Static task
static1
Behavioral task
behavioral1
Sample
e8f22bb6096a7451a0202ed08ad49500_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
e8f22bb6096a7451a0202ed08ad49500_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
e8f22bb6096a7451a0202ed08ad49500_NeikiAnalytics.exe
-
Size
96KB
-
MD5
e8f22bb6096a7451a0202ed08ad49500
-
SHA1
3ec9019ac1ffad2be2a02bd0bdbbf593df7418b6
-
SHA256
4836cb7eed0b20da50acb26472f918b180917101c026ce36074e0e879b604308
-
SHA512
c647bc54d24b95f3f06f66e238dcecb1f24756e48dab94eedfdd3efd7b76bd41111877e08840d037ed73bdc5e14e8b1a99c5aa686b7b66579696416a0d32d2f2
-
SSDEEP
1536:N95ho579+cybwUfDUNCY09/2fIrYzK5DJ69hOydgU7D+MWhPr:NLh2X2+Q/4Ir+K5dyOydgUH6Pr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e8f22bb6096a7451a0202ed08ad49500_NeikiAnalytics.exe
Files
-
e8f22bb6096a7451a0202ed08ad49500_NeikiAnalytics.exe.exe windows:5 windows x86 arch:x86
e10e31397b5c4daf9a1821868cbd0764
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
CreateThread
ReadFile
Sleep
FindFirstFileW
CreateFileW
FindNextFileW
FindClose
CreatePipe
SetHandleInformation
DuplicateHandle
GetCurrentProcess
PeekNamedPipe
WriteFile
GetEnvironmentVariableA
InterlockedDecrement
CreateProcessA
GetModuleFileNameW
CreateProcessW
GetComputerNameW
GetComputerNameA
GetLogicalDrives
GetDiskFreeSpaceExA
GetVolumeInformationW
GetDriveTypeA
GetLocalTime
GetFileTime
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetSystemTimeAsFileTime
GetCurrentProcessId
lstrlenA
FindResourceExA
FindResourceA
SizeofResource
LockResource
LoadResource
LeaveCriticalSection
GetLastError
EnterCriticalSection
lstrlenW
WideCharToMultiByte
SetEnvironmentVariableA
MultiByteToWideChar
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoA
InterlockedCompareExchange
InterlockedExchange
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
DeleteCriticalSection
InitializeCriticalSection
RaiseException
user32
GetSystemMetrics
gdi32
CreateDCA
SelectObject
DeleteObject
BitBlt
CreateCompatibleDC
DeleteDC
GetObjectA
CreateCompatibleBitmap
advapi32
RegGetValueW
GetUserNameW
GetUserNameA
ole32
CoUninitialize
CreateStreamOnHGlobal
CoInitializeSecurity
CoSetProxyBlanket
CoInitializeEx
CoCreateInstance
oleaut32
SysAllocString
VariantClear
SysFreeString
ws2_32
WSAStartup
inet_addr
htonl
socket
connect
WSAGetLastError
recv
send
ntohl
htons
freeaddrinfo
inet_ntoa
getaddrinfo
closesocket
msvcp90
??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?reserve@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@I_W@Z
?_Tidy@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@IAEX_NI@Z
?close@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?open@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXPB_WHH@Z
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@XZ
?close@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?open@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXPB_WHH@Z
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@PB_WHH@Z
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@XZ
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@H@2@@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADH@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBDH@Z
?resize@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
shlwapi
ord184
ord213
ord214
gdiplus
GdipFree
GdipAlloc
GdipDisposeImage
GdipCloneImage
GdipSaveImageToStream
GdipCreateBitmapFromScan0
GdiplusShutdown
GdiplusStartup
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipCreateBitmapFromHBITMAP
urlmon
URLOpenBlockingStreamA
msvcr90
__dllonexit
_controlfp_s
_invoke_watson
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
_crt_debugger_hook
_except_handler4_common
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_decode_pointer
_onexit
??3@YAXPAX@Z
memcpy_s
memmove_s
??_V@YAXPAX@Z
free
??2@YAPAXI@Z
_invalid_parameter_noinfo
_vsnprintf
malloc
_resetstkoflw
wcscat_s
strcpy_s
_wremove
strstr
printf
sprintf
atoi
_itoa
wcstombs
exit
fopen_s
fclose
_recalloc
calloc
memset
__CxxFrameHandler3
_CxxThrowException
_unlock
memcpy
_encode_pointer
_lock
Sections
.text Size: 49KB - Virtual size: 48KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ