5eb3475aa6bc109b2951cf0ba1dfd3c0_NeikiAnalytics[.]exe | Triage

Sharing

General

Target

5eb3475aa6bc109b2951cf0ba1dfd3c0_NeikiAnalytics.exe
Size

9.2MB
MD5

5eb3475aa6bc109b2951cf0ba1dfd3c0
SHA1

127dda141fe2005565fd849ea84928d6757a361d
SHA256

dca6bf0f27bee5857e73d4fdceaf92330b62f48897b1e6f8862714fc7d2f7756
SHA512

2c2671872ff9ab7dde1d71225168db0fe98fee4593530835168d06a9a9bdfd53fea4aa5abaf4b1e23f8f3d486c27292211c2eb746b5757ed704816397ccf7bf9
SSDEEP

196608:4I9/kDlLQZqYzLAxNuoJUs2orfzQc4EMy0nBvNGr2RsKVjN:r/kDVQNMN95HYEM9BVGrHK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
5eb3475aa6bc109b2951cf0ba1dfd3c0_NeikiAnalytics.exe

Files

5eb3475aa6bc109b2951cf0ba1dfd3c0_NeikiAnalytics.exe
.exe windows:5 windows x86 arch:x86

387f84cc13884dfd1aed93c3aac88dc3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\MyGit\mylibrary\PeMemoryRun\Debug\PeMemoryRun9.pdb

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

LoadImageW

gdi32

GetStockObject

msimg32

TransparentBlt

winspool.drv

ClosePrinter

advapi32

RegQueryValueA

shell32

SHBrowseForFolderA

comctl32

InitCommonControlsEx

shlwapi

StrFormatKBSizeA

uxtheme

IsAppThemed

ole32

CoRegisterClassObject

oleaut32

VarBstrFromDate

oledlg

ord8

oleacc

LresultFromObject

gdiplus

GdipCreateFromHDC

imm32

ImmReleaseContext

winmm

PlaySoundA

Sections

.text
Size: 9.2MB - Virtual size: 11.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 53KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE