239b6715983d706382a78494da6792f0_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
239b6715983d706382a78494da6792f0_NeikiAnalytics.exe
Size 156KB
Sample240529-bcztdscf74
SHA256 78548aa43dfd3c5cf3352db8a122ba12dc53291e5e0d32fbe4f57f032d35f7a8
MD5 239b6715983d706382a78494da6792f0
SHA1 534f4a731df7430c8a6a7e854270cb4899a7fea4
SHA512 7f2d9c76d9b1d06074ed864c4a9ab7a13a5be2208e1bc8bd7e03bb36d19e6988e829398669f04a1025d284fe9aa08f89dd8e7e02dce1316b246782ae5c3a0d5d
SSDEEP 3072:fG9lG6TZ9WqfkA/ar9xMS/TEcxYPpsCmOPsy3TMELkRB/:fwXTZppyx7hx+rPsGo7RB
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
239b6715983d706382a78494da6792f0_NeikiAnalytics.exe

File Explorer

239b6715983d706382a78494da6792f0_NeikiAnalytics.exe

.exe 156KB

239b6715983d706382a78494da6792f0_NeikiAnalytics.exe

IMPHASH 4eadfec2f0763fd2f2082a665e604fce
SHA256 78548aa43dfd3c5cf3352db8a122ba12dc53291e5e0d32fbe4f57f032d35f7a8
MD5 239b6715983d706382a78494da6792f0
SHA1 534f4a731df7430c8a6a7e854270cb4899a7fea4
SHA512 7f2d9c76d9b1d06074ed864c4a9ab7a13a5be2208e1bc8bd7e03bb36d19e6988e829398669f04a1025d284fe9aa08f89dd8e7e02dce1316b246782ae5c3a0d5d
SSDEEP 3072:fG9lG6TZ9WqfkA/ar9xMS/TEcxYPpsCmOPsy3TMELkRB/:fwXTZppyx7hx+rPsGo7RB
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

126354

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvcrt

sprintf wcscpy wcscat wcslen wcscmp _snprintf floor strncpy atoi _strnicmp _iob strtoul _vsnprintf fprintf free malloc perror memmove _stricmp _wcsicmp rand wcsrchr _snwprintf wcsncat wcschr wcsstr _c_exit _exit _XcptFilter _cexit __initenv __getmainargs _initterm __setusermatherr _adjust_fdiv __p__commode __p__fmode __set_app_type _except_handler3 _controlfp _ftol exit

advapi32

RegisterServiceCtrlHandlerExA SetServiceStatus AllocateAndInitializeSid GetLengthSid InitializeAcl AddAccessAllowedAce InitializeSecurityDescriptor SetSecurityDescriptorDacl FreeSid RegNotifyChangeKeyValue RegQueryValueExW RegSetValueExA RegCloseKey CryptAcquireContextA CryptGenRandom CryptReleaseContext OpenSCManagerA OpenServiceA QueryServiceStatus CloseServiceHandle RegOpenKeyExA RegQueryValueExA ReportEventA RegisterEventSourceA StartServiceCtrlDispatcherA

kernel32

IsBadWritePtr InterlockedExchangeAdd InterlockedDecrement OpenProcess CreateFileA ReadFile GetStdHandle WriteFile IsBadReadPtr GetLocalTime SystemTimeToFileTime UnmapViewOfFile CreateSemaphoreA CreateFileMappingA MapViewOfFile WaitForMultipleObjects GetTickCount WaitForSingleObject DeleteCriticalSection FormatMessageA LocalFree CreateEventA InitializeCriticalSection ResetEvent SetProcessWorkingSetSize GetCurrentProcess GetSystemTime HeapDestroy HeapCreate CreateDirectoryW CompareFileTime GetFileAttributesExW SetFilePointer CreateFileW WideCharToMultiByte LoadLibraryExW GetSystemDirectoryW GetVersionExA HeapSize OpenEventA FlushViewOfFile ReleaseSemaphore GetModuleHandleA LocalAlloc OpenFileMappingA CloseHandle ExitProcess HeapAlloc HeapFree FreeLibrary GetProcAddress GetLastError MultiByteToWideChar ExpandEnvironmentStringsW SetEvent LeaveCriticalSection EnterCriticalSection CreateThread

ntdll

DbgBreakPoint RtlRandomEx DbgPrint

rpcrt4

NdrServerCall2 RpcAsyncCompleteCall UuidCreate RpcServerUnregisterIfEx RpcServerListen RpcServerRegisterIf RpcServerUseProtseqEpA RpcServerRegisterAuthInfoA RpcAsyncAbortCall RpcServerTestCancel RpcRevertToSelfEx RpcImpersonateClient RpcMgmtWaitServerListen RpcMgmtStopServerListening NdrAsyncServerCall

secur32

GetUserNameExA

user32

DefWindowProcA PostQuitMessage DispatchMessageA GetMessageA CreateWindowExA RegisterClassA

ws2_32

WSACreateEvent WSAWaitForMultipleEvents ntohs ntohl htons htonl inet_ntoa closesocket WSACloseEvent setsockopt WSAGetLastError WSAIoctl WSACleanup WSCEnumProtocols WSAStartup WSASocketW bind sendto recvfrom socket WSAEnumNetworkEvents WSAEventSelect