WSPStartup
Static task
static1
Behavioral task
behavioral1
Sample
41dc47fe376402dae899a7db6391960b3c283f5505977e16cab41cb9760166c9_NeikiAnalytics.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
41dc47fe376402dae899a7db6391960b3c283f5505977e16cab41cb9760166c9_NeikiAnalytics.dll
Resource
win10v2004-20240508-en
General
-
Target
41dc47fe376402dae899a7db6391960b3c283f5505977e16cab41cb9760166c9_NeikiAnalytics.exe
-
Size
89KB
-
MD5
ec039fcb66cdb12ee31ee35a862c7620
-
SHA1
063cc4b660041e22300aa14ca73f08a59e2c07d9
-
SHA256
41dc47fe376402dae899a7db6391960b3c283f5505977e16cab41cb9760166c9
-
SHA512
b240ff211f77f24fbe2164e8a5369f739c52ee2cef3df37fa7cf8e83f1116c8f9f91a53bdef1d7a90c122efca246d836887a5106552a8f17b8c404b57feae084
-
SSDEEP
1536:/SuG4MDwK7hx04xQzAzxeR4zfHbIzG4/AjAa+qx:FG+K7E4B1eRhdW+k
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 41dc47fe376402dae899a7db6391960b3c283f5505977e16cab41cb9760166c9_NeikiAnalytics.exe
Files
-
41dc47fe376402dae899a7db6391960b3c283f5505977e16cab41cb9760166c9_NeikiAnalytics.exe.dll windows:5 windows x64 arch:x64
770408797610b05993500bf33ca86866
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
ws2_32
WSACreateEvent
socket
ntohl
WPUCompleteOverlappedRequest
WSCEnumProtocols
WSCGetProviderPath
sendto
recvfrom
select
WSAEventSelect
connect
WSAGetLastError
closesocket
WSAWaitForMultipleEvents
WSAEnumNetworkEvents
WSAResetEvent
send
recv
WSACloseEvent
htonl
htons
WSASetLastError
kernel32
GetTickCount
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
GetCurrentThreadId
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
RtlVirtualUnwind
LoadLibraryW
HeapDestroy
CreateEventA
HeapCreate
ExpandEnvironmentStringsW
GetSystemTimeAsFileTime
ExpandEnvironmentStringsA
WideCharToMultiByte
TlsGetValue
CloseHandle
LeaveCriticalSection
SleepEx
CreateThread
EnterCriticalSection
GetLastError
ResetEvent
WaitForSingleObject
HeapFree
HeapAlloc
GetProcessHeap
ExitProcess
Sleep
InitializeCriticalSection
GetModuleFileNameW
GetCurrentProcessId
lstrcpyW
DeleteCriticalSection
CreateSemaphoreA
GetSystemInfo
CreateIoCompletionPort
WaitForMultipleObjectsEx
PostQueuedCompletionStatus
ReleaseSemaphore
WaitForSingleObjectEx
ExitThread
GetQueuedCompletionStatus
FreeLibrary
GetProcAddress
LoadLibraryA
SetEvent
OutputDebugStringA
TlsFree
TlsAlloc
TlsSetValue
user32
CreateWindowExA
IsWindow
wvsprintfA
wsprintfA
MessageBoxW
DispatchMessageA
wsprintfW
PostQuitMessage
DefWindowProcA
LoadIconA
LoadCursorA
RegisterClassA
TranslateMessage
GetMessageA
DestroyWindow
gdi32
GetStockObject
msvcr90
strncpy
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
__crt_debugger_hook
__CppXcptFilter
_amsg_exit
_decode_pointer
_encoded_null
free
_initterm_e
_initterm
_malloc_crt
_encode_pointer
memcmp
memset
__C_specific_handler
wcsstr
_time64
srand
rand
memcpy
_wassert
_onexit
Exports
Exports
Sections
.text Size: 70KB - Virtual size: 70KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 36B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ