ServiceMain
Static task
static1
Behavioral task
behavioral1
Sample
208dea4f20a39672e513e17a7ef7ef40_NeikiAnalytics.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
208dea4f20a39672e513e17a7ef7ef40_NeikiAnalytics.dll
Resource
win10v2004-20240611-en
General
-
Target
208dea4f20a39672e513e17a7ef7ef40_NeikiAnalytics.exe
-
Size
36KB
-
MD5
208dea4f20a39672e513e17a7ef7ef40
-
SHA1
ca1ef63ba75c8f884651aa3f54c5a5b2ebcfee95
-
SHA256
e9e44dbaa89651fa44128d1fb2e2c07b62ab337811a17f865b372a5c7c21b3f8
-
SHA512
67af1aee85b6647f7c37db69de4babde47237d48d25963357df0cea26f8178b17e78b990faa20ef911ba47defa6719ec22128ca74131023b2c8d1e461c8f5fc8
-
SSDEEP
768:8mlVXeOklbitCk1L1pStGMku2TDjCvPMvFGDV9q/QVS:8mlohlGtCmLfMku2fm00K/kS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 208dea4f20a39672e513e17a7ef7ef40_NeikiAnalytics.exe
Files
-
208dea4f20a39672e513e17a7ef7ef40_NeikiAnalytics.exe.dll windows:5 windows x86 arch:x86
180a612f2798831f95e978b95cb0344a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
msvcrt
_initterm
rand
atol
strstr
free
_strnicmp
isdigit
strtoul
_ftol
_itoa
_except_handler3
_snprintf
malloc
_adjust_fdiv
strncmp
strtok
_stricmp
strchr
_atoi64
strncpy
advapi32
RegisterServiceCtrlHandlerA
SetServiceStatus
kernel32
Sleep
WriteFile
FreeLibrary
DisableThreadLibraryCalls
ResetEvent
SetLastError
FileTimeToLocalFileTime
lstrcpynA
ReadFile
GetEnvironmentVariableA
CreateFileA
GetSystemTimeAsFileTime
CreateEventA
InterlockedExchange
lstrcatA
lstrcmpiA
DeleteCriticalSection
InitializeCriticalSection
HeapAlloc
CreateThread
GetCurrentThread
SetThreadPriority
WaitForMultipleObjects
ExitThread
InterlockedDecrement
LoadLibraryW
GetProcAddress
lstrcpyA
lstrlenA
WaitForSingleObject
LeaveCriticalSection
EnterCriticalSection
CreateSemaphoreA
CloseHandle
ReleaseSemaphore
HeapFree
GetLastError
InterlockedIncrement
SetEvent
GetProcessHeap
rpcrt4
NdrServerCall2
RpcSsDontSerializeContext
RpcServerListen
RpcServerUseProtseqEpA
UuidCreate
UuidToStringA
RpcStringFreeA
RpcServerRegisterIf
RpcServerInqBindings
RpcBindingVectorFree
RpcServerUnregisterIf
user32
wsprintfA
TranslateMessage
GetMessageA
DefWindowProcA
UpdateWindow
CharLowerBuffA
DestroyWindow
UnregisterClassA
RegisterClassA
DispatchMessageA
PostMessageA
CreateWindowExA
ShowWindow
ws2_32
gethostbyname
WSAAsyncSelect
socket
htons
shutdown
WSAIoctl
inet_addr
ioctlsocket
recvfrom
sendto
WSAStartup
WSACleanup
WSAGetLastError
accept
listen
closesocket
bind
inet_ntoa
setsockopt
Exports
Exports
Sections
.text Size: 30KB - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 788B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 984B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ