Static task
static1
Behavioral task
behavioral1
Sample
b3d288dfd4e1da742ea5640eb4016cf0_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b3d288dfd4e1da742ea5640eb4016cf0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
b3d288dfd4e1da742ea5640eb4016cf0_NeikiAnalytics
-
Size
50KB
-
MD5
b3d288dfd4e1da742ea5640eb4016cf0
-
SHA1
bd5fa1e1ea86c211fb63c6fb28168c861664a503
-
SHA256
fc63bc7c812eb9cff9b7ab5cc4bdfaaa6948882fc1d4c2b69adb9efaa0957012
-
SHA512
a9190cfe42e8578911c5baef4ad87611a8a444c0a0a1e26e554119433312c9e4005d341d5e2ee638a030f2e8a8118458e460b9dd1c63f2ba524c643a1f379c26
-
SSDEEP
768:yPT/BIq9Xo8xyqOhkuQ4lyKImu1ZajVkChFK6qLZ+oKfm5h:y7/yqto8ZL4oj2kChyL9Ke
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b3d288dfd4e1da742ea5640eb4016cf0_NeikiAnalytics
Files
-
b3d288dfd4e1da742ea5640eb4016cf0_NeikiAnalytics.exe windows:1 windows x86 arch:x86
5898d8b74a596cff3f24b0fca836a5fa
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shell32
SHGetFolderPathA
ShellExecuteEx
ws2_32
htons
gethostname
gethostbyname
connect
closesocket
WSAStartup
WSACleanup
send
socket
WSAIoctl
advapi32
RegEnumKeyExA
StartServiceA
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyA
RegEnumValueA
RegDeleteKeyA
RegCreateKeyA
RegCloseKey
OpenSCManagerA
OpenProcessToken
LookupPrivilegeValueA
GetUserNameA
DeleteService
CreateServiceA
CloseServiceHandle
AdjustTokenPrivileges
crypt32
CryptUnprotectData
gdi32
GetDeviceCaps
kernel32
Sleep
SetProcessPriorityBoost
WideCharToMultiByte
UnmapViewOfFile
lstrlenW
CloseHandle
lstrlen
lstrcpyn
lstrcpy
lstrcmpi
lstrcmp
lstrcat
SetPriorityClass
SetErrorMode
OpenProcess
MultiByteToWideChar
MapViewOfFile
LocalFree
LocalAlloc
LoadLibraryA
GlobalMemoryStatus
GlobalFree
GlobalAlloc
GetWindowsDirectoryA
GetVolumeInformationA
GetVersionExA
GetTickCount
GetTempPathA
GetSystemDirectoryA
GetShortPathNameA
GetProcAddress
GetPrivateProfileStringA
GetPrivateProfileSectionNamesA
GetPrivateProfileIntA
GetModuleFileNameA
GetLogicalDrives
GetLocaleInfoA
GetLocalTime
GetLastError
GetFullPathNameA
GetFileSize
GetEnvironmentVariableA
GetDriveTypeA
GetDiskFreeSpaceA
GetCurrentProcess
GetCurrentDirectoryA
GetComputerNameA
FindNextFileA
FindFirstFileA
FindClose
ExpandEnvironmentStringsA
ExitProcess
DeleteFileA
CreateThread
CreateFileMappingA
CreateFileA
CopyFileA
WriteFile
ole32
CreateStreamOnHGlobal
CoTaskMemFree
psapi
GetModuleFileNameExA
EnumProcesses
EnumProcessModules
rasapi32
RasGetEntryPropertiesA
RasGetEntryDialParamsA
RasEnumEntriesA
shlwapi
StrChrA
PathFileExistsA
StrStrIA
StrRChrA
StrCmpNA
user32
GetDlgCtrlID
ReleaseDC
GetDC
FindWindowExA
SetActiveWindow
wsprintfA
FindWindowA
SendMessageA
wininet
InternetGetConnectedState
Sections
.text Size: 32KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 8KB - Virtual size: 192KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
FCryptor Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
RCryptor Size: 99B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ