ADelRCP_Exec.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2cd59839293e4452f9014e6a1574bf1b6f2b5e51761499a3f7870427043e1d56_NeikiAnalytics.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
2cd59839293e4452f9014e6a1574bf1b6f2b5e51761499a3f7870427043e1d56_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
General
-
Target
2cd59839293e4452f9014e6a1574bf1b6f2b5e51761499a3f7870427043e1d56_NeikiAnalytics.exe
-
Size
1.7MB
-
MD5
2ef13041d69fc7de6194521ecabd0f00
-
SHA1
e4d042dec269bbdcb01262bce765ceab94f34f03
-
SHA256
2cd59839293e4452f9014e6a1574bf1b6f2b5e51761499a3f7870427043e1d56
-
SHA512
2a91b26a3aaf2aecda12a88b01b139df9197ccb88c67740ebafa82b803dc9e15f59823607a422c188366545ff2d0b54093979e6bfba1dceaf20d5d35638dc425
-
SSDEEP
24576:9Tj+YwfaeTb8Bm8N4OSu4a+GSfhedAXpeeee:VvwfehxTZF+hnXp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2cd59839293e4452f9014e6a1574bf1b6f2b5e51761499a3f7870427043e1d56_NeikiAnalytics.exe
Files
-
2cd59839293e4452f9014e6a1574bf1b6f2b5e51761499a3f7870427043e1d56_NeikiAnalytics.exe.exe windows:6 windows x86 arch:x86
b5e7f4b4f0d98d809d04c3a874c687da
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
msi
ord8
ord17
ord125
ord70
ord205
ord167
ord145
ord74
ord103
api-ms-win-crt-string-l1-1-0
strcpy_s
strcat_s
wcscmp
wcsncmp
wcstok
_wcslwr_s
strlen
wcslen
wcsncpy_s
wcscat_s
memset
wcscpy_s
_wcsicmp
api-ms-win-crt-convert-l1-1-0
_itow_s
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
_wsplitpath_s
api-ms-win-crt-stdio-l1-1-0
setvbuf
__stdio_common_vswprintf
_get_stream_buffer_pointers
fclose
fflush
fgetc
fgetpos
fputc
ungetc
fread
fsetpos
fwrite
_fseeki64
api-ms-win-crt-runtime-l1-1-0
_errno
_register_onexit_function
_crt_atexit
_invalid_parameter_noinfo
terminate
abort
_invalid_parameter_noinfo_noreturn
_wassert
_initialize_onexit_table
api-ms-win-crt-heap-l1-1-0
calloc
_recalloc
_callnewh
free
malloc
vcruntime140
_setjmp3
wcschr
_except_handler4_common
wcsstr
__CxxFrameHandler3
__std_exception_copy
__std_exception_destroy
memcmp
memcpy
memmove
_CxxThrowException
longjmp
msvcp140
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
??0_Lockit@std@@QAE@H@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??Bid@locale@std@@QAEIXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
??1_Lockit@std@@QAE@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
kernel32
Sleep
TlsSetValue
TlsGetValue
SetLastError
LoadLibraryExW
VirtualQuery
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
ProcessIdToSessionId
TerminateProcess
GetCurrentProcessId
GetFullPathNameW
SystemTimeToFileTime
GetModuleHandleW
GetWindowsDirectoryW
OpenProcess
GetCurrentProcess
DeleteCriticalSection
InitializeCriticalSectionEx
GetProcessHeap
HeapFree
HeapAlloc
RaiseException
CreateFileW
WideCharToMultiByte
MultiByteToWideChar
lstrlenW
lstrcatW
lstrcpyW
lstrcmpiW
lstrcmpW
FormatMessageW
LocalFree
LoadLibraryW
GetProcAddress
GetModuleFileNameW
FreeLibrary
GetSystemDirectoryW
GetSystemTime
CreateProcessW
OutputDebugStringW
GetLastError
CloseHandle
advapi32
ConvertSidToStringSidW
RegEnumKeyExW
RegDeleteKeyExW
CreateProcessWithTokenW
EqualSid
DuplicateTokenEx
AllocateAndInitializeSid
CreateProcessAsUserW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
RegOpenKeyExW
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
RegDeleteKeyW
GetTokenInformation
OpenProcessToken
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegQueryInfoKeyW
RegCloseKey
shell32
SHGetSpecialFolderPathW
SHChangeNotify
SHGetKnownFolderPath
ole32
CoTaskMemFree
CLSIDFromString
CoCreateInstance
CoInitializeEx
Sections
.text Size: 76KB - Virtual size: 75KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 168KB - Virtual size: 168KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE