5e177b1a18e0831839f8bbc08c1de620_NeikiAnalytics[.]exe

General

Target

5e177b1a18e0831839f8bbc08c1de620_NeikiAnalytics.exe
Size

94KB
MD5

5e177b1a18e0831839f8bbc08c1de620
SHA1

8352fea352e99c31040f071d2cd45d382c89a3bf
SHA256

bd8694b7a638e9f45fce931699f806ddbfd9e3ab356027f509cdd611be62f978
SHA512

1b4730c95e27671086555850f919e1d4264c5a1d70af9a4a2a2ccd2ee03d56f3439d6edc5ac256e7e42f1975fcae4d6316f0d5dae100127d32b8ba054b077ced
SSDEEP

1536:nx52vQBKLmh4jIUs7ghzerjJC8kVidxfUjQRKr2nTWExTOojRO:nxIvQBK+7rghzSLkIdxfmQ0oTOoj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5e177b1a18e0831839f8bbc08c1de620_NeikiAnalytics.exe

Files

5e177b1a18e0831839f8bbc08c1de620_NeikiAnalytics.exe
.dll windows:5 windows x86 arch:x86

0c6901a47b781d4366bf86600fc4701b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetConsoleTextAttribute
GetStdHandle
GetCurrentThreadId
DecodePointer
GetCommandLineA
EnterCriticalSection
LeaveCriticalSection
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
SetLastError
GetLastError
GetProcAddress
HeapFree
Sleep
ExitProcess
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapAlloc
HeapSize
HeapReAlloc
LCMapStringW
MultiByteToWideChar
GetStringTypeW
LoadLibraryW
WriteFile
GetModuleFileNameW
RtlUnwind
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetFilePointer
CloseHandle
CompareStringW
SetEnvironmentVariableA
WriteConsoleW
SetStdHandle
CreateFileW

Exports

Exports

pp_free_context
pp_free_mode
pp_get_context
pp_get_mode_by_name_and_quality
pp_postprocess

Sections

.text
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 696B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0c6901a47b781d4366bf86600fc4701b

Headers

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 71KB - Virtual size: 70KB

.rdata Size: 12KB - Virtual size: 12KB

.data Size: 5KB - Virtual size: 13KB

.rsrc Size: 1024B - Virtual size: 696B

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 71KB - Virtual size: 70KB

.rdata
Size: 12KB - Virtual size: 12KB

.data
Size: 5KB - Virtual size: 13KB

.rsrc
Size: 1024B - Virtual size: 696B

.reloc
Size: 4KB - Virtual size: 3KB