Static task
static1
Behavioral task
behavioral1
Sample
cfe68818b4228952c8b056e10d0aa310_NeikiAnalytics.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
cfe68818b4228952c8b056e10d0aa310_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
cfe68818b4228952c8b056e10d0aa310_NeikiAnalytics.exe
-
Size
372KB
-
MD5
cfe68818b4228952c8b056e10d0aa310
-
SHA1
9a8cca2155ec03635fb5c74de546da010c87b27f
-
SHA256
7aceb5248bae7c360a8a741939c39d756d60f7d3fe92c152a1241160144b6115
-
SHA512
d8d198af50e022f14d924b408ed89e580b0c27f2168e86bc50e705a9ce00cf8c1e4a4dc9b535e10bc9a942c839ff392ec3368041154b9239b4d53d10a8c90eeb
-
SSDEEP
6144:dB9OPNaEUzj+uc+KgRlXF+nDzyMjkYABQzNR1CVnl:dzOPNaEKhc+KQCDeMjluqNjCVn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cfe68818b4228952c8b056e10d0aa310_NeikiAnalytics.exe
Files
-
cfe68818b4228952c8b056e10d0aa310_NeikiAnalytics.exe.exe windows:4 windows x86 arch:x86
6abcbf644124138c3ee9e1ad9325010d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FileTimeToSystemTime
SetPriorityClass
GetCurrentProcess
GetCurrentThread
SetThreadPriority
CreateProcessA
lstrcatA
lstrcpyA
GetVersion
CloseHandle
WriteFile
lstrlenA
CreateFileA
GetCurrentProcessId
FindClose
FindFirstFileA
GetTempPathA
GetModuleFileNameA
TerminateProcess
OpenProcess
GetExitCodeProcess
GetProcAddress
GetModuleHandleA
CreateMutexA
WaitForSingleObject
ReleaseMutex
SetConsoleCtrlHandler
LoadLibraryA
Sleep
GetLastError
MapViewOfFile
CreateFileMappingA
GetCurrentThreadId
GetTickCount
HeapDestroy
HeapCreate
ExitThread
CompareStringW
CompareStringA
GetLocaleInfoW
SetEndOfFile
ReadFile
GetOEMCP
GetACP
SetStdHandle
SetFilePointer
GetUserDefaultLCID
HeapAlloc
InterlockedDecrement
InterlockedIncrement
ExitProcess
HeapFree
GetTimeZoneInformation
GetSystemTime
GetLocalTime
EnterCriticalSection
LeaveCriticalSection
RemoveDirectoryA
DeleteFileA
ResumeThread
FileTimeToLocalFileTime
GetDriveTypeA
FindNextFileA
SetEnvironmentVariableA
GetCurrentDirectoryA
SetCurrentDirectoryA
GetFullPathNameA
CreateDirectoryA
RtlUnwind
CreateThread
TlsSetValue
TlsGetValue
EnumSystemLocalesA
GetCommandLineA
GetEnvironmentVariableA
GetVersionExA
GetStdHandle
SetHandleCount
VirtualFree
VirtualAlloc
HeapReAlloc
IsBadWritePtr
InitializeCriticalSection
DeleteCriticalSection
FatalAppExitA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
IsValidCodePage
GetLocaleInfoA
GetFileType
GetStartupInfoA
FlushFileBuffers
TlsAlloc
TlsFree
SetLastError
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetCPInfo
IsValidLocale
user32
MessageBoxA
wsprintfA
ws2_32
connect
closesocket
gethostbyname
htons
socket
WSAStartup
WSACleanup
send
recv
Sections
.text Size: 308KB - Virtual size: 307KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 32KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 16KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ