1d7bf7d9ea068656b212c734f0c380c0_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
1d7bf7d9ea068656b212c734f0c380c0_NeikiAnalytics.exe
Size 9.7MB
Sample240522-e5fsrsca97
SHA256 9a0452fd8cc5d8b93cc3a430be5c9afbf6918f153e3925922773500f4ff11378
MD5 1d7bf7d9ea068656b212c734f0c380c0
SHA1 0928eb2861d5cd077101bd590a82c2da3d4223bc
SHA512 880728e2de3107c917255ac6d5faa878f98e25fff8e67a9303ee42ae56c7c9e95f47bbea6e04a8ed3b03d4874abbdb17d156aeacce6d5a30e414464fa0c7c24f
SSDEEP 98304:lvkaiCCzNT0MuOHkWn0f+6QpREZVuWfHpz2sR1IiXfI2B+:l8+60EHkWn0fDsGVnPNLRTIW
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1d7bf7d9ea068656b212c734f0c380c0_NeikiAnalytics.exe

File Explorer

1d7bf7d9ea068656b212c734f0c380c0_NeikiAnalytics.exe

.exe 9.7MB

1d7bf7d9ea068656b212c734f0c380c0_NeikiAnalytics.exe

IMPHASH a7b37bab8d16843ef006864140ca2326
SHA256 9a0452fd8cc5d8b93cc3a430be5c9afbf6918f153e3925922773500f4ff11378
MD5 1d7bf7d9ea068656b212c734f0c380c0
SHA1 0928eb2861d5cd077101bd590a82c2da3d4223bc
SHA512 880728e2de3107c917255ac6d5faa878f98e25fff8e67a9303ee42ae56c7c9e95f47bbea6e04a8ed3b03d4874abbdb17d156aeacce6d5a30e414464fa0c7c24f
SSDEEP 98304:lvkaiCCzNT0MuOHkWn0f+6QpREZVuWfHpz2sR1IiXfI2B+:l8+60EHkWn0fDsGVnPNLRTIW
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

50000

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

wextract.pdb

advapi32

OpenProcessToken GetTokenInformation RegSetValueExA EqualSid RegQueryValueExA LookupPrivilegeValueA RegCreateKeyExA RegOpenKeyExA RegQueryInfoKeyA RegDeleteValueA AllocateAndInitializeSid FreeSid AdjustTokenPrivileges RegCloseKey

kernel32

GetCurrentProcess GlobalLock _lclose ExpandEnvironmentStringsA GetWindowsDirectoryA GlobalAlloc GetPrivateProfileIntA GetFileAttributesA IsDBCSLeadByte GetSystemDirectoryA GlobalUnlock GetShortPathNameA CreateDirectoryA FindFirstFileA GetLastError GetProcAddress RemoveDirectoryA SetFileAttributesA GlobalFree FindClose GetPrivateProfileStringA LoadLibraryA LocalAlloc WritePrivateProfileStringA GetModuleFileNameA FindNextFileA CompareStringA _lopen CloseHandle LocalFree DeleteFileA ExitProcess DosDateTimeToFileTime FreeLibrary FindResourceA SetFilePointer FreeResource LoadResource WaitForSingleObject SetEvent GetModuleHandleW FormatMessageA SetFileTime WriteFile GetDriveTypeA GetVolumeInformationA TerminateThread SizeofResource CreateEventA GetExitCodeProcess lstrlenA ReadFile SetCurrentDirectoryA GetTempFileNameA ResetEvent LockResource GetSystemInfo LoadLibraryExA CreateMutexA GetCurrentDirectoryA GetVersionExA GetVersion GetTempPathA CreateThread LocalFileTimeToFileTime Sleep CreateFileA _llseek lstrcmpA GetStartupInfoW OutputDebugStringA RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext SetUnhandledExceptionFilter QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess UnhandledExceptionFilter EnumResourceLanguagesA MulDiv GetDiskFreeSpaceA CreateProcessA

gdi32

GetDeviceCaps

user32

ReleaseDC PeekMessageA MessageBoxA GetDC SendMessageA SetForegroundWindow MsgWaitForMultipleObjects SendDlgItemMessageA GetWindowLongPtrA GetWindowRect SetWindowPos ShowWindow SetWindowLongPtrA DispatchMessageA SetWindowTextA EnableWindow CallWindowProcA DialogBoxIndirectParamA GetDlgItemTextA LoadStringA MessageBeep CharUpperA CharNextA ExitWindowsEx CharPrevA EndDialog GetDesktopWindow SetDlgItemTextA GetDlgItem GetSystemMetrics

msvcrt

__set_app_type memcpy memset ?terminate@@YAXXZ _fmode _acmdln exit _commode __setusermatherr _amsg_exit _cexit _ismbblead _exit _XcptFilter __C_specific_handler __getmainargs _errno _vsnprintf _initterm

comctl32

ord17

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

Name

.text

Size

52KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

567KB

Virtual Size

566KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

324B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rdata

Size

9.1MB

Virtual Size

9.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

1d7bf7d9ea068656b212c734f0c380c0_NeikiAnalytics.exe

advapi32

kernel32

gdi32

user32

msvcrt

comctl32

version

generic