Static task
static1
Behavioral task
behavioral1
Sample
2564d6ae56d7fc7d0a37ced5a72be6d0_NeikiAnalytics.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2564d6ae56d7fc7d0a37ced5a72be6d0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
2564d6ae56d7fc7d0a37ced5a72be6d0_NeikiAnalytics
-
Size
2.1MB
-
MD5
2564d6ae56d7fc7d0a37ced5a72be6d0
-
SHA1
e9e71680eeb9d75579e78293c93c74e7cfd7534a
-
SHA256
2dc4373585593e37925c9d7c9ff3d119c974da63f8951f9ffdf3dc14ca3543cd
-
SHA512
8753a7bd8833ecf9c22f37056c2c667ae8dbaf680f30218b30926fbabd0f0fc99f006eeb11d1c47383a51a243f9e5d4b74f7a57dc617180e1e3c316e2ad47eda
-
SSDEEP
24576:Oo0dks6WWuZf1Ef1Dn+Vm2p742FolApi7rq7DFdmFkGBlm7y8tNmN:dumIj8JQtYN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2564d6ae56d7fc7d0a37ced5a72be6d0_NeikiAnalytics
Files
-
2564d6ae56d7fc7d0a37ced5a72be6d0_NeikiAnalytics.exe windows:4 windows x86 arch:x86
7a554074c167a6b1948b6c6e01f87b73
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
xppui2
XBPFILEDIALOG
XBPBROWSE
APPBROWSENEW
APPEDITNEW
XBPCOLUMN
ascom10
CREATEOBJECT
sqlxpp
SQLCONNECTION
SQLSELECT
SQLDATASET
SQLLISTCOLUMNPRIVILEGES
SQLLISTCOLUMNS
SQLLISTFOREIGNKEYS
SQLLISTPRIMARYKEYS
SQLLISTPROCEDURECOLUMNS
SQLLISTPROCEDURES
SQLLISTSPECIALCOLUMNS
SQLLISTSTATISTICS
SQLLISTTABLEPRIVILEGES
SQLLISTTABLES
SQLLISTTYPEINFO
xpprt1
?prepareOpStack
?ehIsError
?ehSetContext
?setjmp
?exeNativeError
?exeStackUnwind
?momSOn
?symContextInit
__vft18ConUndefinedObject10AtomObject
?conNAllocL
?conNewString
?conNewLogic
?symRefItemConst
?getRFPC
?domValEql
?domAssign
?momSOff
?retNil
?conNRelease
?conNReleaseL
?frameExit
?ehUnwind
?symPublicConst
SETLOCALE
SET
?retStackValue
CHR
?domAdd
APPNAME
SUBSTR
LEFT
UPPER
CURDIR
AT
PROCNAME
?passParameter
?conNNewNil
NATIONMSG
ACREATE
THREAD
?conSendItem
?symParameterConst
DBCLOSEALL
DBSELECTAREA
SETAPPFOCUS
SETAPPWINDOW
SPACE
?conAssignRefWMember
?pushCodeBlock
APPDESKTOP
?conMemberToItem
ALLTRIM
TRIM
?getWFPC
SLEEP
__vft20ConStringConstObject10AtomObject
__vft19ConNumericIntObject10AtomObject
?conNewCon
?symGetItemConst
?callStack
?conRelease
DBELOAD
?domNot
ALERT
DBEBUILD
DBESETDEFAULT
DBEINFO
TIME
SECONDS
GETENV
ARRAY
?domGetElem
?domRefElem
?domMul
?domMulEqu
SETCOLOR
?domValXEql
SETCURSOR
SCROLL
SETPOS
_QUIT
?conNewNil
PCOUNT
?retStackItem
XBPHELP
APPEVENT
RUNSHELL
DATE
STR
CURDRIVE
STRTRAN
LEN
DIRECTORY
FILE
VALTYPE
?domEql
?orShortCut
?domOr
?andShortCut
?domGCmp
?domAnd
SELECT
ISFIELDVAR
MONTH
DAY
?getRFCC
?getWFCC
?domSub
DBUNLOCK
DTOS
SETENV
FEXISTS
RLOCK
VAL
LTRIM
PROCLINE
CONFIRMBOX
DBCLOSEAREA
DBGOTOP
DBSKIP
EOF
DEVPOS
DEVOUT
DEVOUTPICT
GET
AADD
ROW
COL
_WAIT
ASC
DBGOBOTTOM
DBUSEAREA
?symPrivateConst
CREATEDIR
EMPTY
RIGHT
?domNegate
?Xb2MacroSubstStringConst
TYPE
__vft14ConLogicObject10AtomObject
YEAR
POSTAPPEVENT
?domLCmp
?getRCFC
DBAPPEND
DBDELETE
RECNO
?getWCFC
PADC
EVAL
DBPOSITION
DBGOPOSITION
SETMOUSE
FLOCK
DBZAP
DBPACK
QOUT
DBCREATE
SETMODE
_EARLYBOUNDCODEBLOCK
DBCREATEINDEX
ORDLISTREBUILD
FIELDPOS
DBCOPYEXTSTRUCT
ROUND
?domNEql
_COPYFILE
FERASE
USED
ORDLISTCLEAR
ORDLISTADD
?exePcodeEval
?setCWArea
?restWArea
FCOUNT
FIELDNAME
LOWER
SAVESCREEN
DISPBOX
RESTSCREEN
LASTKEY
?domXEql
PADR
DELETED
TONE
_KEYBOARD
DBRECALL
?executeLMacro
?getWCFS
FIELDGET
MEMOEDIT
FIELDPUT
RTRIM
LASTREC
FCREATE
FERROR
FCLOSE
XBPHELPLABEL
?domInc
DBLOCATE
FOUND
DBGOTO
FOPEN
FREAD
NETERR
RECCOUNT
BREAK
ERRORBLOCK
?ehUnsetContext
?ehGetBreakContainer
_BREAK
ORDCONDSET
STRZERO
ORDCREATE
MSGBOX
ISLOWER
?symPublic
DBCLEARFILTER
DBRLOCK
?conOpNewInt
STOD
?domLECmp
AEVAL
DBEVAL
REMOVEDIR
ISFUNCTION
TRANSFORM
FRENAME
__vft21ConNumericFloatObject10AtomObject
MAX
MIN
ALIAS
?executeMacro
DBSETFILTER
DBFILTER
AFILL
?domDiv
?domValNEql
DBSEEK
FWRITE
BOF
ISMEMVAR
THREADID
DOSERRORMESSAGE
DBSESSION
APPTYPE
ERRORLEVEL
ISMETHOD
?domValGCmp
ROOTCRT
PADL
OUTERR
REPLICATE
VERSION
OS
MLCOUNT
MEMOLINE
CTOD
RAT
DBSORT
?domPostInc
?nomClassLock
?nomTryFindRegisteredClass
?retObject
?nomClassUnlock
XBPPARTHANDLER
?conGetClass
?nomCreateClass
?nomDefineVar
?nomDefineMethod
?nomEndClassDefinition
?nomRegisterClass
?nomCallInitClass
?conGetSelfClass
ACLONE
?domAddEqu
?domSubEqu
ATAIL
INT
DLLLOAD
DLLCALL
BIN2L
BIN2VAR
DLLUNLOAD
L2BIN
VAR2BIN
_EJECT
?getWFIC
?getRFIC
DBCONTINUE
DTOC
MAXROW
MAXCOL
INKEY
SIGNAL
?nomDefineVarMethod
THREADOBJECT
GRABOX
?domMod
DBSTRUCT
?domSubStr
LASTAPPEVENT
ISMEMBERVAR
GRAQUERYTEXTBOX
GRASTRINGAT
ABS
XBPCLIPBOARD
?domDec
?domGECmp
ASCAN
SETAPPEVENT
NEXTAPPEVENT
?domValLCmp
ERROR
__vft14ConStringShort10AtomObject
_iniExitProcedureList
___iniStart
___iniGetDLLInitHook
__This_executable_needs_version_1_90_0
___xpprt1Version
xppsys
XBPDIALOG
XBPSTATIC
XBPPUSHBUTTON
XBPCRT
XBPMENU
ANCHORCB
READMODAL
DBEXPORT
_DBIMPORT
DBSKIPPER
DBCREATEFROM
DBEDIT
XBPCOMBOBOX
DBCREATEEXTSTRUCT
XBPSLE
XBPMLE
XBPRADIOBUTTON
XBPCHECKBOX
_DBEXPORT
READKILL
GRASETATTRAREA
GATHER
XBPLISTBOX
READVAR
GRASETATTRSTRING
APPEXIT
xppdbgc
__XPPdbgClient
Sections
.text Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 226KB - Virtual size: 225KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xpp Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 31KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 74KB - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ