Static task
static1
Behavioral task
behavioral1
Sample
501de61d367a40712a26078658f1e420_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
501de61d367a40712a26078658f1e420_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
501de61d367a40712a26078658f1e420_NeikiAnalytics
-
Size
1.5MB
-
MD5
501de61d367a40712a26078658f1e420
-
SHA1
dcdf8399fe269a0670a8ee8eceab0a759209138c
-
SHA256
8f32239b25e8686863e5fb9acfaed7df09e2fa1fe3de7c6c6e470153fb9542fe
-
SHA512
11d2e332914059daeb18eaed76cc35ad6d6283b0bf3247b01f7f3ddc3763f02fbc811fa3949497c30513cabe2e6d0c5c746c27fee363f675372cd61cb9521c04
-
SSDEEP
24576:a038qsSvetJjBfY5n/F0EiExrQqh9YJyZUxWl1jEHxjGNL5+WbC9FZAbcjF0cu8:UrSiExkAE945+SC9FuE0cVTib+JCl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 501de61d367a40712a26078658f1e420_NeikiAnalytics
Files
-
501de61d367a40712a26078658f1e420_NeikiAnalytics.exe windows:5 windows x86 arch:x86
295b88b65b10857490b2a9e7494664dd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
timeGetTime
waveOutGetNumDevs
kernel32
GetShortPathNameW
GetWindowsDirectoryW
GetCurrentDirectoryW
InterlockedDecrement
WideCharToMultiByte
Sleep
CopyFileW
CreateDirectoryW
InterlockedIncrement
GetFileType
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetProcessHeap
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
CreateFileA
FlushFileBuffers
SetStdHandle
GetLocaleInfoW
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetConsoleMode
GetConsoleCP
GetModuleHandleA
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
CloseHandle
ReadFile
SetFilePointer
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetFileAttributesW
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
HeapSize
GetModuleFileNameA
GetStdHandle
WriteFile
ExitProcess
VirtualAlloc
VirtualFree
HeapCreate
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetProcAddress
GetModuleHandleW
IsValidCodePage
GetOEMCP
GetACP
HeapReAlloc
GetCPInfo
LCMapStringW
LCMapStringA
RtlUnwind
RaiseException
GetFileAttributesA
GetStartupInfoA
GetCommandLineA
HeapAlloc
HeapFree
GetLastError
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
MultiByteToWideChar
user32
LoadCursorW
GetCursor
EnumDisplayDevicesW
EnumDisplaySettingsW
SetCursor
advapi32
RegCloseKey
RegFlushKey
RegOpenKeyW
RegSetValueExW
shell32
SHGetFolderPathW
SHFileOperationW
ole32
CoCreateInstance
CoInitialize
pflib
lua_topointer
lua_pushlightuserdata
?Get@TTexture@PG50@@SA?AV?$shared_ptr@VTTexture@PG50@@@boost@@Vstr@2@@Z
?SetCallBack@TSoundInstance@PG50@@QAEXPAVTSoundCallBack@2@@Z
?SetVolume@TSoundInstance@PG50@@QAEXM@Z
?Kill@TSoundInstance@PG50@@QAEXM@Z
?Pause@TSoundInstance@PG50@@QAEX_NM@Z
?Play@TSound@PG50@@QAE?AV?$shared_ptr@VTSoundInstance@PG50@@@boost@@_NM@Z
?Get@TSound@PG50@@SA?AV?$shared_ptr@VTSound@PG50@@@boost@@Vstr@2@_N@Z
??1TSoundCallBack@PG50@@UAE@XZ
??0TSoundCallBack@PG50@@QAE@XZ
?OnPlaybackComplete@TSoundCallBack@PG50@@UAEXV?$shared_ptr@VTSoundInstance@PG50@@@boost@@@Z
?OnNextSound@TSoundCallBack@PG50@@UAEXV?$shared_ptr@VTSoundInstance@PG50@@@boost@@@Z
?SetTextureMapMode@TBasicEffect@PG50@@QAEXW4ETextureMapMode@12@0@Z
??0TVec3@PG50@@QAE@XZ
??0TVertexSet@PG50@@QAE@PAUTTransformedLitVert@1@I@Z
??1TVertexSet@PG50@@QAE@XZ
?DrawVertices@TRenderer@PG50@@QAEXW4EDrawType@12@ABVTVertexSet@2@@Z
?SetViewport@TRenderer@PG50@@QAEXABVTRect@2@@Z
?SetClippingRectangle@TRenderer@PG50@@QAEXABVTURect@2@@Z
?BeginRenderTarget@TRenderer@PG50@@QAE_NV?$shared_ptr@VTTexture@PG50@@@boost@@@Z
?EndRenderTarget@TRenderer@PG50@@QAEXXZ
?BeginDraw@TRenderer@PG50@@QAE_NXZ
?EndDraw@TRenderer@PG50@@QAEX_N@Z
?Begin2d@TRenderer@PG50@@QAE_NXZ
?End2d@TRenderer@PG50@@QAEXXZ
?GetDefault2dEffect@TRenderer@PG50@@QAE?AV?$shared_ptr@VT2dEffect@PG50@@@boost@@XZ
?FillRect@TRenderer@PG50@@QAEXABVTURect@2@ABVTColor@2@V?$shared_ptr@VTTexture@PG50@@@boost@@@Z
?SetWorldMatrix@TRenderer@PG50@@QAEXABVTMat4@2@@Z
??0TVec2@PG50@@QAE@XZ
?SetTexture@TBasicEffect@PG50@@QAEXV?$shared_ptr@VTTexture@PG50@@@boost@@@Z
??0TColor32@PG50@@QAE@EEEE@Z
??0TColor32@PG50@@QAE@XZ
??0TMat4@PG50@@QAE@MMMMMMMMMMMMMMMM@Z
??0TMat4@PG50@@QAE@XZ
??1TMat4@PG50@@QAE@XZ
?Identity@TMat4@PG50@@QAEAAV12@XZ
??0TFile@PG50@@QAE@XZ
??1TFile@PG50@@QAE@XZ
?Open@TFile@PG50@@QAE_NVstr@2@W4_eFileMode@@@Z
?IsValid@TFile@PG50@@QBE_NXZ
?Close@TFile@PG50@@QAEXXZ
?Size@TFile@PG50@@QAEJXZ
?Read@TFile@PG50@@QAEJPAXK@Z
?Write@TFile@PG50@@QAEJPBXK@Z
?DeleteFile@TFile@PG50@@SA_NVstr@2@@Z
?Create@TTexture@PG50@@SA?AV?$shared_ptr@VTTexture@PG50@@@boost@@II_NW4ETextureTypes@12@@Z
??0TVec3@PG50@@QAE@MMM@Z
??4TVec3@PG50@@QAEAAV01@ABV01@@Z
??0TVec2@PG50@@QAE@MM@Z
??4TVec2@PG50@@QAEAAV01@ABV01@@Z
?GetInstance@TSoundManager@PG50@@SAPAV12@XZ
?SetVolume@TSoundManager@PG50@@QAEXM@Z
?Ready@TTask@PG50@@UAE_NW4ETaskContext@12@@Z
?kWindowTitle@TPlatform@PG50@@2PBDB
?GetInstance@TRenderer@PG50@@SAPAV12@XZ
?SetOption@TRenderer@PG50@@QAEXVstr@2@0@Z
??1TTask@PG50@@UAE@XZ
?Exit@TPlatform@PG50@@QAEXH@Z
?SetDisplay@TPlatform@PG50@@QAEXII_N0W4AntiAliasMode@12@@Z
?GetDisplay@TPlatform@PG50@@QAEXPAI0PA_N1PAW4AntiAliasMode@12@@Z
?ShowCursor@TPlatform@PG50@@QAEX_N@Z
?AdoptTextureRefreshListener@TPlatform@PG50@@QAEXPAVTTask@2@@Z
luaL_loadbuffer
lua_isnumber
lua_objlen
lua_pushcclosure
?pfWriteDbgUnsafe@PG50@@YAXPBDZZ
?pfWriteDbg@PG50@@YAXABVstr@1@@Z
lua_insert
lua_close
luaL_openlibs
lua_next
lua_pushnil
lua_gettable
luaL_newstate
luaL_loadstring
lua_pcall
?PlayFirstExec@PG50@@YAHPAUHINSTANCE__@@0PADHP6A_NPBD@ZP6A_NABVTEvent@1@@ZP6AXXZP6AXM@Z6_N@Z
?pfPGInit@PG50@@YAXXZ
?kGameName@TPlatform@PG50@@2PBDB
?kPublisherName@TPlatform@PG50@@2PBDB
?SetConfig@TPlatform@PG50@@SAXABVstr@2@0@Z
lua_getfield
lua_pushboolean
lua_toboolean
lua_tointeger
lua_settop
lua_gettop
lua_pushstring
lua_tonumber
??0str@PG50@@QAE@PBD@Z
??1str@PG50@@QAE@XZ
?GetInstance@TPlatform@PG50@@SAPAV12@XZ
?OpenBrowser@TPlatform@PG50@@QAEXVstr@2@@Z
lua_settable
lua_type
lua_pushnumber
lua_tolstring
lua_pushinteger
lua_setfield
lua_createtable
??0TURect@PG50@@QAE@IIII@Z
??0TColor32@PG50@@QAE@I@Z
?SetBlendMode@TEffect@PG50@@QAEXW4EBlendMode@12@@Z
?SetFilteringMode@TBasicEffect@PG50@@QAEXW4EFilteringMode@12@@Z
Sections
.text Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 220KB - Virtual size: 219KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 212KB - Virtual size: 211KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 48KB - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ