521839d28028f05d814ec5e0a850f560_NeikiAnalytics[.]exe | Triage

Sharing

General

Target

521839d28028f05d814ec5e0a850f560_NeikiAnalytics.exe
Size

10KB
MD5

521839d28028f05d814ec5e0a850f560
SHA1

789d51405244a40b1a7ce97febf7a7ba68942d11
SHA256

b0acae64106d242eddfa40990e822aa2ee1543a2f7237cea8394b200431e47e2
SHA512

b37b2398913850edcb6047913492fc62c8df847abe01b16ff9804f06f8c1e7b6335827b6da3a9127c09cf31869fbbd65f56a597e3e9107dfd2bf97527c80e84f
SSDEEP

192:RaSG35+LSwUHEP+HYZsx8nn08tQVGdUqbuUonm:RmJ+EZofN6GW/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
521839d28028f05d814ec5e0a850f560_NeikiAnalytics.exe

Files

521839d28028f05d814ec5e0a850f560_NeikiAnalytics.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\MIZE\DEV\TFS\QT\QUADROtech\QT-X\Libraries\QUADROtech.EnterpriseVault.Cloud\main\src\QUADROtech.EnterpriseVault.Cloud.TestConsole\obj\Debug\QUADROtech.EnterpriseVault.Cloud.TestConsole.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ