510dd4e7f6faf299bc73aaed6ff0f6a0_NeikiAnalytics[.]exe

General

Target
510dd4e7f6faf299bc73aaed6ff0f6a0_NeikiAnalytics.exe
Size 1.5MB
Sample240529-mfb3aabd6x
SHA256 526171b21be27e49151aba41eeca01b321c5a6233e8bb85415ef67685122d7bf
MD5 510dd4e7f6faf299bc73aaed6ff0f6a0
SHA1 230e71e126790a631ade73b0ecc8453d77a732ec
SHA512 531478152865272875e74ee23aeeae052cd0b84d8b088ba82c03db53b668561af54057d666a5e45162aa72fd67ab1619a329e1c3c9a9938bd4c1f9961786c364
SSDEEP 12288:CT6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4:CT6LaRFdGJm0Q3WKVSwdr13Ek0VA
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
510dd4e7f6faf299bc73aaed6ff0f6a0_NeikiAnalytics.exe

File Explorer

510dd4e7f6faf299bc73aaed6ff0f6a0_NeikiAnalytics.exe

.exe 1.5MB

510dd4e7f6faf299bc73aaed6ff0f6a0_NeikiAnalytics.exe

IMPHASH a6025a8de97dc433de45fbffff6b2737
SHA256 526171b21be27e49151aba41eeca01b321c5a6233e8bb85415ef67685122d7bf
MD5 510dd4e7f6faf299bc73aaed6ff0f6a0
SHA1 230e71e126790a631ade73b0ecc8453d77a732ec
SHA512 531478152865272875e74ee23aeeae052cd0b84d8b088ba82c03db53b668561af54057d666a5e45162aa72fd67ab1619a329e1c3c9a9938bd4c1f9961786c364
SSDEEP 12288:CT6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4:CT6LaRFdGJm0Q3WKVSwdr13Ek0VA
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

6752

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\undname.pdb

kernel32

UnmapViewOfFile CreateFileA CloseHandle CreateFileMappingA GetFileSize MapViewOfFile GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent TerminateProcess GetCurrentProcess GetModuleHandleW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter QueryPerformanceCounter

vcruntime140

__C_specific_handler strstr __unDNameEx __current_exception __current_exception_context memset memcpy

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _register_onexit_function _register_thread_local_exe_atexit_callback _initterm _initialize_onexit_table _initterm_e exit __p___argv _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _cexit _set_app_type _seh_filter_exe __p___argc _exit terminate _c_exit

api-ms-win-crt-stdio-l1-1-0

putc __acrt_iob_func __p__commode _set_fmode __stdio_common_vfprintf

api-ms-win-crt-convert-l1-1-0

strtoul

api-ms-win-crt-filesystem-l1-1-0

_access_s

api-ms-win-crt-heap-l1-1-0

malloc free _set_new_mode

api-ms-win-crt-environment-l1-1-0

_dupenv_s

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

512B

Virtual Size

432B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

510dd4e7f6faf299bc73aaed6ff0f6a0_NeikiAnalytics.exe

kernel32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic