5ed787a76b3feade2da1f6f9120271a0_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
5ed787a76b3feade2da1f6f9120271a0_NeikiAnalytics.exe
Size 3.4MB
Sample240526-edzfssdh2t
SHA256 148bccc3a6c660f53f4ecdc39d4d3c3fac5db267d380da3cc5076d9ff685954d
MD5 5ed787a76b3feade2da1f6f9120271a0
SHA1 bf0207b51d47d63937f507156f2c75e9d6834da3
SHA512 b52aa4b4e0ad668e5a8d77f796dd81db16e44928c900dd0383e472dd5b3ff7d84e1512a348b90347c441443d685d39f11357338e9bff7963c9e0b0c33c5e67c2
SSDEEP 49152:qbDOAv9MErOO53RTqtiMxzSbtL2tLMljIumUi6AjW/MUSdGRf3/IR:m9NrOO53JV2VXjxAZs
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5ed787a76b3feade2da1f6f9120271a0_NeikiAnalytics.exe

File Explorer

5ed787a76b3feade2da1f6f9120271a0_NeikiAnalytics.exe

.exe 3.4MB

5ed787a76b3feade2da1f6f9120271a0_NeikiAnalytics.exe

IMPHASH 79e1bf126f286a03f0b7587666321da8
SHA256 148bccc3a6c660f53f4ecdc39d4d3c3fac5db267d380da3cc5076d9ff685954d
MD5 5ed787a76b3feade2da1f6f9120271a0
SHA1 bf0207b51d47d63937f507156f2c75e9d6834da3
SHA512 b52aa4b4e0ad668e5a8d77f796dd81db16e44928c900dd0383e472dd5b3ff7d84e1512a348b90347c441443d685d39f11357338e9bff7963c9e0b0c33c5e67c2
SSDEEP 49152:qbDOAv9MErOO53RTqtiMxzSbtL2tLMljIumUi6AjW/MUSdGRf3/IR:m9NrOO53JV2VXjxAZs
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

23746

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

TextExtractor.pdb

query

LoadIFilter

kernel32

InterlockedIncrement GetCurrentProcess GetProcAddress GetModuleHandleA GetLongPathNameW LocalFree GetCommandLineW SetErrorMode UnmapViewOfFile InterlockedDecrement SetEvent OpenProcess GetVersionExA MapViewOfFile OpenFileMappingW OpenEventW ResetEvent WaitForMultipleObjects GetTickCount GetStartupInfoW CloseHandle TerminateProcess HeapSetInformation InterlockedCompareExchange Sleep InterlockedExchange GetSystemTimeAsFileTime DecodePointer EncodePointer WideCharToMultiByte lstrlenA MultiByteToWideChar GetCurrentProcessId GetCurrentThreadId QueryPerformanceCounter IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetLastError

advapi32

RegQueryValueExA RegCloseKey RegOpenKeyExA

shell32

CommandLineToArgvW

ole32

CoUninitialize CoInitialize

oleaut32

SysStringLen SysFreeString SysAllocString VariantClear

shlwapi

PathFileExistsW PathIsRelativeW PathFindExtensionW PathAddBackslashW PathIsDirectoryW

msvcp100

?_Xlength_error@std@@YAXPBD@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?_BADOFF@std@@3_JB ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@ ??_7ios_base@std@@6B@ ??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@ ?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@ ?_Xout_of_range@std@@YAXPBD@Z

msvcr100

?what@exception@std@@UBEPBDXZ ??0exception@std@@QAE@ABQBD@Z ??3@YAXPAX@Z memcpy memmove ??2@YAPAXI@Z ??_V@YAXPAX@Z _CxxThrowException ??0exception@std@@QAE@ABV01@@Z __CxxFrameHandler3 strlen _mbschr _mbslwr _splitpath_s _fullpath memset _wcslwr wcslen _wfullpath _wcsicmp _wcsnicmp wcscpy_s swscanf_s free malloc _unlock __dllonexit _lock _onexit _amsg_exit __getmainargs _cexit _exit _XcptFilter _ismbblead exit _acmdln _initterm _initterm_e _configthreadlocale __setusermatherr _commode _fmode __set_app_type _except_handler4_common ?terminate@@YAXXZ ?_type_info_dtor_internal_method@type_info@@QAEXXZ _crt_debugger_hook _invoke_watson _controlfp_s ??1exception@std@@UAE@XZ