c:\repos\cpython\PCbuild\amd64\py.pdb
Static task
static1
Behavioral task
behavioral1
Sample
b91ed5d44c11780c2cbd7c30b92adb55c2c557b6302c62e45f947d39efef4224_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
b91ed5d44c11780c2cbd7c30b92adb55c2c557b6302c62e45f947d39efef4224_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
b91ed5d44c11780c2cbd7c30b92adb55c2c557b6302c62e45f947d39efef4224_NeikiAnalytics.exe
-
Size
777KB
-
MD5
059103091345d4a32d16b75f2aa4b660
-
SHA1
548facbcdd9cdf5fc0961fd5284e0353b1261b6d
-
SHA256
b91ed5d44c11780c2cbd7c30b92adb55c2c557b6302c62e45f947d39efef4224
-
SHA512
17953cbb7d84c1b12804228c3aad6e2a0a59f3a8ff5762d89483e3f62f3c6d3ab6bf7645e0754427caba67f19953e16591d79b64262097a3d13790d9b5daa8f5
-
SSDEEP
12288:A7Ih6SNOFGRdUo/UB7v14t677Vut+XG1ykwM+hGx:Nh6SNOkUo8Bx4tSVuUXG4fM+hG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b91ed5d44c11780c2cbd7c30b92adb55c2c557b6302c62e45f947d39efef4224_NeikiAnalytics.exe
Files
-
b91ed5d44c11780c2cbd7c30b92adb55c2c557b6302c62e45f947d39efef4224_NeikiAnalytics.exe.exe windows:6 windows x64 arch:x64
fafeaa34e78bd476323a75dae8cf14ef
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
shell32
ShellExecuteExW
SHGetFolderPathW
api-ms-win-core-path-l1-1-0
PathCchCombineEx
PathCchRemoveFileSpec
advapi32
RegEnumKeyExW
RegOpenKeyExW
RegGetValueW
RegCloseKey
kernel32
HeapSize
HeapReAlloc
WriteConsoleW
SetFilePointerEx
IsProcessorFeaturePresent
GetStartupInfoW
ReadFile
SizeofResource
SetConsoleCtrlHandler
SetInformationJobObject
QueryInformationJobObject
FindFirstFileW
SearchPathW
GetBinaryTypeW
GetCommandLineW
GetCurrentProcess
GetStdHandle
DeviceIoControl
AssignProcessToJobObject
GetModuleFileNameW
CreateJobObjectW
CompareStringOrdinal
GetEnvironmentVariableW
FindClose
CreateFileW
GetFileAttributesW
DuplicateHandle
MultiByteToWideChar
GetPrivateProfileStringW
FormatMessageW
GetLastError
OutputDebugStringW
WaitForSingleObjectEx
LockResource
CloseHandle
CompareStringEx
FindResourceExW
LoadResource
GetCurrentDirectoryW
GetProcAddress
CreateProcessW
GetModuleHandleW
IsWow64Process
GetExitCodeProcess
GetFileSizeEx
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
EncodePointer
RaiseException
RtlPcToFileHeader
WriteFile
ExitProcess
TerminateProcess
GetModuleHandleExW
GetCommandLineA
HeapFree
HeapAlloc
GetFileType
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
SetStdHandle
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetStringTypeW
GetProcessHeap
Sections
.text Size: 148KB - Virtual size: 148KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 63KB - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 552KB - Virtual size: 551KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ