6d56064bde1c6ac6ab8d48ffc02d3770_NeikiAnalytics

Sharing

Copy URL Twitter E-mail

General

Target

6d56064bde1c6ac6ab8d48ffc02d3770_NeikiAnalytics
Size

640KB
MD5

6d56064bde1c6ac6ab8d48ffc02d3770
SHA1

425ca9f2d0d0167159bcec86a99bd3e0c65bebd8
SHA256

83ebf565bd082983169bed83389c800eb3e64fadf64543d370a01e4a9f2c3b4e
SHA512

c599d1f21ea37e1b6d1e3da0f5fd561a8b9e7d67fd80c85ce4732f66bad7b7d0666f83b58c045b1a7dcded31cc9f4d86fce6591f670e8cec9a09a50bbf3f6ef8
SSDEEP

12288:CFgeKznl5TXJR0j3p2pVUrrQuLoWTF23JVbd0UILzXSocmKdYNq6:g7ozX0j52pMkuLoiSJVlIL29mhNq6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6d56064bde1c6ac6ab8d48ffc02d3770_NeikiAnalytics

Files

6d56064bde1c6ac6ab8d48ffc02d3770_NeikiAnalytics
.exe windows:10 windows x64 arch:x64

288c77221ee9a27f869b542320d273ef

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

CertMgr.pdb

Imports

msvcrt

_exit
_cexit
__setusermatherr
_initterm
_XcptFilter
__C_specific_handler
_fmode
_commode
?terminate@@YAXXZ
__set_app_type
wprintf
strtok
_vsnwprintf
realloc
printf
_wasctime
free
scanf
_wtol
towupper
memset
__wgetmainargs
exit
_amsg_exit
_wcsicmp
vwprintf
malloc
memcmp
memcpy
strcmp

user32

LoadStringW
LoadStringA

crypt32

CertGetCRLFromStore
CertDuplicateCTLContext
CryptFreeOIDFunctionAddress
CertGetCertificateContextProperty
CertGetCRLContextProperty
CryptStringToBinaryW
CertAddEncodedCTLToStore
CertOpenStore
CryptInstallOIDFunctionAddress
CertGetCTLContextProperty
CertFindCertificateInStore
CertSetCertificateContextProperty
CertEnumCTLsInStore
CertRDNValueToStrW
CryptEncodeObject
CryptMsgGetParam
CertCloseStore
CryptSIPLoad
CertEnumCertificateContextProperties
CertDeleteCRLFromStore
CertDeleteCertificateFromStore
CertDuplicateCRLContext
CryptHashPublicKeyInfo
CryptDecodeObject
CertFreeCTLContext
CertAddEncodedCertificateToStore
CertGetPublicKeyLength
CryptSIPRetrieveSubjectGuid
CryptMsgClose
CryptMsgUpdate
CryptGetOIDFunctionAddress
CryptInitOIDFunctionSet
CertRDNValueToStrA
CertFreeCRLContext
CertDeleteCTLFromStore
CertFreeCertificateContext
CryptStringToBinaryA
CryptFindOIDInfo
CertAddCRLContextToStore
CertAddCertificateContextToStore
CryptMsgGetAndVerifySigner
CryptMsgOpenToDecode
CertSaveStore
CertFindCTLInStore
CertEnumCertificatesInStore
CertAddEncodedCRLToStore
CertAddCTLContextToStore
CertDuplicateCertificateContext

cryptui

CryptUIDlgCertMgr

advapi32

CryptAcquireContextA
CryptReleaseContext

kernel32

CreateFileMappingA
CreateFileW
WriteFile
GetSystemTime
SystemTimeToFileTime
MultiByteToWideChar
CompareFileTime
GetFileSize
HeapSetInformation
CloseHandle
FileTimeToSystemTime
GetLastError
GetModuleHandleA
UnmapViewOfFile
SetLastError
WideCharToMultiByte
FileTimeToLocalFileTime
RtlLookupFunctionEntry
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
Sleep
SetUnhandledExceptionFilter
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
RtlCaptureContext
MapViewOfFile
RtlVirtualUnwind

Sections

.text
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 568KB - Virtual size: 572KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

288c77221ee9a27f869b542320d273ef

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

user32

crypt32

cryptui

advapi32

kernel32

Sections

.text Size: 38KB - Virtual size: 37KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 512B - Virtual size: 10KB

.pdata Size: 1KB - Virtual size: 1KB

.rsrc Size: 23KB - Virtual size: 22KB

.reloc Size: 568KB - Virtual size: 572KB

.text
Size: 38KB - Virtual size: 37KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 512B - Virtual size: 10KB

.pdata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 23KB - Virtual size: 22KB

.reloc
Size: 568KB - Virtual size: 572KB