6fff8451f0a44368a5a6ce168edeaea0_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
6fff8451f0a44368a5a6ce168edeaea0_NeikiAnalytics.exe
Size 656KB
Sample240530-repn7sbb3x
SHA256 8178608ecb785f4d26aa178e37f740fcb61c59b8e0c3702b60e52a8dfbbf9524
MD5 6fff8451f0a44368a5a6ce168edeaea0
SHA1 52c95d29533b61af751d37f71eb82227d992e214
SHA512 f92159e49235cdce660cf312bfe3cdaa88f7cea8f181f8a7ae4eb582b3a5e9e911f504791cc5a39aac1b73f04c01cdf32a7ae779bfea19d97a6df30058e1030f
SSDEEP 12288:kxJsTLGsHMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:kWLbsSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6fff8451f0a44368a5a6ce168edeaea0_NeikiAnalytics.exe

File Explorer

6fff8451f0a44368a5a6ce168edeaea0_NeikiAnalytics.exe

.exe 656KB

6fff8451f0a44368a5a6ce168edeaea0_NeikiAnalytics.exe

IMPHASH 0880969dd70df552ede1edaf71e17a74
SHA256 8178608ecb785f4d26aa178e37f740fcb61c59b8e0c3702b60e52a8dfbbf9524
MD5 6fff8451f0a44368a5a6ce168edeaea0
SHA1 52c95d29533b61af751d37f71eb82227d992e214
SHA512 f92159e49235cdce660cf312bfe3cdaa88f7cea8f181f8a7ae4eb582b3a5e9e911f504791cc5a39aac1b73f04c01cdf32a7ae779bfea19d97a6df30058e1030f
SSDEEP 12288:kxJsTLGsHMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:kWLbsSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

50848

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ALG.pdb

msvcrt

??1type_info@@UEAA@XZ exit _lock _unlock __set_app_type _exit __dllonexit __wgetmainargs _amsg_exit _XcptFilter _onexit ?terminate@@YAXXZ _cexit _commode _fmode _initterm memcpy __CxxFrameHandler3 _wcmdln isdigit _CxxThrowException _callnewh ??0exception@@QEAA@AEBQEBDH@Z memmove ??0exception@@QEAA@XZ memmove_s memcpy_s _wcsicmp ?what@exception@@UEBAPEBDXZ realloc wcscat_s malloc free ??0exception@@QEAA@AEBV0@@Z ??1exception@@UEAA@XZ ??0exception@@QEAA@AEBQEBD@Z __C_specific_handler __setusermatherr memcmp memset

api-ms-win-core-synch-l1-1-0

EnterCriticalSection SetEvent LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection CreateEventW WaitForSingleObject

api-ms-win-core-libraryloader-l1-2-0

LoadResource LoadLibraryExW GetModuleHandleW FreeLibrary GetModuleFileNameW FindResourceExW SizeofResource GetProcAddress

api-ms-win-core-string-l2-1-0

CharPrevW CharNextW

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter GetLastError UnhandledExceptionFilter RaiseException

api-ms-win-core-registry-l1-1-0

RegEnumKeyExW RegOpenKeyExW RegSetValueExW RegNotifyChangeKeyValue RegCreateKeyExW RegDeleteValueW RegQueryValueExW RegCloseKey RegQueryInfoKeyW RegEnumValueW

api-ms-win-core-memory-l1-1-0

VirtualProtect VirtualAlloc VirtualQuery

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo GetSystemTimeAsFileTime GetTickCount

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-handle-l1-1-0

DuplicateHandle CloseHandle

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-heap-l1-1-0

GetProcessHeap HeapDestroy HeapFree HeapAlloc HeapSetInformation

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId TerminateProcess GetCurrentProcessId CreateThread GetCurrentProcess GetStartupInfoW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext

api-ms-win-core-threadpool-legacy-l1-1-0

CreateTimerQueueTimer CreateTimerQueue DeleteTimerQueueEx DeleteTimerQueueTimer

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW lstrcpynW

cryptbase

SystemFunction036

mswsock

AcceptEx GetAcceptExSockaddrs

api-ms-win-core-file-l1-1-0

WriteFile ReadFile

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-kernel32-legacy-l1-1-0

BindIoCompletionCallback

Name

.text

Size

51KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

280B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

6fff8451f0a44368a5a6ce168edeaea0_NeikiAnalytics.exe

msvcrt

api-ms-win-core-synch-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-synch-l1-2-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

cryptbase

mswsock

api-ms-win-core-file-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

generic