?ReflectiveDllMain@@YAHPEAE@Z
Static task
static1
Behavioral task
behavioral1
Sample
341d78c3bb56e8be98a25025650b03d0_NeikiAnalytics.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
341d78c3bb56e8be98a25025650b03d0_NeikiAnalytics.dll
Resource
win10v2004-20240508-en
General
-
Target
341d78c3bb56e8be98a25025650b03d0_NeikiAnalytics.exe
-
Size
144KB
-
MD5
341d78c3bb56e8be98a25025650b03d0
-
SHA1
762cc26f6caf1f4be4486699e5cb9f177a298a33
-
SHA256
e7e9692b47bda4e97ab40f9071b580a077e5b46557b5949eedc75050e915d681
-
SHA512
8be4f854e2f1ca0536d83ee6d28062710613ed0fb30d549eff72a0f8a8debda0d8c1aa4c476e893465018768e18e724313f2b5980effc6013c03de2ec3e875a1
-
SSDEEP
3072:j7lMDoGFw8M9z4WsaGqY6S0CQLrrhiePLSqMIQ2XfRf:jQLWXaqY606rrhiWZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 341d78c3bb56e8be98a25025650b03d0_NeikiAnalytics.exe
Files
-
341d78c3bb56e8be98a25025650b03d0_NeikiAnalytics.exe.dll windows:6 windows x64 arch:x64
7a32a0919a866c6b96091c856486ecb3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
IsWow64Process
FreeLibrary
GetModuleHandleA
GetModuleHandleW
GetProcAddress
lstrcmpW
lstrcmpiW
lstrcpyW
VirtualProtect
lstrlenW
WideCharToMultiByte
K32GetModuleFileNameExW
TerminateThread
GetFileType
GetCurrentThread
GetProcessIdOfThread
VirtualProtectEx
FreeLibraryAndExitThread
GetModuleFileNameW
WriteConsoleW
OpenProcess
CreateThread
TerminateProcess
GetCurrentProcessId
GetCurrentProcess
Sleep
GetLastError
CloseHandle
WriteFile
ReadFile
GetFinalPathNameByHandleW
lstrcatW
CreateFileW
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
SetStdHandle
HeapReAlloc
HeapSize
GetCurrentThreadId
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualFree
VirtualQuery
SetLastError
LoadLibraryExW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
GetModuleHandleExW
LCMapStringW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetStdHandle
GetStringTypeW
advapi32
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumValueW
RegCloseKey
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
shlwapi
PathCombineW
PathFindFileNameW
Exports
Exports
Sections
.text Size: 81KB - Virtual size: 81KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourd Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ