717472ae53a219f93f1fce4215eb5640_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

717472ae53a219f93f1fce4215eb5640_NeikiAnalytics.exe
Size

808KB
MD5

717472ae53a219f93f1fce4215eb5640
SHA1

91e328afbee596b51aaef5580f28d4c6dd6051d4
SHA256

1cb1496ee71cb1ce7258ec73d306a64813bd89697c1506424bc66e1880e232cd
SHA512

7a4953de8e231c4262e07cb1a4a41cd8ae9fa52081a266ae248b19d3f1dcd14f47f7dc09f2a7248648d6da7f168334e560dfb54faf54816ced0b9e38c7203005
SSDEEP

12288:R+lBRLpe5YTXwI/SIxn85c6S4Hb4849nIYVjIlCOU4hog96o2gZ:UrbtjwI/S65gcTVjUCs2Vo2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
717472ae53a219f93f1fce4215eb5640_NeikiAnalytics.exe

Files

717472ae53a219f93f1fce4215eb5640_NeikiAnalytics.exe
.exe windows:10 windows x86 arch:x86

9558560cbfdb419535f9680927a961eb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

vshadow.pdb

Imports

kernel32

GetLastError
GetVolumePathNamesForVolumeNameW
WriteFile
CloseHandle
CreateFileW
WideCharToMultiByte
QueryDosDeviceW
GetFileAttributesW
FindFirstFileW
FindClose
FindNextFileW
GetThreadLocale
GetTimeFormatW
GetDateFormatW
FileTimeToSystemTime
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
GetVolumePathNameW
ExpandEnvironmentStringsW
VerSetConditionMask
VerifyVersionInfoW
HeapSetInformation
GetExitCodeProcess
LocalFree
CreateProcessW
ReadFile
GetFileSize
GetCommandLineW
GetCurrentProcess
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
SetUnhandledExceptionFilter
Sleep
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
DecodePointer
EncodePointer
InitializeCriticalSectionEx
GetStringTypeW
MultiByteToWideChar
WaitForSingleObject
FormatMessageW
TerminateProcess

msvcrt

??0exception@@QAE@ABQBDH@Z
_CxxThrowException
memcpy
memmove
_errno
___mb_cur_max_func
___lc_handle_func
___lc_codepage_func
_ismbblead
memset
__uncaught_exception
setlocale
_lock
_unlock
_fsopen
fseek
__pctype_func
isupper
calloc
__iob_func
__mb_cur_max
islower
_wcsdup
__crtLCMapStringW
__crtLCMapStringA
_wsetlocale
abort
_wcsnicmp
_callnewh
memcmp
_XcptFilter
__p__commode
_amsg_exit
__wgetmainargs
__set_app_type
exit
_exit
_cexit
__p__fmode
__setusermatherr
_initterm
__dllonexit
_onexit
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_controlfp
_except_handler4_common
strcspn
fputwc
ungetwc
fclose
localeconv
??_V@YAXPAX@Z
__CxxFrameHandler3
??3@YAXPAX@Z
_purecall
_vsnwprintf
wprintf
??0exception@@QAE@ABV0@@Z
?what@exception@@UBEPBDXZ
malloc
getchar
_wcsicmp
free
??0bad_cast@@QAE@PBD@Z
??1bad_cast@@UAE@XZ
??0bad_cast@@QAE@ABV0@@Z
sprintf_s
fwrite
memcpy_s
ungetc
fgetc
fgetwc
fgetpos
_fseeki64
fsetpos
setvbuf
fflush
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
fputc

atl

ord30

oleaut32

SysFreeString
SysAllocString

ole32

CLSIDFromString
CoInitializeSecurity
CoInitialize
CoUninitialize
CoTaskMemFree
CoCreateInstance

vssapi

VssFreeSnapshotPropertiesInternal
CreateVssBackupComponentsInternal
ShouldBlockRevertInternal

resutils

ClusterPrepareSharedVolumeForBackup
ClusterIsPathOnSharedVolume
ClusterGetVolumePathName
ClusterGetVolumeNameForVolumeMountPoint

shlwapi

PathFileExistsW

Sections

.text
Size: 225KB - Virtual size: 225KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 576KB - Virtual size: 580KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

9558560cbfdb419535f9680927a961eb

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

msvcrt

atl

oleaut32

ole32

vssapi

resutils

shlwapi

Sections

.text Size: 225KB - Virtual size: 225KB

.data Size: 512B - Virtual size: 2KB

.idata Size: 4KB - Virtual size: 3KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 576KB - Virtual size: 580KB

.text
Size: 225KB - Virtual size: 225KB

.data
Size: 512B - Virtual size: 2KB

.idata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 576KB - Virtual size: 580KB