ADelRCP_Exec.pdb
Static task
static1
Behavioral task
behavioral1
Sample
879366c8b305c81a69982fb13990db592773deab00c4078e31d598f2f57057fe_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
879366c8b305c81a69982fb13990db592773deab00c4078e31d598f2f57057fe_NeikiAnalytics.exe
-
Size
1.5MB
-
MD5
fa06e7aa83bf1f259a7a709fc8d291e0
-
SHA1
7e0f9bef81e9c2a98272405d06ff45bf9834de6b
-
SHA256
879366c8b305c81a69982fb13990db592773deab00c4078e31d598f2f57057fe
-
SHA512
5af6b5327b20de120b549978b76f397bd90c658bc7a5930a53b715b675a8429b1e0c75570cc1a2823c0a5463009c1af2902a2a0c86255b32c3d17852ac039856
-
SSDEEP
12288:mB1y6U0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:8/sqjnhMgeiCl7G0nehbGZpbD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 879366c8b305c81a69982fb13990db592773deab00c4078e31d598f2f57057fe_NeikiAnalytics.exe
Files
-
879366c8b305c81a69982fb13990db592773deab00c4078e31d598f2f57057fe_NeikiAnalytics.exe.exe windows:6 windows x64 arch:x64
3d5aff0d722622c517e2c6d981bfd8d1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
msi
ord17
ord74
ord103
ord125
ord167
ord70
ord8
ord145
ord205
api-ms-win-crt-string-l1-1-0
strcat_s
wcscat_s
wcsncmp
strlen
_wcslwr_s
wcslen
wcsncpy_s
memset
_wcsicmp
wcscpy_s
wcscmp
strcpy_s
wcstok
api-ms-win-crt-runtime-l1-1-0
_register_onexit_function
_invalid_parameter_noinfo
terminate
abort
_initialize_onexit_table
_errno
_crt_atexit
_wassert
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-convert-l1-1-0
_itow_s
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
_wsplitpath_s
api-ms-win-crt-stdio-l1-1-0
fread
fsetpos
_fseeki64
fgetpos
fgetc
setvbuf
fflush
fwrite
ungetc
fputc
__stdio_common_vswprintf
_get_stream_buffer_pointers
fclose
api-ms-win-crt-heap-l1-1-0
calloc
_callnewh
malloc
free
_recalloc
vcruntime140
longjmp
_CxxThrowException
wcschr
__std_exception_destroy
__std_exception_copy
wcsstr
memmove
memcpy
memcmp
vcruntime140_1
__CxxFrameHandler4
msvcp140
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??Bid@locale@std@@QEAA_KXZ
?_Xout_of_range@std@@YAXPEBD@Z
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Xlength_error@std@@YAXPEBD@Z
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
kernel32
TlsSetValue
TlsGetValue
SetLastError
LoadLibraryExW
RtlUnwindEx
VirtualQuery
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
ProcessIdToSessionId
TerminateProcess
GetCurrentProcessId
GetFullPathNameW
SystemTimeToFileTime
GetModuleHandleW
GetWindowsDirectoryW
OpenProcess
GetCurrentProcess
DeleteCriticalSection
InitializeCriticalSectionEx
GetProcessHeap
HeapFree
OutputDebugStringW
HeapAlloc
RaiseException
CreateFileW
WideCharToMultiByte
MultiByteToWideChar
lstrlenW
lstrcatW
lstrcpyW
lstrcmpiW
lstrcmpW
FormatMessageW
LocalFree
LoadLibraryW
GetProcAddress
GetModuleFileNameW
FreeLibrary
GetSystemDirectoryW
GetSystemTime
CreateProcessW
Sleep
GetLastError
CloseHandle
advapi32
CryptCreateHash
RegEnumKeyExW
RegDeleteKeyExW
CreateProcessWithTokenW
EqualSid
DuplicateTokenEx
AllocateAndInitializeSid
CreateProcessAsUserW
GetNamedSecurityInfoW
ConvertSidToStringSidW
CryptDestroyHash
CryptHashData
RegOpenKeyExW
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
RegDeleteKeyW
GetTokenInformation
OpenProcessToken
SetNamedSecurityInfoW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegQueryInfoKeyW
RegCloseKey
shell32
SHGetKnownFolderPath
SHChangeNotify
SHGetSpecialFolderPathW
ole32
CLSIDFromString
CoInitializeEx
CoTaskMemFree
CoCreateInstance
Sections
.text Size: 83KB - Virtual size: 82KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 215KB - Virtual size: 215KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.CRT Size: 512B - Virtual size: 64B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1.2MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE