312edbb32bd325ed59183c5e43480e30_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

312edbb32bd325ed59183c5e43480e30_NeikiAnalytics.exe
Size

58KB
MD5

312edbb32bd325ed59183c5e43480e30
SHA1

d71bc8417330aacfd8024bc52c280127309d09b4
SHA256

5a2e6e2dbabc0ef15a7459e5373378e99362b4bc86a5e9471fc5dcae8b526a8a
SHA512

0f4a6b908237ecab663a7457017616e862a7776e194aa3cff25cba5c4d1e731c4a563c4d8210c862652aa87ef6fcd18b2420e169ea8c9950ce143a2734d4e744
SSDEEP

1536:5V/GrlhiYZBZoKSFRPm7gOqjDDzWHUR667R8wslzS:+rlhiYZw1FK5kDGHd63sl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
312edbb32bd325ed59183c5e43480e30_NeikiAnalytics.exe

Files

312edbb32bd325ed59183c5e43480e30_NeikiAnalytics.exe
.exe windows:6 windows x86 arch:x86

0f737807d46c5a9e1654b97b0efb649b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

setspn.pdb

Imports

kernel32

FormatMessageW
LoadLibraryW
GetLastError
GetSystemDirectoryW
ExitProcess
GetModuleHandleW
GetProcessHeap
HeapAlloc
GetStdHandle
WriteFile
HeapFree
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
OutputDebugStringA
InterlockedCompareExchange
Sleep
InterlockedExchange
GetConsoleOutputCP
SetThreadUILanguage
WideCharToMultiByte

msvcrt

_fileno
_lseeki64
__pioinfo
_isatty
__badioinfo
ferror
malloc
_itoa
_snprintf
__wgetmainargs
isleadbyte
__mb_cur_max
mbtowc
_controlfp
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
exit
_XcptFilter
_exit
_cexit
_write
fwprintf
_errno
_vsnwprintf
memcpy
calloc
_wcsnicmp
_wcsicmp
_iob
fprintf
towupper
free
wcschr
memset
_wsetlocale

netapi32

DsGetDcNameWithAccountW
NetApiBufferFree

ntdsapi

DsCrackNamesW
DsBindW
DsUnBindW
DsFreeNameResultW
DsWriteAccountSpnW

wldap32

ord46
ord170
ord16
ord73
ord191
ord208
ord41
ord26
ord147
ord88
ord127
ord140
ord224
ord167
ord97
ord135
ord206
ord12
ord118
ord133
ord145
ord13
ord27

user32

LoadStringW

shlwapi

StrChrW
StrCmpW

ntdll

RtlInitUnicodeString
RtlUnwind

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 29KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

nwdapih
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

0f737807d46c5a9e1654b97b0efb649b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

msvcrt

netapi32

ntdsapi

wldap32

user32

shlwapi

ntdll

Sections

.text Size: 24KB - Virtual size: 24KB

.data Size: 1024B - Virtual size: 3KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 29KB - Virtual size: 30KB

nwdapih Size: - Virtual size: 4KB

.text
Size: 24KB - Virtual size: 24KB

.data
Size: 1024B - Virtual size: 3KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 29KB - Virtual size: 30KB

nwdapih
Size: - Virtual size: 4KB