Addin_GetObject
Static task
static1
Behavioral task
behavioral1
Sample
714bef8029616b2f74d6bfb2e299fa80_NeikiAnalytics.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
714bef8029616b2f74d6bfb2e299fa80_NeikiAnalytics.dll
Resource
win10v2004-20240508-en
General
-
Target
714bef8029616b2f74d6bfb2e299fa80_NeikiAnalytics
-
Size
1.4MB
-
MD5
714bef8029616b2f74d6bfb2e299fa80
-
SHA1
72d3704a4530d997e6b5869aa26832705da36a89
-
SHA256
8311ecfe6835743fae921f5537a98158f145b52b77789e460ea776bd900d207f
-
SHA512
a2fd210e24eacd7b9c6a1be2c728321becde2953ef29717210ffdb735e9dbc458b253d064e5109f65ac0b354665e3f68a23c2251391b0bcb944a2e16013ff972
-
SSDEEP
24576:wZaThLsi3N3k6e+Y5mv61ftH0cCYqVUshUjustwfe5IGnASo3AHxu9gtD3e:wukB1h2FUjuYwfonTRu9gtD3e
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 714bef8029616b2f74d6bfb2e299fa80_NeikiAnalytics
Files
-
714bef8029616b2f74d6bfb2e299fa80_NeikiAnalytics.dll windows:4 windows x86 arch:x86
01793e0c0075db60bfd82c8a22ba2d81
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mfc42
ord2864
ord535
ord2818
ord540
ord5861
ord913
ord616
ord656
ord4277
ord858
ord6877
ord6385
ord939
ord941
ord2867
ord815
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord4079
ord4698
ord5307
ord5714
ord3401
ord4622
ord3738
ord561
ord3953
ord1134
ord2725
ord3815
ord1175
ord6423
ord3610
ord2411
ord2023
ord4218
ord2578
ord4398
ord3582
ord4376
ord4853
ord4710
ord5280
ord3361
ord5265
ord4998
ord6052
ord1775
ord4425
ord3597
ord324
ord2298
ord2358
ord2289
ord2370
ord2299
ord2302
ord4234
ord5981
ord6334
ord3811
ord2642
ord3092
ord6199
ord1768
ord3873
ord3337
ord2763
ord3874
ord4129
ord2379
ord699
ord397
ord3438
ord2820
ord3317
ord4188
ord912
ord1802
ord4083
ord1829
ord4123
ord1771
ord6366
ord2413
ord2024
ord4219
ord2581
ord4401
ord3639
ord692
ord3803
ord3619
ord3663
ord3626
ord2414
ord613
ord5789
ord289
ord6696
ord6215
ord4299
ord6880
ord6283
ord6282
ord4284
ord326
ord2086
ord2301
ord4224
ord559
ord812
ord3698
ord765
ord4287
ord6605
ord2915
ord6905
ord1641
ord4189
ord6741
ord3721
ord795
ord6508
ord1233
ord1146
ord1168
ord926
ord3708
ord3301
ord5651
ord3616
ord5773
ord3127
ord350
ord6640
ord2860
ord5953
ord859
ord6911
ord755
ord5875
ord6172
ord5873
ord470
ord860
ord3302
ord3499
ord2515
ord355
ord2614
ord940
ord5572
ord6453
ord2575
ord4396
ord3574
ord609
ord5710
ord4278
ord6407
ord798
ord1997
ord5194
ord533
ord4202
ord3790
ord924
ord541
ord801
ord398
ord700
ord809
ord556
ord1088
ord2122
ord2639
ord6197
ord6379
ord4220
ord2584
ord3654
ord2438
ord6270
ord2863
ord1644
ord2243
ord3908
ord4133
ord4297
ord4160
ord2537
ord763
ord640
ord5678
ord5736
ord1199
ord2450
ord1640
ord323
ord3506
ord483
ord3719
ord793
ord2294
ord2362
ord2645
ord554
ord807
ord5655
ord4163
ord6625
ord955
ord6662
ord2754
ord3571
ord3573
ord3693
ord6128
ord2405
ord5785
ord5148
ord5768
ord3752
ord4694
ord4476
ord536
ord2366
ord3631
ord683
ord2364
ord3226
ord2295
ord6380
ord1844
ord4275
ord4400
ord682
ord2567
ord2753
ord5788
ord3089
ord472
ord2862
ord2393
ord5053
ord2971
ord5759
ord6192
ord5756
ord6186
ord4330
ord6189
ord6021
ord5794
ord5579
ord5571
ord6061
ord5864
ord3596
ord6194
ord5440
ord6383
ord5450
ord6394
ord4243
ord3370
ord3584
ord2582
ord4402
ord3640
ord686
ord693
ord543
ord384
ord803
ord6242
ord3293
ord2859
ord6762
ord3286
ord3910
ord6007
ord3998
ord6907
ord2463
ord354
ord5186
ord3318
ord5442
ord1979
ord2514
ord665
ord781
ord641
ord3742
ord4424
ord4627
ord1116
ord1176
ord1575
ord1577
ord1182
ord342
ord1243
ord1197
ord1570
ord1253
ord1255
ord1578
ord600
ord826
ord269
ord2055
ord4080
ord3079
ord3825
ord3831
ord3830
ord3402
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5277
ord2124
ord2446
ord5261
ord1727
ord5065
ord6376
ord3749
ord2648
ord4441
ord4837
ord3798
ord5290
ord4353
ord6374
ord5163
ord2385
ord5241
ord4407
ord1776
ord4078
ord6055
ord537
ord2764
ord800
ord6467
ord1651
ord6143
ord5594
ord5606
ord825
ord500
ord567
ord823
ord5860
ord772
ord5593
ord818
msvcrt
_purecall
rand
srand
time
strncpy
strstr
atoi
atol
atof
sprintf
_mbscmp
_stricmp
strchr
_ftol
strncmp
_atoi64
_vsnprintf
_mbsicmp
memmove
localtime
_mbschr
__dllonexit
_onexit
??1type_info@@UAE@XZ
free
_initterm
malloc
_adjust_fdiv
__CxxFrameHandler
kernel32
EnterCriticalSection
MulDiv
DeleteCriticalSection
InitializeCriticalSection
GetProfileStringA
GetVersion
GlobalFree
GlobalLock
lstrlenA
GlobalAlloc
lstrcpynA
GetWindowsDirectoryA
LocalAlloc
LocalFree
GetTickCount
DeleteFileA
lstrcpyA
Sleep
LeaveCriticalSection
user32
InvalidateRect
GetNextDlgTabItem
GetFocus
SendMessageA
LoadCursorA
IsWindowVisible
KillTimer
EnableWindow
PostMessageA
GetWindowRect
GetClientRect
SetCursor
SetTimer
ClientToScreen
SetFocus
ShowScrollBar
GetSystemMetrics
BringWindowToTop
RedrawWindow
SetForegroundWindow
MessageBoxA
TranslateMessage
DispatchMessageA
PeekMessageA
ActivateKeyboardLayout
LoadKeyboardLayoutA
GetKeyboardLayoutList
RegisterWindowMessageA
GetDlgItem
ScreenToClient
IsRectEmpty
GetWindowLongA
GetWindowTextA
DestroyWindow
CopyRect
EnableMenuItem
DeleteMenu
GrayStringA
DrawTextA
TabbedTextOutA
InflateRect
GetSysColor
GetKeyState
UpdateWindow
GetDesktopWindow
GetDC
ReleaseDC
SystemParametersInfoA
LoadBitmapA
IsIconic
DrawIcon
GetDlgCtrlID
SetWindowPos
SetWindowLongA
GetCursorPos
IsWindow
PtInRect
CallWindowProcA
wsprintfA
SetRect
LoadMenuA
GetSubMenu
ModifyMenuA
GetParent
LoadIconA
gdi32
EndPage
StartPage
StartDocA
SetAbortProc
DPtoLP
GetDeviceCaps
CreatePen
CreatePatternBrush
BitBlt
EndDoc
CreateCompatibleDC
SetWindowOrgEx
CreateDCA
ResetDCA
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
AbortDoc
Rectangle
CreateFontA
CreateCompatibleBitmap
GetTextExtentPoint32A
CreateFontIndirectA
winspool.drv
DocumentPropertiesA
advapi32
RegOpenKeyA
RegQueryValueExA
shell32
ShellExecuteA
SHGetSpecialFolderPathA
comctl32
ImageList_GetImageInfo
Exports
Exports
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 128KB - Virtual size: 125KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 56KB - Virtual size: 61KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 48KB - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 76KB - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ