luaopen_winapi
Behavioral task
behavioral1
Sample
9dff9924ecc38a14fce39172cfeb141e437473ab64fd48a5ef38b6de589c9e2b_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
9dff9924ecc38a14fce39172cfeb141e437473ab64fd48a5ef38b6de589c9e2b_NeikiAnalytics.exe
-
Size
3.8MB
-
MD5
bdd466760ee121df76d6491b05b11ca0
-
SHA1
80090b9b08f59ef22422cf4af04e30a1e27120d5
-
SHA256
9dff9924ecc38a14fce39172cfeb141e437473ab64fd48a5ef38b6de589c9e2b
-
SHA512
fe0a5db41a5cf30725ded1ca807d9677216711d25186c46ec2cee3bcacb0ad08e9ce68b0877a3376cebe36131ab2d20bfefff5ed66abedaa26a1eea823a511a7
-
SSDEEP
98304:/stAV1vNLxnMQDupm7enPk7qpoB+6kLofYMPUegY2y1eO/o:EtA/vl1dupm7v7qp2jkLofY8US1eOQ
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9dff9924ecc38a14fce39172cfeb141e437473ab64fd48a5ef38b6de589c9e2b_NeikiAnalytics.exe
Files
-
9dff9924ecc38a14fce39172cfeb141e437473ab64fd48a5ef38b6de589c9e2b_NeikiAnalytics.exe.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 977KB - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 157KB - Virtual size: 400KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 36KB - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 239KB - Virtual size: 668KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.exports Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.imports Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 281KB - Virtual size: 281KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 3.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.loadcon Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.boot Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ