C:\Build\Main\Release\BFArchive.pdb
Static task
static1
Behavioral task
behavioral1
Sample
25bcbfa1874f744070db4d2326a361b54100a4c5ec59c19a3abb89f183227a57_NeikiAnalytics.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
25bcbfa1874f744070db4d2326a361b54100a4c5ec59c19a3abb89f183227a57_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
25bcbfa1874f744070db4d2326a361b54100a4c5ec59c19a3abb89f183227a57_NeikiAnalytics.exe
-
Size
390KB
-
MD5
8041ca5ee36b4e80ba5111a8e2373cd0
-
SHA1
775219c49f93fbf6fe88ffdecc2fcf95a7f189dd
-
SHA256
25bcbfa1874f744070db4d2326a361b54100a4c5ec59c19a3abb89f183227a57
-
SHA512
d5fde39ad38d472000048ea1b161a6e6b1ab399b2f2a8f46fb7d92eed42c6a8f6beb16cf594fc063adfd3e196d80d6b2a0dc84421474824d74ada81212b52b4c
-
SSDEEP
6144:jSBeao4+F23y5w5nfSLiSVSKtGCwaO63EaTBJDWjvCGZph:jSBeao4+IdGfYsO7aTrZGZph
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 25bcbfa1874f744070db4d2326a361b54100a4c5ec59c19a3abb89f183227a57_NeikiAnalytics.exe
Files
-
25bcbfa1874f744070db4d2326a361b54100a4c5ec59c19a3abb89f183227a57_NeikiAnalytics.exe.exe windows:5 windows x86 arch:x86
24e8952ce2a66f5ab8f4dada48cfb3af
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
MoveFileA
GetTempFileNameA
FindClose
FindFirstFileA
SetFileTime
FindNextFileA
GetFileType
SetEndOfFile
SetFilePointer
GetFileSize
FlushFileBuffers
FormatMessageA
InitializeCriticalSection
RemoveDirectoryA
EnterCriticalSection
LeaveCriticalSection
GetTimeZoneInformation
GetVolumeInformationA
GetACP
WriteFile
ReadFile
QueryPerformanceCounter
LoadLibraryA
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
SetFileAttributesA
DeleteFileA
GetFileAttributesA
CreateDirectoryA
CreateFileA
CloseHandle
GetLastError
DeleteCriticalSection
LocalFree
InterlockedExchangeAdd
InterlockedIncrement
InterlockedDecrement
GetStringTypeW
LCMapStringW
GetCPInfo
CompareStringA
CompareStringW
GetLocaleInfoA
LCMapStringA
GetStringTypeA
Sleep
GetSystemInfo
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
RaiseException
RtlUnwind
GetCommandLineA
HeapAlloc
HeapReAlloc
HeapFree
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileInformationByHandle
PeekNamedPipe
SetHandleCount
GetStdHandle
GetStartupInfoA
SetStdHandle
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetModuleFileNameA
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
IsDebuggerPresent
HeapSize
ExitProcess
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
VirtualFree
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetOEMCP
IsValidCodePage
VirtualAlloc
GetModuleHandleA
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
Sections
.text Size: 280KB - Virtual size: 280KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 64KB - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 14KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
STLPORT_ Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ