Static task
static1
Behavioral task
behavioral1
Sample
3b1dcaa27d64ab6046a3e5833446af750a7b4413abfba5a292f96ced39f70e53_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
3b1dcaa27d64ab6046a3e5833446af750a7b4413abfba5a292f96ced39f70e53_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
3b1dcaa27d64ab6046a3e5833446af750a7b4413abfba5a292f96ced39f70e53_NeikiAnalytics
-
Size
33KB
-
MD5
92d6a17203ecd704ff95d0b8c0291d00
-
SHA1
3a81bd3e6e3d453b5b2c4a664331045b8ded51c0
-
SHA256
3b1dcaa27d64ab6046a3e5833446af750a7b4413abfba5a292f96ced39f70e53
-
SHA512
1eee32e090255861eabd9010e0102449fbaca4a9ca4acf18d4b9f8a3c4a8236542fcddd754f053e416448bfabbd82faef921cbe75102b99059dee1b2191d7602
-
SSDEEP
384:0d1whctpueB5PE9T9fVOm+BfYiRyrC6YKoJp50R7ouKDwKKDLdk:0d1CdKexSfYiRyNYp6Jomdk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3b1dcaa27d64ab6046a3e5833446af750a7b4413abfba5a292f96ced39f70e53_NeikiAnalytics
Files
-
3b1dcaa27d64ab6046a3e5833446af750a7b4413abfba5a292f96ced39f70e53_NeikiAnalytics.exe windows:4 windows x86 arch:x86
11d5b92b3a3f2ec77c7bdb58c6a83586
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapFree
LoadLibraryA
GetProcAddress
VirtualAlloc
HeapAlloc
DeleteFileA
GetStdHandle
ExitProcess
SetHandleCount
GetCommandLineA
GetStartupInfoA
GetVersion
TerminateProcess
GetCurrentProcess
GetModuleHandleA
GetModuleFileNameA
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetFileType
FreeEnvironmentStringsW
GetEnvironmentStrings
WriteFile
RtlUnwind
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentStringsW
GetOEMCP
GetACP
GetCPInfo
WideCharToMultiByte
user32
WinHelpA
LoadIconA
MessageBoxA
kremdll
SetParseCallback
ParseCommandLine
DoDecryptDialog
GetGlobalString
SetProgress1
SplitPath
DoFilelistDialog
WriteGlobalInt
InitProgressDialog
GetProgressDlgHandle
EndProgressDialog
GetGlobalInt
SetTopCaption
DoOverwriteDialog
CheckCancelButton
SetCaption1
kremsdk
ArchiveAlgorithm
InitKremlinSDK
SetMemPasses
SetDiskPasses
SetProgressCallback
SetContinueCallback
SetVersionCallback
ArchiveReadInit
KillKremlinSDK
ArchiveGetValidateData
ArchiveMaxKeyLen
ArchiveSetPasskey
ArchiveNumFiles
ArchiveFilename
ArchiveExtractFileNumber
ArchiveKill
ArchiveExtractAll
smalloc
sfree
GetErrorText
SetOverwriteCallback
Sections
.text Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 819B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ