59727d0b777b471e2545e4a7533aa390_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
59727d0b777b471e2545e4a7533aa390_NeikiAnalytics.exe
Size 107KB
Sample240526-dp89psde65
SHA256 fa0e59ff8a0364fb2946888b9e4565d42f83436ff955b2a474d325702dc1b1a9
MD5 59727d0b777b471e2545e4a7533aa390
SHA1 b1adcc5a0a63ed40e6c881d1c5e7f57efb0d51d8
SHA512 78bd4bb44179480db3f2da70bb45d131123b67672fdaa936a4b2d2bec985f6844108e2175bf6939951d53e0e2d44a47ab912b4d9bc5e3e6d57d001437e47a66a
SSDEEP 3072:REhLjKw6CnK4cT6HKBmg0crZA2fdmpmt/mfp:WjKycWvcri2fdKt
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
59727d0b777b471e2545e4a7533aa390_NeikiAnalytics.exe

File Explorer

59727d0b777b471e2545e4a7533aa390_NeikiAnalytics.exe

.exe 107KB

59727d0b777b471e2545e4a7533aa390_NeikiAnalytics.exe

IMPHASH e9199e48f00cb40541b813f918c50e1f
SHA256 fa0e59ff8a0364fb2946888b9e4565d42f83436ff955b2a474d325702dc1b1a9
MD5 59727d0b777b471e2545e4a7533aa390
SHA1 b1adcc5a0a63ed40e6c881d1c5e7f57efb0d51d8
SHA512 78bd4bb44179480db3f2da70bb45d131123b67672fdaa936a4b2d2bec985f6844108e2175bf6939951d53e0e2d44a47ab912b4d9bc5e3e6d57d001437e47a66a
SSDEEP 3072:REhLjKw6CnK4cT6HKBmg0crZA2fdmpmt/mfp:WjKycWvcri2fdKt
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

31248

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

CharUpperA CharLowerA wsprintfA

kernel32

GetLastError GetLogicalDriveStringsA GetModuleFileNameA GetModuleHandleA GetFileSize GetProcAddress GetSystemDirectoryA GetTickCount GetVersionExA InitializeCriticalSection InterlockedDecrement InterlockedIncrement IsBadReadPtr LeaveCriticalSection LoadLibraryA LocalAlloc LocalFree MapViewOfFile OpenFileMappingA GetCurrentProcessId ResumeThread SetErrorMode GetCommandLineW FlushViewOfFile GetDriveTypeA SetThreadPriority Sleep SuspendThread TerminateProcess UnmapViewOfFile VirtualAlloc VirtualFree WaitForSingleObject WideCharToMultiByte WriteFile lstrcatA lstrcmpA GetCurrentProcess lstrcpyA lstrcpynA lstrlenA lstrlenW CreateFileMappingA CreateFileA CreateEventA CopyFileA CloseHandle SetFilePointer FindNextFileA FindFirstFileA FindClose ExitThread ExitProcess EnterCriticalSection DeleteFileA CreateThread CreateProcessA CreateMutexA SetEvent SetFileAttributesA ReadFile lstrcmpiA SetLastError MultiByteToWideChar GetModuleFileNameW

msvcrt

memset rand strstr memcpy

imagehlp

CheckSumMappedFile

ole32

CoTaskMemFree CoTaskMemAlloc CoInitialize CoCreateGuid IsEqualGUID CoRegisterClassObject

shell32

CommandLineToArgvW

advapi32

RegCreateKeyExA RegDeleteKeyA RegCreateKeyA CryptReleaseContext CryptGenRandom CryptAcquireContextA RegDeleteValueA RegEnumKeyExA RegOpenKeyA RegOpenKeyExA RegQueryValueA RegSetValueA RegSetValueExA SetServiceStatus RegCloseKey

ws2_32

recv select ioctlsocket inet_addr send htons socket htonl gethostbyname connect closesocket WSAStartup WSAGetLastError setsockopt shutdown inet_ntoa

shlwapi

PathFindFileNameA