C:\Documents and Settings\Administrator\Desktop\ShellExec\out\release\qvjxjtk.pdb
Static task
static1
Behavioral task
behavioral1
Sample
6befff5f7e9c763f81c13dc02d0010d0_NeikiAnalytics.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
6befff5f7e9c763f81c13dc02d0010d0_NeikiAnalytics.dll
Resource
win10v2004-20240226-en
General
-
Target
6befff5f7e9c763f81c13dc02d0010d0_NeikiAnalytics
-
Size
6.9MB
-
MD5
6befff5f7e9c763f81c13dc02d0010d0
-
SHA1
872dd924010b9fc9194e212995d99b6e7ab7c330
-
SHA256
b71601cf7cdb71b3cf4c1f72b0c36d9e259c7aff46499a8828bf629085ee9af6
-
SHA512
b855af84f95ee8a989c177493665f61d3f05bbe49f88538123738cd8229cf9d3cd0142f0783809fda63e7b149bb7298abfb12dfde171d425ece1f39bb1973090
-
SSDEEP
98304:UbAq6pE3dgL2bry77I3kx31nEpv26xiNE6JgzffNXYyM6mIc8:x+37KNDEN2+thIyMZ4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6befff5f7e9c763f81c13dc02d0010d0_NeikiAnalytics
Files
-
6befff5f7e9c763f81c13dc02d0010d0_NeikiAnalytics.dll windows:5 windows x86 arch:x86
53b6e2eb8919330c87958716761129f2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
CreateFileA
SetFilePointer
lstrlenA
FreeLibrary
HeapAlloc
SetEnvironmentVariableW
GetEnvironmentStringsW
GetModuleHandleExW
GetTickCount
GetProcessHeap
FormatMessageA
GetLocaleInfoW
GetModuleFileNameW
lstrlenW
GetLastError
GetProcAddress
GetComputerNameA
ConvertDefaultLocale
VirtualProtect
GetCurrentDirectoryA
lstrcpyW
lstrcpyA
SetEnvironmentVariableA
WriteConsoleW
SetEndOfFile
HeapReAlloc
HeapSize
FlushFileBuffers
LoadLibraryA
GetCommandLineW
LCMapStringW
SetStdHandle
LoadLibraryW
HeapFree
WideCharToMultiByte
GetCurrentThreadId
DecodePointer
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
EncodePointer
RtlUnwind
IsProcessorFeaturePresent
GetStringTypeW
HeapCreate
HeapDestroy
GetModuleHandleW
ExitProcess
WriteFile
GetStdHandle
RaiseException
MultiByteToWideChar
ReadFile
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
SetHandleCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
CloseHandle
Sleep
GetModuleFileNameA
FreeEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
CreateFileW
GetConsoleCP
GetConsoleMode
CompareStringW
user32
IsWindowEnabled
FindWindowW
ReleaseDC
GetDesktopWindow
EnableScrollBar
IsWindow
PostMessageA
FindWindowA
CreateWindowExA
gdi32
GetObjectType
shell32
ShellExecuteA
shlwapi
PathRemoveFileSpecW
PathStripPathA
Exports
Exports
CWqAUo8Sm6Qk4OiQ
aMHXZstceqZjYT
bojcjpyiehfpuczy
cgsuwwewmnmgd
pfywzuhuqaoe
uUKIMoHidhaKQhB
uqlmfhudhjhujsyn
vusqqnmzvpnegrph
xSbfMYnoOMmw
xosyhhqmcqflo
xxzoipdozgxdsasx
zrRFOGBbyETipb
Sections
.text Size: 73KB - Virtual size: 72KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ