Static task
static1
Behavioral task
behavioral1
Sample
60283ab2d6cdbd7b52cdc5fa19f00580b27a48615fea1bfcda8d03c1c1c2f863_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
60283ab2d6cdbd7b52cdc5fa19f00580b27a48615fea1bfcda8d03c1c1c2f863_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
60283ab2d6cdbd7b52cdc5fa19f00580b27a48615fea1bfcda8d03c1c1c2f863_NeikiAnalytics.exe
-
Size
1.6MB
-
MD5
52879b41926752163ef5ae197162b6d0
-
SHA1
d5361be1dbb76639827503b8761a38e748eded36
-
SHA256
60283ab2d6cdbd7b52cdc5fa19f00580b27a48615fea1bfcda8d03c1c1c2f863
-
SHA512
275a7231e9696bdb200a73f61a2df0e4c73cbc9d8a8b9679135ffc18bed5fbec14c27380678c93327336f3402f59876bc6a4e11106e18e1ccab8ec0f083418c7
-
SSDEEP
49152:duVYm+zxWeWa6zsG9TX50/824OL7QEGIyB:YL2BWaqsg6/54OL7QEGI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 60283ab2d6cdbd7b52cdc5fa19f00580b27a48615fea1bfcda8d03c1c1c2f863_NeikiAnalytics.exe
Files
-
60283ab2d6cdbd7b52cdc5fa19f00580b27a48615fea1bfcda8d03c1c1c2f863_NeikiAnalytics.exe.exe windows:4 windows x64 arch:x64
3b5267ffde1717aa04363b9308999350
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
CloseHandle
CreateFileA
CreateProcessA
DeleteCriticalSection
EnterCriticalSection
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetExitCodeProcess
GetFileAttributesA
GetFullPathNameA
GetLastError
GetModuleFileNameW
GetProcAddress
GetStartupInfoA
GetSystemTimeAsFileTime
GetTempPathA
GetTickCount
GetTimeZoneInformation
GetVersionExA
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
QueryPerformanceCounter
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetHandleInformation
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WaitForSingleObject
msvcrt
__C_specific_handler
__argv
__doserrno
__getmainargs
__initenv
__iob_func
__lconv_init
__pioinfo
__set_app_type
__setusermatherr
_access
_acmdln
_amsg_exit
_cexit
_chmod
_close
_close
_ctime64
_dup
_errno
_exit
_fdopen
_filelengthi64
_fileno
_findclose
_findfirst64
_fileno
_findnext64
_fmode
_fstat64
_fullpath
_get_osfhandle
_getcwd
_getpid
_initterm
_isatty
_lseeki64
_mkdir
_mktemp
_onexit
_open
_open
_pipe
_read
_snwprintf
_sopen
_stat64
_strdup
_stricmp
_stricmp
_strnicmp
_time64
_umask
_unlink
_vsnprintf
_wcsnicmp
_write
abort
atoi
bsearch
calloc
clearerr
exit
fclose
ferror
fflush
fgetpos
fopen
fprintf
fputc
fputs
fread
free
fseek
fsetpos
ftell
fwprintf
fwrite
getc
getenv
islower
isspace
isupper
malloc
memchr
memcmp
memcpy
memmove
memset
printf
putc
putchar
puts
qsort
raise
rand
realloc
remove
setlocale
signal
sprintf
sscanf
strcat
strchr
strcmp
strcpy
strcspn
strerror
strlen
strncat
strncmp
strncpy
strpbrk
strrchr
strspn
strstr
strtok
strtol
strtoul
tolower
vfprintf
vprintf
wcscpy
user32
CharLowerBuffA
MessageBoxW
Sections
.text Size: 770KB - Virtual size: 769KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 244KB - Virtual size: 244KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 21KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 104B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 568KB - Virtual size: 572KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE