C:\CodeProj\SPIFilterX64\x64\Release\Injection.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2072d854ac5d6909f8275a78e0188a876b524f4c3f6a25aaff135f3b0ae19ed9_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2072d854ac5d6909f8275a78e0188a876b524f4c3f6a25aaff135f3b0ae19ed9_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
General
-
Target
2072d854ac5d6909f8275a78e0188a876b524f4c3f6a25aaff135f3b0ae19ed9_NeikiAnalytics.exe
-
Size
99KB
-
MD5
a2d1ff888113bb5eadeea12ace02b270
-
SHA1
4110eb2b786dc4dcb5e41d8fa4d1c4ceeebdc6b6
-
SHA256
2072d854ac5d6909f8275a78e0188a876b524f4c3f6a25aaff135f3b0ae19ed9
-
SHA512
56b32ef82dda949dda54445ad902e8fa9850e643b5bb3cad9515e0197cbe8285c4d77432c174e2bc7cb05e87b316ae282127d594ded85eb565ce969e584c7ecb
-
SSDEEP
1536:sqUFf5yPLPybL3qCZT9pGHm1F+T3Kk0qGQP+TDZoJy3IYnSeNhatKs:EFMTPG7ZT9pUAFk9FJyNphatKs
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2072d854ac5d6909f8275a78e0188a876b524f4c3f6a25aaff135f3b0ae19ed9_NeikiAnalytics.exe
Files
-
2072d854ac5d6909f8275a78e0188a876b524f4c3f6a25aaff135f3b0ae19ed9_NeikiAnalytics.exe.exe windows:5 windows x64 arch:x64
f65710e795cc93860c4fe22a104f11af
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
WritePrivateProfileStringW
GetModuleFileNameW
GetProcAddress
GetModuleHandleW
FindNextFileW
CreateFileW
MultiByteToWideChar
CloseHandle
OpenProcess
VirtualAllocEx
WriteProcessMemory
ReadProcessMemory
VirtualFreeEx
CreateRemoteThread
WaitForSingleObject
GetCurrentProcess
OpenEventW
LoadLibraryW
SetEvent
Sleep
CompareStringW
WideCharToMultiByte
lstrlenW
FlushFileBuffers
GetTimeZoneInformation
WriteConsoleW
SetStdHandle
HeapReAlloc
GetStringTypeW
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetConsoleMode
GetSystemTimeAsFileTime
GetLastError
SetEnvironmentVariableW
GetCurrentDirectoryW
SetCurrentDirectoryW
FindFirstFileExW
GetCommandLineW
GetStartupInfoW
RaiseException
RtlPcToFileHeader
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
HeapFree
EncodePointer
DecodePointer
HeapAlloc
FlsGetValue
FlsSetValue
FlsFree
SetLastError
GetCurrentThreadId
FlsAlloc
FileTimeToSystemTime
FileTimeToLocalFileTime
ExitProcess
WriteFile
GetStdHandle
RtlUnwindEx
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
HeapSetInformation
GetVersion
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
LeaveCriticalSection
EnterCriticalSection
HeapSize
SetFilePointer
GetConsoleCP
SetEnvironmentVariableA
user32
GetTopWindow
FindWindowW
GetWindowThreadProcessId
SendMessageW
advapi32
LookupPrivilegeValueW
OpenProcessToken
AdjustTokenPrivileges
shell32
SHGetSpecialFolderPathW
ole32
CoInitialize
CoCreateInstance
shlwapi
PathFileExistsW
StrToIntW
Sections
.text Size: 64KB - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ