66d1ef97dd08b7be33002211ffb09f10_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
66d1ef97dd08b7be33002211ffb09f10_NeikiAnalytics.exe
Size 1.6MB
Sample240530-gdccdagd6w
SHA256 9097662d05b5dfc07bf0e27b278818ff532ec5b319f0d6dd3ecabdc994f98ac4
MD5 66d1ef97dd08b7be33002211ffb09f10
SHA1 56205e2eca4ec667b2875f1350b214dc77cd2f94
SHA512 dddca7994bc59fa28c69715656aa7c9a9304e13f4754e3feceb6e7904d1cf3fb298becbe83e54f3c6520e74d12bdd906e6f7c1e469982783fb54fa13fd5c4a32
SSDEEP 12288:1dhjo4sVrLzxAUMPa76huDeegxo8vvEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsz:qDMS76huDyqKERIk1k7c+vDqGJAAg
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
66d1ef97dd08b7be33002211ffb09f10_NeikiAnalytics.exe

File Explorer

66d1ef97dd08b7be33002211ffb09f10_NeikiAnalytics.exe

.exe 1.6MB

66d1ef97dd08b7be33002211ffb09f10_NeikiAnalytics.exe

IMPHASH ed3c2cf4a30e2437502a5d05e29f059d
SHA256 9097662d05b5dfc07bf0e27b278818ff532ec5b319f0d6dd3ecabdc994f98ac4
MD5 66d1ef97dd08b7be33002211ffb09f10
SHA1 56205e2eca4ec667b2875f1350b214dc77cd2f94
SHA512 dddca7994bc59fa28c69715656aa7c9a9304e13f4754e3feceb6e7904d1cf3fb298becbe83e54f3c6520e74d12bdd906e6f7c1e469982783fb54fa13fd5c4a32
SSDEEP 12288:1dhjo4sVrLzxAUMPa76huDeegxo8vvEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsz:qDMS76huDyqKERIk1k7c+vDqGJAAg
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

80884

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\jenkins\workspace\8-2-build-windows-amd64-cygwin\jdk8u261\295\build\windows-amd64\deploy\jre-image\bin\javaws.pdb

kernel32

GetCurrentProcessId WideCharToMultiByte FreeLibrary GetModuleHandleW GetProcAddress LoadLibraryW CreateDirectoryW FindClose FindFirstFileW CloseHandle WaitForSingleObject CreateEventW OpenProcess GetTickCount GetSystemWindowsDirectoryW GetModuleFileNameW GetThreadLocale CreateToolhelp32Snapshot Process32FirstW Process32NextW VerSetConditionMask GetEnvironmentVariableW CreateFileW GetLongPathNameW GetShortPathNameW GetTempPathW RaiseException GetLastError InitializeCriticalSectionAndSpinCount DeleteCriticalSection GetCurrentProcess CreateProcessW GlobalMemoryStatusEx GetLocalTime GetSystemDirectoryW GetWindowsDirectoryW GetVersionExW GetNativeSystemInfo GlobalAlloc GlobalFree LocalAlloc LocalFree FormatMessageW lstrlenW VerifyVersionInfoW WTSGetActiveConsoleSessionId OutputDebugStringW GetCurrentThreadId GetExitCodeProcess GetModuleHandleExW GetFileAttributesW WriteConsoleW HeapSize GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW GetFileSizeEx GetFileAttributesExW SetFilePointerEx ReadConsoleW ReadFile SetEndOfFile HeapReAlloc GetConsoleMode GetConsoleCP FlushFileBuffers SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetFullPathNameW GetCurrentDirectoryW SetEnvironmentVariableW HeapAlloc HeapFree GetStringTypeW WriteFile GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead EnterCriticalSection LeaveCriticalSection MultiByteToWideChar RtlUnwindEx RtlPcToFileHeader SetLastError EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetDriveTypeW GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ExitProcess GetCommandLineA GetCommandLineW DeleteFileW GetTimeZoneInformation GetStdHandle

user32

GetMessageW TranslateMessage MessageBoxW CloseDesktop DispatchMessageW DefWindowProcW RegisterClassW CreateWindowExW SetTimer LoadCursorW wsprintfW OpenInputDesktop GetWindowThreadProcessId GetShellWindow

ole32

CoTaskMemFree StringFromCLSID

oleaut32

VariantClear SysAllocString SysFreeString SysStringLen SysAllocStringByteLen

wsock32

WSAAsyncSelect socket send ntohs listen ioctlsocket htons getsockname accept recv bind closesocket WSAStartup WSAGetLastError connect

Name

.text

Size

254KB

Virtual Size

254KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

100KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

33KB

Virtual Size

121KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

32KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

66d1ef97dd08b7be33002211ffb09f10_NeikiAnalytics.exe

kernel32

user32

ole32

oleaut32

wsock32

generic