Static task
static1
Behavioral task
behavioral1
Sample
0e5a1eeeb628cf605d99c3eb9cf6d9f0_NeikiAnalytics.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
0e5a1eeeb628cf605d99c3eb9cf6d9f0_NeikiAnalytics.dll
Resource
win10v2004-20240508-en
General
-
Target
0e5a1eeeb628cf605d99c3eb9cf6d9f0_NeikiAnalytics.exe
-
Size
21KB
-
MD5
0e5a1eeeb628cf605d99c3eb9cf6d9f0
-
SHA1
93e300d0d8bde4cde0aa5259fd48cfe12e6688d7
-
SHA256
243d51c90dc2a9d4194e8aa0fe6b235bf81b7fa246a367958359b7cd173cd807
-
SHA512
22ff3606fc5c9e7e72148434112c2607495f14200add87bda1fdf2a1b7412d772f3500a80ed4fca1e2fa93528d003257eca6739aabb03558977cfe7ad9ef7b67
-
SSDEEP
384:2912eop8vbvJykjl+YOGxE+9FinuOxA0BGy2iK/WoBiB5:29goDl+Y7xZ8xxAMGy2t9iB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0e5a1eeeb628cf605d99c3eb9cf6d9f0_NeikiAnalytics.exe
Files
-
0e5a1eeeb628cf605d99c3eb9cf6d9f0_NeikiAnalytics.exe.dll windows:6 windows x86 arch:x86
452d19117ddea2739393fea7e8fe1edc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ntdll
RtlRandom
memset
kernel32
CloseHandle
GetSystemDirectoryW
CreateProcessW
GetTempPathW
GetTempFileNameW
HeapCreate
GetCommandLineW
LoadLibraryA
FreeLibrary
CreateDirectoryW
GetVersion
CreateEventW
SetEvent
Sleep
WriteFile
VirtualAlloc
VirtualFree
CreateFileW
OpenProcess
GetLastError
FindFirstFileW
FindNextFileW
FindClose
HeapAlloc
HeapFree
MultiByteToWideChar
WideCharToMultiByte
GetModuleFileNameW
GetCurrentProcess
GetProcAddress
GetModuleHandleA
GetTickCount
ResetEvent
GetCurrentProcessId
advapi32
StartServiceW
OpenServiceW
CloseServiceHandle
ChangeServiceConfig2W
CreateServiceW
OpenSCManagerW
ConvertStringSecurityDescriptorToSecurityDescriptorA
shell32
CommandLineToArgvW
ShellExecuteW
Sections
.text Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 786B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ