77fa3b12a5c6e3c0fff9a72ba3eede50_NeikiAnalytics[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

77fa3b12a5c6e3c0fff9a72ba3eede50_NeikiAnalytics.exe
Size

915KB
MD5

77fa3b12a5c6e3c0fff9a72ba3eede50
SHA1

f0a735eb2885b10963825940dd967065541651f1
SHA256

75545f86e25726beac5d0e62ea1ef6d03eaa9f7b1437295b50b3e77ce1b56f07
SHA512

05c2280a54b4ad473b073290654d0a2cc4635088c882a51be8698fcad588be66d3c4144cf34e5ea7ce9a59a691574afc2592c233de20f5e4c688697a2f4486a0
SSDEEP

12288:YsfKoGpm+xC0nJPAEumQoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVU:Y9oaXHD2JOt934J7Z6bQaj1BvUm9J

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
77fa3b12a5c6e3c0fff9a72ba3eede50_NeikiAnalytics.exe

Files

77fa3b12a5c6e3c0fff9a72ba3eede50_NeikiAnalytics.exe
.exe windows:10 windows x64 arch:x64

42443e9a79c89f639c2deef11b71ecc4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

mftrace.pdb

Imports

msvcrt

memmove_s
_wfopen_s
fclose
memcpy_s
fprintf_s
wcschr
vswprintf_s
_vscwprintf
__iob_func
wcsspn
fwrite
free
_wtoi
vsprintf_s
_vscprintf
printf_s
calloc
malloc
wcscspn
_callnewh
__C_specific_handler
wcstoul
_XcptFilter
_amsg_exit
__wgetmainargs
__set_app_type
_wcsicmp
exit
_exit
_cexit
__setusermatherr
_initterm
_fmode
_commode
_lock
_unlock
__dllonexit
_onexit
_errno
realloc
memcpy
_wcstoui64
iswxdigit
iswdigit
vfprintf_s
?terminate@@YAXXZ
memcmp
memset

api-ms-win-core-errorhandling-l1-1-0

GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException
SetLastError

oleaut32

SysAllocString
SysFreeString
VariantClear
VarBstrCmp

api-ms-win-core-console-l2-1-0

GetConsoleScreenBufferInfo
SetConsoleTextAttribute

api-ms-win-core-processenvironment-l1-1-0

SetEnvironmentVariableW
GetStdHandle
SearchPathW

api-ms-win-core-com-l1-1-0

CoInitializeEx
CoCreateInstance
IIDFromString
StringFromGUID2
CoUninitialize

api-ms-win-eventing-tdh-l1-1-0

TdhGetEventInformation
TdhEnumerateProviders
TdhGetProperty
TdhGetPropertySize

api-ms-win-core-toolhelp-l1-1-0

Process32NextW
CreateToolhelp32Snapshot
Process32FirstW

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-heap-l1-1-0

HeapSize
HeapSetInformation
HeapDestroy
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc

api-ms-win-core-console-l1-1-0

SetConsoleCtrlHandler

api-ms-win-core-string-l1-1-0

WideCharToMultiByte

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
FindResourceExW
LoadResource
LockResource
SizeofResource
LoadLibraryExW
FreeLibrary
GetModuleFileNameW
GetModuleHandleW

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
WaitForSingleObject
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

SuspendThread
CreateRemoteThread
CreateThread
CreateProcessW
ResumeThread
GetExitCodeThread
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
GetExitCodeProcess
GetCurrentProcessId

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

dbghelp

StackWalk64
SymFunctionTableAccess64
SymGetModuleBase64

api-ms-win-security-base-l1-1-0

CheckTokenMembership
AllocateAndInitializeSid
FreeSid

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegCreateKeyExW

api-ms-win-eventing-controller-l1-1-0

ControlTraceW
StartTraceW

api-ms-win-eventing-legacy-l1-1-0

EnableTraceEx

api-ms-win-core-processthreads-l1-1-1

FlushInstructionCache
GetThreadContext

api-ms-win-core-debug-l1-1-1

DebugActiveProcess
DebugActiveProcessStop
WaitForDebugEvent
ContinueDebugEvent

api-ms-win-core-wow64-l1-1-0

IsWow64Process

api-ms-win-core-memory-l1-1-0

VirtualFreeEx
VirtualProtectEx
WriteProcessMemory
VirtualQueryEx
VirtualAllocEx
ReadProcessMemory

api-ms-win-eventing-consumer-l1-1-0

ProcessTrace
CloseTrace
OpenTraceW

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Sections

.text
Size: 89KB - Virtual size: 89KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 243KB - Virtual size: 242KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 576KB - Virtual size: 580KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

42443e9a79c89f639c2deef11b71ecc4

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-errorhandling-l1-1-0

oleaut32

api-ms-win-core-console-l2-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-eventing-tdh-l1-1-0

api-ms-win-core-toolhelp-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-debug-l1-1-0

dbghelp

api-ms-win-security-base-l1-1-0

api-ms-win-core-registry-l1-1-1

api-ms-win-core-registry-l1-1-0

api-ms-win-eventing-controller-l1-1-0

api-ms-win-eventing-legacy-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-debug-l1-1-1

api-ms-win-core-wow64-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-eventing-consumer-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Sections

.text Size: 89KB - Virtual size: 89KB

.rdata Size: 243KB - Virtual size: 242KB

.data Size: 1024B - Virtual size: 2KB

.pdata Size: 3KB - Virtual size: 2KB

.didat Size: 512B - Virtual size: 16B

.rsrc Size: 1024B - Virtual size: 928B

.reloc Size: 576KB - Virtual size: 580KB

.text
Size: 89KB - Virtual size: 89KB

.rdata
Size: 243KB - Virtual size: 242KB

.data
Size: 1024B - Virtual size: 2KB

.pdata
Size: 3KB - Virtual size: 2KB

.didat
Size: 512B - Virtual size: 16B

.rsrc
Size: 1024B - Virtual size: 928B

.reloc
Size: 576KB - Virtual size: 580KB