Static task
static1
Behavioral task
behavioral1
Sample
44ac516c029fccc80bfa24114d3f449a82be159ba09bc878e92db29c4180008b_NeikiAnalytics.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
44ac516c029fccc80bfa24114d3f449a82be159ba09bc878e92db29c4180008b_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
General
-
Target
44ac516c029fccc80bfa24114d3f449a82be159ba09bc878e92db29c4180008b_NeikiAnalytics.exe
-
Size
281KB
-
MD5
8b9774ce8186e4360780d726a6f2d140
-
SHA1
772b1cec2b86b1d01a2dafc48eb8b85b32fc19a8
-
SHA256
44ac516c029fccc80bfa24114d3f449a82be159ba09bc878e92db29c4180008b
-
SHA512
9b2e4ee0a090e4e6be07461f529ae62426fbaf98bc7c70ff563829f028f34ccbf77b8337696bec53cc339175379d00e245bfe9cebb05ecbc6d97a3d4c8ceab8e
-
SSDEEP
6144:uzC4dHmgkgwGPgGG1e/w0+YSV/mtoVspna5Y:cHmx/GdY0Jtoqpna5Y
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 44ac516c029fccc80bfa24114d3f449a82be159ba09bc878e92db29c4180008b_NeikiAnalytics.exe
Files
-
44ac516c029fccc80bfa24114d3f449a82be159ba09bc878e92db29c4180008b_NeikiAnalytics.exe.exe windows:4 windows x86 arch:x86
771ea2c8f9753c82a048d4e97b9ce887
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord4129
ord5710
ord4486
ord1576
ord6375
ord815
ord4274
ord4710
ord537
ord924
ord6199
ord800
ord3092
ord641
ord825
ord324
ord3597
ord4425
ord4627
ord4080
ord3079
ord3825
ord3831
ord3830
ord2976
ord3081
ord2985
ord922
ord3136
ord4465
ord3259
ord3147
ord2982
ord5277
ord2124
ord2446
ord5261
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord5280
ord4353
ord6374
ord5163
ord2385
ord1168
ord5241
ord4407
ord1775
ord4078
ord5272
ord2614
ord774
ord502
ord5588
ord980
ord6343
ord6282
ord6283
ord536
ord939
ord535
ord926
ord858
ord860
ord2645
ord2642
ord2302
ord567
ord692
ord3639
ord3402
ord5290
ord4401
ord1776
ord6055
ord2581
ord4219
ord2024
ord2413
ord6366
ord1771
ord5715
ord2725
ord540
ord2818
ord1200
ord823
ord561
ord3738
ord4424
ord4622
ord5289
ord5307
ord4698
ord4079
ord5302
ord5300
ord3346
ord2396
ord5199
ord1089
ord3922
ord5731
ord2512
ord3262
ord2554
ord6052
ord2514
ord4998
ord4853
ord4376
ord5265
ord2763
ord4234
msvcrt
exit
__CxxFrameHandler
_setmbcp
_CxxThrowException
_purecall
__RTDynamicCast
wcslen
memmove
towupper
towlower
wcsncmp
_wcsnicmp
wcsstr
wcschr
wcsrchr
iswspace
toupper
tolower
strncmp
_strnicmp
strstr
strchr
strrchr
isspace
wcstol
_errno
strtol
wcstoul
_wtoi64
wcsspn
atoi
_mbsicmp
qsort
wcscpy
_splitpath
_ismbcspace
_mbscmp
??1type_info@@UAE@XZ
__dllonexit
_onexit
_controlfp
__set_app_type
__p__fmode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
__p__commode
_XcptFilter
_exit
?terminate@@YAXXZ
_except_handler3
kernel32
CreateDirectoryA
RemoveDirectoryA
FindNextFileW
FindNextFileA
FindClose
FindFirstFileW
FindFirstFileA
SetFileTime
GetFileSize
WriteFile
GetVersionExA
SetFilePointer
ReadFile
CreateFileA
DeleteFileA
MoveFileA
GetTempPathA
GetLongPathNameA
GetVolumeInformationA
GetFullPathNameW
GetDriveTypeW
GetFullPathNameA
GetDriveTypeA
GetComputerNameW
GetCurrentProcess
GetCurrentThread
LocalAlloc
ReleaseMutex
WaitForSingleObject
GetModuleFileNameA
CreateFileW
GetFileInformationByHandle
CreateFileMappingA
OpenFileMappingA
MapViewOfFile
VirtualQuery
UnmapViewOfFile
CloseHandle
FormatMessageA
WideCharToMultiByte
FormatMessageW
SetLastError
LocalFree
InterlockedDecrement
InterlockedIncrement
MultiByteToWideChar
RaiseException
CreateProcessA
lstrcmpA
lstrlenA
lstrcpynA
CreateMutexA
GetLastError
GetCommandLineA
GetModuleHandleA
GetStartupInfoA
user32
GetClassLongA
FindWindowA
SendMessageA
GetWindowLongA
ShowWindow
IsIconic
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
GetWindowTextLengthA
GetWindowTextA
SetWindowTextA
DeleteMenu
PostQuitMessage
MessageBoxA
CreatePopupMenu
EnumWindows
EnableMenuItem
GetClassNameA
GetParent
LoadImageA
IsWindow
GetLastActivePopup
RegisterClassA
DestroyMenu
DefWindowProcA
GetSystemMetrics
GetCursorPos
SetForegroundWindow
TrackPopupMenu
CreateWindowExA
RegisterWindowMessageA
SetWindowLongA
DestroyWindow
AppendMenuA
EnableWindow
UpdateWindow
InvalidateRect
PostMessageA
advapi32
RegCloseKey
InitializeSecurityDescriptor
MakeSelfRelativeSD
GetSecurityDescriptorControl
EqualSid
GetAclInformation
RevertToSelf
AccessCheck
OpenThreadToken
ImpersonateLoggedOnUser
GetKernelObjectSecurity
GetFileSecurityA
SetSecurityDescriptorOwner
CopySid
GetLengthSid
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
SetSecurityDescriptorSacl
SetSecurityDescriptorControl
SetEntriesInAclW
BuildExplicitAccessWithNameW
GetTokenInformation
OpenProcessToken
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
MakeAbsoluteSD
RegCreateKeyExA
RegQueryValueExA
RegSetValueExA
GetSecurityDescriptorLength
RegDeleteValueA
RegDeleteKeyA
RegSetKeySecurity
RegEnumKeyExA
RegEnumValueA
RegQueryInfoKeyA
InitializeAcl
GetAce
AddAce
DeleteAce
FreeSid
AllocateAndInitializeSid
GetSidSubAuthority
InitializeSid
GetSidIdentifierAuthority
GetSidLengthRequired
GetSidSubAuthorityCount
EqualPrefixSid
LsaFreeMemory
LsaNtStatusToWinError
LsaQueryInformationPolicy
LsaLookupSids
LsaLookupNames
LsaOpenPolicy
LsaClose
RegOpenKeyExA
shell32
Shell_NotifyIconA
wsock32
htonl
ntohl
Sections
.text Size: 140KB - Virtual size: 137KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 32KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rrdata Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE