924b1c412124ed418b10f636c5474520_NeikiAnalytics[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

924b1c412124ed418b10f636c5474520_NeikiAnalytics.exe
Size

1.3MB
MD5

924b1c412124ed418b10f636c5474520
SHA1

31032524538bf3a9862a26cd1b4fcdce0e6f2830
SHA256

56f9df70447d6565e8fd320a23edc8e5202f8597228e616de4da24d1ad95dd2c
SHA512

85f852a0bcceab5e389559020a226ef22f802b6b3b4d260f5fdb94e0a895fbf6b29f219228b78f34d02e89d59b19d6df9c79fdf6532ea984cb17932967b4f8ff
SSDEEP

12288:VI0WsKipqaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kw:VKcHsqjnhMgeiCl7G0nehbGZpbD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
924b1c412124ed418b10f636c5474520_NeikiAnalytics.exe

Files

924b1c412124ed418b10f636c5474520_NeikiAnalytics.exe
.exe windows:4 windows x64 arch:x64

d317abd077369ff0d133db4f40fd298a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

s:\dev\apos\aefilters\aefilterssrv\x64\release-realtek\AERTSr64.pdb

Imports

advapi32

RegOpenKeyA
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA
OpenSCManagerA
OpenServiceA
CloseServiceHandle
StartServiceA
RegEnumKeyExA
RegisterServiceCtrlHandlerA
SetServiceStatus
RegisterEventSourceA
ReportEventA
DeregisterEventSource
CreateServiceA
ControlService
QueryServiceStatus
DeleteService
StartServiceCtrlDispatcherA
ConvertStringSecurityDescriptorToSecurityDescriptorA
InitializeSecurityDescriptor

kernel32

GetModuleHandleA
GetModuleFileNameA
lstrlenA
SetEvent
WaitForSingleObject
CloseHandle
Sleep
WriteFile
CreateFileA
GetLastError
CreateEventA
WaitForMultipleObjects
GetLocalTime
GetDateFormatA
GetTimeFormatA
SetFilePointer
MultiByteToWideChar
SetConsoleCtrlHandler
FormatMessageA
LocalFree
LoadLibraryA
GetProcAddress
CreateNamedPipeA
ResetEvent
ConnectNamedPipe
ReadFile
GetOverlappedResult
DisconnectNamedPipe
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
HeapReAlloc
HeapAlloc
HeapFree
ExitProcess
GetCommandLineA
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
HeapSetInformation
HeapCreate
HeapSize
GetCPInfo
GetOEMCP
IsValidCodePage
FlsGetValue
FlsSetValue
TlsFree
FlsFree
SetLastError
GetCurrentThreadId
FlsAlloc
RtlUnwindEx
EnterCriticalSection
LeaveCriticalSection
GetStdHandle
DeleteCriticalSection
InitializeCriticalSection
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetConsoleCP
GetConsoleMode
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetStdHandle
WriteConsoleA

Sections

.text
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.2MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

d317abd077369ff0d133db4f40fd298a

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

Sections

.text Size: 59KB - Virtual size: 59KB

.rdata Size: 19KB - Virtual size: 18KB

.data Size: 5KB - Virtual size: 14KB

.pdata Size: 3KB - Virtual size: 3KB

.rsrc Size: 1.2MB - Virtual size: 1.8MB

.text
Size: 59KB - Virtual size: 59KB

.rdata
Size: 19KB - Virtual size: 18KB

.data
Size: 5KB - Virtual size: 14KB

.pdata
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 1.2MB - Virtual size: 1.8MB