t:\delivery\x86\ship\0\ose.pdb
Static task
static1
Behavioral task
behavioral1
Sample
83882ec5652b5bd9aea03d1f5f7025dd74ece9e663117297315580de8bbe1436_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
83882ec5652b5bd9aea03d1f5f7025dd74ece9e663117297315580de8bbe1436_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
General
-
Target
83882ec5652b5bd9aea03d1f5f7025dd74ece9e663117297315580de8bbe1436_NeikiAnalytics.exe
-
Size
1.3MB
-
MD5
5c0b8173fcc69c4b7ce131510cf7b9b0
-
SHA1
e38732f37c59989385aa6ec7d065557354b99d17
-
SHA256
83882ec5652b5bd9aea03d1f5f7025dd74ece9e663117297315580de8bbe1436
-
SHA512
494b05ce2a9e9c268e226cd33e0d1053bd90c7abeaf7586284ced912ea92322b4b335a5ecfeb8b90a9e4e341c0043dc025787f2a9a8628cd5e6f95d837a54baf
-
SSDEEP
12288:yQRYHVMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:yQRAGSkQ/7Gb8NLEbeZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 83882ec5652b5bd9aea03d1f5f7025dd74ece9e663117297315580de8bbe1436_NeikiAnalytics.exe
Files
-
83882ec5652b5bd9aea03d1f5f7025dd74ece9e663117297315580de8bbe1436_NeikiAnalytics.exe.exe windows:4 windows x86 arch:x86
e5a1bfe9d29ff6e7cdf0de13098a43c2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
PDB Paths
Imports
advapi32
RegCloseKey
RegEnumKeyExW
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
SetThreadToken
RegEnumValueW
RegQueryValueExW
RegNotifyChangeKeyValue
SetServiceStatus
StartServiceCtrlDispatcherW
DuplicateToken
RegDeleteValueW
RegisterServiceCtrlHandlerW
CryptDestroyHash
CryptCreateHash
CryptGetHashParam
CryptHashData
FreeSid
AllocateAndInitializeSid
LookupAccountNameW
ConvertStringSecurityDescriptorToSecurityDescriptorW
CheckTokenMembership
OpenThreadToken
RegDeleteKeyW
SetFileSecurityW
CryptAcquireContextW
CryptReleaseContext
kernel32
GetLastError
GetModuleFileNameW
CloseHandle
SetEvent
lstrlenW
GetDriveTypeW
GetLogicalDrives
lstrcmpW
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
Sleep
ExitProcess
InitializeCriticalSection
GetCommandLineW
GetTickCount
ReleaseMutex
ResetEvent
WaitForMultipleObjectsEx
SetErrorMode
CreateEventW
CreateMutexW
CreateProcessW
MoveFileExW
GetSystemInfo
CreateFileA
ReadFile
SetFilePointer
DosDateTimeToFileTime
MultiByteToWideChar
FreeLibrary
GetProcAddress
LoadLibraryW
WideCharToMultiByte
CreateFileW
ReleaseSemaphore
WaitForSingleObject
WaitForMultipleObjects
CreateThread
CreateSemaphoreW
VirtualFree
VirtualAlloc
SetFilePointerEx
GetSystemTimeAsFileTime
CompareStringW
ExpandEnvironmentStringsW
SystemTimeToFileTime
GetSystemTime
SetFileTime
SetEndOfFile
WriteFile
LocalFree
lstrlenA
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
GetFileSizeEx
FindClose
FindFirstFileW
GetFileAttributesW
CreateDirectoryW
GetTempPathW
GlobalFree
GlobalAlloc
GetFileAttributesExW
CopyFileW
CreateHardLinkW
SetFileAttributesW
DeleteFileW
GetTempPathA
GetFileTime
FindNextFileW
GetStdHandle
GetCurrentThread
RemoveDirectoryW
FormatMessageA
GetComputerNameW
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoA
GetModuleHandleA
GetModuleFileNameA
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapDestroy
HeapCreate
QueryPerformanceCounter
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
GetCPInfo
GetACP
GetOEMCP
LCMapStringA
LCMapStringW
LoadLibraryA
HeapReAlloc
RtlUnwind
GetLocaleInfoA
HeapSize
GetStringTypeA
GetStringTypeW
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
rpcrt4
RpcServerRegisterIfEx
RpcServerUseProtseqEpW
RpcServerUnregisterIf
RpcRevertToSelf
RpcImpersonateClient
NdrServerCall2
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
wininet
InternetSetFilePointer
InternetOpenUrlW
InternetCloseHandle
InternetReadFile
InternetOpenW
InternetGetConnectedState
InternetCanonicalizeUrlW
HttpQueryInfoW
wintrust
WinVerifyTrust
Sections
.text Size: 121KB - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1.1MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE