E:\KMS-8\KMSEmulator2\KMS Server\bin\Debug\KMS Server.pdb
Static task
static1
Behavioral task
behavioral1
Sample
4b7aa11eb4a5e8d317615f450654518871a9334921f01b0f4cc54e7441761448_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
4b7aa11eb4a5e8d317615f450654518871a9334921f01b0f4cc54e7441761448_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
4b7aa11eb4a5e8d317615f450654518871a9334921f01b0f4cc54e7441761448_NeikiAnalytics.exe
-
Size
1.2MB
-
MD5
f8bf30d4e018d65c68538a48b4ecbe40
-
SHA1
299d5bc0a94f98c817624ed44c8899229d80aa8e
-
SHA256
4b7aa11eb4a5e8d317615f450654518871a9334921f01b0f4cc54e7441761448
-
SHA512
89336ab94b9cbb32d1978b862d54307da3243eea840b8b31206fa2ed09a8bb4b883f7555b165e77138fed4bb17fe137596c1a66d1bfe4a7085079673c89a2b75
-
SSDEEP
24576:T3vH0OhJBdw2VkhaNJhItdOwvzFFBdVgHY2qVqX:LH04LMPOwFdVg42qQX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4b7aa11eb4a5e8d317615f450654518871a9334921f01b0f4cc54e7441761448_NeikiAnalytics.exe
Files
-
4b7aa11eb4a5e8d317615f450654518871a9334921f01b0f4cc54e7441761448_NeikiAnalytics.exe.exe windows:6 windows x86 arch:x86
a5432b32324d13b3ddc015867d927b29
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
CloseHandle
Sleep
TerminateProcess
OpenProcess
GetVersionExW
MultiByteToWideChar
WideCharToMultiByte
SetEnvironmentVariableA
FlushFileBuffers
SetFilePointerEx
GetConsoleCP
SetStdHandle
InterlockedIncrement
InterlockedDecrement
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
InterlockedExchange
EncodePointer
DecodePointer
GetLocaleInfoEx
GetStringTypeW
RaiseException
RtlUnwind
IsDebuggerPresent
IsProcessorFeaturePresent
DuplicateHandle
GetCurrentProcess
CreateProcessA
GetModuleFileNameW
GetModuleHandleExW
HeapValidate
GetSystemInfo
GetSystemTimeAsFileTime
GetCommandLineA
InitializeCriticalSectionAndSpinCount
FatalAppExitA
GetCPInfo
GetLastError
GetStdHandle
WriteFile
ExitProcess
GetProcAddress
AreFileApisANSI
LoadLibraryExW
lstrlenA
LoadLibraryW
SetLastError
GetCurrentThread
GetCurrentThreadId
UnhandledExceptionFilter
SetUnhandledExceptionFilter
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetStartupInfoW
GetModuleHandleW
IsValidCodePage
GetACP
GetOEMCP
GetFileType
InitOnceExecuteOnce
WaitForSingleObject
GetExitCodeProcess
CreatePipe
SetConsoleCtrlHandler
OutputDebugStringW
WaitForSingleObjectEx
CreateThread
OutputDebugStringA
WriteConsoleW
HeapFree
HeapReAlloc
HeapSize
HeapQueryInformation
GetModuleFileNameA
HeapAlloc
GetProcessHeap
QueryPerformanceCounter
GetTickCount64
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetTimeFormatEx
GetDateFormatEx
CompareStringEx
GetUserDefaultLocaleName
LCMapStringEx
IsValidLocaleName
EnumSystemLocalesEx
GetTimeZoneInformation
FreeLibrary
VirtualQuery
ReadFile
GetConsoleMode
ReadConsoleW
GetFileAttributesExW
CreateFileW
rpcrt4
RpcServerRegisterIfEx
RpcServerListen
NdrServerCall2
RpcServerUseProtseqEpW
Sections
.textbss Size: - Virtual size: 480KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 1011KB - Virtual size: 1010KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 160KB - Virtual size: 159KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 42KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ