amstream.pdb
Static task
static1
Behavioral task
behavioral1
Sample
91bf4541a817f30718b6e615b06dc4b0_NeikiAnalytics.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
91bf4541a817f30718b6e615b06dc4b0_NeikiAnalytics.dll
Resource
win10v2004-20240611-en
General
-
Target
91bf4541a817f30718b6e615b06dc4b0_NeikiAnalytics.exe
-
Size
87KB
-
MD5
91bf4541a817f30718b6e615b06dc4b0
-
SHA1
1f72a609fffeac13e2b2126399fef4c27872a51b
-
SHA256
b3437172418d9238e44d1d27d167e81057514d13a6c36622281fd929cdd9436c
-
SHA512
2f14f55cef72103dab36efe3dd8bef15e43f26ca9b87e0b54cfd4183aa0ed9a3b22fe8914fa252fbe83437fcdd4ba2889b86670a296e0c970491c87079349703
-
SSDEEP
1536:C1eS4ffqIoDK10Y1rDFPZaDKMJyd2yKiezuJ:ejWfq3DcDFPRl3IzuJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 91bf4541a817f30718b6e615b06dc4b0_NeikiAnalytics.exe
Files
-
91bf4541a817f30718b6e615b06dc4b0_NeikiAnalytics.exe.dll regsvr32 windows:5 windows x64 arch:x64
893ecdda0bca4db4d91a3100770bfc64
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_vsnwprintf
memcpy
memcmp
??_U@YAPEAX_K@Z
__C_specific_handler
_amsg_exit
_initterm
_XcptFilter
_purecall
??2@YAPEAX_K@Z
realloc
??3@YAXPEAX@Z
??_V@YAXPEAX@Z
malloc
free
memset
kernel32
lstrlenW
GetLastError
GetProcAddress
EnterCriticalSection
lstrcmpiW
GetModuleFileNameW
DeleteCriticalSection
GetCurrentThreadId
CloseHandle
lstrcpyW
DisableThreadLibraryCalls
SetEvent
lstrcmpW
MultiByteToWideChar
CreateEventW
Sleep
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
ReleaseSemaphore
lstrcpynW
MulDiv
CreateThread
QueueUserAPC
DuplicateHandle
ResetEvent
LeaveCriticalSection
HeapDestroy
SizeofResource
LoadLibraryW
InitializeCriticalSection
GetCurrentThread
GetModuleHandleW
WaitForSingleObject
GetCurrentProcess
LoadLibraryExW
LoadResource
FreeLibrary
FindResourceW
lstrlenA
CreateSemaphoreW
user32
IsRectEmpty
CharNextW
advapi32
RegEnumKeyExW
RegOpenKeyExW
RegDeleteValueW
RegQueryInfoKeyW
RegQueryValueExW
RegCreateKeyExW
RegCloseKey
RegSetValueExW
RegDeleteKeyW
ole32
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
CoCreateInstance
oleaut32
SysFreeString
RegisterTypeLi
VarI4FromStr
LoadTypeLi
ddraw
DirectDrawCreate
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 76KB - Virtual size: 75KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ