Static task
static1
Behavioral task
behavioral1
Sample
6c0f9d5ea32890e268a281a79dc2df40_NeikiAnalytics.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
6c0f9d5ea32890e268a281a79dc2df40_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
6c0f9d5ea32890e268a281a79dc2df40_NeikiAnalytics.exe
-
Size
221KB
-
MD5
6c0f9d5ea32890e268a281a79dc2df40
-
SHA1
f35a134d85cc780e5b2a406bd51c5881fe861b89
-
SHA256
ac06dedc995d2d45898d0d4f9871d33ed95e2660d1e11c24d51f7043bdcf1036
-
SHA512
29070969f03bc1672cfa45883733a17e46ec5d7e647f1851a7a6457bed30dde479fac160e2ea94d6da94eb196b58b34af3cb1cd72143cb1c740011f9a1d1587a
-
SSDEEP
6144:p8BdIYK+IG5rRLkpXEtSYpmAQ/mV99ZNB:pKQ+R5rRAdEtS1oV9bD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6c0f9d5ea32890e268a281a79dc2df40_NeikiAnalytics.exe
Files
-
6c0f9d5ea32890e268a281a79dc2df40_NeikiAnalytics.exe.exe windows:4 windows x86 arch:x86
adea663fcc9d58958f2b0eeeff50f875
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetUserDefaultLCID
GetCurrentProcessId
GetLastError
MultiByteToWideChar
lstrlenA
InterlockedDecrement
LoadLibraryA
GetCurrentThreadId
lstrlenW
WideCharToMultiByte
Thread32Next
ResumeThread
SuspendThread
GetModuleHandleA
Thread32First
Sleep
IsBadReadPtr
IsBadCodePtr
GetSystemInfo
CreateProcessA
LocalFree
GetStartupInfoA
GetProcAddress
GetTickCount
IsValidCodePage
OpenThread
GetVersion
user32
GetCursor
IsCharLowerA
GetWindowThreadProcessId
SetThreadDesktop
IsCharUpperA
CreateWindowExA
GetClientRect
GetSystemMetrics
PostMessageA
GetForegroundWindow
GetInputState
GetCapture
GetActiveWindow
advapi32
RegEnumValueA
RegOpenKeyExA
RegEnumKeyExA
ole32
CoCreateInstance
OleRun
CLSIDFromString
CLSIDFromProgID
oleaut32
SysAllocStringByteLen
GetErrorInfo
SysAllocString
SysAllocStringLen
VariantClear
SysStringLen
SysFreeString
SysStringByteLen
msvcp60
??0logic_error@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
??_7out_of_range@std@@6B@
??1out_of_range@std@@UAE@XZ
??0out_of_range@std@@QAE@ABV01@@Z
??0logic_error@std@@QAE@ABV01@@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
?_Xran@std@@YAXXZ
?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEPADPADD@Z
??Mstd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHABV12@@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_Decref@facet@locale@std@@QAEPAV123@XZ
?_Incref@facet@locale@std@@QAEXXZ
??1?$ctype@D@std@@UAE@XZ
??0_Lockit@std@@QAE@XZ
?id@?$ctype@D@std@@2V0locale@2@A
??Bid@locale@std@@QAEIXZ
?_Getfacet@locale@std@@QBEPBVfacet@12@I_N@Z
?_Iscloc@locale@std@@QBE_NXZ
??0?$ctype@D@std@@QAE@PBF_NI@Z
??1_Lockit@std@@QAE@XZ
??_7bad_cast@std@@6B@
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@ABV01@@Z
?do_tolower@?$ctype@D@std@@MBEPBDPADPBD@Z
?do_tolower@?$ctype@D@std@@MBEDD@Z
?do_toupper@?$ctype@D@std@@MBEPBDPADPBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHIIPBDI@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??_F?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
??0locale@std@@QAE@PBDH@Z
??1locale@std@@QAE@XZ
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?find_first_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?do_toupper@?$ctype@D@std@@MBEDD@Z
msvcrt
strcpy
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_onexit
__dllonexit
strncat
strcat
_strnicmp
sprintf
_stricmp
strstr
strchr
strncpy
free
rand
memcmp
srand
_strdup
strlen
__CxxFrameHandler
_except_handler3
memcpy
memset
malloc
??2@YAPAXI@Z
wcslen
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@ABQBD@Z
_CxxThrowException
shlwapi
PathGetDriveNumberA
wininet
InternetQueryDataAvailable
Sections
.text Size: 192KB - Virtual size: 192KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE