Behavioral task
behavioral1
Sample
85b878a2b1366a0a9f851d4e7c2f0610_NeikiAnalytics.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
85b878a2b1366a0a9f851d4e7c2f0610_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
85b878a2b1366a0a9f851d4e7c2f0610_NeikiAnalytics
-
Size
137KB
-
MD5
85b878a2b1366a0a9f851d4e7c2f0610
-
SHA1
3682bd9cb6416732d9b16fba6d4d220c769a4012
-
SHA256
0e4070143950daa86d5fbcea539a6d1b0214e7071ec3c99a1a865379000b9a80
-
SHA512
e422a222096ddcb1c904a37ae8328295553c4bd58eb56451fff7c9358f29d9b5e35f5cbc33ee806f8e7c0f3da2b4ee76e24df1d76a5da01df51687bcfb332bc8
-
SSDEEP
768:JB9Cq/4qn0FCraGCImFb+G31LSad8YwUu+dLkL8TA0344524444/tesXRM6:JWk4e04CIml+C1uaDu+dv00N6jRt
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 85b878a2b1366a0a9f851d4e7c2f0610_NeikiAnalytics
Files
-
85b878a2b1366a0a9f851d4e7c2f0610_NeikiAnalytics.exe windows:5 windows x86 arch:x86
725ce1c4e0966f033a2263198ec17c1d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
RtlUnwind
FreeEnvironmentStringsW
GetModuleFileNameA
GetModuleHandleW
GetProcAddress
GetProcessHeap
HeapAlloc
LoadLibraryA
GetModuleHandleA
GetStartupInfoW
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
GetModuleFileNameW
FreeEnvironmentStringsA
MultiByteToWideChar
GetEnvironmentStringsW
GetEnvironmentStrings
GetCommandLineW
GetCommandLineA
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
WriteFile
VirtualAlloc
HeapReAlloc
WideCharToMultiByte
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
Sections
UPX0 Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 76KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE