d65b46432e1843fd0735d7b046a11990_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

d65b46432e1843fd0735d7b046a11990_NeikiAnalytics.exe
Size

661KB
MD5

d65b46432e1843fd0735d7b046a11990
SHA1

7ffad947c76bbdeab9abe33617b822eb72da45cd
SHA256

ff4e92800b0886b03bf6fc8e221672075a61b77eefbc2a05e09e0b6563bf3689
SHA512

57f4c493797a5a27f6b69ce7990c335cfc1459ab3e434ede1a76c359d00f5006d9427b3b6e6087c2b8fab4eb7266414d90d1a15e9131e867ebc39d775fe2b859
SSDEEP

12288:9i9huPpuA0RswjWu+R93V+C4iiVAM1AQjJHz3wsDLM1Dy0T/1+ZTgl:Q9heMjWu+R93Vf+AQ9HzfLM1G0T/10g

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d65b46432e1843fd0735d7b046a11990_NeikiAnalytics.exe

Files

d65b46432e1843fd0735d7b046a11990_NeikiAnalytics.exe
.exe windows:6 windows x86 arch:x86

4d8edd503ce0f77c7d484a2b4e073cb1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\VSProjects\IAMT_Stuff\CIU string decoder encoder\Release\IAMT.pdb

Imports

kernel32

SetStdHandle
GetProcessHeap
HeapSize
WideCharToMultiByte
MultiByteToWideChar
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
GetTimeZoneInformation
HeapReAlloc
LocalFree
FormatMessageA
GetLocaleInfoEx
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
SetEndOfFile
SetFilePointerEx
AreFileApisANSI
CloseHandle
GetLastError
GetFileInformationByHandleEx
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
CompareStringEx
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwind
RaiseException
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetStdHandle
WriteFile
GetModuleFileNameW
GetCommandLineA
GetCommandLineW
GetFileSizeEx
GetFileType
HeapAlloc
HeapFree
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
DeleteFileW
WaitForSingleObject
GetExitCodeProcess
CreateProcessW
ReadFile
ReadConsoleW
WriteConsoleW

user32

SendMessageA

comdlg32

GetSaveFileNameA
GetOpenFileNameA

shell32

SHGetMalloc
SHBrowseForFolderA
SHGetPathFromIDListA

Sections

.text
Size: 390KB - Virtual size: 390KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 98KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 147KB - Virtual size: 146KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4d8edd503ce0f77c7d484a2b4e073cb1

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

comdlg32

shell32

Sections

.text Size: 390KB - Virtual size: 390KB

.rdata Size: 98KB - Virtual size: 98KB

.data Size: 7KB - Virtual size: 11KB

.rsrc Size: 147KB - Virtual size: 146KB

.reloc Size: 17KB - Virtual size: 16KB

.text
Size: 390KB - Virtual size: 390KB

.rdata
Size: 98KB - Virtual size: 98KB

.data
Size: 7KB - Virtual size: 11KB

.rsrc
Size: 147KB - Virtual size: 146KB

.reloc
Size: 17KB - Virtual size: 16KB