05152d652a6a0cce34eb06213fdaa000_NeikiAnalytics[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

05152d652a6a0cce34eb06213fdaa000_NeikiAnalytics.exe
Size

220KB
MD5

05152d652a6a0cce34eb06213fdaa000
SHA1

c3a55694aaf1eaae0af43e08c1c3ca751dcbf857
SHA256

589326d8c5669ca62e765067e9e3acbec9747d0cd822a2f173991d7e90ea35d6
SHA512

d6654cf346874513bd99b0624cdaeb66d0b9f4c697581795dd6dbe3b2aa617c14b38d1da7c90c6470bd08086933c6502830a939045c43aa1f2fa2154929f84d7
SSDEEP

6144:MXIsHv4OGIwoNETyBM05UicEa2x+5nX3Y9GjBW3G5nbBkSuIkbFtagB98en+u7Zu:PsHQOtwQPgk85m

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
05152d652a6a0cce34eb06213fdaa000_NeikiAnalytics.exe

Files

05152d652a6a0cce34eb06213fdaa000_NeikiAnalytics.exe
.exe windows:5 windows x64 arch:x64

ac6068f56ce5b0abf9ad95fd3684cfd9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

E:\LocalGitHub\GenieWindow\plugins\GeniePlugin_VC\x64\Release\NETGEARGenieDaemon64.pdb

Imports

wpcap

pcap_loop
pcap_open_live
pcap_freealldevs
pcap_close
pcap_setfilter
pcap_datalink
pcap_compile
pcap_findalldevs
pcap_breakloop
pcap_freecode

ws2_32

ntohl
ntohs

iphlpapi

GetExtendedTcpTable
GetExtendedUdpTable
GetIpNetTable

psapi

GetModuleFileNameExW

kernel32

ReadFile
CreateFileW
GetOverlappedResult
GetLastError
CreateEventW
CloseHandle
ConnectNamedPipe
CreateNamedPipeW
ReleaseSemaphore
CreateSemaphoreW
WaitForMultipleObjects
OpenProcess
WideCharToMultiByte
TerminateProcess
MultiByteToWideChar
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
QueryPerformanceCounter
GetLocaleInfoA
WriteFile
SetEvent
GetModuleHandleW
Sleep
GetExitCodeProcess
GetModuleFileNameW
GetProcAddress
GetCurrentThreadId
GetCurrentProcessId
LocalFree
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
FreeEnvironmentStringsW
FlsAlloc
SetLastError
FlsFree
FlsSetValue
WaitNamedPipeW
WaitForSingleObject
GetCurrentProcess
GetEnvironmentStringsW
HeapSize
SetFilePointer
GetCommandLineW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetStringTypeW
HeapReAlloc
LoadLibraryW
WriteConsoleW
SetStdHandle
CreateProcessW
FlsGetValue
IsValidCodePage
GetOEMCP
GetACP
EncodePointer
DecodePointer
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
ExitThread
CreateThread
GetStartupInfoW
RaiseException
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
LCMapStringW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
HeapSetInformation
GetVersion
HeapCreate
GetStdHandle
GetLocaleInfoW
ExitProcess
GetConsoleCP
GetConsoleMode
FlushFileBuffers
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetFileType

user32

GetIconInfo
LoadIconW
DestroyIcon
DrawIconEx
UnregisterDeviceNotification

gdi32

CreateDIBSection
GdiFlush
DeleteObject
SelectObject
CreateCompatibleDC
GetObjectW
DeleteDC

advapi32

CloseServiceHandle
ControlService
SetServiceStatus
QueryServiceStatus
StartServiceW
RegisterServiceCtrlHandlerExW
OpenServiceW
StartServiceCtrlDispatcherW
OpenSCManagerW
DeleteService
CreateServiceW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor

shell32

ExtractIconW
CommandLineToArgvW

Sections

.text
Size: 153KB - Virtual size: 152KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ac6068f56ce5b0abf9ad95fd3684cfd9

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

wpcap

ws2_32

iphlpapi

psapi

kernel32

user32

gdi32

advapi32

shell32

Sections

.text Size: 153KB - Virtual size: 152KB

.rdata Size: 45KB - Virtual size: 45KB

.data Size: 8KB - Virtual size: 18KB

.pdata Size: 9KB - Virtual size: 8KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 153KB - Virtual size: 152KB

.rdata
Size: 45KB - Virtual size: 45KB

.data
Size: 8KB - Virtual size: 18KB

.pdata
Size: 9KB - Virtual size: 8KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 1KB