Static task
static1
Behavioral task
behavioral1
Sample
4cfc33deeedcc336cc541b2a91eb666fdb2c8984c215daf8cee6ab793c9ef9d1_NeikiAnalytics.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
4cfc33deeedcc336cc541b2a91eb666fdb2c8984c215daf8cee6ab793c9ef9d1_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
4cfc33deeedcc336cc541b2a91eb666fdb2c8984c215daf8cee6ab793c9ef9d1_NeikiAnalytics.exe
-
Size
1.6MB
-
MD5
9188c33ab4a38ed6d04af3cad9a93fd0
-
SHA1
8fe33de4478ae8065ebb0b10b987be20e913fc22
-
SHA256
4cfc33deeedcc336cc541b2a91eb666fdb2c8984c215daf8cee6ab793c9ef9d1
-
SHA512
654472fe6e10e714b3da8c4e7e3f3ccc981c52d743bef3a64ed52c67572eeef68e00a76f82473e207b20f65534f99e8a1fdfcc5f35e2911cf359abd35b08ade4
-
SSDEEP
24576:lb9bhDjaHR4Os0/jZlBiABSqcqTWkd6Drwf7n16oi2xx9avbF7KL:lb9bBjaH6OB7zBiABSxqTwvK432JucL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4cfc33deeedcc336cc541b2a91eb666fdb2c8984c215daf8cee6ab793c9ef9d1_NeikiAnalytics.exe
Files
-
4cfc33deeedcc336cc541b2a91eb666fdb2c8984c215daf8cee6ab793c9ef9d1_NeikiAnalytics.exe.exe windows:6 windows x86 arch:x86
78e337a2e45ceff8dd70ccf26e5f7285
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetStdHandle
SetStdHandle
GetCommandLineA
CreateFileA
FindFirstFileExW
FindNextChangeNotification
FlushFileBuffers
GetFileAttributesExW
GetFileInformationByHandle
GetFileSize
GetFileSizeEx
GetFileType
GetFileTime
GetLogicalDrives
LockFile
LockFileEx
SetEndOfFile
SetFilePointer
SetFilePointerEx
SetFileValidData
UnlockFile
UnlockFileEx
AreFileApisANSI
EncodePointer
DecodePointer
EncodeSystemPointer
DecodeSystemPointer
SetHandleInformation
GetLastError
SetLastError
DisconnectNamedPipe
PeekNamedPipe
GetNamedPipeInfo
GetNamedPipeHandleStateW
QueryPerformanceCounter
QueryPerformanceFrequency
HeapCreate
GetProcessHeap
CreateIoCompletionPort
PostQueuedCompletionStatus
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetEvent
ResetEvent
ReleaseSemaphore
ReleaseMutex
WaitForSingleObject
CreateMutexA
CreateEventA
CancelWaitableTimer
WaitForMultipleObjects
GetProcessTimes
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetThreadPriorityBoost
GetThreadPriority
GetProcessVersion
SetPriorityClass
GetPriorityClass
GetProcessId
GetThreadContext
FlushInstructionCache
GetThreadTimes
OpenProcess
IsProcessorFeaturePresent
GetProcessHandleCount
GetProcessPriorityBoost
SetProcessPriorityBoost
GetThreadIOPendingFlag
LoadLibraryA
GetVersion
GetVersionExA
GetNativeSystemInfo
SetSystemTimeAdjustment
CreateFileMappingW
FlushViewOfFile
SetProcessWorkingSetSize
GetWriteWatch
ResetWriteWatch
CreateMemoryResourceNotification
IsProcessInJob
AssignProcessToJobObject
SetInformationJobObject
DisableThreadLibraryCalls
FreeResource
GetModuleFileNameA
GetModuleFileNameW
LockResource
GlobalUnlock
GlobalCompact
GlobalUnfix
GlobalUnWire
LocalUnlock
LocalShrink
LocalCompact
GetProcessAffinityMask
GetProcessIoCounters
ConvertFiberToThread
CreateFiberEx
CreateFiber
ConvertThreadToFiber
PulseEvent
GlobalDeleteAtom
InitAtomTable
DeleteAtom
SetHandleCount
SetMessageWaitingIndicator
ClearCommBreak
ClearCommError
EscapeCommFunction
GetCommMask
GetCommModemStatus
GetCommTimeouts
TransmitCommChar
PrepareTape
EraseTape
CreateTapePartition
GetTapeStatus
MulDiv
GetMailslotInfo
SetMailslotInfo
AddAtomA
GetNamedPipeHandleStateA
VerifyVersionInfoA
MapUserPhysicalPagesScatter
CloseHandle
CreateFileW
WriteConsoleW
GetConsoleMode
GetConsoleOutputCP
HeapReAlloc
HeapSize
LCMapStringW
GetProcAddress
GetSystemInfo
GetModuleHandleA
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
GetCommandLineW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindClose
HeapFree
HeapAlloc
GetModuleHandleExW
ExitProcess
WriteFile
RaiseException
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
RtlUnwind
TerminateProcess
GetModuleHandleW
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
winspool.drv
SetJobA
SetPrinterA
GetPrinterA
FlushPrinter
GetPrinterDataA
GetPrinterDataExA
EnumPrinterDataA
EnumPrinterDataExA
EnumPrinterKeyA
SetPrinterDataA
SetPrinterDataExA
GetFormA
EnumFormsA
ResetPrinterA
ConnectToPrinterDlg
EnumPrintersA
advapi32
DecryptFileA
GetUserNameA
ole32
CoTaskMemRealloc
CoTaskMemAlloc
CoInvalidateRemoteMachineBindings
CoGetTreatAsClass
CoWaitForMultipleHandles
StringFromGUID2
CLSIDFromProgID
ProgIDFromCLSID
StringFromIID
CLSIDFromString
CoDisableCallCancellation
CoEnableCallCancellation
CoTestCancel
CoCancelCall
CoSetCancelObject
CoSwitchCallContext
CoFileTimeNow
CoRevokeMallocSpy
CoSetProxyBlanket
CoQueryProxyBlanket
CoGetCallContext
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoGetStdMarshalEx
CoGetStandardMarshal
CoLockObjectExternal
CoDisconnectObject
CoUnmarshalHresult
CoMarshalHresult
CoMarshalInterface
CoGetMarshalSizeMax
CoGetPSClsid
CoRevokeClassObject
CoGetContextToken
CoGetCallerTID
CoGetCurrentProcess
CoUninitialize
CoCopyProxy
CoRevokeInitializeSpy
CoGetInterceptor
OleDoAutoConvert
OleRegGetUserType
OleGetIconOfClass
OleGetIconOfFile
IsAccelerator
GetRunningObjectTable
GetClassFile
MkParseDisplayName
CoGetObject
BindMoniker
CoInstall
CoAllowSetForegroundWindow
CoRevertToSelf
CoGetInstanceFromIStorage
gdiplus
GdiplusStartup
Sections
.text Size: 973KB - Virtual size: 972KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 327KB - Virtual size: 327KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 295KB - Virtual size: 301KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ