Static task
static1
Behavioral task
behavioral1
Sample
a6714cbf144078eb23be0e69176df780_NeikiAnalytics.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
a6714cbf144078eb23be0e69176df780_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
a6714cbf144078eb23be0e69176df780_NeikiAnalytics.exe
-
Size
472KB
-
MD5
a6714cbf144078eb23be0e69176df780
-
SHA1
6effdd39a6c338dbae8db49bc5cab512652bc26f
-
SHA256
c043ca45c7c3471d8b63d22d8b55725eb4f3f55d70807dddf5d218f28482085d
-
SHA512
606235e6771f1f7cdfc88594537f92246af30d62da6bc7eec819185593de3bae836d8b30d4a0a713009a1a8ad56ee8fee5ab8d52d196b43a1c886fe304e766a0
-
SSDEEP
12288:myLnMGeZC0/y7CBumPzy7LxrACTz7AAO:myLnMGI7/y7CEmPz2zTz7AA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a6714cbf144078eb23be0e69176df780_NeikiAnalytics.exe
Files
-
a6714cbf144078eb23be0e69176df780_NeikiAnalytics.exe.exe windows:4 windows x86 arch:x86
386e0233fcc41fb75565b07f666dc543
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord5856
ord6648
ord4203
ord6874
ord2764
ord6569
ord5601
ord926
ord4083
ord1814
ord3790
ord1911
ord3316
ord3314
ord5242
ord6121
ord1774
ord2490
ord2509
ord3069
ord3062
ord5658
ord2395
ord6322
ord2609
ord1006
ord1787
ord4291
ord503
ord775
ord5192
ord1994
ord6123
ord5010
ord2721
ord5708
ord1813
ord1773
ord1978
ord5200
ord5181
ord317
ord635
ord5009
ord2393
ord321
ord823
ord1668
ord5712
ord2017
ord802
ord542
ord1567
ord268
ord6663
ord1261
ord5699
ord5692
ord5701
ord5703
ord5694
ord4099
ord5697
ord2777
ord3663
ord1871
ord879
ord2740
ord882
ord2801
ord1193
ord1151
ord668
ord3178
ord2781
ord2770
ord356
ord610
ord287
ord5690
ord603
ord5933
ord1969
ord273
ord665
ord5186
ord354
ord5440
ord2810
ord5622
ord5442
ord6385
ord4274
ord6375
ord4486
ord2554
ord5731
ord1089
ord5199
ord2396
ord3346
ord5300
ord4079
ord4698
ord5289
ord5714
ord2982
ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord3830
ord3831
ord3825
ord3079
ord1576
ord4622
ord4424
ord3738
ord815
ord561
ord2725
ord5307
ord3922
ord617
ord700
ord5214
ord398
ord296
ord798
ord1997
ord5465
ord5194
ord533
ord3810
ord923
ord2077
ord4202
ord524
ord2029
ord1085
ord690
ord5311
ord5683
ord3215
ord389
ord536
ord2652
ord1669
ord957
ord4058
ord859
ord6407
ord5700
ord5695
ord5704
ord5709
ord6878
ord5583
ord1105
ord3880
ord2814
ord2820
ord3811
ord3337
ord551
ord2818
ord6282
ord6876
ord6662
ord5710
ord924
ord922
ord4327
ord6877
ord1200
ord4160
ord540
ord6283
ord2763
ord939
ord4129
ord858
ord941
ord535
ord940
ord800
ord4278
ord537
ord4189
ord913
ord860
ord5220
ord2614
ord4411
ord4919
ord1168
ord791
ord825
ord523
ord967
ord1995
ord5479
ord5797
ord4975
ord4863
ord4335
ord4447
ord2032
ord5482
ord5811
ord4779
ord5308
ord1925
ord1979
ord4080
msvcrt
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
?terminate@@YAXXZ
_except_handler3
??1type_info@@UAE@XZ
_onexit
__dllonexit
_mbsicmp
_itoa
isprint
_purecall
_mbscoll
fopen
fgets
fclose
free
time
srand
rand
malloc
_mbsnbcpy
_CxxThrowException
_mbsicoll
atof
islower
isupper
_stat
sscanf
__CxxFrameHandler
sprintf
_mbsnbcmp
_setmbcp
_mkdir
isdigit
_CIpow
_mbscmp
atol
atoi
kernel32
GetProcAddress
GetModuleHandleA
GetVersion
GetEnvironmentVariableA
GetComputerNameA
GetLastError
Sleep
LoadLibraryA
CopyFileA
DeleteFileA
ReadFile
FlushFileBuffers
WriteFile
PurgeComm
LocalAlloc
SetupComm
GetCommTimeouts
CreateFileA
SetCommTimeouts
SetCommState
GetCommState
CancelIo
CloseHandle
FileTimeToSystemTime
SetFilePointer
GetFileSize
GetFileInformationByHandle
MapViewOfFile
CreateFileMappingA
UnmapViewOfFile
SystemTimeToFileTime
GetLocalTime
GetTickCount
GetStartupInfoA
MoveFileExA
FreeLibrary
GetSystemDirectoryA
EscapeCommFunction
LocalFree
GetModuleHandleW
GetModuleFileNameA
LocalUnlock
LocalLock
GetLocaleInfoA
user32
MessageBoxA
GetDesktopWindow
SendMessageA
PeekMessageA
wsprintfA
advapi32
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegSetValueExA
odbc32
ord72
wsock32
shutdown
Sections
.text Size: 372KB - Virtual size: 370KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 64KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 28KB - Virtual size: 111KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ