PyInit__msi
Static task
static1
Behavioral task
behavioral1
Sample
6e6b48f28900948cf7deba61bbe39cd0_NeikiAnalytics.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6e6b48f28900948cf7deba61bbe39cd0_NeikiAnalytics.dll
Resource
win10v2004-20240508-en
General
-
Target
6e6b48f28900948cf7deba61bbe39cd0_NeikiAnalytics
-
Size
32KB
-
MD5
6e6b48f28900948cf7deba61bbe39cd0
-
SHA1
3c3b218a4e1bdae4283f7f7124392ee479ab6191
-
SHA256
4e7b9e82b15df2dd21cdd7a34d90c028554f77c8cf1535d1f5eee76f25985613
-
SHA512
8e08c1843c88f5b01ab54d03bd5bd8280a08c1e0d8b5b7f9ff372a8ff3aa4ac7314b1a4a0bdcc61972cbb54c1e469f3f37ba2fd0da78c19db5ea370fda7ae5c1
-
SSDEEP
768:97wHsJ+CxooeJ5Dhkze3kGbvCF58ebI0IgxdCgZic7K4KaCPqzuuzzzzzzzzzzzN:mMoAeJ5XhS58eK4KaCQ4mGzo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6e6b48f28900948cf7deba61bbe39cd0_NeikiAnalytics
Files
-
6e6b48f28900948cf7deba61bbe39cd0_NeikiAnalytics.dll windows:4 windows x86 arch:x86
47ae49064f38d1143ee656bc364e9874
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
Imports
libpython3.9
PyArg_ParseTuple
PyBytes_AsString
PyBytes_FromStringAndSize
PyErr_Format
PyErr_NewException
PyErr_NoMemory
PyErr_Occurred
PyErr_SetString
PyExc_MemoryError
PyExc_NotImplementedError
PyExc_TypeError
PyExc_ValueError
PyLong_AsLong
PyLong_FromLong
PyLong_Type
PyModule_AddIntConstant
PyModule_AddObject
PyModule_Create2
PyObject_Free
PyObject_GenericGetAttr
PyObject_GenericSetAttr
PyUnicode_FromWideChar
_PyObject_CallMethodId
_PyObject_New
_PyUnicode_AsUnicode
_Py_Dealloc
_Py_NoneStruct
cabinet
FCIAddFile
FCICreate
FCIDestroy
FCIFlushCabinet
kernel32
CloseHandle
CreateFileA
DeleteCriticalSection
EnterCriticalSection
FileTimeToDosDateTime
FileTimeToLocalFileTime
FreeLibrary
GetFileInformationByHandle
GetLastError
GetModuleHandleA
GetProcAddress
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
msi
MsiCloseHandle
MsiCreateRecord
MsiDatabaseCommit
MsiDatabaseOpenViewW
MsiFormatRecordA
MsiGetLastErrorRecord
MsiGetSummaryInformationA
MsiOpenDatabaseW
MsiRecordClearData
MsiRecordGetFieldCount
MsiRecordGetInteger
MsiRecordGetStringW
MsiRecordSetInteger
MsiRecordSetStreamW
MsiRecordSetStringW
MsiSummaryInfoGetPropertyA
MsiSummaryInfoGetPropertyCount
MsiSummaryInfoPersist
MsiSummaryInfoSetPropertyA
MsiSummaryInfoSetPropertyW
MsiViewClose
MsiViewExecute
MsiViewFetch
MsiViewGetColumnInfo
MsiViewModify
msvcrt
_amsg_exit
_close
_errno
_initterm
_iob
_lock
_lseek
_open
_read
_tempnam
_unlock
_write
abort
calloc
free
fwrite
malloc
memcpy
realloc
remove
strcpy
strlen
strncmp
strncpy
vfprintf
wcslen
rpcrt4
RpcStringFreeW
UuidCreate
UuidToStringW
user32
CharNextA
Exports
Exports
Sections
.text Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.eh_fram Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 144B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 512B - Virtual size: 87B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ