4ba3237479f076e186276934dba66dd0_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

4ba3237479f076e186276934dba66dd0_NeikiAnalytics.exe
Size

776KB
MD5

4ba3237479f076e186276934dba66dd0
SHA1

058f95737c5b31cab4cfc7876e0ab488d82736cf
SHA256

e1677d3461e7900e83db88bb577a595d25c152c84e80a959a3c9a59214c4882c
SHA512

e4f3412c3913f892f33d4ced80c859dedee046aefa274ac982925dab74b666d2c3fd3966208448f4469ca9ee4ffd00e2f457189b7142159b986dd818ab0fa9c7
SSDEEP

12288:fAgfS2dticxjEQeY+79tgHO4Aar2+HdTf+EwxbfkaT8nktao5Q:fAWrPxoQmeVJ2+Hd9cbMStV5

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4ba3237479f076e186276934dba66dd0_NeikiAnalytics.exe

Files

4ba3237479f076e186276934dba66dd0_NeikiAnalytics.exe
.dll windows:4 windows x86 arch:x86

31cd982b9396c08f769c7658171a4160

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetVersion
GetVersionExA
GetVersion
GetCommandLineA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

ScreenToClient

advapi32

RegQueryValueExA

oleaut32

GetErrorInfo

version

GetFileVersionInfoA

gdi32

GetEnhMetaFilePaletteEntries

ole32

CoUninitialize

comctl32

ImageList_GetDragImage

Exports

Exports

AntiComa
IsFloat
IsRefCod
SqRoot
TimeToSecond
e_ChPer
e_Digit
e_PZTChannel

Sections

CODE
Size: 359KB - Virtual size: 359KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 213B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: 227KB - Virtual size: 227KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 125KB - Virtual size: 125KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

31cd982b9396c08f769c7658171a4160

Headers

File Characteristics

Imports

kernel32

user32

advapi32

oleaut32

version

gdi32

ole32

comctl32

Exports

Exports

Sections

CODE Size: 359KB - Virtual size: 359KB

DATA Size: 5KB - Virtual size: 4KB

BSS Size: - Virtual size: 3KB

.idata Size: 9KB - Virtual size: 8KB

.edata Size: 512B - Virtual size: 213B

.vmp0 Size: 227KB - Virtual size: 227KB

.vmp1 Size: 125KB - Virtual size: 125KB

.reloc Size: 26KB - Virtual size: 25KB

.rsrc Size: 22KB - Virtual size: 21KB

CODE
Size: 359KB - Virtual size: 359KB

DATA
Size: 5KB - Virtual size: 4KB

BSS
Size: - Virtual size: 3KB

.idata
Size: 9KB - Virtual size: 8KB

.edata
Size: 512B - Virtual size: 213B

.vmp0
Size: 227KB - Virtual size: 227KB

.vmp1
Size: 125KB - Virtual size: 125KB

.reloc
Size: 26KB - Virtual size: 25KB

.rsrc
Size: 22KB - Virtual size: 21KB