gacutil.pdb
Static task
static1
Behavioral task
behavioral1
Sample
6797b782b94f88b624687d8a31030d1fa39aa142f2c1cb382a4143259cd7aefd_NeikiAnalytics.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
6797b782b94f88b624687d8a31030d1fa39aa142f2c1cb382a4143259cd7aefd_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
General
-
Target
6797b782b94f88b624687d8a31030d1fa39aa142f2c1cb382a4143259cd7aefd_NeikiAnalytics.exe
-
Size
1.5MB
-
MD5
756d6ce0a85b31ed2807861672f74040
-
SHA1
325453abd14772a5f7a42843ec0e5d9a2b77e122
-
SHA256
6797b782b94f88b624687d8a31030d1fa39aa142f2c1cb382a4143259cd7aefd
-
SHA512
6c1fb12373c3690eff1aeca07937fb80385585469733dc9ca66cda42105b87b32f46ff4cc0c056f3f85ad446d4c32046c72c01d82e573c243616c916020b89bf
-
SSDEEP
12288:/1YwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+:/bsRjhm0Ijr/eax8JXO02q3A
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6797b782b94f88b624687d8a31030d1fa39aa142f2c1cb382a4143259cd7aefd_NeikiAnalytics.exe
Files
-
6797b782b94f88b624687d8a31030d1fa39aa142f2c1cb382a4143259cd7aefd_NeikiAnalytics.exe.exe windows:5 windows x86 arch:x86
d76b0d681009fd566d7425e08f54123b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetVersionExW
GetLastError
MultiByteToWideChar
GetFullPathNameA
SetLastError
WideCharToMultiByte
GetFullPathNameW
lstrlenW
LocalFree
LocalAlloc
FormatMessageA
FormatMessageW
CreateFileA
CreateFileW
WriteFile
GetConsoleOutputCP
GetProcAddress
GetModuleHandleA
GetFileType
GetStdHandle
CloseHandle
lstrlenA
ReadFile
FreeLibrary
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
RtlUnwind
ExitProcess
GetModuleFileNameA
UnhandledExceptionFilter
GetModuleFileNameW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetStartupInfoA
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
GetCPInfo
GetACP
GetOEMCP
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
InitializeCriticalSection
Sleep
VirtualAlloc
HeapReAlloc
HeapSize
SetFilePointer
GetConsoleCP
GetConsoleMode
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
WriteConsoleW
FlushFileBuffers
mscoree
ord22
LoadLibraryShim
user32
LoadStringA
LoadStringW
shlwapi
PathCombineW
Sections
.text Size: 66KB - Virtual size: 65KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE