tracerpt.pdb
Static task
static1
Behavioral task
behavioral1
Sample
81e3e9b474b1e8d096755ad0da6b6be9121bafbed9a0312f6866130a85609bda_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
81e3e9b474b1e8d096755ad0da6b6be9121bafbed9a0312f6866130a85609bda_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
General
-
Target
81e3e9b474b1e8d096755ad0da6b6be9121bafbed9a0312f6866130a85609bda_NeikiAnalytics.exe
-
Size
385KB
-
MD5
9a05d933c7151048c1aeb7a83303c280
-
SHA1
0bb28fc6eb20de1b9a0ee709fe57b70b25c74586
-
SHA256
81e3e9b474b1e8d096755ad0da6b6be9121bafbed9a0312f6866130a85609bda
-
SHA512
2c130a28e02a976f4c952e24f34b09c1895855e325f865f05fa3654917952386c7755ec3e189fcf291aa4786b387a4d7ac909bdd0a922ff6364001ae0d90d0dd
-
SSDEEP
6144:I3rj6LeNCqChOIuGRtmGwJECoFjLeSwJECoFjLe:TSkqChOZGRQGwJEC6jLeSwJEC6jLe
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 81e3e9b474b1e8d096755ad0da6b6be9121bafbed9a0312f6866130a85609bda_NeikiAnalytics.exe
Files
-
81e3e9b474b1e8d096755ad0da6b6be9121bafbed9a0312f6866130a85609bda_NeikiAnalytics.exe.exe windows:5 windows x86 arch:x86
f669e086134239088f1b1940e23fb298
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
advapi32
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegisterTraceGuidsW
StartTraceW
TraceEvent
LookupAccountSidA
LookupAccountSidW
OpenTraceW
ProcessTrace
CloseTrace
StopTraceW
kernel32
FindClose
FindNextFileW
FindFirstFileW
SetThreadLocale
GetSystemDefaultLCID
GetConsoleOutputCP
GetThreadLocale
GetUserDefaultUILanguage
LocalFree
WriteFile
WriteConsoleW
GetFileType
FormatMessageW
GetModuleHandleW
GetModuleFileNameW
ReadConsoleW
MultiByteToWideChar
ReadFile
SetConsoleMode
GetConsoleMode
CloseHandle
CreateFileW
SystemTimeToFileTime
FreeLibrary
LoadLibraryW
DeleteFileW
LockResource
LoadResource
FindResourceW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetVersionExA
ExitProcess
GetLastError
GetModuleHandleA
GetACP
GetOEMCP
GetCPInfo
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
WideCharToMultiByte
VirtualProtect
GetSystemInfo
VirtualQuery
LCMapStringA
LCMapStringW
RtlUnwind
InterlockedExchange
GetStringTypeA
GetStringTypeW
LoadLibraryA
VirtualAlloc
HeapReAlloc
SetFilePointer
GetLocaleInfoA
RaiseException
SetStdHandle
FlushFileBuffers
SetEndOfFile
Sleep
lstrlenA
FileTimeToLocalFileTime
FileTimeToSystemTime
SetLastError
ExpandEnvironmentStringsW
GetStringTypeExW
GetLocaleInfoW
SetConsoleTextAttribute
GetStdHandle
GetConsoleScreenBufferInfo
GetProcessHeap
HeapAlloc
HeapFree
GetProcAddress
SetEvent
lstrlenW
GetLocalTime
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
user32
LoadStringW
CharToOemW
wsprintfW
rpcrt4
UuidCreate
ole32
CoCreateInstance
CoInitialize
CoSetProxyBlanket
oleaut32
SafeArrayUnaccessData
VariantClear
SysAllocString
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SysFreeString
SafeArrayGetElement
VariantInit
VariantChangeType
SafeArrayDestroy
ntdll
RtlLeaveCriticalSection
RtlDeleteCriticalSection
RtlInitializeCriticalSection
RtlFreeUnicodeString
RtlStringFromGUID
RtlEnterCriticalSection
RtlAnsiCharToUnicodeChar
Sections
.text Size: 141KB - Virtual size: 140KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 238KB - Virtual size: 239KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE