Static task
static1
Behavioral task
behavioral1
Sample
26651622316f42177102b2d7ed030ec0_NeikiAnalytics.exe
Resource
win7-20231129-en
General
-
Target
26651622316f42177102b2d7ed030ec0_NeikiAnalytics.exe
-
Size
605KB
-
MD5
26651622316f42177102b2d7ed030ec0
-
SHA1
8155ded132092cce3ee9156bed76dc615ac8a6be
-
SHA256
650f1a1e03b200b20a45cc1f808a25f8dd33fa9fa8a0a6cfec0dfdf65914be48
-
SHA512
945a21413b5a1b41741312ae537590cff15e1e779434eb85629e628215484a688692c6abf40d5601718d48d40223afb3a41b2703597650483c4151a236da7350
-
SSDEEP
12288:Aaplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5:TYTqMi8CtBd2QHCHmTBW5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 26651622316f42177102b2d7ed030ec0_NeikiAnalytics.exe
Files
-
26651622316f42177102b2d7ed030ec0_NeikiAnalytics.exe.exe windows:4 windows x86 arch:x86
256378b620a1391048c889acd08fc55b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateProcessA
SetFileAttributesA
CopyFileA
Sleep
CloseHandle
GetFileSize
CreateFileA
GetWindowsDirectoryA
GetCommandLineA
GetLocalTime
GetSystemDirectoryA
GetShortPathNameA
WriteFile
DeleteFileA
GetExitCodeProcess
CreateMutexA
SetFilePointer
ReadFile
FindClose
FindNextFileA
FindFirstFileA
PeekNamedPipe
GetStartupInfoA
CreatePipe
GetModuleHandleA
GetLastError
GetLogicalDriveStringsA
WaitForSingleObject
GetDriveTypeA
user32
DispatchMessageA
TranslateMessage
TranslateAcceleratorA
GetMessageA
LoadAcceleratorsA
PostQuitMessage
BeginPaint
EndPaint
DefWindowProcA
wsprintfA
DestroyWindow
CreateWindowExA
LoadIconA
LoadCursorA
RegisterClassExA
LoadStringA
advapi32
RegCloseKey
RegOpenKeyExA
RegSetValueExA
shell32
ShellExecuteA
msvcrt
memmove
_endthread
??2@YAPAXI@Z
_CxxThrowException
exit
rename
fclose
fwrite
fseek
fopen
fread
__dllonexit
_onexit
??1type_info@@UAE@XZ
_exit
_XcptFilter
_acmdln
__getmainargs
_initterm
__CxxFrameHandler
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
_beginthread
??3@YAXPAX@Z
memchr
__setusermatherr
msvcp60
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?_Xran@std@@YAXXZ
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?_Xlen@std@@YAXXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
ws2_32
htons
inet_addr
socket
inet_ntoa
gethostbyname
WSAStartup
closesocket
send
recv
connect
Sections
.text Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 80KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE