34bf5c5ee235805ab8e931d37664e4d0_NeikiAnalytics

Sharing

Copy URL

Twitter E-mail

General

Target

34bf5c5ee235805ab8e931d37664e4d0_NeikiAnalytics
Size

684KB
MD5

34bf5c5ee235805ab8e931d37664e4d0
SHA1

c9ea5110c2b617eadeff9c24d75edcc13dc34f47
SHA256

dad3e31b8cdf60053f9568244faf85fe3cbea5338ec4d13ddeb23ccdfe15e725
SHA512

e73ce6ef65c2aad5744bb04885c22a7b3747d1c4771fcd43175035609bcb46f649b1449d3101e008a622f018e6c684379834a08d97fbd23ff6d7c387b2494231
SSDEEP

12288:gYTj57u3FN92mrRUDkDTYNmN3Rus3SAFYq8Noz9qirzrEX1fsd7TOoOTd:Pxu1N3RUDHNmdPCAaq8Nozgi/rE0TOj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
34bf5c5ee235805ab8e931d37664e4d0_NeikiAnalytics

Files

34bf5c5ee235805ab8e931d37664e4d0_NeikiAnalytics
.exe windows:10 windows x64 arch:x64

32314b0749d6e242a4d9b55c6738dad5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

midl.pdb

Imports

kernel32

GetCommandLineW
GetStdHandle
GetEnvironmentVariableW
WaitForSingleObject
MultiByteToWideChar
CloseHandle
LocalFree
CreateProcessW
CreateProcessA
GetExitCodeProcess
Sleep
GetTempPathA
GetLastError
HeapSetInformation
GetTempFileNameA
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
OutputDebugStringA
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetTickCount

msvcrt

fflush
_unlink
printf
fopen
fclose
fgetc
isspace
_errno
_XcptFilter
_amsg_exit
__getmainargs
__set_app_type
exit
_exit
_cexit
__setusermatherr
_initterm
_fmode
isdigit
memcpy
memset
__C_specific_handler
?terminate@@YAXXZ
_lock
_unlock
__dllonexit
_onexit
setvbuf
isxdigit
isleadbyte
calloc
free
localeconv
mbtowc
__mb_cur_max
_iob
_snprintf
_itoa
wctomb
malloc
??1type_info@@UEAA@XZ
_read
__badioinfo
__pioinfo
realloc
_write
_lseeki64
wcsstr
strstr
atoi
ctime
_makepath
strncmp
_fileno
fprintf
_isatty
_splitpath
fseek
_vsnprintf
_fgetchar
freopen
_strnicmp
_commode
__iob_func
putc
_fsopen
_setmode
fwrite
strcmp

shell32

CommandLineToArgvW

Sections

.text
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 568KB - Virtual size: 572KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

32314b0749d6e242a4d9b55c6738dad5

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

msvcrt

shell32

Sections

.text Size: 47KB - Virtual size: 47KB

.rdata Size: 62KB - Virtual size: 61KB

.data Size: 1024B - Virtual size: 2KB

.pdata Size: 1KB - Virtual size: 1KB

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 568KB - Virtual size: 572KB

.text
Size: 47KB - Virtual size: 47KB

.rdata
Size: 62KB - Virtual size: 61KB

.data
Size: 1024B - Virtual size: 2KB

.pdata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 568KB - Virtual size: 572KB