d:\MyProject\StreetPlayer\ExtraProgram\PotPlayer\x64\Release_Mini\PotPlayerMiniXP64.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2d8586a75c0ad0f6e9ee3fccca2306942f5656690ac07f55f8d5e48a0a687b47_NeikiAnalytics.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2d8586a75c0ad0f6e9ee3fccca2306942f5656690ac07f55f8d5e48a0a687b47_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
2d8586a75c0ad0f6e9ee3fccca2306942f5656690ac07f55f8d5e48a0a687b47_NeikiAnalytics
-
Size
223KB
-
MD5
42725e5e855140f45a16ba2887eca3b0
-
SHA1
e23e25789ccaf2ebfec823351f0a80eca8e16f05
-
SHA256
2d8586a75c0ad0f6e9ee3fccca2306942f5656690ac07f55f8d5e48a0a687b47
-
SHA512
73cf94cfea25637eaf5cdad89223fc35ad48276f71e8e1fb37af8f133e6b62b167062a716056de4ff178f17321c693e09e40ffefd6378b9eda2128a64d3c7f49
-
SSDEEP
1536:n+4vjF7AVmIfskKoNGCwcjj0r6G+qT1CGizTySlqc2B:+iF7AIIfh1wcj0r6OqfccA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2d8586a75c0ad0f6e9ee3fccca2306942f5656690ac07f55f8d5e48a0a687b47_NeikiAnalytics
Files
-
2d8586a75c0ad0f6e9ee3fccca2306942f5656690ac07f55f8d5e48a0a687b47_NeikiAnalytics.exe windows:5 windows x64 arch:x64
1bb4c9a7a64f8a3f0f2b606e1d270a5f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
potplayer64
DestroyPotPlayer
RunPotPlayerEx
CreatePotPlayerExW
PreprocessCmdLineExW
SetPotPlayRegKeyW
UninitPotPlayer
kernel32
MultiByteToWideChar
GetStringTypeA
WideCharToMultiByte
GetLocaleInfoA
CreateFileW
CloseHandle
GetLastError
FreeLibrary
LoadLibraryW
GetModuleFileNameW
GetCurrentProcess
TerminateProcess
GetUserDefaultLCID
GetVersionExW
GetStringTypeW
LCMapStringA
LCMapStringW
RaiseException
HeapReAlloc
HeapFree
HeapAlloc
GetStartupInfoW
HeapSetInformation
HeapCreate
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlPcToFileHeader
GetModuleHandleW
Sleep
GetProcAddress
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
RtlUnwindEx
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
EncodePointer
DecodePointer
FlsGetValue
FlsSetValue
FlsFree
SetLastError
GetCurrentThreadId
FlsAlloc
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapSize
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
user32
MessageBoxW
ole32
CoInitialize
imagehlp
ImageGetCertificateHeader
ImageEnumerateCertificates
ImageGetCertificateData
crypt32
CryptMsgOpenToDecode
CryptMsgUpdate
CryptMsgGetParam
CertGetSubjectCertificateFromStore
CryptMsgControl
CryptMsgClose
CertCreateCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
CertFreeCertificateChainEngine
CertOpenStore
CertFindCertificateInStore
CertGetNameStringW
CryptSignMessage
CertFreeCertificateContext
CertCloseStore
CryptVerifyMessageSignature
wintrust
WinVerifyTrust
Sections
.text Size: 33KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 150KB - Virtual size: 149KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zero Size: 8KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ