shutdown.pdb
Static task
static1
Behavioral task
behavioral1
Sample
96373d34fb007a7cc2767f793c3e4e09139ff0a9ecfb1d4670d33ad54d2dc05f_NeikiAnalytics.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
96373d34fb007a7cc2767f793c3e4e09139ff0a9ecfb1d4670d33ad54d2dc05f_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
General
-
Target
96373d34fb007a7cc2767f793c3e4e09139ff0a9ecfb1d4670d33ad54d2dc05f_NeikiAnalytics.exe
-
Size
57KB
-
MD5
c0f2596b56e4ef2c95b3f52bb78aef50
-
SHA1
acdfffee64823e9cbb3f9d18c41a94ae036e112e
-
SHA256
96373d34fb007a7cc2767f793c3e4e09139ff0a9ecfb1d4670d33ad54d2dc05f
-
SHA512
8346ca8b39de5dd480056424194a1e08d0933af91c4c5107317f1aa485a71d1475d77febac138304974d20c4a246e9cbcd8f543b266c7604882e6d6ff11eb8d3
-
SSDEEP
1536:K1CaVIN4nxzLQ4sr3/1bL3WaZYNpxWdD:KFu4s5dGNpgh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 96373d34fb007a7cc2767f793c3e4e09139ff0a9ecfb1d4670d33ad54d2dc05f_NeikiAnalytics.exe
Files
-
96373d34fb007a7cc2767f793c3e4e09139ff0a9ecfb1d4670d33ad54d2dc05f_NeikiAnalytics.exe.exe windows:6 windows x86 arch:x86
cf6f10f52ff334cf74b7131ab6fdd42d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
user32
GetWindowTextW
GetDlgItem
GetWindowTextLengthW
EndDialog
SendMessageW
LoadStringW
GetClassNameW
IsDlgButtonChecked
EnableWindow
CallWindowProcW
SetWindowTextW
IsSETEnabled
BuildReasonArray
RecordShutdownReason
DestroyReasons
ReasonCodeNeedsComment
ReasonCodeNeedsBugID
EnableMenuItem
GetWindowLongW
SetForegroundWindow
SetFocus
GetDesktopWindow
ExitWindowsEx
RegisterClipboardFormatW
DialogBoxParamW
MessageBoxW
SetWindowLongW
CheckDlgButton
secur32
GetUserNameExW
ole32
CoInitialize
CoCreateInstance
CoUninitialize
ReleaseStgMedium
ntdll
RtlAdjustPrivilege
NtInitiatePowerAction
RtlNtStatusToDosError
DbgPrint
NtPowerInformation
advapi32
RegQueryValueExA
RegCreateKeyExW
AbortSystemShutdownW
InitiateShutdownW
InitiateSystemShutdownExW
RegConnectRegistryW
RegOpenKeyExW
RegQueryValueExW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
RegCloseKey
RegOpenKeyExA
kernel32
ExpandEnvironmentStringsA
SystemTimeToFileTime
GetSystemTimeAsFileTime
HeapSetInformation
GetEnvironmentVariableW
GlobalLock
GlobalUnlock
GetModuleHandleW
LoadLibraryW
GetProcAddress
FreeLibrary
EncodePointer
GetLastError
LoadLibraryA
FormatMessageW
DecodePointer
GetStdHandle
lstrlenW
GetFileType
GetConsoleMode
WriteConsoleW
LocalAlloc
UnhandledExceptionFilter
WideCharToMultiByte
lstrlenA
WriteFile
lstrcmpW
LocalFree
InterlockedExchange
Sleep
InterlockedCompareExchange
SetUnhandledExceptionFilter
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
SetThreadPreferredUILanguages
GetConsoleOutputCP
msvcrt
wcsstr
wcsncmp
_wcsicmp
exit
_wtoi
memset
__wgetmainargs
_cexit
_exit
_XcptFilter
_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
_unlock
__dllonexit
_lock
_onexit
?terminate@@YAXXZ
_except_handler4_common
_controlfp
_vsnwprintf
Sections
.text Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 29KB - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE