382c0468320fea0677192c63f6b15d20_NeikiAnalytics

Sharing

Copy URL Twitter E-mail

General

Target

382c0468320fea0677192c63f6b15d20_NeikiAnalytics
Size

1.2MB
MD5

382c0468320fea0677192c63f6b15d20
SHA1

5b05fd5717b80a45aedb90988409e772d0b3f4df
SHA256

585152207d02b8cbaee54b3095e2278073147f239bb603af85ae8112f997e85d
SHA512

81695f84a7e3c03d425e79e85e56773c0cd1485d0e45b776cc94290d580654bd55279646ebfedb7495c7e7c479386a590b414fa341f3d436eef7005de7226751
SSDEEP

24576:1gebc46vVa4eZwq86QAhhUkXuMDtz6Blg:1gebcFvVa4eZw6QAhukeMJz66

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
382c0468320fea0677192c63f6b15d20_NeikiAnalytics

Files

382c0468320fea0677192c63f6b15d20_NeikiAnalytics
.exe windows:6 windows x64 arch:x64

6d08db5b7990c26ea7afcea30ea2df27

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

dllhost.pdb

Imports

msvcrt

_wcmdln
_XcptFilter
_amsg_exit
__wgetmainargs
?terminate@@YAXXZ
_commode
_fmode
_wcsicmp
__C_specific_handler
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type

ntdll

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-com-private-l1-1-0

CoRegisterSurrogateEx

api-ms-win-core-com-l1-1-1

CoUninitialize
IIDFromString
CoInitializeEx

api-ms-win-core-processthreads-l1-1-2

TerminateProcess
GetStartupInfoW
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-heap-l1-2-0

HeapSetInformation

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-errorhandling-l1-1-1

SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetSystemTimeAsFileTime

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 288B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.2MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

6d08db5b7990c26ea7afcea30ea2df27

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

api-ms-win-core-com-private-l1-1-0

api-ms-win-core-com-l1-1-1

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-heap-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

Sections

.text Size: 4KB - Virtual size: 3KB

.data Size: 1KB - Virtual size: 1KB

.pdata Size: 512B - Virtual size: 288B

.idata Size: 2KB - Virtual size: 1KB

.rsrc Size: 1024B - Virtual size: 1000B

.reloc Size: 1.2MB - Virtual size: 1.9MB

.text
Size: 4KB - Virtual size: 3KB

.data
Size: 1KB - Virtual size: 1KB

.pdata
Size: 512B - Virtual size: 288B

.idata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 1024B - Virtual size: 1000B

.reloc
Size: 1.2MB - Virtual size: 1.9MB