jefri.pdb
Static task
static1
Behavioral task
behavioral1
Sample
518f044d238905bef19fde9f9808f800_NeikiAnalytics.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
518f044d238905bef19fde9f9808f800_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
518f044d238905bef19fde9f9808f800_NeikiAnalytics
-
Size
44KB
-
MD5
518f044d238905bef19fde9f9808f800
-
SHA1
57cbe4396b2a717d1f9e7c1829ec43a51831b9ab
-
SHA256
04f2efbae6b59e166862c7be8e50f89846450ac4a2eee8a62dde501b1e3da712
-
SHA512
15db157ff1e62bac304cbe67a6c89bb49407437996a19482409a93971731a4ca15a72cb68902b2fe172643452f3e2144a315709f329cabf76104dc7cbfcf863c
-
SSDEEP
768:Pf+Fn+PDdK8CMeIVKGucOyGAwggggggLvggggggggSaSQPndWMojAvv:Pf+Is8CMdicOWuSMoC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 518f044d238905bef19fde9f9808f800_NeikiAnalytics
Files
-
518f044d238905bef19fde9f9808f800_NeikiAnalytics.exe windows:4 windows x86 arch:x86
58513824c990be56f1e07213c3610d56
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
shell32
SHGetDesktopFolder
SHGetDiskFreeSpaceA
SHGetFileInfoA
StrChrA
SHChangeNotify
SHGetMalloc
ShellMessageBoxW
FreeIconList
SHGetFolderPathA
DragFinish
SHCreateShellItem
ExtractIconA
SHFileOperationA
wtsapi32
WTSEnumerateServersA
WTSTerminateProcess
WTSFreeMemory
WTSRegisterSessionNotification
WTSVirtualChannelRead
WTSUnRegisterSessionNotification
WTSEnumerateProcessesA
WTSLogoffSession
WTSEnumerateSessionsA
WTSVirtualChannelWrite
WTSSendMessageA
WTSQueryUserToken
WTSQuerySessionInformationA
dciman32
DCICreateOverlay
DCICloseProvider
DCIBeginAccess
DCIDestroy
DCIEnum
kernel32
lstrcpynW
GetSystemTime
ReplaceFileA
GetModuleHandleW
GetStringTypeA
SetErrorMode
FindFirstFileA
ReadConsoleW
GetProcAddress
GetLocalTime
WriteConsoleA
DeviceIoControl
GetLastError
GetPrivateProfileIntW
GetPrivateProfileIntW
GetStdHandle
SearchPathA
FindNextVolumeW
GetTickCount
IsBadStringPtrA
lstrcmpiA
CompareStringW
SetEnvironmentVariableW
FoldStringA
Sections
.text Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ