G:\dev\ProcessHacker\trunk\bin\Release32\plugins\ServiceBackupRestorePlugin.pdb
Static task
static1
Behavioral task
behavioral1
Sample
57bc6f11a799605b0c1bc5e5b82cb4e0_NeikiAnalytics.dll
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
57bc6f11a799605b0c1bc5e5b82cb4e0_NeikiAnalytics.dll
Resource
win10v2004-20240508-en
General
-
Target
57bc6f11a799605b0c1bc5e5b82cb4e0_NeikiAnalytics.exe
-
Size
77KB
-
MD5
57bc6f11a799605b0c1bc5e5b82cb4e0
-
SHA1
bdd238ba90c510dd9911f863c170e947264e02ec
-
SHA256
a586df59de4403781a7c88e6683a02b1bd33c4a73881e436df619251e907962b
-
SHA512
526199853d20cda0238cbbd3dd5c6854df6485cb0611b071631a04b60437370c611ee536b0c5b22d6d7b97474661da956989ffabd81c20230ccbefaa05d68a4f
-
SSDEEP
1536:94HQVhmOG04fF2+i7NmTvsWGcdH9LON4e:W1Zt238VHBONL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 57bc6f11a799605b0c1bc5e5b82cb4e0_NeikiAnalytics.exe
Files
-
57bc6f11a799605b0c1bc5e5b82cb4e0_NeikiAnalytics.exe.dll windows:6 windows x86 arch:x86
6e4d38e785c2c714211155ac0b0ef030
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
processhacker.exe
_PhGetPluginCallback@8
PhDereferenceObject
PhShowMessage
PhConcatStringRef2
_PhGetIntegerSetting@4
PhQueryRegistryString
PhFindStringInStringRef
PhCreateFileWin32
PhInsertEMenuItem
_PhPluginCreateEMenuItem@20
PhCreateEMenuItem
PhFindEMenuItem
_PhAddSettings@8
_PhGetGeneralCallback@4
PhIndexOfEMenuItem
PhRegisterCallback
PhSetTokenPrivilege
_PhRegisterPlugin@12
PhOpenKey
PhFreeFileDialog
PhShowFileDialog
PhDeleteFileWin32
PhEqualStringRef
PhSetFileDialogFilter
PhCreateOpenFileDialog
PhGetFileDialogFileName
PhShowStatus
PhSetFileDialogFileName
PhCreateSaveFileDialog
ntdll
NtOpenProcessToken
NtRestoreKey
NtSaveKeyEx
RtlUnwind
NtClose
user32
MessageBoxW
advapi32
RegLoadAppKeyW
kernel32
CreateFileW
CloseHandle
DecodePointer
WriteConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
WriteFile
SetStdHandle
HeapReAlloc
HeapSize
GetStringTypeW
RaiseException
GetStdHandle
GetProcessHeap
LCMapStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetFileType
TlsAlloc
GetOEMCP
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
InterlockedFlushSList
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
HeapFree
HeapAlloc
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetACP
Sections
.text Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE