d:\jk_9\workspace\GSP_DH3.RD008766_4X5X_windows\code_path\NPAPI__814ee2\Bin\Win32\Win_x86_32\pdb\HttpServer.pdb
Static task
static1
Behavioral task
behavioral1
Sample
634caf3f2395b1bf68a1e7c9c269d1ee623fa0631a755e63bcc0e9e3366db545_NeikiAnalytics.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
634caf3f2395b1bf68a1e7c9c269d1ee623fa0631a755e63bcc0e9e3366db545_NeikiAnalytics.dll
Resource
win10v2004-20240611-en
General
-
Target
634caf3f2395b1bf68a1e7c9c269d1ee623fa0631a755e63bcc0e9e3366db545_NeikiAnalytics.exe
-
Size
2.0MB
-
MD5
9532d11b697a418a965bc5fff1a73000
-
SHA1
773946b35ba9927595dfb487c909ee5e97b727c0
-
SHA256
634caf3f2395b1bf68a1e7c9c269d1ee623fa0631a755e63bcc0e9e3366db545
-
SHA512
d3b826d7d553ce6027f8ade6f14a914cc6c8c5e893e7e580d00ed8e129fe7d8934bb83b95e1f66a652d676330a1a3254eba5a58635d9d522d64b014f873bf2fb
-
SSDEEP
49152:b7mknk8J79mKOyfn19zQ+HPv5p3NYEIpFtFRdjql:Km7NHzNHPry5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 634caf3f2395b1bf68a1e7c9c269d1ee623fa0631a755e63bcc0e9e3366db545_NeikiAnalytics.exe
Files
-
634caf3f2395b1bf68a1e7c9c269d1ee623fa0631a755e63bcc0e9e3366db545_NeikiAnalytics.exe.dll windows:4 windows x86 arch:x86
f3347351c420641d5795e021c2f85d54
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
shlwapi
PathRemoveFileSpecA
kernel32
EnterCriticalSection
GetCurrentThreadId
LeaveCriticalSection
QueryPerformanceCounter
QueryPerformanceFrequency
GetLocalTime
GetSystemTime
SetLocalTime
TryEnterCriticalSection
TlsAlloc
TlsSetValue
TlsGetValue
TlsFree
Sleep
ExitThread
GetLastError
SetThreadPriority
CloseHandle
WaitForSingleObject
GetExitCodeThread
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
GetStdHandle
OutputDebugStringA
GetDiskFreeSpaceExA
GetTimeZoneInformation
CreateSemaphoreA
ReleaseSemaphore
DeleteCriticalSection
FreeLibrary
GetModuleHandleA
LocalFree
GetSystemDirectoryA
SetThreadAffinityMask
GetCurrentThread
GetSystemInfo
SetLastError
SystemTimeToFileTime
MultiByteToWideChar
GetVersion
WriteFile
GetFileType
FindNextFileA
FindFirstFileA
FindClose
GetTickCount
GlobalMemoryStatus
FlushConsoleInputBuffer
CreateMutexA
ReleaseMutex
WideCharToMultiByte
SetEvent
CreateEventA
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetEndOfFile
InitializeCriticalSection
LoadLibraryA
InterlockedExchange
InterlockedDecrement
GetCurrentProcessId
InterlockedIncrement
VirtualQuery
LoadLibraryExA
ResetEvent
GetModuleFileNameA
GetProcAddress
LCMapStringA
FormatMessageA
GetConsoleOutputCP
OpenThread
WriteConsoleA
GetLocaleInfoW
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
SetStdHandle
CreateFileW
CreateFileA
SetFilePointer
FlushFileBuffers
GetConsoleCP
GetCurrentDirectoryA
GetFullPathNameA
LoadLibraryW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
SetHandleCount
IsValidCodePage
GetOEMCP
GetACP
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
HeapSize
GetCPInfo
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
HeapAlloc
HeapReAlloc
GetTimeFormatA
GetDateFormatA
GetSystemTimeAsFileTime
GetCommandLineA
GetVersionExA
GetProcessHeap
RtlUnwind
WriteConsoleW
GetModuleFileNameW
RaiseException
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
MoveFileA
CreateThread
ReadFile
DeleteFileA
CreateDirectoryA
RemoveDirectoryA
GetFileAttributesA
ExitProcess
SetConsoleCtrlHandler
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
GetFileAttributesW
SetFileAttributesW
CreateDirectoryW
LCMapStringW
user32
GetUserObjectInformationW
MessageBoxA
GetProcessWindowStation
advapi32
RegisterEventSourceA
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
ReportEventA
DeregisterEventSource
iphlpapi
GetAdaptersAddresses
ws2_32
getservbyport
gethostbyaddr
getservbyname
inet_ntoa
gethostbyname
inet_addr
accept
listen
htonl
WSAStringToAddressA
select
__WSAFDIsSet
recv
WSASetLastError
WSACleanup
setsockopt
socket
bind
connect
getsockopt
ioctlsocket
getpeername
getsockname
closesocket
WSAGetLastError
htons
ntohl
ntohs
WSASendTo
WSAStartup
sendto
recvfrom
shutdown
send
WSARecvFrom
Exports
Exports
??0CCC@Dhts@Dahua@@QAE@XZ
??0CDHTSException@Dhts@Dahua@@QAE@ABV012@@Z
??0CDHTSException@Dhts@Dahua@@QAE@HHH@Z
??1CCC@Dhts@Dahua@@UAE@XZ
??1CDHTSException@Dhts@Dahua@@UAE@XZ
??4CCC@Dhts@Dahua@@AAEAAV012@ABV012@@Z
??4CDHTSException@Dhts@Dahua@@QAEAAV012@ABV012@@Z
??_7CCC@Dhts@Dahua@@6B@
??_7CDHTSException@Dhts@Dahua@@6B@
??_FCDHTSException@Dhts@Dahua@@QAEXXZ
?EASYNCFAIL@CDHTSException@Dhts@Dahua@@2HB
?EASYNCRCV@CDHTSException@Dhts@Dahua@@2HB
?EASYNCSND@CDHTSException@Dhts@Dahua@@2HB
?EBOUNDSOCK@CDHTSException@Dhts@Dahua@@2HB
?ECONNFAIL@CDHTSException@Dhts@Dahua@@2HB
?ECONNLOST@CDHTSException@Dhts@Dahua@@2HB
?ECONNREJ@CDHTSException@Dhts@Dahua@@2HB
?ECONNSETUP@CDHTSException@Dhts@Dahua@@2HB
?ECONNSOCK@CDHTSException@Dhts@Dahua@@2HB
?EDGRAMILL@CDHTSException@Dhts@Dahua@@2HB
?EDUPLISTEN@CDHTSException@Dhts@Dahua@@2HB
?EFILE@CDHTSException@Dhts@Dahua@@2HB
?EINVOP@CDHTSException@Dhts@Dahua@@2HB
?EINVPARAM@CDHTSException@Dhts@Dahua@@2HB
?EINVPOLLID@CDHTSException@Dhts@Dahua@@2HB
?EINVRDOFF@CDHTSException@Dhts@Dahua@@2HB
?EINVSOCK@CDHTSException@Dhts@Dahua@@2HB
?EINVWROFF@CDHTSException@Dhts@Dahua@@2HB
?ELARGEMSG@CDHTSException@Dhts@Dahua@@2HB
?ENOBUF@CDHTSException@Dhts@Dahua@@2HB
?ENOCONN@CDHTSException@Dhts@Dahua@@2HB
?ENOLISTEN@CDHTSException@Dhts@Dahua@@2HB
?ENOSERVER@CDHTSException@Dhts@Dahua@@2HB
?EPEERERR@CDHTSException@Dhts@Dahua@@2HB
?ERDPERM@CDHTSException@Dhts@Dahua@@2HB
?ERDVNOSERV@CDHTSException@Dhts@Dahua@@2HB
?ERDVUNBOUND@CDHTSException@Dhts@Dahua@@2HB
?ERESOURCE@CDHTSException@Dhts@Dahua@@2HB
?ERROR@Dhts@Dahua@@3HB
?ESECFAIL@CDHTSException@Dhts@Dahua@@2HB
?ESOCKFAIL@CDHTSException@Dhts@Dahua@@2HB
?ESTREAMILL@CDHTSException@Dhts@Dahua@@2HB
?ETHREAD@CDHTSException@Dhts@Dahua@@2HB
?ETIMEOUT@CDHTSException@Dhts@Dahua@@2HB
?EUNBOUNDSOCK@CDHTSException@Dhts@Dahua@@2HB
?EUNKNOWN@CDHTSException@Dhts@Dahua@@2HB
?EWRPERM@CDHTSException@Dhts@Dahua@@2HB
?INVALID_SOCK@Dhts@Dahua@@3HB
?SUCCESS@CDHTSException@Dhts@Dahua@@2HB
?accept@Dhts@Dahua@@YAHHPAUsockaddr@@PAH@Z
?bind2@Dhts@Dahua@@YAHHI@Z
?bind@Dhts@Dahua@@YAHHPBUsockaddr@@H@Z
?cleanup@Dhts@Dahua@@YAHXZ
?clear@CDHTSException@Dhts@Dahua@@UAEXXZ
?close@CCC@Dhts@Dahua@@UAEXXZ
?close@Dhts@Dahua@@YAHH@Z
?congControl@CCC@Dhts@Dahua@@UAEXPAVCDHTS@23@PBURateSample@23@@Z
?connect@Dhts@Dahua@@YAHHPBUsockaddr@@H@Z
?dhts_iopoll@Dhts@Dahua@@YAIH@Z
?epoll_add_ssock@Dhts@Dahua@@YAHHIPBH@Z
?epoll_add_usock@Dhts@Dahua@@YAHHHPBH@Z
?epoll_create@Dhts@Dahua@@YAHXZ
?epoll_modify_usock@Dhts@Dahua@@YAHHHPBH@Z
?epoll_release@Dhts@Dahua@@YAHH@Z
?epoll_remove_ssock@Dhts@Dahua@@YAHHI@Z
?epoll_remove_usock@Dhts@Dahua@@YAHHH@Z
?epoll_wait2@Dhts@Dahua@@YAHHPAH000_J@Z
?epoll_wait2@Dhts@Dahua@@YAHHPAH000_JPAI020@Z
?epoll_wait@Dhts@Dahua@@YAHHPAUtagDhtsPollEvents@12@H_J@Z
?epoll_wait@Dhts@Dahua@@YAHHPAV?$set@HU?$less@H@std@@V?$allocator@H@2@@std@@0_J@Z
?epoll_wait@Dhts@Dahua@@YAHHPAV?$set@HU?$less@H@std@@V?$allocator@H@2@@std@@0_JPAV?$set@IU?$less@I@std@@V?$allocator@I@2@@4@2@Z
?freesockinfo@Dhts@Dahua@@YAXPAUCSockInfo@12@@Z
?freesocksinfo@Dhts@Dahua@@YAXPAUCSockInfo@12@@Z
?getErrorCode@CDHTSException@Dhts@Dahua@@UBEHXZ
?getErrorMessage@CDHTSException@Dhts@Dahua@@UAEPBDXZ
?getPerfInfo@CCC@Dhts@Dahua@@IAEPBUCPerfMon@23@XZ
?getlasterror@Dhts@Dahua@@YAAAVCDHTSException@12@XZ
?getlasterror_code@Dhts@Dahua@@YAHXZ
?getlasterror_desc@Dhts@Dahua@@YAPBDXZ
?getpeername@Dhts@Dahua@@YAHHPAUsockaddr@@PAH@Z
?getsockidbase@Dhts@Dahua@@YAHXZ
?getsockinfo@Dhts@Dahua@@YAHHPAUCSockInfo@12@@Z
?getsockname@Dhts@Dahua@@YAHHPAUsockaddr@@PAH@Z
?getsockopt@Dhts@Dahua@@YAHHHW4DHTSOpt@12@PAXPAH@Z
?getsocksinfo@Dhts@Dahua@@YAHPAPAUCSockInfo@12@@Z
?getsockstate@Dhts@Dahua@@YA?AW4DHTSSTATUS@12@H@Z
?init@CCC@Dhts@Dahua@@UAEXPAX@Z
?init@CCC@Dhts@Dahua@@UAEXXZ
?listen@Dhts@Dahua@@YAHHH@Z
?onACK@CCC@Dhts@Dahua@@UAEXH@Z
?onLoss@CCC@Dhts@Dahua@@UAEXPBHH@Z
?onPktReceived@CCC@Dhts@Dahua@@UAEXPBVCPacket@23@@Z
?onPktSent@CCC@Dhts@Dahua@@UAEXPBVCPacket@23@@Z
?onTimeout@CCC@Dhts@Dahua@@UAEXPAX@Z
?onTimeout@CCC@Dhts@Dahua@@UAEXXZ
?perfmon@Dhts@Dahua@@YAHHPAUCPerfMon@12@_N@Z
?processCustomMsg@CCC@Dhts@Dahua@@UAEXPBVCPacket@23@@Z
?recv@Dhts@Dahua@@YAHHPADHH@Z
?recvfile2@Dhts@Dahua@@YA_JHPBDPA_J_JH@Z
?recvfile@Dhts@Dahua@@YA_JHAAV?$basic_fstream@DU?$char_traits@D@std@@@std@@AA_J_JH@Z
?recvmsg@Dhts@Dahua@@YAHHPADH@Z
?select@Dhts@Dahua@@YAHHPAV?$set@HU?$less@H@std@@V?$allocator@H@2@@std@@00PBUtimeval@@@Z
?selectEx@Dhts@Dahua@@YAHABV?$vector@HV?$allocator@H@std@@@std@@PAV34@11_J@Z
?send@Dhts@Dahua@@YAHHPBDHH@Z
?send@Dhts@Dahua@@YAHHPBDHHHW4DataPriority@12@@Z
?sendCustomMsg@CCC@Dhts@Dahua@@IBEXAAVCPacket@23@@Z
?sendfile2@Dhts@Dahua@@YA_JHPBDPA_J_JH@Z
?sendfile@Dhts@Dahua@@YA_JHAAV?$basic_fstream@DU?$char_traits@D@std@@@std@@AA_J_JH@Z
?sendmsg@Dhts@Dahua@@YAHHPBDH@Z
?sendmsg@Dhts@Dahua@@YAHHPBDHH_N@Z
?setACKInterval@CCC@Dhts@Dahua@@IAEXH@Z
?setACKTimer@CCC@Dhts@Dahua@@IAEXH@Z
?setBandwidth@CCC@Dhts@Dahua@@AAEXH@Z
?setMSS@CCC@Dhts@Dahua@@AAEXH@Z
?setMaxCWndSize@CCC@Dhts@Dahua@@AAEXH@Z
?setRTO@CCC@Dhts@Dahua@@IAEXH@Z
?setRTT@CCC@Dhts@Dahua@@AAEXH@Z
?setRcvRate@CCC@Dhts@Dahua@@AAEXH@Z
?setRttRto@CCC@Dhts@Dahua@@IAEXHH@Z
?setSndCurrSeqNo@CCC@Dhts@Dahua@@AAEXH@Z
?setUserParam@CCC@Dhts@Dahua@@IAEXPBDH@Z
?setsockopt@Dhts@Dahua@@YAHHHW4DHTSOpt@12@PBXH@Z
?socket@Dhts@Dahua@@YAHHHH@Z
?socketEx@Dhts@Dahua@@YAHHHHH@Z
?startup@Dhts@Dahua@@YAHXZ
CheckModule
ClearModule
InitModule
LoadImplObjects
StartHttpSvr
StopHttpSvr
Sections
.text Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 396KB - Virtual size: 393KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 52KB - Virtual size: 81KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 100KB - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ