MakeCert.pdb
Static task
static1
Behavioral task
behavioral1
Sample
6ee42df34ed3656204bb3fe9e3fa4920_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
6ee42df34ed3656204bb3fe9e3fa4920_NeikiAnalytics.exe
-
Size
613KB
-
MD5
6ee42df34ed3656204bb3fe9e3fa4920
-
SHA1
86cef76a5b06aae7e614d440d7c750581c67bc83
-
SHA256
3f64c3a7e4a500292c5287583f0f4316fc57c0baad6a57e3741dadc8a8618253
-
SHA512
a94e07f9b99a4afd286ecf021c8568dd55ed034be62e167ccefdb0d98b21c1682e2e7484293aac9e8cef6b0cac7a030bd7ada6bf84def155072315909eda70f4
-
SSDEEP
12288:S/JHFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:S/JH8NDFKYmKOF0zr31JwAlcR3QC0OXn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 6ee42df34ed3656204bb3fe9e3fa4920_NeikiAnalytics.exe
Files
-
6ee42df34ed3656204bb3fe9e3fa4920_NeikiAnalytics.exe.exe windows:10 windows x86 arch:x86
2d1e4981855d954ba7c83771bded9bc2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
advapi32
CryptReleaseContext
CryptGenKey
CryptGetProvParam
CryptSetKeyParam
CryptAcquireContextW
CryptGetKeyParam
CryptAcquireContextA
CryptGetUserKey
CryptDestroyKey
kernel32
CreateFileW
MultiByteToWideChar
LocalAlloc
MapViewOfFile
WideCharToMultiByte
GetFileSize
CreateFileMappingA
WriteFile
GetTickCount
GetCurrentThreadId
LockResource
DeleteFileW
CloseHandle
FileTimeToSystemTime
GetLastError
LocalFileTimeToFileTime
FreeResource
GetModuleHandleA
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
SizeofResource
CompareFileTime
SetLastError
FindResourceA
UnmapViewOfFile
GetSystemTimeAsFileTime
FreeLibrary
SystemTimeToFileTime
GetProcessHeap
LocalFree
GetProcAddress
FileTimeToLocalFileTime
LoadResource
HeapSetInformation
LoadLibraryA
msvcrt
_ftol2_sse
memcmp
_ftol2
memset
strtok
_wtol
malloc
_callnewh
free
_XcptFilter
__p__commode
_amsg_exit
__wgetmainargs
__set_app_type
exit
_exit
_cexit
memcpy
_except_handler4_common
_controlfp
?terminate@@YAXXZ
_initterm
__setusermatherr
__p__fmode
wprintf
_vsnwprintf
_wcsicmp
vwprintf
_wcsnicmp
mssign32
SignError
FreeCryptProvFromCert
PvkGetCryptProv
GetCryptProvFromCert
PvkPrivateKeyAcquireContextFromMemory
PvkFreeCryptProv
PvkPrivateKeySave
crypt32
CertComparePublicKeyInfo
CertGetCertificateContextProperty
CryptHashCertificate
CertStrToNameW
CertOpenStore
CertCompareIntegerBlob
CertCreateCRLContext
CertFindCertificateInStore
CertSetCertificateContextProperty
CryptEncodeObject
CertCloseStore
CertDuplicateCertificateContext
CryptQueryObject
CertEnumCertificatesInStore
CryptSignAndEncodeCertificate
CertFreeCertificateContext
CertFreeCRLContext
CryptExportPublicKeyInfo
CertGetPublicKeyLength
CertAddEncodedCertificateToStore
CryptDecodeObject
CryptHashPublicKeyInfo
CertCreateCertificateContext
user32
LoadStringA
LoadStringW
ole32
CoInitialize
CoCreateGuid
CoUninitialize
oleaut32
VarDateFromStr
rpcrt4
UuidCreate
UuidToStringA
RpcStringFreeA
Sections
.text Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 568KB - Virtual size: 572KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE