e:\com99\src\fldbwrapper\redist\i386\bbt\Install.pdb
Static task
static1
Behavioral task
behavioral1
Sample
45d522fdff0ea0d34d46517cca7bc790_NeikiAnalytics.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
45d522fdff0ea0d34d46517cca7bc790_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
45d522fdff0ea0d34d46517cca7bc790_NeikiAnalytics.exe
-
Size
200KB
-
MD5
45d522fdff0ea0d34d46517cca7bc790
-
SHA1
532d9f00b10659e599ff4f30a4b2e0a9003de134
-
SHA256
8c20f4ee5737efba868e041be6a194c4c4f52d4ecf88ea3a521b3074a7a1c14f
-
SHA512
3b36eed13549a686efab62756391498ead6826fa668f65c701a3a3fddd94ce00700748fc8984ea0446c96c796796b22172c9995d9885f12c7008ddaf85dfde69
-
SSDEEP
3072:wy0QyBG5Imeb/wOoYdQacLnbO3JKpRiDND5erX7skJLBiyLkkLhfVu/N8e:YIIZ/wnYdSnoKj8D5NkJLkIAV8e
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 45d522fdff0ea0d34d46517cca7bc790_NeikiAnalytics.exe
Files
-
45d522fdff0ea0d34d46517cca7bc790_NeikiAnalytics.exe.exe windows:5 windows x86 arch:x86
6669fecb7d33eb49a006c66ce4a81e5b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
advapi32
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
OpenThreadToken
OpenProcessToken
AllocateAndInitializeSid
InitializeSecurityDescriptor
GetLengthSid
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
IsValidSecurityDescriptor
AccessCheck
RevertToSelf
FreeSid
ControlService
OpenSCManagerA
OpenServiceA
CloseServiceHandle
RegOpenKeyA
QueryServiceStatus
ImpersonateSelf
kernel32
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapDestroy
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
HeapAlloc
LoadLibraryA
GetACP
WideCharToMultiByte
GetCPInfo
VirtualAlloc
HeapReAlloc
IsBadWritePtr
InterlockedExchange
VirtualQuery
IsBadReadPtr
IsBadCodePtr
HeapSize
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
SetConsoleCtrlHandler
GetLocaleInfoA
VirtualProtect
GetSystemInfo
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetModuleFileNameA
GetStdHandle
WriteFile
GetCurrentProcess
TerminateProcess
GetProcAddress
RaiseException
ExitProcess
RtlUnwind
GetVersionExA
GetStartupInfoA
GetModuleHandleA
GetCommandLineA
CreateMutexA
GetLastError
CloseHandle
GetOEMCP
LocalAlloc
LocalFree
FreeLibrary
FormatMessageA
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
SetLastError
Sleep
lstrlenA
lstrcmpA
GetTempPathA
GetVersion
GetSystemDirectoryA
GetCurrentThread
GetLocalTime
FlushFileBuffers
SetFilePointer
SetStdHandle
CreateFileA
SetEndOfFile
ReadFile
user32
MessageBoxA
GetSystemMetrics
LoadStringA
Sections
.text Size: 76KB - Virtual size: 72KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.text Size: 104KB - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE