CourierInit
Static task
static1
Behavioral task
behavioral1
Sample
11d836e1ea3dd8da1aa27c480318cfaae2eb1ad3a6a85146a0c1d14255de649c_NeikiAnalytics.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
11d836e1ea3dd8da1aa27c480318cfaae2eb1ad3a6a85146a0c1d14255de649c_NeikiAnalytics.dll
Resource
win10v2004-20240508-en
General
-
Target
11d836e1ea3dd8da1aa27c480318cfaae2eb1ad3a6a85146a0c1d14255de649c_NeikiAnalytics
-
Size
116KB
-
MD5
200cee1e7c7b81b5af5eea407827f050
-
SHA1
f0f54ea6fd2ce2e65c2c912bd372a62c931cd687
-
SHA256
11d836e1ea3dd8da1aa27c480318cfaae2eb1ad3a6a85146a0c1d14255de649c
-
SHA512
06e4c9f8106ed692fe312809b9bd68cd3a65354fc1228f9cb0769f48fb9f78609e9c401be16589d915468e8929c5942d35d0df9b188f612cbe5ddf4be07790ea
-
SSDEEP
3072:h5liElcEnkvsm9edptoxp5NFR4SDTIgPlBv040rzai:vlPfkvsmGKNrlBMo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 11d836e1ea3dd8da1aa27c480318cfaae2eb1ad3a6a85146a0c1d14255de649c_NeikiAnalytics
Files
-
11d836e1ea3dd8da1aa27c480318cfaae2eb1ad3a6a85146a0c1d14255de649c_NeikiAnalytics.dll windows:4 windows x86 arch:x86
b6069e9e602245349b3e082dda87ccb5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
iphlpapi
GetIpAddrTable
ws2_32
gethostbyname
wininet
InternetCanonicalizeUrlA
InternetCrackUrlA
InternetCreateUrlA
mfc71
ord2392
ord2415
ord2403
ord1191
ord1187
ord578
ord304
ord3641
ord3441
ord1084
ord5182
ord4212
ord4735
ord4890
ord2396
ord1671
ord1670
ord1551
ord5912
ord1620
ord1617
ord3946
ord1401
ord4244
ord5152
ord1908
ord5073
ord6275
ord4185
ord5203
ord3403
ord4722
ord1600
ord5960
ord923
ord928
ord2398
ord2400
ord2390
ord5233
ord5235
ord762
ord764
ord297
ord4282
ord4580
ord5807
ord2160
ord781
ord2468
ord5403
ord2322
ord2657
ord2164
ord2020
ord1892
ord1793
ord354
ord310
ord784
ord605
ord4262
ord4486
ord3949
ord2644
ord3709
ord3719
ord3718
ord2533
ord2646
ord2540
ord2862
ord2714
ord4307
ord2835
ord2731
ord2537
ord5200
ord1599
ord1655
ord1656
ord1964
ord5175
ord1362
ord4967
ord3345
ord6277
ord3802
ord6279
ord1522
ord2172
ord2178
ord2405
ord2387
ord2385
ord2408
ord2413
ord2394
ord2410
ord934
ord930
ord932
msvcr71
realloc
?terminate@@YAXXZ
_onexit
__dllonexit
__security_error_handler
__CppXcptFilter
_adjust_fdiv
_initterm
memset
sscanf
memmove
isdigit
_time64
_ctime64
isspace
isalpha
atoi
__CxxFrameHandler
isalnum
_splitpath
strrchr
strncpy
_strlwr
strncmp
sprintf
strstr
strchr
wcscpy
_except_handler3
_resetstkoflw
free
malloc
_stricmp
_strnicmp
kernel32
ExitProcess
RaiseException
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
WritePrivateProfileStringA
WritePrivateProfileSectionA
GetPrivateProfileStringA
GetPrivateProfileSectionA
GetPrivateProfileSectionNamesA
SetFileAttributesA
CopyFileA
DeviceIoControl
CreateDirectoryA
CreateDirectoryW
GetModuleHandleA
CreateThread
CreateMutexA
FlushFileBuffers
ReleaseMutex
LockFileEx
UnlockFileEx
WaitForSingleObject
GlobalAlloc
GlobalLock
GlobalUnlock
HeapCompact
HeapFree
HeapDestroy
GetProcessHeap
HeapCreate
HeapAlloc
HeapSize
HeapReAlloc
SetFileTime
GetSystemTime
SystemTimeToFileTime
GetFileAttributesW
FindFirstFileW
SetFileAttributesW
DeleteFileW
FindNextFileW
RemoveDirectoryW
Sleep
SetFilePointer
SetEndOfFile
GetCompressedFileSizeA
FormatMessageA
LocalFree
GetCurrentDirectoryA
QueryDosDeviceA
GetDriveTypeA
IsBadStringPtrA
CreateToolhelp32Snapshot
Process32Next
OpenProcess
TerminateProcess
IsBadReadPtr
GetModuleFileNameA
VirtualQuery
LoadLibraryA
GetProcAddress
FreeLibrary
CreateEventA
SetEvent
LeaveCriticalSection
GetCurrentThreadId
EnterCriticalSection
CreateFileA
GetFileInformationByHandle
GetFileSizeEx
SetFilePointerEx
WriteFile
ReadFile
CancelIo
GetOverlappedResult
CloseHandle
FindClose
FindFirstFileA
FindNextFileA
GetStringTypeExW
GetStringTypeExA
GetEnvironmentVariableW
GetEnvironmentVariableA
CompareStringW
CompareStringA
InitializeCriticalSection
GetFileAttributesA
SetLastError
FileTimeToSystemTime
lstrlenA
lstrcmpiW
lstrlenW
lstrcmpiA
GetVersion
GetLastError
WideCharToMultiByte
MultiByteToWideChar
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
DeleteCriticalSection
user32
CharLowerW
CharUpperA
CharUpperW
MessageBoxA
CharLowerA
SendMessageA
EnableWindow
GetDlgCtrlID
GetForegroundWindow
IsWindowVisible
IsWindow
GetParent
GetWindowModuleFileNameA
CloseClipboard
RegisterWindowMessageA
OpenClipboard
IsClipboardFormatAvailable
SetClipboardData
EmptyClipboard
TranslateMessage
DispatchMessageA
PeekMessageA
SetForegroundWindow
BringWindowToTop
UnregisterClassA
GetClipboardData
shell32
SHBrowseForFolderA
SHGetDesktopFolder
SHGetFolderLocation
SHGetPathFromIDListA
oleaut32
SysFreeString
Exports
Exports
Sections
.text Size: 84KB - Virtual size: 80KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ