11fed8b58f01b1511f443d7abf8cb300_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

11fed8b58f01b1511f443d7abf8cb300_NeikiAnalytics.exe
Size

92KB
MD5

11fed8b58f01b1511f443d7abf8cb300
SHA1

b22fefc030da274766b82f8f73aeec4ef0182382
SHA256

dd0178fa6d30e22e123c38dfdd90f4869cf3818d2859666ac7203b1c08d1754c
SHA512

52d8deacc4fa43225c8859954db2d26da980d97514f67ab8f4e4d5b38c852fe7faa6deb30af606360cb1e7264ad8d0db6a0a7a8cc0d572805ff6166e15789fa3
SSDEEP

1536:ZF3iQ40ArdbCG9uO66OWGfyX6gufghfEYTSIXdW/zWi1gsGn6:Dyx0glCG9j2y11hf38n15Gn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
11fed8b58f01b1511f443d7abf8cb300_NeikiAnalytics.exe

Files

11fed8b58f01b1511f443d7abf8cb300_NeikiAnalytics.exe
.exe windows:4 windows x86 arch:x86

fbecf5b257ea44188c31bd5f5b4ec69a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathCombineW
wnsprintfA
wnsprintfW

kernel32

TlsAlloc
InitializeCriticalSection
ExitProcess
GetModuleHandleW
ExitThread
OpenProcess
UnmapViewOfFile
MapViewOfFileEx
GetFileSizeEx
CreateFileMappingW
GetFileSize
SetEndOfFile
MoveFileExW
TlsSetValue
FreeLibrary
LoadLibraryA
LocalFree
SetEvent
WaitForMultipleObjects
GetEnvironmentVariableW
GetTempFileNameW
FindFirstFileW
CreateDirectoryW
CopyFileW
GetTempPathW
TlsGetValue
RemoveDirectoryW
FindNextFileW
SetFileAttributesW
GetCurrentThreadId
GetDriveTypeW
CreateProcessW
GetLogicalDrives
GetFileAttributesW
ReadFile
CreatePipe
DuplicateHandle
GetProcAddress
GetModuleHandleA
VirtualFreeEx
VirtualAllocEx
WriteProcessMemory
HeapReAlloc
HeapAlloc
HeapFree
GetProcessHeap
FileTimeToDosDateTime
FileTimeToLocalFileTime
GetFileInformationByHandle
CreateRemoteThread
ReadProcessMemory
VirtualProtectEx
WideCharToMultiByte
MultiByteToWideChar
GetNativeSystemInfo
GetVersionExW
GetSystemTimeAsFileTime
GetLastError
SetFilePointer
CreateThread
GetVolumeInformationW
GetCurrentProcessId
ReleaseMutex
CreateEventW
ResetEvent
SetThreadPriority
GetModuleFileNameW
Sleep
GetCurrentThread
SignalObjectAndWait
WaitForSingleObject
CreateMutexW
GetComputerNameA
DeleteFileW
CloseHandle
EnterCriticalSection
FlushFileBuffers
CreateFileW
LeaveCriticalSection
WriteFile
InterlockedDecrement
FindClose
InterlockedIncrement

advapi32

GetSecurityDescriptorSacl
SetNamedSecurityInfoW
SetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorA
RegSetValueExW
RegCloseKey
RegNotifyChangeKeyValue
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
GetTokenInformation
OpenThreadToken
OpenProcessToken
CryptHashData
CryptDestroyHash
CryptDecrypt
CryptDestroyKey
CryptGenKey
CryptCreateHash
CryptEncrypt
CryptReleaseContext
CryptDuplicateHash
CryptVerifySignatureW
CryptAcquireContextW
CryptExportKey
CryptGetHashParam
EqualSid
GetLengthSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor

shell32

SHGetFolderPathW

Sections

.text
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

code
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fbecf5b257ea44188c31bd5f5b4ec69a

Headers

File Characteristics

Imports

shlwapi

kernel32

advapi32

shell32

Sections

.text Size: 56KB - Virtual size: 55KB

code Size: 8KB - Virtual size: 7KB

.rdata Size: 12KB - Virtual size: 8KB

.data Size: 4KB - Virtual size: 11KB

.reloc Size: 8KB - Virtual size: 4KB

.text
Size: 56KB - Virtual size: 55KB

code
Size: 8KB - Virtual size: 7KB

.rdata
Size: 12KB - Virtual size: 8KB

.data
Size: 4KB - Virtual size: 11KB

.reloc
Size: 8KB - Virtual size: 4KB