MsiCert.pdb
Static task
static1
Behavioral task
behavioral1
Sample
767ae7f4362619a284d31862a35462e0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
767ae7f4362619a284d31862a35462e0_NeikiAnalytics
-
Size
1.2MB
-
MD5
767ae7f4362619a284d31862a35462e0
-
SHA1
0884d60f634c3ea33ab6c0137b2430e830fc5ae6
-
SHA256
ac8d35d174149ee19d2fc5188cd8756c0abd39f44f5dd0bb0e8ab6c5d397b757
-
SHA512
e68e821d9910d8031bfd253d990d1d1b18c849a55ba666c7f9e28292a0f78e277c1c1996efc923c1a8b826eb15f6b40e4ae944201f4496224c90cacf01ed2950
-
SSDEEP
12288:T40mJ9fLtxKXfxTHP5vDDtbxTezGwd7EM5dEfp5MkVK93P+SdkSS+C3/eoPdBvn:T40mrBxKvxTpDD6qrf3MkIkSFuv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 767ae7f4362619a284d31862a35462e0_NeikiAnalytics
Files
-
767ae7f4362619a284d31862a35462e0_NeikiAnalytics.exe windows:10 windows x86 arch:x86
2a9e8ef4b4a8386ba6d1261855062bd7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetTempPathA
GetLastError
CreateFileA
DeleteFileA
GlobalAlloc
GlobalFree
CloseHandle
GetProcAddress
GetModuleHandleW
GetTempFileNameA
CreateFileW
VirtualQuery
WriteFile
FlushFileBuffers
WriteConsoleW
SetStdHandle
LCMapStringW
MultiByteToWideChar
GetStringTypeW
SetFilePointer
GetSystemInfo
GetModuleFileNameA
GetCommandLineA
GetVersionExW
SetUnhandledExceptionFilter
SetLastError
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
LoadLibraryExW
GetStdHandle
HeapCreate
HeapFree
VirtualFree
GetFileType
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetTickCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
WideCharToMultiByte
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
HeapAlloc
OutputDebugStringA
EnterCriticalSection
LeaveCriticalSection
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
Sleep
VirtualProtect
HeapReAlloc
VirtualAlloc
RtlUnwind
GetConsoleCP
GetConsoleMode
msi
ord122
ord163
ord124
ord31
ord159
ord160
ord91
ord121
ord8
ord17
ord158
ord20
ord223
ord164
version
GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA
crypt32
CertFreeCertificateContext
Sections
.text Size: 50KB - Virtual size: 50KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1.2MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE