D:\OWC\owc-shellext\OWCOnAccessHook\Release\OWCOnAccessHook.pdb
Static task
static1
Behavioral task
behavioral1
Sample
ac9aff73b5fdea5b58d78f05c2cbb580_NeikiAnalytics.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ac9aff73b5fdea5b58d78f05c2cbb580_NeikiAnalytics.dll
Resource
win10v2004-20240226-en
General
-
Target
ac9aff73b5fdea5b58d78f05c2cbb580_NeikiAnalytics
-
Size
708KB
-
MD5
ac9aff73b5fdea5b58d78f05c2cbb580
-
SHA1
7903264b883101ca822b9ba948a7cd93cefd8a1d
-
SHA256
14ab30f2c7742fc86996a5d72e72c55f971096367a4f331a9dbd8de14809288b
-
SHA512
9c21fd7a29099959dbcd5bce77a7efcb7bf6188b47d6f7a615446d157938a8b6e60f6479bb2c1d7be5020dedcddeb3ec7fb1296fc0c44806d11b5b91cceea9f7
-
SSDEEP
12288:xSOC8kY2aqMoQcExYyoFgj7/gxz1eSzNMemhTS0+CgCh2VrvpAi:L7EaqxQcExHoFgj7/gTO3+Cgui
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ac9aff73b5fdea5b58d78f05c2cbb580_NeikiAnalytics
Files
-
ac9aff73b5fdea5b58d78f05c2cbb580_NeikiAnalytics.dll regsvr32 windows:6 windows x86 arch:x86
13d151564df801afda94d75183fdb1c7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
VirtualProtect
EnterCriticalSection
GetCurrentProcess
VirtualAlloc
SetThreadPriority
LeaveCriticalSection
InitializeCriticalSection
GetCurrentThreadId
SuspendThread
ResumeThread
Sleep
GetThreadPriority
CloseHandle
GetSystemInfo
GetThreadContext
GetProcAddress
DeleteCriticalSection
GetModuleHandleW
FlushInstructionCache
VirtualQuery
OpenThread
GetFileAttributesW
OpenProcess
K32GetModuleBaseNameW
K32EnumProcessModules
SetStdHandle
HeapReAlloc
HeapSize
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
DecodePointer
RaiseException
GetLastError
InitializeCriticalSectionEx
GetModuleFileNameW
GetCurrentThread
GetCurrentProcessId
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
GetTimeZoneInformation
ReadConsoleW
ReadFile
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleCP
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
MultiByteToWideChar
FormatMessageW
WideCharToMultiByte
GetStringTypeW
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFileInformationByHandle
GetTempPathW
AreFileApisANSI
SetLastError
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
RtlUnwind
InterlockedFlushSList
FreeLibrary
LoadLibraryExW
GetStdHandle
GetFileType
GetModuleHandleExW
WriteConsoleW
ExitProcess
WriteFile
HeapAlloc
HeapFree
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
SetEndOfFile
user32
DestroyMenu
CreatePopupMenu
InsertMenuItemW
LoadBitmapW
advapi32
RegCloseKey
RegDeleteKeyW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegDeleteValueW
RegQueryValueExW
shell32
DragQueryFileW
SHChangeNotify
SHGetPathFromIDListW
ole32
StringFromCLSID
CoCreateInstance
CoTaskMemFree
ReleaseStgMedium
CoInitializeEx
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 418KB - Virtual size: 417KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 109KB - Virtual size: 109KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 155KB - Virtual size: 158KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ