PyInit__s3fs
Static task
static1
Behavioral task
behavioral1
Sample
8e6bbc943663ca0ee0ad4c8eea115d56e4f018624d5db0f1831835385aef99de_NeikiAnalytics.dll
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
8e6bbc943663ca0ee0ad4c8eea115d56e4f018624d5db0f1831835385aef99de_NeikiAnalytics.dll
Resource
win10v2004-20240508-en
General
-
Target
8e6bbc943663ca0ee0ad4c8eea115d56e4f018624d5db0f1831835385aef99de_NeikiAnalytics.exe
-
Size
108KB
-
MD5
22bb2f3e4babfdb5dda1f62cdcbb4aa0
-
SHA1
01ad39d0e23395f4d5aa1be05b785099708f645c
-
SHA256
8e6bbc943663ca0ee0ad4c8eea115d56e4f018624d5db0f1831835385aef99de
-
SHA512
c86e988f6f7617158dd35b25f5e78f3e0c73fda6588b4b10a123a49589af61544da4fffe364ea7e2e36af42750b48cfaaa79cc556184641fb0c38049e0de415c
-
SSDEEP
3072:82lk2arhwICKu67+5Ddj7wB1ZLrIcxAyhJZEFUjX1X:82ybrh0j67+5D97wB1ZLrIcxA/UjFX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8e6bbc943663ca0ee0ad4c8eea115d56e4f018624d5db0f1831835385aef99de_NeikiAnalytics.exe
Files
-
8e6bbc943663ca0ee0ad4c8eea115d56e4f018624d5db0f1831835385aef99de_NeikiAnalytics.exe.dll windows:6 windows x64 arch:x64
074a391315509a0b57e1035453d8f474
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
python36
PyDict_Copy
PyDict_Contains
_PyDict_NewPresized
PyDict_GetItemString
PyDict_SetItemString
PyCFunction_NewEx
PyModule_NewObject
PyModule_GetDict
PyModule_GetName
PyModuleDef_Init
PyClassMethod_New
PyMethod_New
PyCapsule_New
PyCapsule_GetPointer
PyCapsule_GetName
PyCapsule_IsValid
PyThreadState_Get
_PyThreadState_UncheckedGet
PyGILState_Ensure
PyGILState_Release
PyTraceBack_Here
PyDescr_NewClassMethod
PyErr_WarnEx
PyErr_WarnFormat
PyErr_SetObject
PyErr_SetString
PyErr_Occurred
PyMethodDescr_Type
PyDict_Size
PyErr_ExceptionMatches
PyException_SetCause
PyErr_Format
PyOS_snprintf
Py_GetVersion
_Py_CheckRecursiveCall
PyEval_EvalFrameEx
PyEval_SaveThread
PyEval_RestoreThread
PyImport_GetModuleDict
PyImport_AddModule
PyImport_ImportModule
PyImport_ImportModuleLevelObject
PyObject_Call
PyObject_CallObject
PyObject_CallFunctionObjArgs
PyObject_GetItem
PyObject_SetItem
PyObject_Format
PyObject_GetIter
PyNumber_Remainder
PyNumber_Index
PyNumber_InPlaceAdd
PyObject_IsSubclass
PyCode_New
PyEval_EvalCodeEx
PyFrame_New
PyTraceBack_Type
PyDict_Next
PyDict_DelItem
_PyDict_SetItem_KnownHash
PyDict_SetItem
PyDict_GetItemWithError
_PyDict_GetItem_KnownHash
PyDict_New
PyList_New
PyTuple_Pack
PyTuple_GetSlice
PyTuple_GetItem
PyTuple_New
PyLong_AsSsize_t
PyLong_AsLong
PyLong_FromSsize_t
PyLong_FromLong
PyUnicode_Format
PyUnicode_Compare
PyUnicode_Decode
PyUnicode_InternFromString
PyUnicode_FromFormat
PyUnicode_FromString
PyUnicode_FromStringAndSize
_PyUnicode_FastCopyCharacters
_PyUnicode_Ready
PyUnicode_New
PyBytes_AsStringAndSize
PyBytes_FromStringAndSize
PyObject_GC_UnTrack
PyObject_GC_Del
PyObject_GC_Track
_PyObject_GC_New
PyObject_Free
PyMem_Realloc
PyMem_Malloc
PyObject_Dir
PyObject_CallFinalizerFromDealloc
PyObject_ClearWeakRefs
PyObject_Not
PyObject_IsTrue
PyObject_Hash
PyObject_GenericGetAttr
_PyObject_GetDictPtr
PyObject_SetAttr
PyObject_GetAttr
PyObject_SetAttrString
PyObject_GetAttrString
PyObject_RichCompareBool
PyObject_RichCompare
PyType_Modified
_PyType_Lookup
PyType_Ready
PyType_IsSubtype
PyFrame_Type
_Py_CheckRecursionLimit
PyExc_DeprecationWarning
PyExc_ValueError
PyExc_TypeError
PyExc_SystemError
PyExc_RuntimeError
PyExc_OverflowError
PyExc_NameError
PyExc_KeyError
PyExc_IndexError
PyExc_ImportError
PyExc_AttributeError
PyErr_GivenExceptionMatches
PyExc_StopIteration
PyMethod_Type
PyFunction_Type
PyCFunction_Type
PyDict_Type
PyList_Type
PyTuple_Type
PyFloat_Type
_Py_TrueStruct
_Py_FalseStruct
PyLong_Type
PyUnicode_Type
_PyByteArray_empty_string
PyByteArray_Type
_Py_NoneStruct
PyBaseObject_Type
PyErr_Clear
PyType_Type
arrow
?GetSessionToken@S3Options@fs@arrow@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
??0Status@arrow@@QEAA@XZ
?FinalizeS3@fs@arrow@@YA?AVStatus@2@XZ
?InitializeS3@fs@arrow@@YA?AVStatus@2@AEBUS3GlobalOptions@12@@Z
?Make@S3FileSystem@fs@arrow@@SA?AV?$Result@V?$shared_ptr@VS3FileSystem@fs@arrow@@@std@@@3@AEBUS3Options@23@AEBUIOContext@io@3@@Z
?region@S3FileSystem@fs@arrow@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?options@S3FileSystem@fs@arrow@@QEBA?AUS3Options@23@XZ
??4S3Options@fs@arrow@@QEAAAEAU012@$$QEAU012@@Z
??1S3Options@fs@arrow@@QEAA@XZ
??0S3Options@fs@arrow@@QEAA@XZ
?FromAssumeRole@S3Options@fs@arrow@@SA?AU123@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@00HAEBV?$shared_ptr@VSTSClient@STS@Aws@@@5@@Z
?FromAccessKey@S3Options@fs@arrow@@SA?AU123@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@00@Z
?Anonymous@S3Options@fs@arrow@@SA?AU123@XZ
?Defaults@S3Options@fs@arrow@@SA?AU123@XZ
?default_io_context@io@arrow@@YAAEBUIOContext@12@XZ
?GetSecretKey@S3Options@fs@arrow@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?GetAccessKey@S3Options@fs@arrow@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
??4S3ProxyOptions@fs@arrow@@QEAAAEAU012@$$QEAU012@@Z
??4S3ProxyOptions@fs@arrow@@QEAAAEAU012@AEBU012@@Z
??0S3ProxyOptions@fs@arrow@@QEAA@$$QEAU012@@Z
??1S3ProxyOptions@fs@arrow@@QEAA@XZ
??0S3ProxyOptions@fs@arrow@@QEAA@XZ
?FromUri@S3ProxyOptions@fs@arrow@@SA?AV?$Result@US3ProxyOptions@fs@arrow@@@3@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?CopyFrom@Status@arrow@@AEAAXAEBV12@@Z
??4Status@arrow@@QEAAAEAV01@$$QEAV01@@Z
??1Status@arrow@@QEAA@XZ
arrow_python
?check_status@internal@py@arrow@@YAHAEBVStatus@3@@Z
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
vcruntime140
__std_terminate
strchr
__CxxFrameHandler3
memcpy
memmove
__C_specific_handler
__std_exception_copy
__std_exception_destroy
_CxxThrowException
__std_type_info_destroy_list
memset
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_execute_onexit_table
_cexit
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-heap-l1-1-0
_callnewh
malloc
free
kernel32
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
Exports
Exports
Sections
.text Size: 70KB - Virtual size: 69KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 776B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ