Static task
static1
Behavioral task
behavioral1
Sample
32a6b5314f42e88c7d009dcc6a160a00_NeikiAnalytics.dll
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
32a6b5314f42e88c7d009dcc6a160a00_NeikiAnalytics.dll
Resource
win10v2004-20240426-en
General
-
Target
32a6b5314f42e88c7d009dcc6a160a00_NeikiAnalytics.exe
-
Size
21KB
-
MD5
32a6b5314f42e88c7d009dcc6a160a00
-
SHA1
7b84bfeb3d640fb09bf0ad1999dd16ee7a4865dc
-
SHA256
ba05b0b00cfef41360eb5dfb94d0ac2fedf84366fac9585a5dd55ce9e369b120
-
SHA512
ad62cfb94f0a40ee5922e37c04497cf3aa67b5689f57cdf4d096b65e99caed3284adb0e23d36aa77eafe09073ee7736260ee5961bde7027f05c2db2c95a1bda0
-
SSDEEP
384:2912eop8vbvJykjl+YOGxE+9FinuOxA0BGy2iK/WoBcB5:29goDl+Y7xZ8xxAMGy2t9cB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 32a6b5314f42e88c7d009dcc6a160a00_NeikiAnalytics.exe
Files
-
32a6b5314f42e88c7d009dcc6a160a00_NeikiAnalytics.exe.dll windows:6 windows x86 arch:x86
452d19117ddea2739393fea7e8fe1edc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ntdll
RtlRandom
memset
kernel32
CloseHandle
GetSystemDirectoryW
CreateProcessW
GetTempPathW
GetTempFileNameW
HeapCreate
GetCommandLineW
LoadLibraryA
FreeLibrary
CreateDirectoryW
GetVersion
CreateEventW
SetEvent
Sleep
WriteFile
VirtualAlloc
VirtualFree
CreateFileW
OpenProcess
GetLastError
FindFirstFileW
FindNextFileW
FindClose
HeapAlloc
HeapFree
MultiByteToWideChar
WideCharToMultiByte
GetModuleFileNameW
GetCurrentProcess
GetProcAddress
GetModuleHandleA
GetTickCount
ResetEvent
GetCurrentProcessId
advapi32
StartServiceW
OpenServiceW
CloseServiceHandle
ChangeServiceConfig2W
CreateServiceW
OpenSCManagerW
ConvertStringSecurityDescriptorToSecurityDescriptorA
shell32
CommandLineToArgvW
ShellExecuteW
Sections
.text Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 786B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ