Behavioral task
behavioral1
Sample
974cf643a561eca21aac5cae9db09cc0_NeikiAnalytics.dll
Resource
win7-20240508-en
General
-
Target
974cf643a561eca21aac5cae9db09cc0_NeikiAnalytics.exe
-
Size
67KB
-
MD5
974cf643a561eca21aac5cae9db09cc0
-
SHA1
c831fec9a663131ecbb73e28d87d326fd67ad0fb
-
SHA256
3b27c20658498696ca570d00362cfcec6fb17bf05dbbf972ddbafc14d723b573
-
SHA512
d15641fef456b5a28eac4fcb6bf4743ba59ea1ca84953108bb2c623ebfaccb6e94ff4c46f4ea82bb12b10cdc2efd7479a241ed8b0fe18c46cb46682c0c4de6bc
-
SSDEEP
1536:GJ4UwPZgpoc1wzruMECYCB+2H0eQ8X0iZs3:GOx+poHHuDCYCBFXXs3
Malware Config
Signatures
-
Ramnit family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 974cf643a561eca21aac5cae9db09cc0_NeikiAnalytics.exe
Files
-
974cf643a561eca21aac5cae9db09cc0_NeikiAnalytics.exe.dll .vbs windows:4 windows x86 arch:x86 polyglot
aedeb82dba179b678129895e1ac4d250
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetDiskFreeSpaceExA
GetDriveTypeA
GetFileAttributesA
GetFileSize
GetFileTime
GetLastError
GetLocalTime
GetLocaleInfoA
GetLogicalDriveStringsA
GetLogicalDrives
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetSystemDirectoryA
GetSystemInfo
GetSystemTimeAsFileTime
GetTempFileNameA
GetTempPathA
GetTickCount
GetVersionExA
GetVolumeInformationA
GetWindowsDirectoryA
GlobalAlloc
GlobalFree
GlobalReAlloc
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
GetCurrentProcess
LeaveCriticalSection
LoadLibraryA
MapViewOfFile
MoveFileA
MultiByteToWideChar
OpenMutexA
ReadFile
ReleaseMutex
RemoveDirectoryA
ResumeThread
RtlMoveMemory
SetEndOfFile
SetErrorMode
SetFileAttributesA
SetFilePointer
SetFileTime
SetThreadPriority
Sleep
TryEnterCriticalSection
UnmapViewOfFile
WideCharToMultiByte
WriteFile
lstrcatA
lstrcmpA
lstrcmpiA
lstrcpyA
lstrcpynA
lstrlenA
lstrlenW
FindNextFileA
FindFirstFileA
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
ExpandEnvironmentStringsA
ExitProcess
EnterCriticalSection
DeleteCriticalSection
DeleteFileA
CreateThread
CreateProcessA
CreateMutexA
CreateFileMappingA
CreateFileA
CreateDirectoryA
CopyFileA
CompareStringA
InitializeCriticalSection
CloseHandle
ws2_32
recv
listen
ioctlsocket
inet_addr
select
getsockname
send
socket
getpeername
gethostbyname
connect
closesocket
bind
accept
__WSAFDIsSet
WSAStartup
WSAGetLastError
WSACleanup
htons
user32
GetDC
ExitWindowsEx
CharUpperBuffW
MessageBoxA
GetDesktopWindow
wsprintfA
advapi32
AdjustTokenPrivileges
OpenProcessToken
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
RegQueryValueExA
LookupPrivilegeValueA
shell32
ShellExecuteA
gdi32
CreateCompatibleDC
DeleteDC
DeleteObject
GdiFlush
GetDeviceCaps
SelectObject
SetStretchBltMode
StretchBlt
CreateDIBSection
ole32
CreateStreamOnHGlobal
Sections
.text Size: 50KB - Virtual size: 49KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ