE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4f06af3bedf774d99679e4ba8fb42d64cbd9c803974835e15ed0f9603cd423f4_NeikiAnalytics.exe
Files
-
4f06af3bedf774d99679e4ba8fb42d64cbd9c803974835e15ed0f9603cd423f4_NeikiAnalytics.exe.dll windows:10 windows x86 arch:x86
623a3c3ec67e882d60b04e745ac1be95
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
_o__wcsicmp
_o__wcstoui64
_o__get_errno
memmove
_o_free
_o_malloc
_o_memcpy_s
_o_rand
_o_realloc
_o_terminate
_o_wcsncpy_s
__current_exception
__current_exception_context
_except_handler4_common
_o__execute_onexit_table
_o__errno
_o__invalid_parameter_noinfo_noreturn
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__initialize_narrow_environment
_CxxThrowException
wcsstr
wcschr
__std_terminate
_o__crt_atexit
__CxxFrameHandler3
_o__configure_narrow_argv
_o__CIpow
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
strncmp
wcscspn
memmove_s
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
GetModuleFileNameA
FindStringOrdinal
GetModuleHandleW
GetProcAddress
GetModuleHandleA
LoadStringW
LockResource
LoadResource
FindResourceExW
GetModuleFileNameW
LoadLibraryExW
FreeLibrary
DisableThreadLibraryCalls
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
InitOnceComplete
Sleep
InitOnceBeginInitialize
api-ms-win-core-synch-l1-1-0
OpenMutexW
InitializeCriticalSectionAndSpinCount
CreateMutexW
WaitForMultipleObjectsEx
SetEvent
CreateEventW
AcquireSRWLockExclusive
CreateEventExW
CreateSemaphoreExW
OpenSemaphoreW
AcquireSRWLockShared
WaitForSingleObjectEx
OpenEventW
WaitForSingleObject
ReleaseMutex
DeleteCriticalSection
ReleaseSRWLockExclusive
CreateMutexExW
ReleaseSRWLockShared
ReleaseSemaphore
InitializeCriticalSectionEx
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeSRWLock
ResetEvent
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapReAlloc
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
SetLastError
RaiseException
api-ms-win-eventing-provider-l1-1-0
EventActivityIdControl
EventUnregister
EventSetInformation
EventRegister
EventWriteTransfer
api-ms-win-core-psapi-l1-1-0
K32GetModuleFileNameExW
K32GetModuleBaseNameW
QueryFullProcessImageNameW
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
CompareStringOrdinal
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceEnableFlags
UnregisterTraceGuids
GetTraceLoggerHandle
RegisterTraceGuidsW
GetTraceEnableLevel
api-ms-win-core-processthreads-l1-1-0
OpenThreadToken
GetCurrentThread
GetCurrentProcess
CreateThread
GetProcessId
GetCurrentProcessId
TerminateProcess
TlsAlloc
TlsFree
TlsSetValue
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
CreateProcessAsUserW
DeleteProcThreadAttributeList
SetThreadToken
ResumeThread
OpenProcessToken
GetCurrentThreadId
OpenThread
TlsGetValue
api-ms-win-core-processthreads-l1-1-1
SetProcessMitigationPolicy
IsProcessorFeaturePresent
OpenProcess
api-ms-win-core-localization-l1-2-0
GetLocaleInfoEx
GetLocaleInfoW
GetThreadUILanguage
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
OutputDebugStringA
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetVersionExW
GetSystemDirectoryW
GetSystemTimeAsFileTime
GlobalMemoryStatusEx
GetTickCount64
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-heap-l2-1-0
LocalFree
LocalReAlloc
LocalAlloc
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
SetThreadpoolWait
CloseThreadpoolTimer
WaitForThreadpoolWaitCallbacks
CreateThreadpoolWait
CloseThreadpoolWait
SetThreadpoolTimer
CreateThreadpoolTimer
api-ms-win-core-registry-l1-1-0
RegEnumKeyExW
RegDeleteValueW
RegCloseKey
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegGetValueW
RegCreateKeyExW
RegSetValueExW
RegNotifyChangeKeyValue
api-ms-win-security-base-l1-1-0
CreateRestrictedToken
CheckTokenMembership
CreateWellKnownSid
AllocateAndInitializeSid
ImpersonateLoggedOnUser
GetFileSecurityW
CopySid
SetFileSecurityW
GetLengthSid
GetAclInformation
GetAce
GetSecurityDescriptorControl
AddAce
AddAccessAllowedAceEx
InitializeAcl
AddAccessDeniedAceEx
GetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityDescriptorControl
GetSidSubAuthority
IsWellKnownSid
DuplicateTokenEx
IsValidSid
SetTokenInformation
GetTokenInformation
GetSidIdentifierAuthority
EqualSid
FreeSid
api-ms-win-core-path-l1-1-0
PathCchRemoveExtension
PathCchCombine
PathCchCanonicalizeEx
PathCchAppend
PathCchCanonicalize
PathCchRemoveFileSpec
api-ms-win-core-registry-l1-1-1
RegSetKeyValueW
api-ms-win-core-file-l1-1-0
CreateFileW
GetFileSizeEx
CreateDirectoryW
CompareFileTime
GetFileAttributesExW
DeleteFileW
GetFileAttributesW
FindFirstFileW
FindNextFileW
SetFileAttributesW
FindClose
api-ms-win-core-memory-l1-1-0
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
api-ms-win-core-memory-l1-1-1
PrefetchVirtualMemory
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryA
LoadLibraryW
api-ms-win-core-sysinfo-l1-2-0
GetProductInfo
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-file-l1-2-4
GetTempPath2W
api-ms-win-core-sysinfo-l1-2-1
GetPhysicallyInstalledSystemMemory
api-ms-win-security-appcontainer-l1-1-0
GetAppContainerNamedObjectPath
api-ms-win-core-errorhandling-l1-1-2
RaiseFailFastException
api-ms-win-security-base-l1-2-0
CheckTokenCapability
api-ms-win-core-threadpool-private-l1-1-0
RegisterWaitForSingleObjectEx
api-ms-win-security-activedirectoryclient-l1-1-0
DsCrackNamesW
DsFreeNameResultW
DsUnBindW
api-ms-win-core-atoms-l1-1-0
GlobalGetAtomNameW
api-ms-win-core-kernel32-legacy-l1-1-0
RegisterWaitForSingleObject
MulDiv
api-ms-win-core-shlwapi-legacy-l1-1-0
PathFindExtensionW
SHExpandEnvironmentStringsW
PathFindFileNameW
PathAppendW
PathRemoveFileSpecW
api-ms-win-core-threadpool-legacy-l1-1-0
DeleteTimerQueueTimer
UnregisterWaitEx
CreateTimerQueueTimer
api-ms-win-core-shlwapi-obsolete-l1-1-0
StrCmpIW
StrCmpNIW
QISearch
api-ms-win-core-psm-key-l1-1-0
PsmGetKeyFromToken
api-ms-win-core-winrt-errorprivate-l1-1-0
RoReportCapabilityCheckFailure
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
combase
ord157
ord140
ord90
ntdll
EtwTraceMessage
RtlQueryTokenHostIdAsUlong64
WinSqmIsOptedIn
WinSqmAddToStreamEx
NtQueryWnfStateData
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlSubscribeWnfStateChangeNotification
RtlPublishWnfStateData
WinSqmSetDWORD
WinSqmIncrementDWORD
RtlNtStatusToDosError
WinSqmAddToStream
RtlMapGenericMask
RtlInitUnicodeString
RtlCompareUnicodeString
RtlNtStatusToDosErrorNoTeb
RtlAllocateHeap
NtQueryInformationToken
RtlFreeHeap
RtlUnsubscribeWnfStateChangeNotification
RtlQueryWnfStateData
user32
KillTimer
GetClientRect
MonitorFromRect
SetWindowTextW
GetParent
SetForegroundWindow
GetKeyState
GetWindowBand
ReleaseDC
GetDC
SetRectEmpty
OffsetRect
SetRect
MonitorFromWindow
CopyRect
InflateRect
SubtractRect
GetClassNameW
ord2529
EnableWindow
IsRectEmpty
GetWindowRgn
SetWindowRgn
SetLayeredWindowAttributes
FillRect
GetLastActivePopup
FindWindowExW
FindWindowW
BeginPaint
EndPaint
CreateWindowInBand
RegisterWindowMessageW
GetMonitorInfoW
MonitorFromPoint
GetSystemMetrics
CallNextHookEx
NotifyWinEvent
SetWindowsHookExW
ord2573
GetDesktopWindow
UnhookWindowsHookEx
GetPropW
ord2565
SendNotifyMessageW
IsWindow
IntersectRect
MapWindowPoints
AllowSetForegroundWindow
UnhookWinEvent
RemovePropW
ChangeWindowMessageFilterEx
SetPropW
GetForegroundWindow
SystemParametersInfoW
GetMessageTime
GetMessagePos
CreateWindowExW
RegisterClassW
GetAncestor
AttachThreadInput
MsgWaitForMultipleObjectsEx
PeekMessageW
PostQuitMessage
TranslateMessage
SetCursor
LoadCursorW
DispatchMessageW
SetWinEventHook
GetWindowRect
SetActiveWindow
GetWindow
GetActiveWindow
SetWindowPos
DestroyWindow
SendMessageW
PostMessageW
ShowWindow
GetWindowThreadProcessId
DefWindowProcA
DefWindowProcW
IsWindowUnicode
GetWindowLongW
SetWindowLongW
GetDoubleClickTime
GetFocus
SetFocus
SetWindowCompositionAttribute
IsWindowVisible
GetCursorPos
CreateWindowInBandEx
UpdateWindow
EqualRect
EnumDisplayMonitors
ord2574
GetDpiForWindow
AdjustWindowRectExForDpi
AdjustWindowRect
IsWindowEnabled
ord2522
RegisterClassExW
MoveWindow
MessageBeep
EnumWindows
GetShellWindow
ord2521
UnionRect
PostThreadMessageW
RealGetWindowClassW
SetTimer
msvcp_win
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
Exports
Exports
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
Sections
.text Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ