27634b8d1617ebbe6e49ca2c3aa0b2d0_NeikiAnalytics | Triage

Sharing

Copy URL Twitter E-mail

General

Target

27634b8d1617ebbe6e49ca2c3aa0b2d0_NeikiAnalytics
Size

102KB
MD5

27634b8d1617ebbe6e49ca2c3aa0b2d0
SHA1

512a7405049aaaf191e21476d994ffb22764a406
SHA256

48087826571e18fe993ff8e6d7d1f0ad6a1158ebbc2ad639858be890259d0a70
SHA512

8791b153f4ac09220427d267aa52ed17440d0bc9f3dea47d2fc3a333affabd6717ced9fe14a9643fdee100578356694384794b7d7f2505277c1724e6243c78c5
SSDEEP

3072:YkR5JnIyAIHtQ8oo17tdpw0SQRUD6cwgCiz/P6W:YkNRAIa0dLYDyeJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
27634b8d1617ebbe6e49ca2c3aa0b2d0_NeikiAnalytics

Files

27634b8d1617ebbe6e49ca2c3aa0b2d0_NeikiAnalytics
.exe windows:6 windows x86 arch:x86

3270a8b58f90b6e14dfdc59d4fd836d6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

user32

MessageBoxA

msvcp140

??1_Lockit@std@@QAE@XZ

ws2_32

WSACleanup

vcruntime140

memchr

api-ms-win-crt-stdio-l1-1-0

fgetc

api-ms-win-crt-math-l1-1-0

_dtest

api-ms-win-crt-runtime-l1-1-0

exit

api-ms-win-crt-heap-l1-1-0

free

api-ms-win-crt-locale-l1-1-0

localeconv

api-ms-win-crt-filesystem-l1-1-0

_lock_file

api-ms-win-crt-multibyte-l1-1-0

_mbsicmp

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-string-l1-1-0

strcpy

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-convert-l1-1-0

strtod

Sections

.MPRESS1
Size: 97KB - Virtual size: 416KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE