c:\OJP\Copy of Enhanced\source\Debug\uix86.pdb
Static task
static1
Behavioral task
behavioral1
Sample
402dd8543454075153cac2611d70cd40_NeikiAnalytics.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
402dd8543454075153cac2611d70cd40_NeikiAnalytics.dll
Resource
win10v2004-20240426-en
General
-
Target
402dd8543454075153cac2611d70cd40_NeikiAnalytics.exe
-
Size
1.1MB
-
MD5
402dd8543454075153cac2611d70cd40
-
SHA1
6a28f7745951665e000b59988f9b20ced1efd5be
-
SHA256
d364d9eb6b41d0b97ecdb3931f5ba93180e86f1dc7f5a54fca84fef42e4ec8c9
-
SHA512
5268077efa448389a06210f7fb5c4600ab319216a2053d3b50a897a4ab4ec81c4e2e65fd370375654460f3a7352695f9405149b25e04ac25ffed9a67a45a07cb
-
SSDEEP
12288:EBYFjr8QKqmomaYvXdlw+0woQRZylHvB+NQymeAbAk6x0GQRblW3Ad6Hhvq494DR:EKFUQKImakXr84QymnbAkYAd6Hc4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 402dd8543454075153cac2611d70cd40_NeikiAnalytics.exe
Files
-
402dd8543454075153cac2611d70cd40_NeikiAnalytics.exe.dll windows:5 windows x86 arch:x86
152553738ab36772d051dc73d3a8fcd8
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
IsDebuggerPresent
RaiseException
DebugBreak
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
GetProcAddress
LoadLibraryA
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetModuleHandleA
GetModuleFileNameW
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
TlsGetValue
GetModuleHandleW
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetLastError
GetCurrentThread
LCMapStringA
LCMapStringW
HeapValidate
IsBadReadPtr
HeapFree
HeapAlloc
GetProcessHeap
VirtualQuery
FreeLibrary
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
RtlUnwind
GetStringTypeA
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
FatalAppExitA
WriteFile
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
SetConsoleCtrlHandler
LoadLibraryW
GetTimeFormatA
GetDateFormatA
GetLocaleInfoA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
SetFilePointer
GetConsoleCP
GetConsoleMode
HeapSize
HeapReAlloc
VirtualAlloc
InterlockedExchange
InitializeCriticalSectionAndSpinCount
GetTimeZoneInformation
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
ReadFile
GetLocaleInfoW
CreateFileA
CloseHandle
FlushFileBuffers
CompareStringA
CompareStringW
SetEnvironmentVariableA
Exports
Exports
dllEntry
vmMain
Sections
.textbss Size: - Virtual size: 391KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 808KB - Virtual size: 808KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 167KB - Virtual size: 167KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 45KB - Virtual size: 5.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 59KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ