eb8fa60173ce6d8e0e6496c253d4a360_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

eb8fa60173ce6d8e0e6496c253d4a360_NeikiAnalytics.exe
Size

74KB
MD5

eb8fa60173ce6d8e0e6496c253d4a360
SHA1

390b72447ff259fad705bedf5564b485d4d3ed6b
SHA256

58d79dd7ed71bc2c6cea93b264576d3432985e71639b7abe06caee0586818811
SHA512

f14c63a4208562b2e491b9c10ed6c8765573e0120f4da054822a9a46fb4e4b09adbdd879c898aa14e324f452aa1216e09710467ae01db97d0bfdcfc170d42f39
SSDEEP

1536:ly44Q3ece1YMugSs8/5kvJzhw+r+lmc4Csgh9vGrt7J/lAHTqG:lT4Q3gY/Xkv5hwihyvatBlQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
eb8fa60173ce6d8e0e6496c253d4a360_NeikiAnalytics.exe

Files

eb8fa60173ce6d8e0e6496c253d4a360_NeikiAnalytics.exe
.exe windows:4 windows x86 arch:x86

fd405bab932fd4dbb2d2a294d2094748

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentThreadId
CloseHandle
GetCurrentProcessId
FlushInstructionCache
SetLastError
lstrcmpA
FreeLibrary
IsBadReadPtr
GetVersionExA
GetSystemDirectoryA
ExitProcess
WaitForSingleObjectEx
SetEvent
OpenEventA
InterlockedIncrement
WaitForSingleObject
ExitThread
Sleep
DeleteFileA
UnmapViewOfFile
lstrcatA
OutputDebugStringA
WritePrivateProfileStringA
GetPrivateProfileSectionNamesA
GetTickCount
WriteProcessMemory
VirtualFree
VirtualAlloc
MapViewOfFileEx
CreateFileMappingA
SetThreadContext
VirtualProtectEx
GetThreadContext
CreateRemoteThread
ResumeThread
DuplicateHandle
EnterCriticalSection
CreateProcessA
FindNextFileA
FindFirstFileA
GetExitCodeThread
TerminateProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
VirtualAllocEx
VirtualFreeEx
QueryDosDeviceA
GetLogicalDriveStringsA
CreateThread
GetWindowsDirectoryA
CopyFileA
GetFileAttributesA
CreateEventA
CreateFileA
MapViewOfFile
SetFileTime
GetFileTime
RemoveDirectoryA
WideCharToMultiByte
MultiByteToWideChar
ResetEvent
OpenFile
GlobalAlloc
GlobalFree
LeaveCriticalSection
GetCurrentProcess
InitializeCriticalSection
lstrcpynA
HeapAlloc
lstrlenA
HeapReAlloc
GetLastError
lstrcpyA
HeapFree
GetProcessHeap
lstrcmpiA
VirtualQuery
VirtualProtect
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
OpenProcess
LoadLibraryA

user32

wvsprintfA
MessageBoxA
wsprintfA

advapi32

SetSecurityDescriptorDacl
OpenProcessToken
GetTokenInformation
RegSetValueExA
RegQueryInfoKeyA
RegQueryValueExA
RegEnumKeyExA
RegEnumValueA
RegOpenKeyExA
RegCloseKey
InitializeSecurityDescriptor
RegCreateKeyExA
AdjustTokenPrivileges

shell32

SHGetSpecialFolderPathA

oleaut32

VariantInit
SysAllocString
SysFreeString

wininet

HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetCanonicalizeUrlA
InternetOpenA
InternetSetOptionA
InternetQueryDataAvailable
InternetCrackUrlA
HttpQueryInfoA
InternetReadFile
InternetCloseHandle
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
FindCloseUrlCache
InternetQueryOptionA
HttpAddRequestHeadersA

rpcrt4

RpcStringFreeA
UuidCreate
UuidToStringA

ws2_32

WSAGetLastError
select
inet_ntoa
accept
listen
closesocket
bind
setsockopt
htonl
htons
socket
getpeername
WSAStartup
WSACleanup
inet_addr
gethostbyname
recv
send
connect
shutdown
ioctlsocket
ntohl

urlmon

ObtainUserAgentString

Exports

Exports

?unzip@@YAPAXPADPAK@Z
InstallHook
_WorkProc@4
__mp@4

Sections

.text
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

fd405bab932fd4dbb2d2a294d2094748

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

oleaut32

wininet

rpcrt4

ws2_32

urlmon

Exports

Exports

Sections

.text Size: 66KB - Virtual size: 65KB

.reloc Size: 7KB - Virtual size: 8KB

.text
Size: 66KB - Virtual size: 65KB

.reloc
Size: 7KB - Virtual size: 8KB