3c704d028ec8230cbfa5a3f1dcb57020_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

3c704d028ec8230cbfa5a3f1dcb57020_NeikiAnalytics.exe
Size

1.8MB
MD5

3c704d028ec8230cbfa5a3f1dcb57020
SHA1

d1b564955b2487880b6681cba16b9591f021b7e2
SHA256

384feebd4274c73fe3d905bad0f36e7aa19512847fe1540e3705dd34ed5b9e5e
SHA512

b7a7e561a777146fa0604d59076dbe26ac98f131502b9d0f5371022a0ae049cbc164cdd66fee8ec3206677a9b2769267f86ae04d736201f1289697f95948fdc8
SSDEEP

3072:UQoIEXmIR2vr0rX3HUEn57AXQgNLMH7JttWsoyM1aZzWeHMobswJzx:eJ/6AUE5Pc1m1sobTJzx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3c704d028ec8230cbfa5a3f1dcb57020_NeikiAnalytics.exe

Files

3c704d028ec8230cbfa5a3f1dcb57020_NeikiAnalytics.exe
.dll windows:4 windows x86 arch:x86

61792527ee7f940462e237f6d39bdf55

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\svn\bdm_kv_bind_v1092\basic\Tools\NSIS\Plugins\bind.pdb

Imports

wininet

InternetOpenW
InternetCloseHandle
InternetOpenUrlW
InternetReadFile
HttpQueryInfoW

kernel32

ReadFile
CloseHandle
GetFileSize
CreateFileW
lstrcmpiW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
SetFilePointer
GetLastError
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
CreateFileA
GetWindowsDirectoryW
Sleep
CreateDirectoryW
WideCharToMultiByte
FindResourceW
ExpandEnvironmentStringsW
WaitForSingleObject
LoadResource
LockResource
SizeofResource
FreeResource
GetModuleFileNameW
MultiByteToWideChar
GetSystemDirectoryW
FindResourceExW
LoadLibraryW
GetCurrentThreadId
GetCommandLineW
GetCurrentProcess
GetProcAddress
FreeLibrary
GetTickCount
SetEvent
DeleteFileW
CreateEventW
ResetEvent
WriteConsoleW
GetConsoleOutputCP
WriteFile
RaiseException
WriteConsoleA
LoadLibraryA
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetVersionExA
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
ExitThread
CreateThread
GetCommandLineA
RtlUnwind
LCMapStringA
LCMapStringW
GetCPInfo
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetStdHandle
GetModuleFileNameA
SetHandleCount
GetFileType
GetStartupInfoA
GetConsoleCP
GetConsoleMode
HeapCreate
VirtualFree
VirtualAlloc
GetACP
GetOEMCP
IsValidCodePage
FlushFileBuffers
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
SetStdHandle

user32

wsprintfW
UnregisterClassA

advapi32

RegQueryValueExW
RegOpenKeyExW

shell32

ShellExecuteExW

shlwapi

PathFileExistsW

Exports

Exports

DownloaderHelper

Sections

.text
Size: 100KB - Virtual size: 98KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

61792527ee7f940462e237f6d39bdf55

Headers

File Characteristics

PDB Paths

Imports

wininet

kernel32

user32

advapi32

shell32

shlwapi

Exports

Exports

Sections

.text Size: 100KB - Virtual size: 98KB

.rdata Size: 28KB - Virtual size: 25KB

.data Size: 8KB - Virtual size: 14KB

.rsrc Size: 1.6MB - Virtual size: 1.6MB

.reloc Size: 16KB - Virtual size: 14KB

.text
Size: 100KB - Virtual size: 98KB

.rdata
Size: 28KB - Virtual size: 25KB

.data
Size: 8KB - Virtual size: 14KB

.rsrc
Size: 1.6MB - Virtual size: 1.6MB

.reloc
Size: 16KB - Virtual size: 14KB