Static task
static1
Behavioral task
behavioral1
Sample
8e7540988de93f8bb5fd65ce8dd24a3354c4a8040559c4846d3df265b989172b_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
8e7540988de93f8bb5fd65ce8dd24a3354c4a8040559c4846d3df265b989172b_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
General
-
Target
8e7540988de93f8bb5fd65ce8dd24a3354c4a8040559c4846d3df265b989172b_NeikiAnalytics.exe
-
Size
377KB
-
MD5
0660ff63ca06f8d7582cbd80b3a657c0
-
SHA1
aa8d7b7e718a7303195210e629ba93bfb7621758
-
SHA256
8e7540988de93f8bb5fd65ce8dd24a3354c4a8040559c4846d3df265b989172b
-
SHA512
723c8417efb9f94dbc87986c5cc6fa2021c3e70fe92ef4e3881e81d80ceb3c517d82df6c6da1bd3806ea04cf0984a8c09ed13a536a3e59d9edcbb5f935e769cf
-
SSDEEP
6144:ZecbK9Tuv7Vw9Vm0YRMDbmOoWIWYsG7fAdkshSss0MS:/uTuv7Vw92RMDbmPWPhG7HmJHM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8e7540988de93f8bb5fd65ce8dd24a3354c4a8040559c4846d3df265b989172b_NeikiAnalytics.exe
Files
-
8e7540988de93f8bb5fd65ce8dd24a3354c4a8040559c4846d3df265b989172b_NeikiAnalytics.exe.exe windows:6 windows x64 arch:x64
7e0ec3fcf33011a33b93cfba9b0b7a3b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mpr
WNetGetConnectionW
kernel32
GetCurrentProcessId
IsDebuggerPresent
FindFirstFileW
FindNextFileW
FindClose
FreeLibrary
GetLogicalDrives
FindFirstVolumeW
lstrlenW
lstrcatW
SetVolumeMountPointW
FindVolumeClose
lstrcmpW
lstrcpyW
FindNextVolumeW
lstrcmpiW
GetDriveTypeW
GetLocalTime
GetModuleFileNameW
SetProcessShutdownParameters
GetFileAttributesW
SetFileAttributesW
GetModuleHandleW
WriteFile
CreateFileW
HeapFree
HeapAlloc
GetProcessHeap
EnterCriticalSection
ReleaseSemaphore
LeaveCriticalSection
WaitForSingleObject
WriteConsoleW
HeapSize
SetStdHandle
GetProcAddress
CloseHandle
Process32FirstW
LoadLibraryA
Process32NextW
GetLastError
GetTickCount64
Sleep
RtlUnwind
CreateToolhelp32Snapshot
OpenProcess
GetModuleHandleA
TerminateProcess
GetCurrentProcess
SetEndOfFile
GetVolumePathNamesForVolumeNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
HeapReAlloc
ReadConsoleW
ReadFile
GetConsoleMode
GetConsoleOutputCP
GetFileType
FlushFileBuffers
SetFilePointerEx
GetFileSizeEx
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
FlsFree
FlsSetValue
FlsGetValue
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LocalFree
LCMapStringEx
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetCommandLineA
GetCommandLineW
ExitProcess
GetModuleHandleExW
GetStdHandle
FlsAlloc
user32
wsprintfW
advapi32
EnumDependentServicesA
CloseServiceHandle
OpenSCManagerA
ControlService
QueryServiceStatusEx
OpenServiceA
shell32
SHGetFolderPathW
ShellExecuteW
oleaut32
VariantClear
wsock32
WSAGetLastError
htons
Sections
.text Size: 274KB - Virtual size: 273KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 74KB - Virtual size: 74KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ