Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
7ce21e23096f7be6e7d68f316759d800_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
7ce21e23096f7be6e7d68f316759d800_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
7ce21e23096f7be6e7d68f316759d800_NeikiAnalytics
-
Size
1.0MB
-
MD5
7ce21e23096f7be6e7d68f316759d800
-
SHA1
003795d3436babe860980dbb592a6bac2ca3f88a
-
SHA256
6097d17d5ede804d2ff1440582ba9e90344e5d9add0ade81688988569b87fa25
-
SHA512
0f26e1ac49c1e8cc1f70ed3695c465703c797fd20bd9418d2eabcf28886ab8278394c16246309f65a15a2cffb444168171ce15d603459627701b69063cc06e39
-
SSDEEP
24576:tFZnpgDk9X1oTdfcuD+BCiTEfilL++mMY:trnwI1oZB2dcevmMY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7ce21e23096f7be6e7d68f316759d800_NeikiAnalytics
Files
-
7ce21e23096f7be6e7d68f316759d800_NeikiAnalytics.exe windows:6 windows x64 arch:x64
be17683eae27d00465cdfac396612b84
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
CloseHandle
CreateProcessW
CreateRemoteThread
CreateToolhelp32Snapshot
DeleteProcThreadAttributeList
ExitProcess
GetCurrentProcess
GetModuleFileNameW
GetModuleHandleW
GetThreadContext
GlobalAlloc
GlobalFree
InitializeProcThreadAttributeList
IsWow64Process
OpenProcess
OutputDebugStringW
Process32FirstW
Process32NextW
QueryFullProcessImageNameW
ResumeThread
SetThreadContext
UpdateProcThreadAttribute
VirtualAllocEx
VirtualFreeEx
VirtualProtectEx
WaitForSingleObject
Wow64GetThreadContext
Wow64SetThreadContext
WriteProcessMemory
lstrcmpW
lstrcmpiW
lstrcpyW
lstrlenW
advapi32
AdjustTokenPrivileges
CloseServiceHandle
GetTokenInformation
LookupAccountSidW
LookupPrivilegeValueW
OpenProcessToken
OpenSCManagerW
OpenServiceW
QueryServiceStatusEx
shlwapi
PathFindFileNameW
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 132B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.sign Size: 512B - Virtual size: 64B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ