HWRReg.pdb
Static task
static1
Behavioral task
behavioral1
Sample
7730bff20faecd19a52547a453bed405ffe3ace9fc627ecf2bedb6347858cf17_NeikiAnalytics.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
7730bff20faecd19a52547a453bed405ffe3ace9fc627ecf2bedb6347858cf17_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
General
-
Target
7730bff20faecd19a52547a453bed405ffe3ace9fc627ecf2bedb6347858cf17_NeikiAnalytics.exe
-
Size
203KB
-
MD5
edc1d0c2924650e47a8fa6d46cccd3b0
-
SHA1
85ab2cde665d7366367e813f00347b4232ac9ce1
-
SHA256
7730bff20faecd19a52547a453bed405ffe3ace9fc627ecf2bedb6347858cf17
-
SHA512
3ceac6699fd8a29f7b818ed460e4d6f202fea69aa6a67e6ff2bd460141870c46fd148e1c11c818236b11423cfad332b142304cafa652e062aaa98dad6a759758
-
SSDEEP
3072:nd4ilQSXRKC9TPN/cVRZl31qbydPlJReBrYWQgbmpQJ5GtCmY2lZmV1:nWMRh1uLZLcydPlJReSr45J5G1Y
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7730bff20faecd19a52547a453bed405ffe3ace9fc627ecf2bedb6347858cf17_NeikiAnalytics.exe
Files
-
7730bff20faecd19a52547a453bed405ffe3ace9fc627ecf2bedb6347858cf17_NeikiAnalytics.exe.exe windows:6 windows x86 arch:x86
9b0bbd6a5fab4842f77d636cdf0bf964
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
advapi32
RegCloseKey
RegSetValueExW
RegQueryValueExW
RegCreateKeyExW
RegEnumValueW
RegEnumKeyExW
RegOpenKeyExW
RegDeleteValueW
GetTokenInformation
OpenProcessToken
RegGetValueW
kernel32
LocalFree
FormatMessageW
SetFilePointer
ReadFile
CloseHandle
CreateFileW
LocaleNameToLCID
DeleteFileW
WriteFile
SetFileAttributesW
ExpandEnvironmentStringsW
GetCurrentProcess
MultiByteToWideChar
ReadConsoleW
GetStdHandle
WriteConsoleW
GetLastError
WideCharToMultiByte
GetFileType
GetConsoleMode
GetVersionExW
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
CompareStringW
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
InterlockedCompareExchange
Sleep
InterlockedExchange
SetThreadPreferredUILanguages
LCIDToLocaleName
msvcrt
free
malloc
_controlfp
_except_handler4_common
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
_amsg_exit
_initterm
_XcptFilter
_exit
_cexit
__wgetmainargs
_wchdir
_wremove
strncmp
exit
memset
_wcsicmp
_vsnwprintf
__setusermatherr
_wcsnicmp
ole32
StringFromGUID2
CoCreateGuid
shell32
SHCreateDirectoryExW
Sections
.text Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 159KB - Virtual size: 158KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 28KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE