Static task
static1
Behavioral task
behavioral1
Sample
18e15a9da5394eeb980b6d1cace61bb0_NeikiAnalytics.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
18e15a9da5394eeb980b6d1cace61bb0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
18e15a9da5394eeb980b6d1cace61bb0_NeikiAnalytics.exe
-
Size
126KB
-
MD5
18e15a9da5394eeb980b6d1cace61bb0
-
SHA1
fdca9f26c6dab30fdd7a1d6deef0ceb9fb04a91f
-
SHA256
02a38fe14b7806eb9ec726ceb8d6ed7f0041bc57f39010cfa623a68cc0675665
-
SHA512
33e8db55a83731d11ab943a4b06abebac2259284921945be39f8c909d0cb205ccb0ed0a40debe97e699d3c9f70428d38d2f83bea8085a428097387e6f571ce7a
-
SSDEEP
3072:PlPEiRNgd9HPh++5dv0mbfSUllK006S2UHpRlb:xEiRNgd9HPh++Pv0mbfJ4OUHZb
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 18e15a9da5394eeb980b6d1cace61bb0_NeikiAnalytics.exe
Files
-
18e15a9da5394eeb980b6d1cace61bb0_NeikiAnalytics.exe.exe windows:4 windows x64 arch:x64
92fd4dd35f7a784364eaeb71b90e4461
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Imports
libsqlapiu
_ZN12SAConnection7ConnectERK8SAStringS2_S2_9eSAClientPFvRS_24eSAConnectionHandlerTypeE
_ZN12SAConnection8RollbackEv
_ZN12SAConnection9setClientE9eSAClient
_ZN12SAConnectionC1Ev
_ZN12SAConnectionD1Ev
_ZN8SAString13ReleaseBufferEy
_ZN8SAString5EmptyEv
_ZN8SAString9GetBufferEy
_ZN8SAStringC1Ev
_ZN8SAStringD1Ev
_ZNK11SAException7ErrTextEv
_ZNK12SAConnection13ClientVersionEv
_ZNK12SAConnection13ServerVersionEv
_ZNK12SAConnection19ServerVersionStringEv
_ZNK8SAString13CompareNoCaseEPKw
_ZNK8SAStringcvPKwEv
kernel32
AddAtomA
CloseHandle
CreateEventA
CreateMutexA
CreateSemaphoreA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
FindAtomA
GetAtomNameA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetHandleInformation
GetLastError
GetModuleHandleA
GetProcAddress
GetProcessAffinityMask
GetStartupInfoA
GetSystemTimeAsFileTime
GetThreadContext
GetThreadPriority
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
RaiseException
ReleaseMutex
ReleaseSemaphore
ResetEvent
ResumeThread
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetCriticalSectionSpinCount
SetEvent
SetLastError
SetProcessAffinityMask
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
msvcrt
__C_specific_handler
__dllonexit
__getmainargs
__initenv
__iob_func
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_beginthreadex
_cexit
_endthreadex
_fmode
_initterm
_lock
_onexit
_setjmp
_unlock
_write
abort
calloc
exit
fgetwc
fprintf
fputc
fputs
free
fwrite
longjmp
malloc
memcmp
memcpy
memmove
memset
printf
realloc
setlocale
signal
sprintf
strcmp
strlen
strncmp
vfprintf
wprintf
wscanf
Sections
.text Size: 95KB - Virtual size: 95KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 312B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 2KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 112B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 104B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE