DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
071efd1d9dbb5d01023f77556674ba70_NeikiAnalytics.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
071efd1d9dbb5d01023f77556674ba70_NeikiAnalytics.dll
Resource
win10v2004-20240426-en
Target
071efd1d9dbb5d01023f77556674ba70_NeikiAnalytics.exe
Size
2.9MB
MD5
071efd1d9dbb5d01023f77556674ba70
SHA1
ad12988372f5123c02f99905abc271061a6cbf8d
SHA256
dae2047db1c4078de653b49b1bbb968d3a90a8c2f7706cda8a6ff6e4435700d0
SHA512
1179bc9590247411375b97b56dd36084e8e8bf0059537da259d5cf786111a1667a5bcf301a806016eaee060677d8e9b4031fa66c2b0e9b3435767453561bafb8
SSDEEP
49152:/qRwMRfkQiUig7Pw95zb4tgbEgrIpKcbqMmWby6EzskulU:/qRwMRfkQioDS4+bEUIpXbi+kCU
Detects file using ACProtect software.
Processes:
resource | yara_rule |
---|---|
sample | acprotect |
Processes:
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
Processes:
resource |
---|
071efd1d9dbb5d01023f77556674ba70_NeikiAnalytics.exe |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE