Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Behavioral task
behavioral1
Sample
36685efcf34c7a7a6f6dd2e48199e4700b5ab8fe3945a50297703dd8daced74f_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
36685efcf34c7a7a6f6dd2e48199e4700b5ab8fe3945a50297703dd8daced74f_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
Target
36685efcf34c7a7a6f6dd2e48199e4700b5ab8fe3945a50297703dd8daced74f_NeikiAnalytics
Size
900KB
MD5
4b29ffb60c0e5f5e9bfecff0061cfa6b
SHA1
badd38b886077e082a3fbe025c1e7d0f177de7f4
SHA256
36685efcf34c7a7a6f6dd2e48199e4700b5ab8fe3945a50297703dd8daced74f
SHA512
35eee9f167174e8a2816a2a90e690c9aa8dee7ca9df33c85f957495473dbaecc1d96ea18f17ca75ab2da7f6ed15167d91552ffed4793fdd1fd14d244857f448c
SSDEEP
24576:cdBS2pWPPcyfi7dlXhgWs+2iMllfi706uZS/2IsH:sB/p2+2PC/2IsH
resource | yara_rule |
---|---|
sample | vmprotect |
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
WaitForSingleObject
CreateThread
GetCommandLineW
GetStartupInfoW
SetUnhandledExceptionFilter
GetProcAddress
GetModuleHandleW
ExitProcess
DecodePointer
WriteFile
GetStdHandle
GetModuleFileNameW
RtlUnwindEx
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
EncodePointer
FlsGetValue
FlsSetValue
FlsFree
SetLastError
GetCurrentThreadId
GetLastError
GetCurrentThread
FlsAlloc
HeapSetInformation
GetVersion
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
FatalAppExitA
EnterCriticalSection
SetConsoleCtrlHandler
FreeLibrary
LoadLibraryW
GetLocaleInfoW
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
TerminateProcess
GetCurrentProcess
HeapFree
Sleep
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
WideCharToMultiByte
HeapSize
HeapAlloc
HeapReAlloc
LCMapStringW
MultiByteToWideChar
GetStringTypeW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
]��'`$B���$���.���E!�;b!�-�r�+�����GK��~yp�rq5y��P��&_�lh�=κX=��Z����8+��* ���5��� �ST���Y��6 T��҄16�~��ۮ䖬�pN�� :yx�l[ ˌ���-���@�e���j�� �yl5i�����dm�Hf��;�?fY��,lfSb��^�a���C�5w�~Q��7�?� �����*��nN��i�=��3��N)�ߦo N�R��'z�.k Z��4����5�����5f]�̷���TF��H�uI�,�\d���:a�<_{Y��.�� P)�%`ߚX�y��u��$�R8�U��M���͜t�ɫ7��j�o~�� �\݇љ:0���O���I�'�0�]�����+;UW��� � ��ó�ѓnc��lW�R��H�AB_Y>"�������a�g�bG��^��P��RM\��5Nr��u_mx�TaW�`�A�s�Ȝﱂ����Q��l�Y�LTm!̅��j�e��CC��6���I�����;���C^������h|��kYDǨ�[1��wvW�rqG��4�Q!I�@��"p��?�ٲ�4���:�n���E��H�h�I>�.�lV��,U���ٴ����g��:�7������c��P�')��hI�E�DB-'w.FXvh9b!��?�T �v�?�K��F��k�v��b�6GZK!��H�����{1���������]��>��:\E<�E�^��Ö_u��z�ƽ�L���<�89��m�t4��T�y"��{��4;�u�W���G�&j-�w]ց$k`�;#���}�D[kb=Z�q���Zث^_ݫj2��;���Y�=0�>�ڻ�����A�b �6�Ic��_b��'��*+�dnT�����������\�xW^���z/]{�����L4�&os��#;H_8���VA�� ����e���p�R�ґDn�4^+���fnN�99]��<�*��k[;�p[1�����4���V<�u��q�`��K��$Kyk�+4����8��y�I���~E�j�0C��^����`B�B�9��aA49�G���;�֜��'�WӦ�`:����$��B���++D�g� �[FJ7��|/���;�45���ZJ��6����[��]��BwO-�a�K������rƴ?>P��9I�H�l�c7�-�r��Ҧ�3�6�.Nz*�݈xq�w5Fu��Z�,�?*,Y�<&S����5��i��&�B�M�*.��A�7L?���˚�Fhzj�;�\��OF#Ө7�>��R(��4ÐY���e��Q��T�#��|+;�_�x��r8UAw���֞Kϥ����d�������+q��?C���#UR�ͱ�J��),_g\��U<�L���+5r��������t��]@_��o�<(���f*$���Q�l�ѷݛ��G1� f"�9�e:��K����:k��l�ڡ����>j/Յdϫ�dW3�U�� `�"ͪWDk�V6t�_0m���A jY�b�{/K�)�����O��#L�I�'��h� 4z\Zj]���<2*C$�B�yy�:�mJkh9:�()�f�))=n�/�Z��}sr�r��G��j�N�A�e������l*7V�,�Y����S�*�K����54ڐ� ��G�#��.R�U�ٯ��ޟ�<^��SՑ���,�ˡ���.C >Ja�G��Y�;g�ߍ(1gk�}��&5�=G0a�4�}Jz��W�7 c�b5c1�b`D~���������I*��a��Ƨ�U^�DQ[���X����+J�,.op��\��T<*<z����'�#�,v��-��n"���Y����9�I�{`s��E{���1յ�P/���P�����a�e�n�\ ��ytt� ��)�j���V�*�&�b�P!�ׯ&��L(8�m0<�KP3�����@D�?ɚ�� ������ͼ�^�Dğ,)�_��+��J�p�?q�V}%��i@v9�CEL!�� �ö��z�� ���젲���5�~�<���1lH��I�+�ymG�B�f6����tH������;^�U��Y��Ԕ:]��$�����]ƈ%-�;*�e:%���7H��ᭋ�����o<쐄.��h�}([�����_�_��c���3���?M����!��7,�2�b��w�$�r�f)��r8���TZVG(�#���"!�q���<�؝du�N�3�0�G])q̣�rA��Ԁ��Ȁ^���O�n��:�e�ې6@�4�8�{1$fψwZS�b�U��K@7��&B���������G��� �����Ac�,@�����nϵ�\ù�.8 9�.^�kV�LEB�S<����iY�g�h:���u��nA��|Ֆ�;W��]�I7�v�މE�Q��]�N�D�B����y��~e��y�1���������1�2� �/��ӫ ���bK�+�ԓ<���{m�Z�sQ,�1���R�n ]�_�x�2H�P�}��]�o��BsO ߢ6�T��7$o?��Ѕ�=�sJ<.� a��Vw@ ���G6t�#^����Y�5����s^����؟t�ћ��(�4���YrK���_�r ��*a�]�W�gC��.����O�eK�d~�~u���C=��S)��Rj��e,����Bx�k��y �~.N2����|��*���P''��G;MCȝv���a��ƪm~�/�zGI��fx��k�%����Xu�(oI�'�Ì��c��|ȱ�A���g��o����,��`�G ��a���p��i���?�/;���X�LI���Dr�|��<��,=V�6���#�?���� ��� �C���<P�o9��:�l�ĭq�iy�D -�k�_��^�?!���H %ᶳ~D��]�l�z%ļ�b�_���N���,5"�V���'ɨ�dݲd����`�+s�p�Uci�&}:{0���ӆ���<\'�m��koE���q�(���L�_$����r�tn*q���PEy���t�O==M��P�j����F�%�����#�`m��/~�w���+�$��Y���8�%��I��D2:�GCJ�d�$"��<��
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ