Static task
static1
Behavioral task
behavioral1
Sample
d81184a040f3d54ddc7451e09d078f00_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d81184a040f3d54ddc7451e09d078f00_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
d81184a040f3d54ddc7451e09d078f00_NeikiAnalytics
-
Size
9.9MB
-
MD5
d81184a040f3d54ddc7451e09d078f00
-
SHA1
1ed68acdc9dc965253bf35167f1da5b99859efd2
-
SHA256
53a4aa9aae56d92ee3749feba6d66341cad05607817c5cf13105d050a18de63a
-
SHA512
d3f355e7a7c99411e656fe4b8be1b6a711cdba5bcdb2447c40991c96535a80527c2ff923084e9399646ce11a75ba3352f22ca121572956d96370cb6f823aca79
-
SSDEEP
196608:r1nul3bjfToWw5VfFBRLyeSrg4OxDHshAGqsSX9iOfl7re+6Q/CupH:rol38WwDp9iOfl7rekbpH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d81184a040f3d54ddc7451e09d078f00_NeikiAnalytics
Files
-
d81184a040f3d54ddc7451e09d078f00_NeikiAnalytics.exe windows:6 windows x86 arch:x86
4b0a79ada6a3a21dbdec2e87e96b8dea
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
GetCurrentProcess
K32GetProcessMemoryInfo
Sleep
CreateFileW
GetUserDefaultLCID
FreeLibrary
LoadLibraryW
GetProcAddress
FindFirstFileW
FindNextFileW
FindClose
WriteConsoleW
HeapSize
SetStdHandle
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObjectEx
GetCurrentThreadId
GetExitCodeThread
GetNativeSystemInfo
FormatMessageA
LocalFree
FindFirstFileExW
GetFileAttributesExW
SetEndOfFile
SetFilePointerEx
AreFileApisANSI
GetLastError
GetFileInformationByHandleEx
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
TryEnterCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
CompareStringEx
GetCPInfo
GetSystemTimeAsFileTime
GetModuleHandleW
LoadLibraryA
ReadFile
WriteFile
LocalAlloc
ExitProcess
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
InitializeSListHead
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
RtlUnwind
InterlockedPushEntrySList
RaiseException
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
DeleteFileW
GetModuleFileNameW
GetStdHandle
HeapFree
HeapAlloc
GetFileType
HeapReAlloc
GetConsoleMode
ReadConsoleW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesW
GetTimeZoneInformation
IsValidCodePage
GetACP
GetOEMCP
GetConsoleCP
GetFileSizeEx
FlushFileBuffers
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
CreateDirectoryW
shell32
ShellExecuteW
shlwapi
PathFileExistsW
user32
MessageBoxA
GetWindowRect
SetWindowPos
GetFocus
advapi32
RegCloseKey
Sections
.text Size: 5.7MB - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2.3MB - Virtual size: 7.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: 136KB - Virtual size: 136KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 41KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 317KB - Virtual size: 317KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ