2afefc1fa4af208fbd31d9b586216d10_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

2afefc1fa4af208fbd31d9b586216d10_NeikiAnalytics.exe
Size

104KB
MD5

2afefc1fa4af208fbd31d9b586216d10
SHA1

dd7b690cd73151e8b1decb627f13e37dcec56aeb
SHA256

c45953cd61d4cdfb279635b9c3bb7e56dab59866b5f489eafe7ec11a2dfaa02c
SHA512

073082590da3bdcc808cbe986fa8d5ab24b16702e701a16f032dd47aa129a85301853f81c36dbc416b727c188403f1517e7cd4fbf9e4bf09966d0b8976a81e02
SSDEEP

1536:zzjyvMP5N71bh+KdGqdfCOuHotn6qRt21neGCq2iW7z:zzevMxbFAoIqRt21eGCH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2afefc1fa4af208fbd31d9b586216d10_NeikiAnalytics.exe

Files

2afefc1fa4af208fbd31d9b586216d10_NeikiAnalytics.exe
.exe windows:4 windows x86 arch:x86

5ef7306e323e741336c4f2e3dbd8a668

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\projects\pc connectivity solution\pccs 3.10\source files\platform\media servers\nclirsrv\mediahandler\win32\release\NclIrSrv.pdb

Imports

ws2_32

shutdown
connect
closesocket
socket
WSACleanup
WSAStartup
WSACloseEvent
WSAResetEvent
WSAGetOverlappedResult
WSAWaitForMultipleEvents
WSARecv
WSACreateEvent
WSAGetLastError
getsockopt
WSASend

kernel32

LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
WideCharToMultiByte
LoadLibraryA
CreateMutexW
CreateEventW
CreateFileW
CreateThread
SetThreadPriority
CancelIo
DisconnectNamedPipe
ReleaseMutex
SetEvent
WaitForSingleObject
ReadFile
TerminateThread
GetLastError
CloseHandle
HeapFree
WaitForMultipleObjects
HeapSize
lstrlenW
ResetEvent
ExitThread
GetOverlappedResult
HeapValidate
WriteFile
PeekNamedPipe
GetProcessHeap
ConnectNamedPipe
HeapAlloc
IsBadCodePtr
GetTickCount
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
Sleep
MultiByteToWideChar
IsValidCodePage
GetOEMCP
GetCPInfo
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoA
GetFileType
SetHandleCount
GetCurrentThreadId
GetCommandLineW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetModuleFileNameW
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoW
RaiseException
RtlUnwind
GetModuleHandleA
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
ExitProcess
GetStdHandle
GetModuleFileNameA
GetEnvironmentStrings

user32

DefWindowProcW
DispatchMessageW
RegisterClassExW
CreateWindowExW
PostMessageW
PostQuitMessage
GetMessageW
UnregisterClassW
UpdateWindow
ShowWindow

advapi32

InitializeSecurityDescriptor
SetSecurityDescriptorDacl

ole32

StringFromCLSID
CLSIDFromString
CoTaskMemFree

oleaut32

SysAllocStringByteLen
SysStringByteLen
VarBstrCmp
SysStringLen
SysFreeString
SysAllocString
SysAllocStringLen

Sections

.text
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Y)��u�
Size: 16KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

5ef7306e323e741336c4f2e3dbd8a668

Headers

File Characteristics

PDB Paths

Imports

ws2_32

kernel32

user32

advapi32

ole32

oleaut32

Sections

.text Size: 60KB - Virtual size: 60KB

.rdata Size: 20KB - Virtual size: 20KB

.data Size: 4KB - Virtual size: 7KB

.rsrc Size: 1KB - Virtual size: 1KB

Y)���u� Size: 16KB - Virtual size: 20KB

.text
Size: 60KB - Virtual size: 60KB

.rdata
Size: 20KB - Virtual size: 20KB

.data
Size: 4KB - Virtual size: 7KB

.rsrc
Size: 1KB - Virtual size: 1KB

Y)��u�
Size: 16KB - Virtual size: 20KB