47181215e52f97051da8712e0050238baa00543676d0b95498846da157670661_NeikiAnalytics

General

Target
47181215e52f97051da8712e0050238baa00543676d0b95498846da157670661_NeikiAnalytics
Size 624KB
Sample240521-pbtsmsdb9v
SHA256 47181215e52f97051da8712e0050238baa00543676d0b95498846da157670661
MD5 d9e0c550d6c9f9f85aade89ab51ebe60
SHA1 259ef945830778c64fa756dcd0b115a48f448033
SHA512 1670256b1a1ab00abb1878a85104f77c4abcf0c43717c70e6fb17c61335ef0fbe67b9d09fcde6664d61486dd9a16dad81652eb9d63705790d8a5934f5beabbea
SSDEEP 12288:GZn5XDYiwl8wUpjjHEFUDjmuFCilDdqtGlXwmzklGt:Wn18iwWjjoUD/Q8DdqFw
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
47181215e52f97051da8712e0050238baa00543676d0b95498846da157670661_NeikiAnalytics

File Explorer

47181215e52f97051da8712e0050238baa00543676d0b95498846da157670661_NeikiAnalytics

.exe 624KB

47181215e52f97051da8712e0050238baa00543676d0b95498846da157670661_NeikiAnalytics

IMPHASH f608678ac29c3efcf33101e9d4a5792f
SHA256 47181215e52f97051da8712e0050238baa00543676d0b95498846da157670661
MD5 d9e0c550d6c9f9f85aade89ab51ebe60
SHA1 259ef945830778c64fa756dcd0b115a48f448033
SHA512 1670256b1a1ab00abb1878a85104f77c4abcf0c43717c70e6fb17c61335ef0fbe67b9d09fcde6664d61486dd9a16dad81652eb9d63705790d8a5934f5beabbea
SSDEEP 12288:GZn5XDYiwl8wUpjjHEFUDjmuFCilDdqtGlXwmzklGt:Wn18iwWjjoUD/Q8DdqFw
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

10

Entry point

6592

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

WsTraceDump.pdb

kernel32

GetStdHandle WaitForSingleObject GetLastError CloseHandle CreateProcessW GetConsoleOutputCP GetUserDefaultUILanguage GetLocaleInfoW ConvertDefaultLocale FreeLibrary LoadLibraryExW HeapSetInformation GetVersionExW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess EncodePointer DecodePointer SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree GetCurrentThreadId ExitProcess GetModuleHandleExW GetProcAddress WriteFile GetModuleFileNameA HeapCreate GetFileType InitializeCriticalSectionAndSpinCount DeleteCriticalSection GetStartupInfoW GetModuleFileNameW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetTickCount GetEnvironmentStringsW FreeEnvironmentStringsW GetCommandLineW OutputDebugStringA EnterCriticalSection LeaveCriticalSection RtlUnwindEx HeapAlloc HeapFree SetStdHandle Sleep IsValidCodePage GetACP GetOEMCP GetCPInfo WideCharToMultiByte GetConsoleCP GetConsoleMode SetFilePointer MultiByteToWideChar GetStringTypeW LCMapStringW WriteConsoleW FlushFileBuffers SetThreadStackGuarantee GetSystemInfo VirtualAlloc VirtualProtect VirtualQuery CreateFileW

user32

LoadStringW

Name

.text

Size

35KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

47181215e52f97051da8712e0050238baa00543676d0b95498846da157670661_NeikiAnalytics

kernel32

user32

generic