C:\__w\1\b\release\arm\AuthenticationManager\AuthenticationManager.pdb
Static task
static1
Behavioral task
behavioral1
Sample
989c573ffc0d4eb5793f6363f1df0b4fb3fd6e61d0b8591f8df01a2afb158b48_NeikiAnalytics.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
989c573ffc0d4eb5793f6363f1df0b4fb3fd6e61d0b8591f8df01a2afb158b48_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
General
-
Target
989c573ffc0d4eb5793f6363f1df0b4fb3fd6e61d0b8591f8df01a2afb158b48_NeikiAnalytics.exe
-
Size
474KB
-
MD5
c26b2b8ef18d724de29ea88c76b6c600
-
SHA1
eb8a7a8b087ff2eac784690234c34073d60af632
-
SHA256
989c573ffc0d4eb5793f6363f1df0b4fb3fd6e61d0b8591f8df01a2afb158b48
-
SHA512
e8b0b020e8a3714dd401347f647dee8a684f0cdfb9fc82f68c7215d319cfa8f090690a4c04ba753d7e8fdb19e92a202dd0c49f6c0bb4eface111679270573904
-
SSDEEP
6144:uIRNLFHi6jJV/BD5Cxh159mIZwOYwMoH6//JN9vgmu:NRN1iw/BdY159mYwOYwML/P9Ip
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 989c573ffc0d4eb5793f6363f1df0b4fb3fd6e61d0b8591f8df01a2afb158b48_NeikiAnalytics.exe
Files
-
989c573ffc0d4eb5793f6363f1df0b4fb3fd6e61d0b8591f8df01a2afb158b48_NeikiAnalytics.exe.exe windows:6 windows
f322d001601506569faf9e0c657a659a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
FormatMessageW
OutputDebugStringW
HeapAlloc
GetProcAddress
GetProcessHeap
GetModuleHandleW
DebugBreak
IsDebuggerPresent
SetLastError
CreateEventExW
GetLastError
CloseHandle
LocalFree
WaitForSingleObject
CreateEventW
SetEvent
Sleep
TrySubmitThreadpoolCallback
GetCurrentProcess
GetModuleHandleExW
InterlockedPushEntrySList
CloseThreadpoolWait
FreeLibrary
CreateThreadpoolWait
LoadLibraryW
MultiByteToWideChar
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitOnceComplete
InitOnceBeginInitialize
GetCurrentThreadId
HeapFree
SetThreadpoolWait
GetModuleFileNameA
user32
GetForegroundWindow
PostMessageW
EndPaint
BeginPaint
UpdateWindow
GetSysColorBrush
PostQuitMessage
LoadCursorW
LoadIconW
TranslateMessage
TranslateAcceleratorW
DefWindowProcW
GetSysColor
DispatchMessageW
ShowWindow
LoadAcceleratorsW
RegisterClassExW
SetWindowTextW
GetSystemMetrics
SendMessageW
CreateWindowExW
GetMessageW
gdi32
CreateFontW
DeleteObject
SetBkColor
ole32
CoTaskMemAlloc
CoRevokeClassObject
CoInitializeEx
CoRegisterClassObject
CoUninitialize
CoGetObjectContext
CoCreateInstance
CoCreateFreeThreadedMarshaler
CoGetApartmentType
msvcp140
?tolower@?$ctype@_W@std@@QBAPB_WPA_WPB_W@Z
??0_Locinfo@std@@QAA@PBD@Z
??1_Locinfo@std@@QAA@XZ
?_Getcoll@_Locinfo@std@@QBA?AU_Collvec@@XZ
??Bid@locale@std@@QAAIXZ
?__ExceptionPtrAssign@@YAXPAXPBX@Z
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
?_ReportUnobservedException@details@Concurrency@@YAXXZ
?_Schedule_chore@details@Concurrency@@YAHPAU_Threadpool_chore@12@@Z
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QAAXXZ
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QAAXXZ
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QAAXXZ
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QAAXXZ
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QAAXXZ
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QAAX_N@Z
?_Release_chore@details@Concurrency@@YAXPAU_Threadpool_chore@12@@Z
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AAAXXZ
?_Capture@_ContextCallback@details@Concurrency@@AAAXXZ
?_IsCurrentOriginSTA@_ContextCallback@details@Concurrency@@CA_NXZ
?_Assign@_ContextCallback@details@Concurrency@@AAAXPAX@Z
?_Reset@_ContextCallback@details@Concurrency@@AAAXXZ
?_CallInContext@_ContextCallback@details@Concurrency@@QBAXV?$function@$$A6AXXZ@std@@_N@Z
??0task_continuation_context@Concurrency@@AAA@XZ
?__ExceptionPtrCreate@@YAXPAX@Z
_Cnd_init_in_situ
?__ExceptionPtrCopyException@@YAXPAXPBX1@Z
?__ExceptionPtrCopy@@YAXPAXPBX@Z
?_Throw_Cpp_error@std@@YAXH@Z
?_Xbad_alloc@std@@YAXXZ
?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
_Mtx_destroy_in_situ
?__ExceptionPtrDestroy@@YAXPAX@Z
_Mtx_lock
?__ExceptionPtrCurrentException@@YAXPAX@Z
?__ExceptionPtrRethrow@@YAXPBX@Z
_Mtx_init_in_situ
_Cnd_wait
_Mtx_unlock
_Cnd_broadcast
_Cnd_destroy_in_situ
_Thrd_yield
_Wcscoll
??1_Lockit@std@@QAA@XZ
??0_Lockit@std@@QAA@H@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?id@?$ctype@_W@std@@2V0locale@2@A
?_Xinvalid_argument@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?id@?$collate@_W@std@@2V0locale@2@A
_Wcsxfrm
?c_str@?$_Yarn@D@std@@QBAPBDXZ
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Incref@facet@locale@std@@UAAXXZ
?tolower@?$ctype@_W@std@@QBA_W_W@Z
?is@?$ctype@_W@std@@QBA_NF_W@Z
??1facet@locale@std@@MAA@XZ
??0facet@locale@std@@IAA@I@Z
?_Decref@facet@locale@std@@UAAPAV_Facet_base@3@XZ
vcruntime140
__std_terminate
memmove
memcpy
memcmp
__CxxFrameHandler3
__std_exception_destroy
__std_exception_copy
_purecall
strchr
__current_exception
__current_exception_context
__C_specific_handler
_CxxThrowException
memset
api-ms-win-crt-runtime-l1-1-0
exit
_c_exit
terminate
_exit
_initialize_wide_environment
_initterm_e
_configure_wide_argv
_errno
_initialize_onexit_table
_register_onexit_function
_invalid_parameter_noinfo
_initterm
abort
_register_thread_local_exe_atexit_callback
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_get_wide_winmain_command_line
api-ms-win-crt-heap-l1-1-0
realloc
free
malloc
_callnewh
_set_new_mode
api-ms-win-crt-string-l1-1-0
strlen
towlower
iswspace
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__stdio_common_vsnprintf_s
__p__commode
__stdio_common_vswprintf
api-ms-win-crt-convert-l1-1-0
wcstol
wcstoll
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
oleaut32
SysStringLen
SysAllocString
SysFreeString
GetErrorInfo
SetErrorInfo
Sections
.text Size: 210KB - Virtual size: 209KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 117KB - Virtual size: 117KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 49KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ