MsiCert.pdb
Static task
static1
Behavioral task
behavioral1
Sample
4a2259eeb7405cf201a5f6fed86e9310_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
4a2259eeb7405cf201a5f6fed86e9310_NeikiAnalytics.exe
-
Size
1.5MB
-
MD5
4a2259eeb7405cf201a5f6fed86e9310
-
SHA1
5d92876710aa8fd42b34c850085211b042bbe989
-
SHA256
85fb739aa6959ab5a543bc8e35b6bab74c409f8e6923111fcbafabafd423b151
-
SHA512
3af291484778465e3efcc0bf8e5b57d46fc7acb84c79175e53f28ecd596c337b2c1c4e5b284dbad113add6a04a990c57aa3a437236b4991a1494ee143b88fad5
-
SSDEEP
24576:340mrh8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:Nm1gDUYmvFur31yAipQCtXxc0H
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4a2259eeb7405cf201a5f6fed86e9310_NeikiAnalytics.exe
Files
-
4a2259eeb7405cf201a5f6fed86e9310_NeikiAnalytics.exe.exe windows:10 windows x86 arch:x86
2a9e8ef4b4a8386ba6d1261855062bd7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetTempPathA
GetLastError
CreateFileA
DeleteFileA
GlobalAlloc
GlobalFree
CloseHandle
GetProcAddress
GetModuleHandleW
GetTempFileNameA
CreateFileW
VirtualQuery
WriteFile
FlushFileBuffers
WriteConsoleW
SetStdHandle
LCMapStringW
MultiByteToWideChar
GetStringTypeW
SetFilePointer
GetSystemInfo
GetModuleFileNameA
GetCommandLineA
GetVersionExW
SetUnhandledExceptionFilter
SetLastError
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
LoadLibraryExW
GetStdHandle
HeapCreate
HeapFree
VirtualFree
GetFileType
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetTickCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
WideCharToMultiByte
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
HeapAlloc
OutputDebugStringA
EnterCriticalSection
LeaveCriticalSection
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
Sleep
VirtualProtect
HeapReAlloc
VirtualAlloc
RtlUnwind
GetConsoleCP
GetConsoleMode
msi
ord122
ord163
ord124
ord31
ord159
ord160
ord91
ord121
ord8
ord17
ord158
ord20
ord223
ord164
version
GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA
crypt32
CertFreeCertificateContext
Sections
.text Size: 50KB - Virtual size: 50KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE