D:\adwsf\axa\I Follow You\x64\Release\I Follow You.pdb
Static task
static1
Behavioral task
behavioral1
Sample
33f5c7f16950adb947502b282da3a00123d5f85421ec57062f6a835ec0f71be5_NeikiAnalytics.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
33f5c7f16950adb947502b282da3a00123d5f85421ec57062f6a835ec0f71be5_NeikiAnalytics.dll
Resource
win10v2004-20240508-en
General
-
Target
33f5c7f16950adb947502b282da3a00123d5f85421ec57062f6a835ec0f71be5_NeikiAnalytics.exe
-
Size
2.2MB
-
MD5
261d56dfe787d85cd2dc3df161ff2ce0
-
SHA1
6f9c4e0465195de0d9c0008d1055c1e695f07246
-
SHA256
33f5c7f16950adb947502b282da3a00123d5f85421ec57062f6a835ec0f71be5
-
SHA512
6bf49399ee7f6cb610cbdc85ef29907b90f2bebfca941d229431c52d03203f12c115ce6d0d676ff6a821b620433b172bd574046fd46713538231db82b519ce06
-
SSDEEP
49152:R6U5eaTANbLjm++CYTkcYurtF2BHU+ytDJmBlSF:R6Uq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 33f5c7f16950adb947502b282da3a00123d5f85421ec57062f6a835ec0f71be5_NeikiAnalytics.exe
Files
-
33f5c7f16950adb947502b282da3a00123d5f85421ec57062f6a835ec0f71be5_NeikiAnalytics.exe.dll windows:6 windows x64 arch:x64
b498f6d9b196c4bae6c43ff5f47a888a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
FreeLibraryAndExitThread
GetModuleHandleA
OpenProcess
CreateToolhelp32Snapshot
GetTempPathA
GetModuleHandleExA
CopyFileA
GetLastError
GetFileAttributesA
CreateFileA
FileTimeToSystemTime
LoadLibraryA
DeleteFileA
GlobalAlloc
Process32Next
GlobalFree
CloseHandle
CreateThread
HeapAlloc
GetLocalTime
GetProcAddress
LocalFree
GetFileSize
ExitProcess
GetProcessHeap
FreeLibrary
SystemTimeToTzSpecificLocalTime
CreateProcessA
CreateDirectoryA
GetProcessTimes
IsDebuggerPresent
CheckRemoteDebuggerPresent
MultiByteToWideChar
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
EnterCriticalSection
GetFullPathNameW
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
LeaveCriticalSection
InitializeCriticalSection
LocalAlloc
Process32First
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateMutexW
WaitForSingleObject
CreateFileW
GetFileAttributesW
GetCurrentThreadId
UnmapViewOfFile
HeapValidate
HeapSize
Sleep
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
WaitForSingleObjectEx
DeleteFileW
HeapReAlloc
RaiseException
GetSystemInfo
LoadLibraryW
HeapCompact
HeapDestroy
UnlockFile
LockFileEx
DeleteCriticalSection
GetCurrentProcessId
SystemTimeToFileTime
WideCharToMultiByte
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
InitializeSListHead
SleepConditionVariableSRW
WakeAllConditionVariable
FindClose
CreatePipe
FindNextFileA
TerminateProcess
DeviceIoControl
WriteFile
GetCurrentProcess
HeapFree
SetFilePointer
FindFirstFileA
GetFileSizeEx
GetModuleFileNameA
ReadFile
GetFullPathNameA
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileInformationByHandleEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetLocaleInfoEx
user32
MessageBoxA
ReleaseDC
GetDC
gdi32
BitBlt
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
GetDIBits
GetDeviceCaps
DeleteDC
DeleteObject
GetObjectA
advapi32
RegSetValueExA
RegOpenKeyExA
RegCloseKey
msvcp140
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
?good@ios_base@std@@QEBA_NXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?tolower@?$ctype@D@std@@QEBADD@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
??Bid@locale@std@@QEAA_KXZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
_Strcoll
?_Syserror_map@std@@YAPEBDH@Z
?id@?$collate@D@std@@2V0locale@2@A
?_Xlength_error@std@@YAXPEBD@Z
?id@?$ctype@D@std@@2V0locale@2@A
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Winerror_map@std@@YAHH@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?uncaught_exceptions@std@@YAHXZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
_Strxfrm
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
winhttp
WinHttpConnect
WinHttpReadData
WinHttpOpen
WinHttpReceiveResponse
WinHttpQueryDataAvailable
WinHttpCloseHandle
WinHttpSendRequest
WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpWriteData
WinHttpQueryHeaders
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception
memcmp
memcpy
memmove
__std_type_info_destroy_list
memset
strchr
__std_exception_destroy
memchr
__C_specific_handler
__std_terminate
_CxxThrowException
__current_exception_context
strrchr
__std_exception_copy
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
exit
_cexit
_errno
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
terminate
abort
_invalid_parameter_noinfo_noreturn
_endthreadex
_beginthreadex
api-ms-win-crt-heap-l1-1-0
free
realloc
_msize
_callnewh
malloc
api-ms-win-crt-convert-l1-1-0
strtoll
api-ms-win-crt-stdio-l1-1-0
fflush
_wfopen_s
fclose
_fseeki64
fread
_ftelli64
__stdio_common_vsprintf_s
fwrite
_wfreopen_s
api-ms-win-crt-string-l1-1-0
strncmp
isspace
isalnum
strcmp
strspn
strcspn
api-ms-win-crt-multibyte-l1-1-0
_mbsicmp
api-ms-win-crt-environment-l1-1-0
_dupenv_s
api-ms-win-crt-filesystem-l1-1-0
_wstat64
api-ms-win-crt-time-l1-1-0
_time64
_localtime64_s
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-math-l1-1-0
ceilf
Exports
Exports
DF109
DllMain
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 983KB - Virtual size: 982KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 53KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ