stealth_loader.pdb
Static task
static1
Behavioral task
behavioral1
Sample
826c68194497a68adc8fb95b9df7b7b899b67e08e9d821f01042a5565489d3b8_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
826c68194497a68adc8fb95b9df7b7b899b67e08e9d821f01042a5565489d3b8_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
826c68194497a68adc8fb95b9df7b7b899b67e08e9d821f01042a5565489d3b8_NeikiAnalytics.exe
-
Size
247KB
-
MD5
9836c183d2eb80c94b1fb4bc6ff19cc0
-
SHA1
9690819c84cc85c05d1471a22243b9acd87ad782
-
SHA256
826c68194497a68adc8fb95b9df7b7b899b67e08e9d821f01042a5565489d3b8
-
SHA512
19ce76396ce26e47491a3c0653e4eefa77f4a04eee9d21a211b528fe8370d48df7b1c1897d27d3405bd9464cf8fb216aef8b86c4170b572ad2c3689b02109c6a
-
SSDEEP
3072:pP/C1+jwRw7CyzzyPcaMmliFHyznF9zS0+NdRB3p9aKfsul8wDo/PCq5fHlPdg:9/kS7C8yUqliNyjSrB59a6scjDyX5R
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 826c68194497a68adc8fb95b9df7b7b899b67e08e9d821f01042a5565489d3b8_NeikiAnalytics.exe
Files
-
826c68194497a68adc8fb95b9df7b7b899b67e08e9d821f01042a5565489d3b8_NeikiAnalytics.exe.exe windows:6 windows x64 arch:x64
dc5d06ded303b1e7aa5063ef2c7584b9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
api-ms-win-core-synch-l1-2-0
WaitOnAddress
WakeByAddressSingle
WakeByAddressAll
bcryptprimitives
ProcessPrng
ntdll
RtlNtStatusToDosError
NtProtectVirtualMemory
RtlCaptureContext
NtTestAlert
NtWriteVirtualMemory
NtAllocateVirtualMemory
RtlVirtualUnwind
NtQueueApcThread
RtlLookupFunctionEntry
NtWriteFile
kernel32
InitializeProcThreadAttributeList
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
CreateMutexA
LoadLibraryA
WaitForSingleObjectEx
GetProcAddress
GetModuleHandleA
GetFullPathNameW
CreateThread
WriteConsoleW
CloseHandle
FreeEnvironmentStringsW
DeleteProcThreadAttributeList
CompareStringOrdinal
GetLastError
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetCurrentThread
WaitForSingleObject
QueryPerformanceCounter
SetLastError
GetCurrentDirectoryW
GetEnvironmentStringsW
GetEnvironmentVariableW
SetFileInformationByHandle
GetCurrentProcess
DuplicateHandle
GetStdHandle
GetCurrentProcessId
WriteFileEx
SleepEx
HeapFree
HeapReAlloc
lstrlenW
ReleaseMutex
GetProcessHeap
HeapAlloc
CreateFileW
GetConsoleMode
GetModuleHandleW
FormatMessageW
GetModuleFileNameW
CreateNamedPipeW
ReadFileEx
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
IsProcessorFeaturePresent
UpdateProcThreadAttribute
MultiByteToWideChar
vcruntime140
memset
__current_exception_context
__current_exception
memcpy
__CxxFrameHandler3
_CxxThrowException
memcmp
memmove
__C_specific_handler
api-ms-win-crt-runtime-l1-1-0
_set_app_type
terminate
_configure_narrow_argv
_seh_filter_exe
_crt_atexit
_get_initial_narrow_environment
_initterm
_initterm_e
exit
_exit
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_register_onexit_function
_initialize_narrow_environment
_initialize_onexit_table
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
free
_set_new_mode
Sections
.text Size: 173KB - Virtual size: 173KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 62KB - Virtual size: 61KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 784B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ