Static task
static1
Behavioral task
behavioral1
Sample
0149e45c60f18b1b20125c72190e2740_NeikiAnalytics.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
0149e45c60f18b1b20125c72190e2740_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
0149e45c60f18b1b20125c72190e2740_NeikiAnalytics
-
Size
176KB
-
MD5
0149e45c60f18b1b20125c72190e2740
-
SHA1
63de1b60726cf15dc23389ea83ebb1d8547b577b
-
SHA256
0ac6ee8c11041d28cc27d279bfebcfc8b0fa6c8f0453b0868132e1250c35aaf9
-
SHA512
7a7dfdbe8cd6994d6002c6b19b65f382466dfeaef042b564a4bff19fdafbc6b7a3f6fa6aac47f2a7d06dde5eab5bf1e145eb6bfa4a0e8944c5c48f9bb6b17bf8
-
SSDEEP
3072:jGCkTw+UHku1W3C4S8ySZV5tNjFlsSmVlxhAimqRtGENCZMSavs6snQg27zrgh:4MHj03ReS+nMZMSJFssh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0149e45c60f18b1b20125c72190e2740_NeikiAnalytics
Files
-
0149e45c60f18b1b20125c72190e2740_NeikiAnalytics.exe windows:5 windows x86 arch:x86
6e77162a57f8f29d6c4c3704f169c25b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ReleaseMutex
GetLastError
GetStartupInfoA
CreateProcessA
HeapFree
Sleep
HeapAlloc
GetProcessHeap
GetTickCount
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetWindowsDirectoryA
DeleteCriticalSection
GetSystemDirectoryA
DeleteFileA
CreateThread
CreateDirectoryA
VirtualFree
VirtualAlloc
FreeConsole
ExitProcess
SetUnhandledExceptionFilter
InterlockedDecrement
InterlockedIncrement
MultiByteToWideChar
WideCharToMultiByte
SetFileTime
GetCurrentDirectoryA
CreateFileW
GetFileAttributesA
SystemTimeToFileTime
UnmapViewOfFile
DecodePointer
WriteConsoleW
SetFilePointerEx
HeapReAlloc
WaitForSingleObject
CreateMutexA
SetFilePointer
GetCurrentProcess
CloseHandle
CreateFileA
WriteFile
GetFileSizeEx
ReadFile
LocalFree
LocalAlloc
HeapSize
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetStringTypeW
SetStdHandle
FindNextFileA
FindFirstFileExA
FindClose
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetCurrentThreadId
LocalFileTimeToFileTime
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
EncodePointer
GetModuleFileNameW
RaiseException
SetLastError
RtlUnwind
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetModuleHandleExW
GetStdHandle
GetModuleFileNameA
GetCommandLineA
GetCommandLineW
GetACP
CompareStringW
LCMapStringW
GetFileType
IsValidCodePage
GetOEMCP
user32
wsprintfA
advapi32
SystemFunction036
CryptImportKey
CryptVerifySignatureA
CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptReleaseContext
ws2_32
bind
WSAIoctl
closesocket
select
listen
WSAStartup
accept
socket
connect
recv
htonl
setsockopt
gethostbyname
gethostname
__WSAFDIsSet
inet_addr
send
htons
iphlpapi
GetTcpTable
Sections
.text Size: 122KB - Virtual size: 121KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 38KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 1000B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ