nbtstat.pdb
Static task
static1
Behavioral task
behavioral1
Sample
65049c37a73952ca01811ee092527f334a5d18070b2c6b322ba5204d9c326e70_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
65049c37a73952ca01811ee092527f334a5d18070b2c6b322ba5204d9c326e70_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
General
-
Target
65049c37a73952ca01811ee092527f334a5d18070b2c6b322ba5204d9c326e70_NeikiAnalytics.exe
-
Size
42KB
-
MD5
aa326411ff76b1a49ec9e2a6321caa80
-
SHA1
b0b0d7ecae7ae1c1bd55eb1d73985656275e04b3
-
SHA256
65049c37a73952ca01811ee092527f334a5d18070b2c6b322ba5204d9c326e70
-
SHA512
72a925a65a97e8414a4bfcfeb97f36670a372f2223a6d644d02f9d00c876aa43df35898931ec1d3343deff1adc208218d1bd8d1994e020d7c9a8b08cc50d4fe7
-
SSDEEP
768:30mwxXA7N3ILPd6xmnJ9cAZpd7fO1/vssT:3r8lkmJ9DO1c
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 65049c37a73952ca01811ee092527f334a5d18070b2c6b322ba5204d9c326e70_NeikiAnalytics.exe
Files
-
65049c37a73952ca01811ee092527f334a5d18070b2c6b322ba5204d9c326e70_NeikiAnalytics.exe.exe windows:6 windows x86 arch:x86
2a32010b0683a00f1a1c6066c0a61901
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
advapi32
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
kernel32
LocalFree
LocalAlloc
Sleep
SetThreadUILanguage
HeapSetInformation
InterlockedExchange
InterlockedCompareExchange
SetUnhandledExceptionFilter
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FormatMessageA
WideCharToMultiByte
MultiByteToWideChar
msvcrt
_write
_setmode
__setusermatherr
_amsg_exit
_initterm
_XcptFilter
_cexit
__getmainargs
exit
atoi
memset
memmove
isprint
_vsnprintf
__p__commode
__p__fmode
_except_handler4_common
?terminate@@YAXXZ
_exit
__set_app_type
_controlfp
ntdll
RtlExtendedLargeIntegerDivide
NtClose
RtlUnicodeStringToAnsiString
RtlFreeAnsiString
RtlUpcaseUnicodeStringToOemString
RtlIpv4AddressToStringA
NtDeviceIoControlFile
NtWaitForSingleObject
RtlInitString
RtlAnsiStringToUnicodeString
NtCreateFile
RtlFreeUnicodeString
RtlGUIDFromString
RtlInitUnicodeString
user32
CharToOemBuffA
OemToCharBuffA
wsock32
ntohl
ioctlsocket
ord1108
iphlpapi
NhGetInterfaceNameFromDeviceGuid
Sections
.text Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 28KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE