C:\bamboo-agent\xml-data\build-dir\CP3-CP1-JOB1\CodecPack_bld\!bin\Release\Ipint.VWVDecoder.pdb
Static task
static1
Behavioral task
behavioral1
Sample
1a6b68ea88f97d3c689c304a3501765ec6ef17aca3f76120546a6e1fbade7b7a_NeikiAnalytics.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1a6b68ea88f97d3c689c304a3501765ec6ef17aca3f76120546a6e1fbade7b7a_NeikiAnalytics.dll
Resource
win10v2004-20240508-en
General
-
Target
1a6b68ea88f97d3c689c304a3501765ec6ef17aca3f76120546a6e1fbade7b7a_NeikiAnalytics.exe
-
Size
697KB
-
MD5
cf47d4a8d923a73f9fff7a3f00583f70
-
SHA1
f77241597598a956bb0ca33e44e402fac4274af6
-
SHA256
1a6b68ea88f97d3c689c304a3501765ec6ef17aca3f76120546a6e1fbade7b7a
-
SHA512
b2c1e23a3f2483145573fc4b2bfa3e2e97ab257779052ca5fbd1ffa166c72d1ebdf6642120d2e4da6dd71df18c2f3369caf0b07d7bd6fdfaeb9adb00280d4f7e
-
SSDEEP
12288:X5EArZ45I9GF+XTIzGt+bKBI5VHFeTSJ/GcH+IBWJoCzjZnLCiWh4IlC7Aw0oHFF:XXrZ59GQTIzGt+bKBI5VHFe2J/n+IBUs
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1a6b68ea88f97d3c689c304a3501765ec6ef17aca3f76120546a6e1fbade7b7a_NeikiAnalytics.exe
Files
-
1a6b68ea88f97d3c689c304a3501765ec6ef17aca3f76120546a6e1fbade7b7a_NeikiAnalytics.exe.dll windows:6 windows x86 arch:x86
7dccbb5404d4ca32efeb13dbd76a1338
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
shlwapi
PathRemoveFileSpecA
kernel32
GetProcessHeap
VirtualFree
SetEvent
WaitForSingleObjectEx
CloseHandle
CreateEventA
OutputDebugStringA
GetModuleFileNameA
GetCurrentProcess
GetCurrentThreadId
DuplicateHandle
GetModuleHandleA
CreateSemaphoreA
GetTickCount
ReleaseSemaphore
LoadLibraryA
GetProcAddress
FreeLibrary
VirtualQuery
lstrcmpA
lstrcpynA
GetComputerNameA
SetErrorMode
FreeEnvironmentStringsA
GetEnvironmentStrings
SetEnvironmentVariableA
GetEnvironmentVariableA
WriteFile
GetStdHandle
AllocConsole
SwitchToThread
LoadLibraryExA
GetModuleHandleExA
GetThreadLocale
WideCharToMultiByte
FormatMessageW
GetProcessAffinityMask
GetSystemDirectoryA
QueryPerformanceFrequency
SetThreadAffinityMask
ExitThread
SleepEx
GetExitCodeThread
CreateThread
GetCurrentThread
TerminateThread
GetProcessTimes
SetThreadPriority
InitializeCriticalSection
WaitForSingleObject
DisableThreadLibraryCalls
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InitializeSListHead
GetModuleHandleW
CreateEventW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
FormatMessageA
LocalFree
SystemTimeToFileTime
CreateWaitableTimerA
GetLogicalProcessorInformation
GetSystemTimeAsFileTime
GetSystemInfo
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
ResumeThread
GetCurrentProcessId
Sleep
SetWaitableTimer
OpenEventA
WaitForMultipleObjectsEx
ResetEvent
VirtualAlloc
HeapFree
HeapAlloc
GetLastError
ole32
CoTaskMemAlloc
CoTaskMemFree
msvcp140
?_Xout_of_range@std@@YAXPBD@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?_Xlength_error@std@@YAXPBD@Z
_Mbrtowc
?uncaught_exception@std@@YA_NXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Xbad_alloc@std@@YAXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?width@ios_base@std@@QAE_J_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?width@ios_base@std@@QBE_JXZ
?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ
?_Getdays@_Locinfo@std@@QBEPBDXZ
?_Getmonths@_Locinfo@std@@QBEPBDXZ
?_W_Getdays@_Locinfo@std@@QBEPBGXZ
?_W_Getmonths@_Locinfo@std@@QBEPBGXZ
?good@ios_base@std@@QBE_NXZ
?flags@ios_base@std@@QBEHXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z
vcruntime140
__std_exception_destroy
__std_exception_copy
_purecall
__std_terminate
memmove
_CxxThrowException
memcpy
__std_type_info_destroy_list
memset
_except_handler4_common
__CxxFrameHandler3
strchr
_except_handler3
strrchr
longjmp
_setjmp3
__std_type_info_name
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
_crt_at_quick_exit
_cexit
exit
_beginthreadex
strerror
terminate
_initterm
_seh_filter_dll
_initterm_e
abort
signal
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_invalid_parameter_noinfo_noreturn
_wassert
_getpid
raise
_exit
_errno
_configure_narrow_argv
_execute_onexit_table
api-ms-win-crt-heap-l1-1-0
calloc
free
_callnewh
malloc
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
__stdio_common_vfprintf_p
__stdio_common_vsnprintf_s
__stdio_common_vsprintf_p
__stdio_common_vsscanf
fclose
__stdio_common_vfprintf_s
fopen
fseek
__stdio_common_vfprintf
__stdio_common_vswscanf
__stdio_common_vswprintf_p
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf_s
__stdio_common_vswprintf
__stdio_common_vfwscanf
__stdio_common_vfwprintf_p
__stdio_common_vfwprintf_s
__stdio_common_vfwprintf
__stdio_common_vfscanf
fflush
feof
fgets
fputs
__acrt_iob_func
fgetc
__stdio_common_vsprintf_s
api-ms-win-crt-string-l1-1-0
_stricmp
strncmp
strncpy
strcspn
strspn
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-convert-l1-1-0
strtod
atoi
Exports
Exports
GetIModule
GetMediaConverter
SetLogger
Sections
.text Size: 560KB - Virtual size: 560KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text1 Size: 512B - Virtual size: 48B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 84KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 17KB - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: 512B - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 31KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ