Behavioral task
behavioral1
Sample
39db87754b942adb0e26e5c791b98260_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
39db87754b942adb0e26e5c791b98260_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
39db87754b942adb0e26e5c791b98260_NeikiAnalytics.exe
-
Size
5.2MB
-
MD5
39db87754b942adb0e26e5c791b98260
-
SHA1
3bbbae2bf8568b47b4cbc93138aa7ca4e5180c0c
-
SHA256
0b07637dc62f51f7b6df6e76a1c5bfd1815de710c2f71cab67e67a11d0f7df74
-
SHA512
2a8858da2df1d7835d006d736dfbe74025926c3dbfb3cfef97f71e3de365452e9515e6b150a7b873ab65513ab08e2af65146cd755a283cffe12529e15d53ab98
-
SSDEEP
98304:NWuxtmVxV13Ae+qSIMCOFsyXmCXIH56ujhbSzrOK4XlD:rmLVNAeAtsk1a0uNuOK49
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 39db87754b942adb0e26e5c791b98260_NeikiAnalytics.exe
Files
-
39db87754b942adb0e26e5c791b98260_NeikiAnalytics.exe.exe windows:5 windows x86 arch:x86
1e6f1edf86c71a1bdb7ab03f17e2f3a7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
waveOutGetNumDevs
ws2_32
getpeername
rasapi32
RasHangUpA
kernel32
InterlockedDecrement
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CallNextHookEx
gdi32
Rectangle
winspool.drv
DocumentPropertiesA
advapi32
RegCreateKeyExA
shell32
Shell_NotifyIconA
ole32
OleInitialize
oleaut32
LoadTypeLi
comctl32
ord17
wininet
InternetCloseHandle
comdlg32
GetFileTitleA
Sections
.text Size: - Virtual size: 448KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 318KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 776KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 4.8MB - Virtual size: 4.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 360KB - Virtual size: 357KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ