_register_koffi_
Static task
static1
Behavioral task
behavioral1
Sample
50ff674767ac7e83b00dd3a4aa7526a0_NeikiAnalytics.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
50ff674767ac7e83b00dd3a4aa7526a0_NeikiAnalytics.dll
Resource
win10v2004-20240508-en
General
-
Target
50ff674767ac7e83b00dd3a4aa7526a0_NeikiAnalytics
-
Size
2.2MB
-
MD5
50ff674767ac7e83b00dd3a4aa7526a0
-
SHA1
dbd2a7537dc32fa097111543c242efd3e3b03b0a
-
SHA256
a1aa805a157f3e3e49cb4d544c5f65303e047a38d08bb4bc4a3567040a98d507
-
SHA512
8aa693ee8cbe6010d477a6b3b941163da0b20f97d539f9f8ae454ffe62f544e05a05ae867d9dc11493ebebfd96acce964c5a88b560e4bdc3e8b613bb895f2075
-
SSDEEP
12288:sXM1bo6qsNC1fQxIa519hIz1RIUZfZpBF0nzOKloK37trcIhF8XdY0Bu0p:sXM1usK4xIa519hiRIU7XLKNthF8XW0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 50ff674767ac7e83b00dd3a4aa7526a0_NeikiAnalytics
Files
-
50ff674767ac7e83b00dd3a4aa7526a0_NeikiAnalytics.dll windows:6 windows x64 arch:x64
e326b9d986207643a21d70d1d9956c6b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
GetProcessHeap
FreeEnvironmentStringsW
GetModuleHandleA
GetStdHandle
GetEnvironmentStringsW
GetCurrentDirectoryW
CreateFileA
CreateFileW
DeleteFileA
DeleteFileW
FindClose
FindFirstFileExW
FindNextFileW
FlushFileBuffers
ReadFile
CloseHandle
GetLastError
CreateEventA
Sleep
GetCurrentProcess
GetStringTypeW
GetSystemTimeAsFileTime
GetTickCount64
VirtualAlloc
VirtualFree
FreeLibrary
GetModuleFileNameA
GetModuleFileNameW
GetProcAddress
LoadLibraryExW
LoadLibraryW
FormatMessageA
FormatMessageW
MoveFileExA
MoveFileExW
MultiByteToWideChar
WideCharToMultiByte
GetACP
GetConsoleMode
SetConsoleMode
SetConsoleCP
SetConsoleOutputCP
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
HeapSize
WriteConsoleW
GetCurrentProcessId
RtlCaptureContext
RaiseException
GetSystemInfo
VirtualProtect
VirtualQuery
GetModuleHandleW
LoadLibraryExA
RtlUnwind
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
InitializeSListHead
TryAcquireSRWLockExclusive
WakeConditionVariable
InitializeCriticalSectionEx
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
RtlPcToFileHeader
RtlUnwindEx
InterlockedFlushSList
SetLastError
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetDriveTypeW
GetFileType
SetStdHandle
SetFilePointerEx
ExitProcess
GetModuleHandleExW
GetFullPathNameW
SetEnvironmentVariableW
HeapAlloc
HeapFree
HeapReAlloc
CompareStringW
LCMapStringW
WriteFile
GetConsoleOutputCP
GetFileSizeEx
advapi32
SystemFunction036
Exports
Exports
Sections
.text Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 349KB - Virtual size: 349KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 608KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 205KB - Virtual size: 204KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ