Behavioral task
behavioral1
Sample
04649ccce574df25cdf0213801e70df0_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
04649ccce574df25cdf0213801e70df0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
04649ccce574df25cdf0213801e70df0_NeikiAnalytics
-
Size
3.3MB
-
MD5
04649ccce574df25cdf0213801e70df0
-
SHA1
3daca768f1370150f03d85ee982c249d24d92d91
-
SHA256
0ef26b403a756f0aada204fefe27f5d0cb50c5f03e30f229bff8a165e1ba6663
-
SHA512
1f9d48b09277601fc2520d1983262101af1bc50fe1b52b8e5f51929d7dd527e0770f8ba8571b8dff700f9917f1e6e3444ce8edb126b43cbe145b87968b41e48a
-
SSDEEP
49152:OW+kp2vlLNokKPwc+cMtd5cDwGu6LM7TVn7W9JNaRVeWCGWF29TlAYsxCr:D+kOxOwHcMb5c5M7xsJNa/e/R29ThE
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 04649ccce574df25cdf0213801e70df0_NeikiAnalytics
Files
-
04649ccce574df25cdf0213801e70df0_NeikiAnalytics.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.MPRESS1 Size: 1.1MB - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 434KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 70KB - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 5.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ