4967ae63dd50ccf988917c2f891bd2c0_NeikiAnalytics | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4967ae63dd50ccf988917c2f891bd2c0_NeikiAnalytics
Size

1.5MB
MD5

4967ae63dd50ccf988917c2f891bd2c0
SHA1

a70a1a98d2af36df06439ed08cbcf90686259d51
SHA256

c137c1bbff1eb959485a7f6bbf34831aef415e204a26cb8376e95d223e7332bb
SHA512

7388de8e5e77e308325474388a5199e57c4e35c02a6682f18bae98e9ee8311bbce31e8709e2578e26c94cbdcb42d1419ff394e2a9fb41fd7a65a4ac883c8fcee
SSDEEP

49152:QJN3LrnKkBWVS1hxurVLs5vfXZ96eUR0:abrKkBJ0VL6h90

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4967ae63dd50ccf988917c2f891bd2c0_NeikiAnalytics

Files

4967ae63dd50ccf988917c2f891bd2c0_NeikiAnalytics
.dll windows:5 windows x86 arch:x86

95e54f29b5434a181c189261f11329df

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscms

GetColorProfileElement

kernel32

DeleteCriticalSection
GetFileSize
GetModuleFileNameA
GetProcAddress
GetBinaryTypeA
ConvertDefaultLocale
IsProcessInJob

advapi32

RegCloseKey
OpenProcessToken
GetSidSubAuthority

winspool.drv

GetPrinterW

ole32

HWND_UserMarshal

wintrust

CryptCATClose

winmm

waveInStart

shell32

SHSetLocalizedName

Exports

Exports

SeraeqhdlH

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ

.code
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 840B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

DATA
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ