Behavioral task
behavioral1
Sample
daa4d9cb978955a3364ac61267b91bb0_NeikiAnalytics.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
daa4d9cb978955a3364ac61267b91bb0_NeikiAnalytics.dll
Resource
win10v2004-20240508-en
General
-
Target
daa4d9cb978955a3364ac61267b91bb0_NeikiAnalytics.exe
-
Size
156KB
-
MD5
daa4d9cb978955a3364ac61267b91bb0
-
SHA1
03383f8fbb0d48a9c3a356674d98bdfe218488d1
-
SHA256
a799911963673b569d8206f2181413044d911086611a90edb91493fc7626ed25
-
SHA512
ea1634358d16a16ba780f2afd82c7476f99623151ed6bd88ecd140aac6ef4ebad9e1c2eb4935dc981376de0a6c5408fd17d2084e4258eda6ff9d494c56ceb9ee
-
SSDEEP
3072:fUpcSKyRj+o91NRPz6N+TBflnno/yBIUeOjT4U7j8Ap:siXI/1NRr6N+TBXIAjT42jL
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource daa4d9cb978955a3364ac61267b91bb0_NeikiAnalytics.exe
Files
-
daa4d9cb978955a3364ac61267b91bb0_NeikiAnalytics.exe.dll windows:4 windows x86 arch:x86
afe929a2bc6373a2c3c3525a9976770c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
VirtualAlloc
CloseHandle
VirtualProtectEx
OpenProcess
GetCurrentProcessId
GetModuleHandleA
VirtualProtect
GetLastError
GetFileAttributesA
Process32Next
Process32First
CreateToolhelp32Snapshot
CreateProcessA
Sleep
FindNextFileA
FindClose
FindFirstFileA
VirtualFree
LoadLibraryA
GetFileSize
GetLocalTime
FileTimeToSystemTime
GetFileTime
CreateFileA
HeapFree
HeapAlloc
GetProcessHeap
OutputDebugStringA
CreateThread
DeleteFileA
WriteFile
CreateMutexA
GetComputerNameA
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetProcAddress
WriteConsoleA
GetConsoleCursorInfo
SetConsoleCursorInfo
SetConsoleWindowInfo
FreeConsole
AllocConsole
SetConsoleTitleA
GetStdHandle
GetConsoleScreenBufferInfo
ReadFile
SetConsoleTextAttribute
SetStdHandle
GetOEMCP
GetACP
GetStringTypeW
GetStringTypeA
FlushFileBuffers
LCMapStringW
LCMapStringA
MultiByteToWideChar
SetFilePointer
InterlockedDecrement
InterlockedIncrement
GetTimeZoneInformation
GetSystemTime
RtlUnwind
GetCommandLineA
GetVersion
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
WideCharToMultiByte
TerminateProcess
GetCurrentProcess
HeapReAlloc
HeapSize
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetCPInfo
user32
ReleaseDC
wsprintfA
gdi32
CreateCompatibleDC
GetDeviceCaps
CreateCompatibleBitmap
SelectObject
BitBlt
GetStockObject
SelectPalette
RealizePalette
GetDIBits
DeleteDC
CreateDCA
shell32
SHGetSpecialFolderPathA
urlmon
URLDownloadToFileA
ws2_32
send
closesocket
socket
htons
connect
inet_addr
recv
WSAStartup
WSACleanup
shlwapi
PathFindFileNameA
Sections
.text Size: 56KB - Virtual size: 54KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 160B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 48KB - Virtual size: 47KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ