320d02d8c22ce455bddfb201bc44cf40_NeikiAnalytics | Triage

Sharing

Copy URL Twitter E-mail

General

Target

320d02d8c22ce455bddfb201bc44cf40_NeikiAnalytics
Size

1.3MB
MD5

320d02d8c22ce455bddfb201bc44cf40
SHA1

966aa1fbe54f5bed9b84a4964b9c9a3a49acb4d6
SHA256

a2e24cef2d0e713450efc735d3b65adf0617dc6dd0a1aab58a0859170c3083fb
SHA512

64ae2473ccb9b1e06b092f509faca27f34de67179473108f2f65ae7efdd2d12e95249b2ffba834abb3d6a35f594528c8a0c24fecb2bbe72d71c09c46e1aacd1b
SSDEEP

12288:swkBlMVBlMjAQAvBlMDC0zUtNL8YcL5YHaI7XHgZQKhJgeCmdN:uLMVLM7QLMDC04bL8iHFLHgZpJEO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
320d02d8c22ce455bddfb201bc44cf40_NeikiAnalytics

NSIS installer 1 IoCs

resource	yara_rule
sample	nsis_installer_2

Files

320d02d8c22ce455bddfb201bc44cf40_NeikiAnalytics
.exe windows:4 windows x86 arch:x86

2f0ce985d06e786fa194a8b2bdb24c15

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr70

exit
__p___winitenv
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
_cexit
__set_app_type
__dllonexit
_onexit
_controlfp
_except_handler3
printf
_XcptFilter
_exit
_c_exit
_wcsicmp
wprintf
__p__fmode

kernel32

LocalFree
GetModuleHandleA

ole32

CoUninitialize
CoInitializeEx

aspnet_isapi

RegisterISAPIEx
RegisterISAPI
ListAspnetInstalledVersions
ListAspnetInstalledIISKeys
ValidateIISPath
RemoveAspnetFromIISKey
RemoveClientScriptFiles
CopyClientScriptFiles
GetExistingVersion
UnregisterISAPI

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 584B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ