OHPTAEOB
Static task
static1
Behavioral task
behavioral1
Sample
c3aa09b863aefc58cf6d17829748b270_NeikiAnalytics.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
c3aa09b863aefc58cf6d17829748b270_NeikiAnalytics.dll
Resource
win10v2004-20240508-en
General
-
Target
c3aa09b863aefc58cf6d17829748b270_NeikiAnalytics
-
Size
376KB
-
MD5
c3aa09b863aefc58cf6d17829748b270
-
SHA1
02f39db1fd6e81c9916a764087285335d827017a
-
SHA256
c6cdbc9131468e8fba356da8a227593f20ac7880d38bc28ed2e0afb062ab8e0e
-
SHA512
b4e09e29c9ef61796b44e69a8a0bd2906d9fb07ecbdd7806e477f62684a527072fcd01910a85821c529f2f43026c60dd75b5218ee4cc41c459fc2958806a4432
-
SSDEEP
6144:NEm5RaNPkgCWJIPAIZgD8tnNs/JYh0ZDW3aSPqb81tPcSqcCOp1R/7NMUe6yisgu:NEiwNPkwaPAIyD8Rm/Kh0ZDW3aEBbN7U
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c3aa09b863aefc58cf6d17829748b270_NeikiAnalytics
Files
-
c3aa09b863aefc58cf6d17829748b270_NeikiAnalytics.dll windows:4 windows x86 arch:x86
4e013e5db454677fd4cc9cff9ba826eb
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
f3biprct
ord30
ord18
ord27
ord25
ord26
ord14
ord19
ord22
ord28
ord54
ord67
ord31
ord24
ord20
ord3
ord1
f3bilpio
ord9
ord8
ord1
f3biio
ord1
ord22
ord38
f3bidbg
ord4
ord3
ord5
ord1
f3binuc
ord9
f3biifnc
ord79
ord31
ord91
ord9
f3biscrn
ord1
kernel32
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
GetModuleHandleA
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
DisableThreadLibraryCalls
WriteFile
HeapAlloc
VirtualAlloc
HeapReAlloc
GetCPInfo
GetACP
GetOEMCP
GetProcAddress
LoadLibraryA
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
RtlUnwind
Exports
Exports
Sections
.text Size: 236KB - Virtual size: 234KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 60KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rodata Size: 32KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 40KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ