General
-
Target
03b054227a8f087a0b939c8f88d9ab8c11ef6634db7167be7bb07d78808f1e57_NeikiAnalytics
-
Size
1.7MB
-
MD5
b74e25bfe1ef2b74dea5d8955d654c20
-
SHA1
a32dc324923d256dbfbf7cfb222862d42f7248d2
-
SHA256
03b054227a8f087a0b939c8f88d9ab8c11ef6634db7167be7bb07d78808f1e57
-
SHA512
4b140ff1bb6aa3d484f321d9713889a1cdd5cd3cbe3b9b10acacb9bf98348a11dbe2b54f2023f6e5b3fd051e9b5bbcf6f72b7b1b2a2bb9434e601aceb0eb4043
-
SSDEEP
49152:LjA8ggSDcajICf3Ckh7lzBmwrqNGOHWG/gQtHyftAmYirEI5:Lc8h6Zh7Xmwr+HboQtSlAmYIX
Malware Config
Signatures
-
Processes:
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 03b054227a8f087a0b939c8f88d9ab8c11ef6634db7167be7bb07d78808f1e57_NeikiAnalytics
Files
-
03b054227a8f087a0b939c8f88d9ab8c11ef6634db7167be7bb07d78808f1e57_NeikiAnalytics.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 139KB - Virtual size: 313KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 21KB - Virtual size: 71KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 2KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 12KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.vm_sec Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.themida Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 16B - Virtual size: 4KB
IMAGE_SCN_MEM_READ