Static task
static1
Behavioral task
behavioral1
Sample
1ebdd5e3df9df4cadaa8a828003535d0_NeikiAnalytics.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
1ebdd5e3df9df4cadaa8a828003535d0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
1ebdd5e3df9df4cadaa8a828003535d0_NeikiAnalytics.exe
-
Size
6.0MB
-
MD5
1ebdd5e3df9df4cadaa8a828003535d0
-
SHA1
63c6129e03b14002bcc44a8589fe5def49b2dc4e
-
SHA256
e17d6c8d178fd9dfc50666bdcbbeca4813457d5e49202374f172da5fcc5ea1c1
-
SHA512
be79553ad7cd375161f0186d317476d4997495acc02f37137e57bfb1c6f7062791e37742efb8256217d3444b6f711506f356ba4c97641dca412fd3b73e6a9282
-
SSDEEP
98304:22WU/LK6QwhIF930FvQfbkrMEkubB84+HAfKaY9IllHfTX8jDT3QgJRJxp:dvK6QwhIF9EFvabB4+002DwvBJRJxp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1ebdd5e3df9df4cadaa8a828003535d0_NeikiAnalytics.exe
Files
-
1ebdd5e3df9df4cadaa8a828003535d0_NeikiAnalytics.exe.exe windows:5 windows x86 arch:x86
6e69bc439e21536cb7b596b4ca668086
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
comctl32
ord410
ord17
ImageList_Remove
InitCommonControlsEx
CreateStatusWindowW
_TrackMouseEvent
ImageList_Add
ImageList_GetImageCount
ImageList_Create
ImageList_GetIconSize
ImageList_LoadImageW
ImageList_Draw
ImageList_Destroy
ord413
PropertySheetW
winmm
timeSetEvent
timeKillEvent
shlwapi
PathAddExtensionW
PathFindExtensionW
PathRemoveExtensionW
PathFileExistsW
AssocQueryStringW
PathFindFileNameW
PathAppendW
StrTrimA
StrChrW
PathStripPathW
StrCpyW
StrCpyNW
PathRemoveFileSpecW
UrlUnescapeW
StrRChrW
PathRemoveBlanksW
PathCombineW
StrTrimW
PathAddBackslashW
PathUnquoteSpacesW
PathRemoveArgsW
PathIsDirectoryW
ord219
shfolder
SHGetFolderPathW
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
xpdfrasterizer
pdfLoadMem
pdfGetPageRotation
pdfGetPageWidth
pdfFreeMemory
pdfConvertRegionToBitmap
pdfGetPageHeight
pdfFree
libmicrohttpd-dll
MHD_get_connection_values
MHD_start_daemon
MHD_lookup_connection_value
MHD_queue_response
MHD_add_response_header
MHD_create_response_from_buffer
MHD_destroy_response
MHD_create_post_processor
MHD_post_process
MHD_stop_daemon
MHD_get_connection_info
kernel32
SetFileTime
GetTimeZoneInformation
GetFileAttributesExW
GetVersionExW
WideCharToMultiByte
LocalFileTimeToFileTime
GetCurrentProcessId
IsDebuggerPresent
OutputDebugStringW
EncodePointer
HeapAlloc
HeapFree
GetProcessHeap
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
GlobalFree
LoadLibraryExA
LoadLibraryA
AreFileApisANSI
ReadFile
TryEnterCriticalSection
GetFullPathNameW
WriteFile
InterlockedCompareExchange
GetDiskFreeSpaceW
LockFile
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
CreateMutexW
UnmapViewOfFile
HeapValidate
HeapSize
GetTempPathA
HeapCreate
GetFileAttributesA
FlushViewOfFile
CreateFileA
WaitForSingleObjectEx
GetVersionExA
DeleteFileA
HeapReAlloc
HeapCompact
HeapDestroy
UnlockFile
CreateFileMappingA
LockFileEx
GetFileSize
GetSystemTimeAsFileTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
FlushFileBuffers
VirtualProtect
LockResource
GetComputerNameW
lstrlenW
SystemTimeToTzSpecificLocalTime
DeleteTimerQueueTimer
GetPrivateProfileStringW
GetPrivateProfileIntW
GetExitCodeProcess
GetLocaleInfoW
FindResourceW
CreateProcessW
LoadLibraryExW
SizeofResource
LoadResource
ResetEvent
DecodePointer
GetFileAttributesW
GetModuleHandleW
GetSystemTime
lstrcmpiW
GetModuleFileNameW
lstrcmpW
MulDiv
SetLastError
GetCurrentThreadId
GetLocalTime
CopyFileW
FindNextFileW
FindFirstFileW
CreateFileW
CreateDirectoryW
GetFileTime
FindClose
SearchPathW
LoadLibraryW
FreeLibrary
GetModuleHandleA
GetProcAddress
GetSystemInfo
SwitchToThread
GetTickCount
MoveFileExW
SetThreadPriority
VirtualAlloc
GetDateFormatW
GetTimeFormatW
CreateEventW
WaitForMultipleObjects
CloseHandle
WaitForSingleObject
SetEvent
GetExitCodeThread
TerminateThread
VirtualFree
InterlockedDecrement
InterlockedIncrement
InitializeCriticalSectionAndSpinCount
RaiseException
FormatMessageW
GetLastError
LocalFree
MultiByteToWideChar
DeleteFileW
GetTempFileNameW
GetTempPathW
OutputDebugStringA
Sleep
CompareFileTime
FileTimeToSystemTime
FileTimeToLocalFileTime
SystemTimeToFileTime
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GlobalUnlock
GlobalLock
GlobalSize
GlobalAlloc
GetUserDefaultLCID
GetCPInfoExW
GetCommandLineW
GetCurrentProcess
TlsSetValue
TlsAlloc
TlsGetValue
TlsFree
InterlockedExchange
VirtualQuery
FindFirstFileExW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
IsProcessorFeaturePresent
GetDiskFreeSpaceA
gdi32
GetWindowOrgEx
GetWindowExtEx
SelectClipRgn
GetViewportExtEx
GetTextAlign
ExtTextOutW
RectVisible
GetTextMetricsW
OffsetWindowOrgEx
GetTextFaceW
AddFontResourceExW
RemoveFontResourceExW
GetViewportOrgEx
RealizePalette
PolylineTo
EnumObjects
AnimatePalette
ModifyWorldTransform
GetTextExtentPoint32A
GetDIBits
EndPage
StartPage
EndDoc
StartDocW
ResetDCW
GetTextExtentPoint32W
GetTextExtentPointW
GetClipBox
CreateDCW
PolyBezierTo
PolyBezier
CreatePolygonRgn
TextOutA
GetObjectW
StrokePath
StrokeAndFillPath
SelectClipPath
GetPath
FlattenPath
FillPath
EndPath
CloseFigure
BeginPath
SetWinMetaFileBits
PlayEnhMetaFile
DeleteEnhMetaFile
SetTextAlign
SetPolyFillMode
SetGraphicsMode
ExtSelectClipRgn
RoundRect
Pie
IntersectClipRect
GetTextColor
GetPaletteEntries
GetCurrentPositionEx
GetCurrentObject
CreateFontIndirectA
CreateEllipticRgn
CreateBitmap
CombineRgn
Chord
Arc
SetMapMode
BitBlt
Polyline
PatBlt
SetBrushOrgEx
SetWorldTransform
GetWorldTransform
SetTextCharacterExtra
SetStretchBltMode
StretchBlt
TextOutW
MoveToEx
ExtCreatePen
SetROP2
LineTo
GetBkColor
GetROP2
Ellipse
CreatePen
CreateFontW
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
CreateDIBSection
CreateDIBitmap
SetWindowOrgEx
SetWindowExtEx
SetViewportOrgEx
SetViewportExtEx
Polygon
LPtoDP
DPtoLP
SetTextColor
SetBkMode
SetBkColor
SelectObject
SaveDC
RestoreDC
Rectangle
GetStockObject
FillRgn
DeleteObject
CreateRectRgnIndirect
CreateBrushIndirect
GetDeviceCaps
CreateSolidBrush
CreateFontIndirectW
SelectPalette
EnumFontFamiliesExW
CreatePalette
comdlg32
GetOpenFileNameW
GetSaveFileNameW
PrintDlgW
CommDlgExtendedError
PageSetupDlgW
ChooseFontW
ChooseColorW
advapi32
SystemFunction036
RegCloseKey
RegCreateKeyExW
GetUserNameW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegCreateKeyW
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExA
IsTextUnicode
shell32
DragQueryFileW
ShellExecuteW
SHGetMalloc
SHGetPathFromIDListW
SHBrowseForFolderW
FindExecutableW
ole32
CoCreateInstance
CoCreateGuid
CLSIDFromString
IIDFromString
CLSIDFromProgID
CoGetClassObject
StringFromGUID2
CoTaskMemAlloc
CoTaskMemFree
OleInitialize
OleUninitialize
OleLockRunning
CreateStreamOnHGlobal
CoTaskMemRealloc
RegisterDragDrop
CoInitialize
GetHGlobalFromStream
oleaut32
CreateErrorInfo
GetErrorInfo
VariantCopy
SafeArrayAccessData
SafeArrayDestroy
SafeArrayCreate
VarUI4FromStr
OleCreateFontIndirect
LoadTypeLi
VariantClear
SysStringLen
RegisterTypeLi
LoadRegTypeLi
LoadTypeLibEx
VariantInit
SysAllocStringByteLen
SysStringByteLen
SysAllocString
SysFreeString
SysAllocStringLen
SetErrorInfo
VariantChangeType
urlmon
CoInternetGetSession
msvcp140
?_Xinvalid_argument@std@@YAXPBD@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAJ@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@I@Z
?tolower@?$ctype@_W@std@@QBE_W_W@Z
?toupper@?$ctype@_W@std@@QBE_W_W@Z
??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?uncaught_exception@std@@YA_NXZ
?_Xout_of_range@std@@YAXPBD@Z
??Bid@locale@std@@QAEIXZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?is@?$ctype@_W@std@@QBE_NF_W@Z
?widen@?$ctype@_W@std@@QBE_WD@Z
?narrow@?$ctype@_W@std@@QBED_WD@Z
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?exceptions@ios_base@std@@QAEXH@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z
?gptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?pptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?imbue@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAE?AVlocale@2@ABV32@@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WD@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z
?id@?$ctype@_W@std@@2V0locale@2@A
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@H@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?widen@?$ctype@D@std@@QBEDD@Z
?narrow@?$ctype@D@std@@QBEDDD@Z
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QAE?AVlocale@2@ABV32@@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?id@?$ctype@D@std@@2V0locale@2@A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
gdiplus
GdiplusShutdown
GdipDisposeImage
GdipSaveImageToStream
GdiplusStartup
GdipFillPath
GdipFillPieI
GdipDrawPath
GdipDrawPieI
GdipDrawBeziersI
GdipDrawArcI
GdipDrawLinesI
GdipDrawLineI
GdipCreateBitmapFromHBITMAP
GdipSetInterpolationMode
GdipSetSmoothingMode
GdipSetCompositingQuality
GdipDeleteGraphics
GdipCreateFromHDC
GdipGetImageEncoders
GdipSetPenDashStyle
GdipSetPenLineJoin
GdipSetPenEndCap
GdipSetPenStartCap
GdipSetPenWidth
GdipDeletePen
GdipCreatePen2
GdipCreatePen1
GdipCreateSolidFill
GdipCreateHatchBrush
GdipDeleteBrush
GdipCloneBrush
GdipAddPathPieI
GdipAddPathBeziersI
GdipAddPathArcI
GdipAddPathLine2I
GdipAddPathLineI
GdipClosePathFigure
GdipStartPathFigure
GdipGetPointCount
GdipDeletePath
GdipCreatePath
GdipFree
GdipAlloc
GdipCloneImage
GdipSetPenDashArray
GdipGetImageEncodersSize
vcruntime140
_purecall
_except_handler4_common
__std_exception_copy
wcsrchr
strrchr
memchr
memset
memmove
memcpy
__CxxFrameHandler3
strstr
__std_terminate
wcschr
strchr
wcsstr
__std_type_info_compare
__std_exception_destroy
_CxxThrowException
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
exit
_seh_filter_exe
_set_app_type
_invalid_parameter_noinfo
_configure_wide_argv
_controlfp_s
_cexit
terminate
_errno
_initialize_wide_environment
_get_wide_winmain_command_line
_initterm
_initialize_onexit_table
abort
_crt_atexit
_register_thread_local_exe_atexit_callback
_c_exit
_exit
_register_onexit_function
_wassert
_beginthreadex
_endthreadex
_initterm_e
api-ms-win-crt-string-l1-1-0
wcscspn
wcsncpy_s
isdigit
iswascii
strncat
_stricmp
isalpha
iswspace
iswalnum
toupper
wcsncat
_wcslwr
strncmp
_wcsupr
isalnum
strspn
iswdigit
strncpy
wcsncmp
isupper
islower
isxdigit
isspace
ispunct
isprint
isgraph
iscntrl
tolower
wcstok_s
wcstok
strcspn
_strnicmp
_wcsnicmp
_strdup
towlower
towupper
iswupper
iswlower
wcsncpy
iswalpha
_wcsicmp
wcsspn
wcscpy_s
strtok
_wcsdup
api-ms-win-crt-heap-l1-1-0
malloc
_msize
calloc
free
_recalloc
_set_new_mode
_callnewh
realloc
api-ms-win-crt-convert-l1-1-0
_itoa_s
wcstod
_itow_s
_i64toa
wcstoul
_wtoi
_wtoi64
atoi
strtod
atof
_itow
strtoull
wcstol
strtol
strtoul
wcstombs
_i64tow
_atoi64
api-ms-win-crt-stdio-l1-1-0
fwrite
_wfopen
__stdio_common_vfprintf
_wfsopen
_wfreopen
ungetwc
__stdio_common_vsprintf
fputc
_set_fmode
_wsopen_s
_close
_write
__stdio_common_vswprintf_s
__p__commode
fclose
fopen
fread
fseek
ftell
fputws
__stdio_common_vfwprintf
rewind
fgetws
fgetpos
__stdio_common_vswprintf
fgetwc
ungetc
fgetc
fsetpos
fflush
fgets
__stdio_common_vsscanf
__stdio_common_vsnprintf_s
feof
__stdio_common_vswscanf
api-ms-win-crt-utility-l1-1-0
srand
qsort
rand
api-ms-win-crt-filesystem-l1-1-0
_wremove
_wrename
_wfindnext64i32
_wfindfirst64i32
_findclose
_wstat64
_waccess
_wchdir
api-ms-win-crt-math-l1-1-0
_libm_sse2_log10_precise
_CIatan2
_CIfmod
round
ceil
_libm_sse2_pow_precise
floor
_libm_sse2_sin_precise
_libm_sse2_cos_precise
__setusermatherr
_except1
_libm_sse2_log_precise
api-ms-win-crt-environment-l1-1-0
_wgetcwd
api-ms-win-crt-time-l1-1-0
_localtime64
_wasctime
_localtime64_s
_time64
api-ms-win-crt-locale-l1-1-0
_wsetlocale
_getmbcp
_setmbcp
_configthreadlocale
api-ms-win-crt-multibyte-l1-1-0
_ismbcspace
_mbslen
Sections
.text Size: 2.6MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 428KB - Virtual size: 427KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 84KB - Virtual size: 588KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2.9MB - Virtual size: 2.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ