Cert2Spc.pdb
Static task
static1
Behavioral task
behavioral1
Sample
ad8b69750936a254bc40798ea0d02970_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
ad8b69750936a254bc40798ea0d02970_NeikiAnalytics.exe
-
Size
580KB
-
MD5
ad8b69750936a254bc40798ea0d02970
-
SHA1
b19911d1888946e05fbd5d23725d385ef4266777
-
SHA256
6e0637131d370fadf5171f102462b6d1aff8d42790ae595aba203636597226ff
-
SHA512
35fc17daa9f6c789e936e7a90919ae522a647244afad1e60404cd0461d854e2149b1f334708cba85c49a36065de3b03e404e9eae441f9b979356e05208123c79
-
SSDEEP
12288:7Gt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:qt/sBlDqgZQd6XKtiMJYiPU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ad8b69750936a254bc40798ea0d02970_NeikiAnalytics.exe
Files
-
ad8b69750936a254bc40798ea0d02970_NeikiAnalytics.exe.exe windows:10 windows x64 arch:x64
6fbab9a22c6679e90186f2c71b342d49
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetTickCount
GetSystemTimeAsFileTime
GetCurrentProcess
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
SetUnhandledExceptionFilter
Sleep
TerminateProcess
CreateFileMappingA
GetFileSize
MapViewOfFile
GetProcessHeap
HeapSetInformation
CreateFileW
CloseHandle
GetLastError
GetModuleHandleA
UnmapViewOfFile
GetCurrentThreadId
msvcrt
?terminate@@YAXXZ
_commode
_fmode
__C_specific_handler
_initterm
__setusermatherr
_cexit
_exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
vwprintf
exit
crypt32
CertGetCRLFromStore
CertOpenStore
CertCloseStore
CertAddEncodedCRLToStore
CertEnumCertificatesInStore
CertSaveStore
CertAddCertificateContextToStore
CertAddCRLContextToStore
CertFreeCertificateContext
CertFreeCRLContext
user32
LoadStringW
Sections
.text Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 228B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 568KB - Virtual size: 572KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE