efsui.pdb
Static task
static1
Behavioral task
behavioral1
Sample
0b7bb4d9735192e1a252374479ea367cfe433ee776d2f17faa2976e908637394_NeikiAnalytics.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0b7bb4d9735192e1a252374479ea367cfe433ee776d2f17faa2976e908637394_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
General
-
Target
0b7bb4d9735192e1a252374479ea367cfe433ee776d2f17faa2976e908637394_NeikiAnalytics.exe
-
Size
39KB
-
MD5
6c6c90edb0f77ec16a1dbafedfbf1750
-
SHA1
5f79ace7d96e91810b4adf16feae064eaad36cbb
-
SHA256
0b7bb4d9735192e1a252374479ea367cfe433ee776d2f17faa2976e908637394
-
SHA512
b3ae0c786a09e69cdbb0455ae598153784395c84697d878528ecdac1449db70a6167a6ec0d577b8f0b825dfb771732ded1afd0d9279e44f13927894e6f2bf190
-
SSDEEP
768:/FN6Mi/4ICdTvgHjTrtkICQmvO8T8RXTBJYV8gRiyT0KrnYGjt4:/FN2wdTvgHjTlCNjTGBJZgRiQrt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0b7bb4d9735192e1a252374479ea367cfe433ee776d2f17faa2976e908637394_NeikiAnalytics.exe
Files
-
0b7bb4d9735192e1a252374479ea367cfe433ee776d2f17faa2976e908637394_NeikiAnalytics.exe.exe windows:6 windows x86 arch:x86
88f5b8a224e2f6213bcef481dff428b6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
advapi32
GetTokenInformation
OpenProcessToken
ConvertSidToStringSidW
kernel32
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
GetModuleHandleA
GetStartupInfoA
InterlockedCompareExchange
Sleep
InterlockedExchange
GetTickCount
LocalAlloc
CloseHandle
GetCommandLineW
LocalFree
GetLastError
CreateMutexW
GetCurrentProcess
SetUnhandledExceptionFilter
msvcrt
_controlfp
_except_handler4_common
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_vsnwprintf
_wcsicmp
crypt32
CryptStringToBinaryW
CertFreeCertificateContext
CryptBinaryToStringW
shell32
CommandLineToArgvW
efsadu
EfsUIUtilKeyBackup
EfsUIUtilSelectCard
EfsUIUtilPromptForPin
EfsUIUtilEnrollEfsCertificate
EfsUIUtilInstallDra
EfsUIUtilEncryptMyDocuments
EfsUIUtilShowBalloonAndWait
efsutil
EfsUtilGetCurrentKey
ntdll
RtlAllocateHeap
RtlImageNtHeader
RtlFreeHeap
Sections
.text Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 920B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 28KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE