Static task
static1
Behavioral task
behavioral1
Sample
419017078a34d4975067dcdfce47a4e0_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
419017078a34d4975067dcdfce47a4e0_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
General
-
Target
419017078a34d4975067dcdfce47a4e0_NeikiAnalytics.exe
-
Size
3.7MB
-
MD5
419017078a34d4975067dcdfce47a4e0
-
SHA1
dc3235c37dbc420532f69a0e584c85bcc7015eda
-
SHA256
bbaa8fa8ffd087642046284eb942866c894716a543202eedcae2f59cd67363e2
-
SHA512
61938d63de6d865083d9bb3af1896cd424058388488625dbe1691717308aab952b8df102eae78c0bb0baf49c0cc02065240d065b67a659c5254529fe3b0c8e9f
-
SSDEEP
98304:Wh/6wGSrfKIFFFpFFFFFJRWFFFFFfFFYFFCNtcWVLYvV5M6vlQ1U+Mcg4VnR:6/6wjKh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 419017078a34d4975067dcdfce47a4e0_NeikiAnalytics.exe
Files
-
419017078a34d4975067dcdfce47a4e0_NeikiAnalytics.exe.exe windows:4 windows x86 arch:x86
e36fc66558424bb7509d440ac5213867
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
recv
WSAAsyncSelect
htonl
closesocket
accept
listen
bind
WSACleanup
socket
htons
gethostname
WSAStartup
WSAGetLastError
connect
inet_addr
send
inet_ntoa
cj609libd
??1CCJTreeCtrl@@UAE@XZ
?GetNextItem@CCJTreeCtrl@@UAEPAU_TREEITEM@@PAU2@@Z
??0CCJTreeCtrl@@QAE@XZ
?messageMap@CCJTreeCtrl@@1UAFX_MSGMAP@@B
?PreCreateWindow@CCJTreeCtrl@@MAEHAAUtagCREATESTRUCTA@@@Z
?GetRuntimeClass@CCJTreeCtrl@@UBEPAUCRuntimeClass@@XZ
?LoadToolBar@CCJToolBar@@QAEHIPAUTOOLBARINFO@@@Z
?GetPrevItem@CCJTreeCtrl@@UAEPAU_TREEITEM@@PAU2@@Z
?GetLastItem@CCJTreeCtrl@@UAEPAU_TREEITEM@@PAU2@@Z
?GetPrevSelectedItem@CCJTreeCtrl@@UAEPAU_TREEITEM@@PAU2@@Z
?GetNextSelectedItem@CCJTreeCtrl@@UAEPAU_TREEITEM@@PAU2@@Z
?GetFirstSelectedItem@CCJTreeCtrl@@UAEPAU_TREEITEM@@XZ
?GetItemColor@CCJTreeCtrl@@UAEKPAU_TREEITEM@@@Z
?ClearSelection@CCJTreeCtrl@@UAEXXZ
??1CCJFlatButton@@UAE@XZ
??0CCJFlatButton@@QAE@XZ
??1CCJFlatSplitterWnd@@UAE@XZ
??1CCJCaption@@UAE@XZ
??0CCJFlatSplitterWnd@@QAE@XZ
??0CCJCaption@@QAE@XZ
?classCCJHtmlView@CCJHtmlView@@2UCRuntimeClass@@B
?DocumentComplete@CCJHtmlView@@MAEXPAUIDispatch@@PAUtagVARIANT@@@Z
?BeforeNavigate2@CCJHtmlView@@MAEXPAUIDispatch@@PAUtagVARIANT@@1111PAH@Z
?NavigateComplete2@CCJHtmlView@@MAEXPAUIDispatch@@PAUtagVARIANT@@@Z
?OnTheaterMode@CCJHtmlView@@UAEXH@Z
?OnFullScreen@CCJHtmlView@@UAEXH@Z
?OnStatusBar@CCJHtmlView@@UAEXH@Z
?OnMenuBar@CCJHtmlView@@UAEXH@Z
?OnToolBar@CCJHtmlView@@UAEXH@Z
?OnVisible@CCJHtmlView@@UAEXH@Z
?OnQuit@CCJHtmlView@@UAEXXZ
?OnDocumentComplete@CCJHtmlView@@UAEXPBD@Z
?OnNewWindow2@CCJHtmlView@@UAEXPAPAUIDispatch@@PAH@Z
?OnPropertyChange@CCJHtmlView@@UAEXPBD@Z
?OnTitleChange@CCJHtmlView@@UAEXPBD@Z
?OnDownloadComplete@CCJHtmlView@@UAEXXZ
?OnDownloadBegin@CCJHtmlView@@UAEXXZ
?OnCommandStateChange@CCJHtmlView@@UAEXJH@Z
?OnProgressChange@CCJHtmlView@@UAEXJJ@Z
?OnNavigateComplete2@CCJHtmlView@@UAEXPBD@Z
?OnDraw@CCJHtmlView@@UAEXPAVCDC@@@Z
?Create@CCJHtmlView@@UAEHPBD0KABUtagRECT@@PAVCWnd@@IPAUCCreateContext@@@Z
?GetEventSinkMap@CCJHtmlView@@MBEPBUAFX_EVENTSINKMAP@@XZ
??1CCJHtmlView@@MAE@XZ
??0CCJHtmlView@@IAE@XZ
?messageMap@CCJHtmlView@@1UAFX_MSGMAP@@B
?AssertValid@CCJHtmlView@@UBEXXZ
?Dump@CCJHtmlView@@UBEXAAVCDumpContext@@@Z
?LoadFromResource@CCJHtmlView@@QAEHI@Z
?OnBeforeNavigate2@CCJHtmlView@@UAEXPBDK0AAVCByteArray@@0PAH@Z
?OnStatusTextChange@CCJHtmlView@@UAEXPBD@Z
?Navigate2@CCJHtmlView@@QAEXPBDK00PAXK@Z
?GetNextItem@CCJTreeCtrl@@UAEPAU_TREEITEM@@PAU2@I@Z
?PreCreateWindow@CCJFrameWnd@@MAEHAAUtagCREATESTRUCTA@@I@Z
?DockControlBarLeftOf@CCJFrameWnd@@UAEXPAVCControlBar@@0@Z
?EnableDocking@CCJFrameWnd@@UAEXK@Z
?SaveBarState@CCJFrameWnd@@UBEXPBD@Z
?LoadBarState@CCJFrameWnd@@UAEXPBD@Z
?PreTranslateMessage@CCJFrameWnd@@UAEHPAUtagMSG@@@Z
??1CCJCoolMenu@@UAE@XZ
??1CCJToolBar@@UAE@XZ
??1CGfxSplitterWnd@@UAE@XZ
??1CCJFrameWnd@@UAE@XZ
??0CCJCoolMenu@@QAE@XZ
??0CCJToolBar@@QAE@XZ
??0CGfxSplitterWnd@@QAE@XZ
??0CCJFrameWnd@@QAE@XZ
?InsertControl@CCJToolBar@@QAEPAVCWnd@@PAUCRuntimeClass@@PBDAAVCRect@@IK@Z
?classCCJFlatComboBox@CCJFlatComboBox@@2UCRuntimeClass@@B
?LoadMenuBar@CCJMenuBar@@QAEHI@Z
?SetItemFont@CCJTreeCtrl@@UAEXPAU_TREEITEM@@AAUtagLOGFONTA@@@Z
?LoadToolbar@CCJCoolMenu@@QAEHI@Z
?Install@CCJCoolMenu@@QAEXPAVCWnd@@@Z
?IsFindValid@CCJTreeCtrl@@MAEHPAU_TREEITEM@@@Z
?FindItem@CCJTreeCtrl@@UAEPAU_TREEITEM@@PBDHHHPAU2@@Z
?SelectItems@CCJTreeCtrl@@UAEHPAU_TREEITEM@@0@Z
?GetItemBold@CCJTreeCtrl@@UAEHPAU_TREEITEM@@@Z
?GetItemFont@CCJTreeCtrl@@UAEHPAU_TREEITEM@@PAUtagLOGFONTA@@@Z
?EnableMultiSelect@CCJTreeCtrl@@UAEXH@Z
?SetItemColor@CCJTreeCtrl@@UAEXPAU_TREEITEM@@K@Z
?SetItemBold@CCJTreeCtrl@@UAEXPAU_TREEITEM@@H@Z
syscomm
ord8
mfc42d
ord3069
ord3944
ord3670
ord2076
ord1566
ord5078
ord3002
ord4064
ord1344
ord4191
ord1830
ord1631
ord4205
ord2340
ord2481
ord2584
ord3691
ord2473
ord2585
ord2341
ord2432
ord2339
ord3143
ord3144
ord3142
ord2431
ord3367
ord3786
ord3658
ord1952
ord1228
ord4492
ord2875
ord574
ord317
ord728
ord1757
ord1857
ord3524
ord4983
ord3831
ord4934
ord1087
ord3655
ord3779
ord3776
ord3774
ord3552
ord5077
ord3702
ord1880
ord1860
ord4415
ord3231
ord1033
ord4130
ord1789
ord2661
ord4227
ord4229
ord3366
ord3826
ord4239
ord4408
ord3784
ord3657
ord2021
ord1285
ord2986
ord528
ord706
ord730
ord900
ord1546
ord5065
ord4951
ord4228
ord996
ord468
ord719
ord1313
ord567
ord3446
ord4820
ord2052
ord4143
ord308
ord1136
ord4630
ord586
ord349
ord596
ord3690
ord4291
ord1041
ord1661
ord1809
ord4215
ord2104
ord1401
ord3527
ord3825
ord2411
ord2415
ord5058
ord1858
ord1876
ord4178
ord4420
ord1350
ord4304
ord2484
ord4387
ord3656
ord4000
ord3950
ord1797
ord3636
ord2753
ord2509
ord4749
ord3373
ord4785
ord4901
ord3785
ord3660
ord328
ord582
ord3382
ord1232
ord1956
ord3777
ord1490
ord3551
ord3758
ord3757
ord3978
ord3627
ord3972
ord4068
ord3611
ord3616
ord3970
ord3729
ord3739
ord3738
ord3726
ord3728
ord3725
ord4004
ord4002
ord3379
ord4756
ord1365
ord4175
ord4216
ord3001
ord1343
ord3664
ord704
ord3432
ord526
ord4190
ord1042
ord3836
ord1284
ord2020
ord3369
ord2255
ord2640
ord470
ord1731
ord450
ord3689
ord3572
ord2995
ord4036
ord556
ord573
ord1799
ord1316
ord3201
ord5072
ord2271
ord4457
ord1639
ord316
ord2324
ord877
ord454
ord3421
ord293
ord2716
ord2024
ord1288
ord533
ord709
ord2435
ord4381
ord2068
ord5056
ord3403
ord3302
ord3554
ord2129
ord1811
ord2351
ord1497
ord2383
ord1788
ord374
ord612
ord1038
ord1187
ord659
ord2008
ord1273
ord2950
ord442
ord1438
ord1993
ord1261
ord632
ord398
ord714
ord3150
ord1826
ord4328
ord2213
ord4339
ord2423
ord2208
ord648
ord1934
ord4566
ord2283
ord2127
ord4403
ord558
ord862
ord1893
ord418
ord1896
ord4811
ord4460
ord1714
ord417
ord1900
ord2120
ord1582
ord1729
ord298
ord2570
ord2993
ord863
ord1638
ord2108
ord4303
ord473
ord2409
ord2422
ord1098
ord723
ord1212
ord1602
ord1800
ord3300
ord2673
ord3561
ord981
ord490
ord2298
ord1538
ord2676
ord2605
ord2352
ord1627
ord697
ord3450
ord516
ord2674
ord1721
ord1676
ord1078
ord812
ord2677
ord3040
ord943
ord944
ord3098
ord945
ord474
ord2043
ord4458
ord3415
ord3570
ord3481
ord4525
ord486
ord4787
ord2800
ord1834
ord1295
ord979
ord878
ord4887
ord2122
ord4556
ord4152
ord1127
ord4368
ord1808
ord813
ord3068
ord4282
ord1666
ord415
ord830
ord4378
ord4856
ord4578
ord1016
ord2252
ord983
ord1208
ord3267
ord847
ord2936
ord410
ord643
ord4264
ord5093
ord2419
ord797
ord803
ord1996
ord1122
ord1264
ord4256
ord5084
ord2613
ord4861
ord1869
ord3625
ord3341
ord4278
ord3391
ord1783
ord4073
ord1326
ord1332
ord4172
ord5074
ord4207
ord4063
ord4180
ord1828
ord2709
ord2018
ord1282
ord2978
ord2094
ord3180
ord1935
ord4993
ord2110
ord4998
ord4286
ord4235
ord2327
ord4430
ord4927
ord4427
ord4916
ord3603
ord4921
ord4731
ord4462
ord4467
ord4398
ord4417
ord4305
ord4301
ord4766
ord4540
ord1951
ord1227
ord2874
ord4929
ord3375
ord3640
ord2863
ord699
ord559
ord519
ord299
ord3553
ord3563
ord2301
ord3793
ord4297
ord4048
ord3879
ord3877
ord4653
ord2742
ord2790
ord3755
ord3848
ord3608
ord3632
ord4011
ord3309
ord2230
ord5073
ord1504
ord3889
ord5011
ord3170
ord1902
ord3598
ord3174
ord4461
ord868
ord1775
ord2179
ord296
ord449
ord562
ord4433
ord302
ord1930
ord5005
ord4952
ord1928
ord4475
ord972
ord1629
ord3447
ord5064
ord1032
ord3119
ord1310
ord1547
ord3513
ord1914
ord3642
ord2869
ord306
ord565
ord4170
ord4720
ord1577
ord493
ord2256
ord3042
ord846
ord2249
ord3610
ord3614
ord3969
ord4003
ord4001
ord4755
ord1342
ord4209
ord3059
ord4818
ord2619
ord2751
ord2508
ord2084
ord3517
ord646
ord413
ord1019
ord318
ord1105
ord740
ord2174
ord507
ord3110
ord2783
ord422
ord4676
ord3960
ord865
ord1906
ord3365
ord3768
ord3862
ord4674
ord335
ord4615
ord4589
ord2123
ord617
ord380
ord2232
ord2316
msvcrtd
_CxxThrowException
_setmbcp
free
malloc
wcscpy
wcslen
wcscmp
memmove
_mbsnbcpy
_splitpath
strstr
atoi
strtoul
_mbstok
strchr
rand
abs
isalpha
isdigit
fclose
fprintf
fopen
_errno
_stat
_ftime
strncpy
asctime
localtime
strtod
_strdup
_CrtDbgReport
pow
__dllonexit
_onexit
??1type_info@@UAE@XZ
_except_handler3
?terminate@@YAXXZ
_exit
_XcptFilter
exit
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
time
srand
strcmp
strcpy
strlen
memcpy
_ftol
memset
sscanf
sprintf
__CxxFrameHandler
_chkesp
_initterm
__getmainargs
_acmdln
kernel32
LockResource
LoadResource
FindResourceA
FreeResource
lstrcmpiA
CloseHandle
WriteFile
CreateFileA
GetModuleFileNameA
GetLocalTime
WinExec
GlobalFree
lstrcmpA
GlobalAlloc
GlobalReAlloc
lstrcpyA
GlobalUnlock
GlobalLock
GlobalSize
MulDiv
lstrcpynA
Sleep
GetTickCount
GetModuleHandleA
GetStartupInfoA
GetCPInfo
lstrlenW
GetVersion
GetVersionExA
CreateMutexA
FormatMessageA
LocalAlloc
LocalFree
InterlockedDecrement
WideCharToMultiByte
lstrlenA
GetLastError
MultiByteToWideChar
user32
wsprintfA
GetSysColor
GetSystemMetrics
TranslateAcceleratorA
MessageBoxA
MessageBeep
SetWindowLongA
ShowWindow
GetFocus
ClipCursor
IsClipboardFormatAvailable
GetParent
EmptyClipboard
SetClipboardData
CloseClipboard
GetWindowLongA
GetDlgItem
GetMessagePos
GetClassInfoA
DefWindowProcA
LoadCursorA
IsWindow
GetKeyState
TranslateMessage
DispatchMessageA
LoadBitmapA
ReleaseCapture
GetCursorPos
LoadAcceleratorsA
SendMessageA
LoadImageA
GetIconInfo
GetDC
CreateIconIndirect
ReleaseDC
PostMessageA
SetCursor
IsMenu
DestroyCursor
GetSysColorBrush
FillRect
DrawTextA
DrawIconEx
DestroyIcon
GetMenuItemInfoA
SystemParametersInfoA
gdi32
GetDIBColorTable
CreateFontA
GetObjectA
GetPixel
TextOutA
CreateFontIndirectA
SetTextColor
SetBkColor
CreateBitmap
SetPixel
CreateCompatibleBitmap
GetStockObject
CreateCompatibleDC
CreateDIBSection
SelectObject
BitBlt
CreateSolidBrush
DeleteObject
DeleteDC
GetTextExtentPoint32W
advapi32
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
shell32
ShellExecuteExA
ShellExecuteA
comctl32
ImageList_DrawEx
_TrackMouseEvent
ImageList_GetIconSize
mfco42d
ord3063
ord1412
ord639
ord321
ord798
ord1054
ord589
ord552
ord283
ord3062
ord2955
ord1818
ord3018
ord931
ord323
ord1629
ord2069
ord1216
ord2904
ord586
ord905
ord322
ord2296
ord1682
ord1273
ord879
ord347
ord595
ord2766
ord2823
ord1414
ord744
ord333
ord334
ord327
ord1929
ord339
ord2663
ord734
ord728
ord1915
ord332
ord809
ord1931
ord2061
ole32
OleUninitialize
OleInitialize
CLSIDFromString
CLSIDFromProgID
CoCreateInstance
OleRun
oleaut32
CreateErrorInfo
SetErrorInfo
SysStringByteLen
SysAllocStringByteLen
VariantChangeType
SysAllocString
VariantClear
VariantCopy
VariantInit
SysFreeString
GetErrorInfo
msimg32
TransparentBlt
winmm
sndPlaySoundA
Sections
.text Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 124KB - Virtual size: 122KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 111.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 24KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 320KB - Virtual size: 319KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ