0089bfbadc3c0da67b737060c9befc90_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

0089bfbadc3c0da67b737060c9befc90_NeikiAnalytics.exe
Size

42KB
MD5

0089bfbadc3c0da67b737060c9befc90
SHA1

173cdd50e521a6a62f9d4cab97f6640b4eebd246
SHA256

3a38da1cbb8a8a4615b118ee18e3faf828bd8505f3a577b7894a1e60a97ed69a
SHA512

b92c9c337878f999be0c7aeaa8b78a941db75227350ee69cb08b5df2adf4276f93df0f479c47305d5bbae0cbb08ba451ecbea05a354d77664bdab93b261e9b8c
SSDEEP

768:eCk0EozaqwJp4aiyEwb+VIvwGR5laTYoL4fTlDme3Xc:eCkbsaXqay4rlaTrsT3Xc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0089bfbadc3c0da67b737060c9befc90_NeikiAnalytics.exe

Files

0089bfbadc3c0da67b737060c9befc90_NeikiAnalytics.exe
.dll windows:6 windows x86 arch:x86

062e1e789405a1da7015b077710c54cb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

MultiByteToWideChar
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter

msvcp140

_Xtime_get_ticks

vcruntime140

__std_type_info_destroy_list
strrchr
memset
memcpy
_except_handler4_common

api-ms-win-crt-stdio-l1-1-0

_wfopen_s
fclose
fopen
_ftelli64
_fseeki64
fwrite
fread

api-ms-win-crt-filesystem-l1-1-0

remove

api-ms-win-crt-heap-l1-1-0

free
malloc
realloc

api-ms-win-crt-time-l1-1-0

_utime64
_mktime64

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv
_seh_filter_dll
_initialize_onexit_table
_execute_onexit_table
_cexit
_initterm_e
_initterm
_initialize_narrow_environment

Exports

Exports

Serum_ApplyRotations
Serum_Colorize
Serum_ColorizeOrApplyRotations
Serum_ColorizeWithMetadata
Serum_ColorizeWithMetadataOrApplyRotations
Serum_DisableColorization
Serum_Dispose
Serum_EnableColorization
Serum_GetMinorVersion
Serum_GetVersion
Serum_Load
Serum_LoadFile
Serum_SetIgnoreUnknownFramesTimeout
Serum_SetMaximumUnknownFramesToSkip
Serum_SetStandardPalette

Sections

.text
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

062e1e789405a1da7015b077710c54cb

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcp140

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

Exports

Exports

Sections

.text Size: 32KB - Virtual size: 31KB

.rdata Size: 7KB - Virtual size: 6KB

.data Size: 512B - Virtual size: 2KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 32KB - Virtual size: 31KB

.rdata
Size: 7KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 2KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 1KB - Virtual size: 1KB