Behavioral task
behavioral1
Sample
11fdfe50c9708f3f76ed84e5d40312a0_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
11fdfe50c9708f3f76ed84e5d40312a0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
11fdfe50c9708f3f76ed84e5d40312a0_NeikiAnalytics.exe
-
Size
2.6MB
-
MD5
11fdfe50c9708f3f76ed84e5d40312a0
-
SHA1
44a44d8f94a2d8ed3f3b7e9b055fce9a077b6527
-
SHA256
a0900d48dc4aa69594d7e13efaf19c6bf1de4b4e3d2b06cf5872fc7adea18de5
-
SHA512
706768b021092f8d74d95e4ea2206f062b0d68959378396af1d10dddd38c215d5d94eaffeae33c4663eefee7b6012950672692031e210cb05b403df3ac9dc031
-
SSDEEP
49152:hetiuYsCB8+pAw0jqX1YggET6EEUp2OiQVgJVlDAl:stPYsCB8Sr0jqgET6zUp/mJVlg
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 11fdfe50c9708f3f76ed84e5d40312a0_NeikiAnalytics.exe
Files
-
11fdfe50c9708f3f76ed84e5d40312a0_NeikiAnalytics.exe.exe windows:4 windows x86 arch:x86
4b62211a11c6936b1890a59ecbd8a708
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvfw32
DrawDibDraw
avifil32
AVIStreamGetFrame
winmm
midiStreamOut
ws2_32
getsockname
kernel32
FlushFileBuffers
user32
LoadStringA
gdi32
CombineRgn
winspool.drv
OpenPrinterA
comdlg32
GetFileTitleA
advapi32
RegCreateKeyExA
shell32
SHGetSpecialFolderPathA
ole32
CLSIDFromProgID
oleaut32
SafeArrayAccessData
comctl32
ImageList_DragMove
msvcrt
strncpy
iphlpapi
GetInterfaceInfo
psapi
GetMappedFileNameW
Sections
.text Size: 1.5MB - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
UPX Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
UPX Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ