MakeAppx.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2e8e59f7aec00ddb4ce499a04fbc6176688ff97c88143778478c24b32eb4eea7_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
2e8e59f7aec00ddb4ce499a04fbc6176688ff97c88143778478c24b32eb4eea7_NeikiAnalytics.exe
-
Size
1.0MB
-
MD5
151c0d21207d3157418e316fa78f4490
-
SHA1
26956be081c0724e061198aa5c511bae474a0455
-
SHA256
2e8e59f7aec00ddb4ce499a04fbc6176688ff97c88143778478c24b32eb4eea7
-
SHA512
1bc58237c1bd4ef4e066572754131a7707b1ae610d7fd263cc6685de998876e41391b88fa4f594ae460b130623839e7218fd47f07972f4922895dcc99205d60e
-
SSDEEP
24576:N4iXSerFvF6kx1t5Jt/sBlDqgZQd6XKtiMJYiPU:XXScZwk7t5r/snji6attJM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2e8e59f7aec00ddb4ce499a04fbc6176688ff97c88143778478c24b32eb4eea7_NeikiAnalytics.exe
Files
-
2e8e59f7aec00ddb4ce499a04fbc6176688ff97c88143778478c24b32eb4eea7_NeikiAnalytics.exe.exe windows:10 windows x64 arch:x64
c031fa4774700754d25fb610d9d04d26
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
api-ms-win-crt-runtime-l1-1-0
_c_exit
_register_thread_local_exe_atexit_callback
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__callnewh
_o__cexit
_o__configthreadlocale
_o__configure_wide_argv
_o__crt_atexit
_o__errno
_o__exit
_o__get_initial_wide_environment
_o__getwche
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
memmove
_o__wcsicmp
_o__wcstoui64
_o_exit
_o_free
_o_malloc
_o_qsort
_o_terminate
_o_towupper
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___stdio_common_vfwprintf_s
_o___std_exception_destroy
_o___std_exception_copy
_o___p__commode
_o___p___wargv
_o___p___argc
wcsrchr
_o___acrt_iob_func
wcschr
wcsstr
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
wcsncmp
kernel32
GetModuleFileNameA
CreateDirectoryW
GetModuleHandleExW
GetTempPathW
FindNextFileW
FindFirstFileW
FindClose
LoadLibraryExA
GetFullPathNameW
MultiByteToWideChar
SetFilePointer
DelayLoadFailureHook
ReadFile
WaitForSingleObject
GetExitCodeProcess
GetProcAddress
FindResourceW
LoadResource
SizeofResource
LockResource
GetModuleHandleW
DebugBreak
FindStringOrdinal
HeapFree
HeapAlloc
GetProcessHeap
FormatMessageW
GetLastError
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
MoveFileExW
CreateFileW
GetFileAttributesW
LocalFree
DeleteFileW
SetLastError
OutputDebugStringW
LoadLibraryExW
FreeLibrary
GlobalMemoryStatusEx
GetCurrentThreadId
IsDebuggerPresent
CompareStringOrdinal
CloseHandle
CompareStringEx
GetFileAttributesExW
CreateProcessW
oleaut32
SetErrorInfo
CreateErrorInfo
SysAllocStringLen
SysAllocString
GetErrorInfo
SysFreeString
VariantClear
SysStringLen
VariantInit
ole32
CoCreateInstance
CoUninitialize
CoInitializeEx
CoTaskMemAlloc
StringFromGUID2
CoCreateGuid
CoTaskMemFree
CreateStreamOnHGlobal
ntdll
RtlInsertElementGenericTableAvl
RtlCompareUnicodeString
RtlDeleteElementGenericTableAvl
RtlEnumerateGenericTableWithoutSplayingAvl
RtlInitializeGenericTableAvl
RtlLookupElementGenericTableAvl
RtlNumberGenericTableElementsAvl
RtlInitUnicodeString
urlmon
CreateUri
opcservices
ord12
ord8
advapi32
IsTextUnicode
EventWriteTransfer
shlwapi
PathFindFileNameW
xmllite
CreateXmlReader
Sections
.text Size: 207KB - Virtual size: 206KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 254KB - Virtual size: 253KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 568KB - Virtual size: 572KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE