Static task
static1
Behavioral task
behavioral1
Sample
de83b78accae647e1815db4bbae94da0_NeikiAnalytics.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
de83b78accae647e1815db4bbae94da0_NeikiAnalytics.dll
Resource
win10v2004-20240508-en
General
-
Target
de83b78accae647e1815db4bbae94da0_NeikiAnalytics
-
Size
2.2MB
-
MD5
de83b78accae647e1815db4bbae94da0
-
SHA1
a9c4f7af808b541389b799821c913085bdc743ca
-
SHA256
e7d3dfef2352dac9fc1cb5242921f7905c79dc5c563fd41d9d4a78300210bece
-
SHA512
615c36a0b6d0d4743205f18071752281b270d7897898069989eb7e84d3746384d8a6aca7c84722834a14678fc3cedd4c040e05c27b66bb48fee3fa50e6f982a9
-
SSDEEP
49152:xATlZNUmDL7ZX3Aidz7L6AIQPZm6Iqo+JJ6OI4leVYj/:x+zNUmrOidz7mAIQXvJMOI4/j
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource de83b78accae647e1815db4bbae94da0_NeikiAnalytics
Files
-
de83b78accae647e1815db4bbae94da0_NeikiAnalytics.dll windows:5 windows x86 arch:x86
f98ab4a256ae8a86fb300c3a850d1469
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
wininet
FindFirstUrlCacheGroup
comdlg32
ChooseFontW
kernel32
CreateFileA
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
GetUserDefaultLangID
GetModuleHandleA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoA
GetModuleFileNameA
GetStartupInfoW
WaitForSingleObjectEx
UnhandledExceptionFilter
CloseHandle
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
SetStdHandle
SetFilePointer
FlushFileBuffers
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
LoadLibraryA
EnterCriticalSection
LeaveCriticalSection
GetStdHandle
DeleteCriticalSection
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
IsDebuggerPresent
Sleep
GetLastError
HeapFree
GetModuleHandleW
GetProcAddress
ExitProcess
MultiByteToWideChar
ReadFile
SetLastError
InitializeCriticalSectionAndSpinCount
TlsGetValue
TlsSetValue
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
RtlUnwind
HeapAlloc
HeapReAlloc
VirtualFree
VirtualAlloc
WriteFile
netapi32
Netbios
NetShareSetInfo
clusapi
ClusterRegDeleteValue
rpcrt4
IUnknown_QueryInterface_Proxy
I_RpcServerSetAddressChangeFn
UuidToStringW
oleaut32
LoadTypeLibEx
iphlpapi
GetIpForwardTable
shlwapi
StrRChrW
ws2_32
closesocket
winmm
midiOutClose
waveOutMessage
ole32
MkParseDisplayName
HICON_UserFree
CoGetClassObject
advapi32
IsValidAcl
RegCloseKey
LookupPrivilegeDisplayNameW
lz32
LZClose
shell32
SHPathPrepareForWriteW
ShellAboutA
ShellExecuteExW
gdi32
GetMapMode
SetPixelV
GetDeviceGammaRamp
SetBkColor
SetSystemPaletteUse
user32
SendNotifyMessageW
GetDlgItemInt
IsDialogMessageA
OpenWindowStationA
MessageBoxIndirectW
UnregisterClassA
ShowWindow
DrawIconEx
setupapi
SetupDiRegisterDeviceInfo
SetupQuerySpaceRequiredOnDriveW
urlmon
URLOpenStreamA
Sections
.text Size: 52KB - Virtual size: 49KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.idata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
9YXw Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Z Size: 68KB - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
O Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
O|6pf Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ