jefri.pdb
Static task
static1
Behavioral task
behavioral1
Sample
076ecd01bc40102411d6af3f84cd7920_NeikiAnalytics.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
076ecd01bc40102411d6af3f84cd7920_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
076ecd01bc40102411d6af3f84cd7920_NeikiAnalytics
-
Size
44KB
-
MD5
076ecd01bc40102411d6af3f84cd7920
-
SHA1
44b0464ce9a3a305fe015d0a0a26851fbe3e6d3d
-
SHA256
6d7ce8a2cac0af1712dce55e07b5f8b7ba33838d25c5c81ea952052ced4cbe4b
-
SHA512
2159db259bd92dd99ee8f4d244ada21e4c720b32b17e36172eb8b91a9bb62f0174edab6183b549a7729922a2cde7d7cc3594776bfae09b0cdc8c330c96c8715f
-
SSDEEP
768:Pf+Fn+PDdK8CMeIVKGucOyGAwggggggLvggggggggSaSQPndWMoj8/:Pf+Is8CMdicOWuSMow/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 076ecd01bc40102411d6af3f84cd7920_NeikiAnalytics
Files
-
076ecd01bc40102411d6af3f84cd7920_NeikiAnalytics.exe windows:4 windows x86 arch:x86
58513824c990be56f1e07213c3610d56
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
shell32
SHGetDesktopFolder
SHGetDiskFreeSpaceA
SHGetFileInfoA
StrChrA
SHChangeNotify
SHGetMalloc
ShellMessageBoxW
FreeIconList
SHGetFolderPathA
DragFinish
SHCreateShellItem
ExtractIconA
SHFileOperationA
wtsapi32
WTSEnumerateServersA
WTSTerminateProcess
WTSFreeMemory
WTSRegisterSessionNotification
WTSVirtualChannelRead
WTSUnRegisterSessionNotification
WTSEnumerateProcessesA
WTSLogoffSession
WTSEnumerateSessionsA
WTSVirtualChannelWrite
WTSSendMessageA
WTSQueryUserToken
WTSQuerySessionInformationA
dciman32
DCICreateOverlay
DCICloseProvider
DCIBeginAccess
DCIDestroy
DCIEnum
kernel32
lstrcpynW
GetSystemTime
ReplaceFileA
GetModuleHandleW
GetStringTypeA
SetErrorMode
FindFirstFileA
ReadConsoleW
GetProcAddress
GetLocalTime
WriteConsoleA
DeviceIoControl
GetLastError
GetPrivateProfileIntW
GetPrivateProfileIntW
GetStdHandle
SearchPathA
FindNextVolumeW
GetTickCount
IsBadStringPtrA
lstrcmpiA
CompareStringW
SetEnvironmentVariableW
FoldStringA
Sections
.text Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ