d67a8472bf0ec7cadde92394431a92b0_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

d67a8472bf0ec7cadde92394431a92b0_NeikiAnalytics.exe
Size

1.3MB
MD5

d67a8472bf0ec7cadde92394431a92b0
SHA1

b8087a3916116f724fd7e3d74c16e29598cf60b2
SHA256

bc6bbb563e00fc97dc30c565bf504deb90f031035b68714d68db156b85a94840
SHA512

175bcdf54e80e2609a388a2cf5482607f4e07fdb8e5ac4d43fa4de5a88b5d1c486b92c5a509c85b14dd666f4ad95f47db4e965af61f3fe996a69b2eddca99f70
SSDEEP

12288:gHXgeKznl5TXJR0j3p2pVUrrQuLoWTF23JVbd0UILzXSocmKdYNq6:g37ozX0j52pMkuLoiSJVlIL29mhNq6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d67a8472bf0ec7cadde92394431a92b0_NeikiAnalytics.exe

Files

d67a8472bf0ec7cadde92394431a92b0_NeikiAnalytics.exe
.exe windows:5 windows x86 arch:x86

9d008fddfe7aba04b6be2a65be7e15b7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

mspdbsrv.pdb

Imports

msvcr80

_controlfp_s
_invoke_watson
_except_handler4_common
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
__set_app_type
_encode_pointer
_purecall
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
__winitenv
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
strncpy_s
malloc
_wpgmptr
memcpy_s
sprintf_s
exit
_snwprintf_s
_wdupenv_s
fclose
_wfopen_s
iswspace
memmove
_wcsicmp
wcstoul
wcschr
free
_wcsdup
_time64
_wctime64
__iob_func
fwprintf
vfwprintf
fflush
wcsncpy_s
??3@YAXPAX@Z
??2@YAPAXI@Z
memcpy
memset
_crt_debugger_hook

advapi32

RegCloseKey
RegOpenKeyExA
GetTokenInformation
OpenProcessToken
RegQueryValueExA

kernel32

InterlockedCompareExchange
Sleep
InterlockedExchange
OpenProcess
QueryPerformanceCounter
GetCurrentThread
GetThreadTimes
QueryPerformanceFrequency
SetUnhandledExceptionFilter
SetErrorMode
VirtualQuery
GetModuleFileNameW
OpenEventW
SetPriorityClass
CreateMutexW
CreateEventW
CreateWaitableTimerA
CreateEventA
CreateMutexA
DuplicateHandle
GetCurrentThreadId
GetTickCount
WaitForSingleObject
SetEvent
ReleaseMutex
UnmapViewOfFile
SetWaitableTimer
CancelWaitableTimer
GetCurrentProcess
CreateFileMappingA
MapViewOfFile
ExpandEnvironmentStringsA
WaitForMultipleObjects
GetCommandLineW
CloseHandle
GetLastError
GetCurrentProcessId
InitializeCriticalSectionAndSpinCount
GetVersion
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
CreateProcessA

rpcrt4

RpcBindingInqAuthClientA
RpcServerUnregisterIf
RpcMgmtStopServerListening
RpcServerListen
RpcServerRegisterIf2
RpcServerUseProtseqEpW
RpcMgmtStatsVectorFree
RpcMgmtInqStats
NdrServerCall2
NdrClientCall2

mspdbcore

?SetErrorHandlerAPI@PDB@@SAHP6APAUIPDBError@@PAU1@@Z@Z
?CloseAllTimeoutPDB@PDB@@SAHXZ
?OpenValidate4@PDB@@SAHPBGPBDPBU_GUID@@KKPAJPAGIPAPAU1@@Z
?OpenEx2W@PDB@@SAHPBGPBDJPAJPAGIPAPAU1@@Z
?FOpen@MREngine@@SGHPAPAU1@PAUPDB@@PAUNameMap@@HH@Z
?FOpen@MREngine@@SGHPAPAU1@PAUMreToPdb@@HH@Z
?FOpenW@MREngine@@SGHPAPAU1@PBGAAJPAGIHH@Z
?open@NameMap@@SAHPAUPDB@@HPAPAU1@@Z
?ShutDownTimeoutManager@PDB@@SAHXZ
?SetPDBCloseTimeout@PDB@@SAH_K@Z

secur32

GetUserNameExW

Sections

.text
Size: 99KB - Virtual size: 98KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.2MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

9d008fddfe7aba04b6be2a65be7e15b7

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcr80

advapi32

kernel32

rpcrt4

mspdbcore

secur32

Sections

.text Size: 99KB - Virtual size: 98KB

.data Size: 1KB - Virtual size: 19KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 1.2MB - Virtual size: 1.8MB

.text
Size: 99KB - Virtual size: 98KB

.data
Size: 1KB - Virtual size: 19KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 1.2MB - Virtual size: 1.8MB