180bd7be79ae0fe76b192db5aedf1720_NeikiAnalytics | Triage

Sharing

Copy URL Twitter E-mail

General

Target

180bd7be79ae0fe76b192db5aedf1720_NeikiAnalytics
Size

26KB
MD5

180bd7be79ae0fe76b192db5aedf1720
SHA1

2874f6ab8f142b159ab987be64013a9668d3fdab
SHA256

753f834df5ff26dddd1e7ddc449a5b794fef1d2582551c4fc42464b7aa86a18f
SHA512

b86b78e2151765c90a96956db530825a2aea3e39d09cbe0504e46217aa5b7489d26f4a79a90beb91f243730e77d13e8af990126e5a1543bc6c0a40ec483f03d2
SSDEEP

768:l8aFyOM1XROXbob/OZ/iS7Ef0xZIR3dxvc95555555555555z55u55555555555W:l8NT1Xg40zYW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
180bd7be79ae0fe76b192db5aedf1720_NeikiAnalytics

Files

180bd7be79ae0fe76b192db5aedf1720_NeikiAnalytics
.dll windows:4 windows x86 arch:x86

e092fd0d49aa893ea789d39cbbd909d3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

WSACleanup
WSAStartup
recv
closesocket
send
gethostbyname
htons
socket
connect

kernel32

CreateFileA
OpenEventA
SetEvent
GetTickCount
lstrcatA
lstrlenA
GetWindowsDirectoryA
GetSystemDirectoryA
lstrcmpiA
lstrcpyA
lstrcpynA
GlobalFree
GlobalAlloc
lstrcmpA
DeleteFileA
GetTempFileNameA
GetTempPathA
WinExec
GetModuleFileNameA
CloseHandle
WriteFile
RtlUnwind
CreateProcessA
GetLastError
Sleep
CreateMutexA
ExitProcess
CreateThread
VirtualQuery

user32

CallNextHookEx
SetWindowsHookExA
wsprintfA
CharLowerA
SendMessageA

advapi32

RegOpenKeyExA
RegSetValueExA
RegCreateKeyA
RegQueryValueExA
RegCloseKey

Exports

Exports

Activate

Sections

.text
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 564B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ