C:\Jenkins\workspace\ceph-windows-installer-reef\Dependencies\wnbd\vstudio\x64\Release\pdb\libwnbd\libwnbd.pdb
Static task
static1
Behavioral task
behavioral1
Sample
6041cba20f054e7dfd2c9ef1ced3632729580ba7892d8b4f2837a69f46771418_NeikiAnalytics.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
6041cba20f054e7dfd2c9ef1ced3632729580ba7892d8b4f2837a69f46771418_NeikiAnalytics.dll
Resource
win10v2004-20240508-en
General
-
Target
6041cba20f054e7dfd2c9ef1ced3632729580ba7892d8b4f2837a69f46771418_NeikiAnalytics.exe
-
Size
109KB
-
MD5
51f7d133421101ad44a87af201332450
-
SHA1
10bdc026f4403582491f52199123cd3dfa44f4d2
-
SHA256
6041cba20f054e7dfd2c9ef1ced3632729580ba7892d8b4f2837a69f46771418
-
SHA512
1dc096fc28bf78575091932a2bdcfca3b599eb690f2718ff5da7007dc83e7b89a387bf06b74fc011a618917b7f3e5b56ebd470beff0627cabe837176588c4e24
-
SSDEEP
1536:4aL6rxmv/yRmqxYWMslS0+lekvYxVCk3ApwWJSvRVHFwEb/e:44CQ/yRhY2l4ckv2VCk3ApwgcRV6Q/e
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6041cba20f054e7dfd2c9ef1ced3632729580ba7892d8b4f2837a69f46771418_NeikiAnalytics.exe
Files
-
6041cba20f054e7dfd2c9ef1ced3632729580ba7892d8b4f2837a69f46771418_NeikiAnalytics.exe.dll windows:6 windows x64 arch:x64
1707e9169b298d50e18482ce2086aef3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
CloseHandle
CreateThread
ResetEvent
GetOverlappedResult
CreateEventA
QueryPerformanceCounter
LoadLibraryW
GetProcAddress
LocalFree
FreeLibrary
FormatMessageA
FindFirstFileW
FindNextFileW
GetFullPathNameA
FindClose
CreateFileW
GetWindowsDirectoryW
GetLocalTime
QueryPerformanceFrequency
GetModuleHandleW
LeaveCriticalSection
CreateFileA
GetLastError
Sleep
WaitForMultipleObjects
DeviceIoControl
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
WaitForSingleObjectEx
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
EnterCriticalSection
ws2_32
closesocket
socket
send
shutdown
freeaddrinfo
recv
getaddrinfo
setsockopt
WSAGetLastError
connect
msvcp140
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
_Thrd_id
?_Throw_C_error@std@@YAXH@Z
_Mtx_lock
_Cnd_do_broadcast_at_thread_exit
_Mtx_unlock
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??_7?$codecvt@_WDU_Mbstatet@@@std@@6B@
??_7_Facet_base@std@@6B@
??_7codecvt_base@std@@6B@
??_7facet@locale@std@@6B@
??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ
??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z
??1codecvt_base@std@@UEAA@XZ
??1facet@locale@std@@MEAA@XZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
??1_Facet_base@std@@UEAA@XZ
_Mtx_init_in_situ
_Mtx_destroy_in_situ
?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Xlength_error@std@@YAXPEBD@Z
?uncaught_exceptions@std@@YAHXZ
?_Throw_Cpp_error@std@@YAXH@Z
_Thrd_join
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z
setupapi
SetupDiGetDeviceInstallParamsA
SetupDiCreateDeviceInfoA
SetupDiGetINFClassA
SetupFindFirstLineW
SetupDiCreateDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyW
SetupDiSetDeviceRegistryPropertyA
SetupDiGetClassDevsW
SetupDiGetDeviceInterfaceDetailW
CM_Query_And_Remove_SubTreeW
SetupDiCallClassInstaller
CM_Enable_DevNode
CM_Locate_DevNode_ExW
CM_Disable_DevNode
SetupDiDestroyDeviceInfoList
SetupGetStringFieldW
SetupDiEnumDeviceInterfaces
SetupCloseInfFile
SetupOpenInfFileW
SetupUninstallOEMInfW
newdev
UpdateDriverForPlugAndPlayDevicesA
DiUninstallDevice
shlwapi
PathFileExistsA
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memset
__std_type_info_destroy_list
__C_specific_handler
__std_exception_copy
__std_exception_destroy
_CxxThrowException
memcpy
memmove
__std_terminate
api-ms-win-crt-heap-l1-1-0
free
realloc
malloc
calloc
_callnewh
api-ms-win-crt-string-l1-1-0
wcscat_s
strcmp
strncpy_s
api-ms-win-crt-runtime-l1-1-0
terminate
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_initterm
_initterm_e
_invalid_parameter_noinfo_noreturn
_beginthreadex
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf_s
__acrt_iob_func
__stdio_common_vfprintf
__stdio_common_vsprintf
__stdio_common_vsnprintf_s
api-ms-win-crt-math-l1-1-0
ceilf
Exports
Exports
WnbdClose
WnbdCreate
WnbdGetAdapterDevInst
WnbdGetConnectionInfo
WnbdGetDriverStats
WnbdGetDriverVersion
WnbdGetDrvOpt
WnbdGetLibVersion
WnbdGetUserContext
WnbdGetUserspaceStats
WnbdInstallDriver
WnbdIoctlCreate
WnbdIoctlFetchRequest
WnbdIoctlGetDrvOpt
WnbdIoctlGetIOLimits
WnbdIoctlList
WnbdIoctlListDrvOpt
WnbdIoctlPing
WnbdIoctlReloadConfig
WnbdIoctlRemove
WnbdIoctlResetDrvOpt
WnbdIoctlSendResponse
WnbdIoctlSetDiskSize
WnbdIoctlSetDrvOpt
WnbdIoctlShow
WnbdIoctlStats
WnbdList
WnbdListDrvOpt
WnbdOpenAdapter
WnbdPollDiskNumber
WnbdRemove
WnbdRemoveAllDisks
WnbdRemoveEx
WnbdResetAdapter
WnbdResetAdapterEx
WnbdResetDrvOpt
WnbdRunNbdDaemon
WnbdSendResponse
WnbdSendResponseEx
WnbdSetDiskSize
WnbdSetDrvOpt
WnbdSetLogLevel
WnbdSetLogger
WnbdSetSense
WnbdSetSenseEx
WnbdShow
WnbdStartDispatcher
WnbdStopDispatcher
WnbdUninstallDriver
WnbdWaitDispatcher
Sections
.text Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 34KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 232B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ