Static task
static1
Behavioral task
behavioral1
Sample
8a5f67c12404ed16ceb12bbbb99d8510_NeikiAnalytics.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8a5f67c12404ed16ceb12bbbb99d8510_NeikiAnalytics.dll
Resource
win10v2004-20240508-en
General
-
Target
8a5f67c12404ed16ceb12bbbb99d8510_NeikiAnalytics
-
Size
121KB
-
MD5
8a5f67c12404ed16ceb12bbbb99d8510
-
SHA1
a8d9aa03dbe4814a2c96b5f5f782dbacf4953939
-
SHA256
0ff192e9f91a22866a5a84741f2dede388fa550180332681006669524d3f0096
-
SHA512
0fa2d3359786f2f5d91aa27de100d1ed77fe993c530db4c6bbb34b7428fd3ede4b285891cdc28f4ce07c88bf4554a9cc9d4f5c7ae156aa8e5b17f579dfa7c90a
-
SSDEEP
1536:Ads52bEGir0IhWQkKxujQxqh2geE1EX7QAM/l7d9ifHwOiT/A0WGfj+I:AdQ2bmDhWixfxqh2geE1EX7QA/kWw
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8a5f67c12404ed16ceb12bbbb99d8510_NeikiAnalytics
Files
-
8a5f67c12404ed16ceb12bbbb99d8510_NeikiAnalytics.dll windows:5 windows x86 arch:x86
fd2d8267f70f5349a799a8059c2b0980
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
Imports
hal
KfAcquireSpinLock
KfReleaseSpinLock
ntoskrnl.exe
DbgPrint
ExAllocatePoolWithTag
ExAllocatePoolWithTagPriority
ExFreePoolWithTag
ExUuidCreate
ExVerifySuite
HeadlessDispatch
IoCreateDevice
IoCreateSymbolicLink
IoCreateSynchronizationEvent
IoDeleteDevice
IoDeleteSymbolicLink
IoGetCurrentProcess
IoRegisterShutdownNotification
IoUnregisterShutdownNotification
KeBugCheckEx
KeCancelTimer
KeClearEvent
KeDelayExecutionThread
KeInitializeDpc
KeInitializeEvent
KeInitializeMutex
KeInitializeSemaphore
KeInitializeTimer
KeQueryTimeIncrement
KeReleaseMutex
KeReleaseSemaphore
KeSetEvent
KeSetTimerEx
KeTickCount
KeWaitForSingleObject
NtSetInformationThread
NtShutdownSystem
ObGetObjectSecurity
ObReferenceObjectByHandle
ObReleaseObjectSecurity
ObfDereferenceObject
PsCreateSystemThread
RtlFillMemoryUlong
RtlFindMessage
RtlGetVersion
RtlInitUnicodeString
ZwClose
ZwOpenKey
ZwQuerySystemInformation
ZwQueryValueKey
ZwSetValueKey
_wcsicmp
memmove
memset
sprintf
strlen
swprintf
wcscpy
wcslen
wcsncmp
wcsncpy
Sections
.text Size: 40KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 352B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 928B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 4KB - Virtual size: 51B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ