872764e1d7ced44cc515cfc70101ad80_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
872764e1d7ced44cc515cfc70101ad80_NeikiAnalytics.exe
Size 658KB
Sample240601-bb9xzacf86
SHA256 f818e9c08d6918a6474a9655456c609d5390fb212fe159c003a1432318936f14
MD5 872764e1d7ced44cc515cfc70101ad80
SHA1 e0a183509108387ee89f8c47f727582973acc1db
SHA512 2f687b238f383ca2feb7d1fb7ea3dcd3132d6324c8ac82250d719722fbbae0f895b1609c2c4aa17d6f96c1e8d764a07cbcdb44da39089b6aa742f8ddcb255914
SSDEEP 12288:Qr+IBLQubGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:Q/LQuKt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
872764e1d7ced44cc515cfc70101ad80_NeikiAnalytics.exe

File Explorer

872764e1d7ced44cc515cfc70101ad80_NeikiAnalytics.exe

.exe 658KB

872764e1d7ced44cc515cfc70101ad80_NeikiAnalytics.exe

IMPHASH 63879732bf2bfd01cf874c563a6cac5b
SHA256 f818e9c08d6918a6474a9655456c609d5390fb212fe159c003a1432318936f14
MD5 872764e1d7ced44cc515cfc70101ad80
SHA1 e0a183509108387ee89f8c47f727582973acc1db
SHA512 2f687b238f383ca2feb7d1fb7ea3dcd3132d6324c8ac82250d719722fbbae0f895b1609c2c4aa17d6f96c1e8d764a07cbcdb44da39089b6aa742f8ddcb255914
SSDEEP 12288:Qr+IBLQubGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:Q/LQuKt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51392

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ALG.pdb

msvcrt

_cexit _amsg_exit _exit _onexit __set_app_type __dllonexit _XcptFilter _wcmdln _CxxThrowException _unlock _lock ??1type_info@@UEAA@XZ __wgetmainargs exit __CxxFrameHandler3 _initterm ?terminate@@YAXXZ _commode __setusermatherr isdigit _callnewh ??0exception@@QEAA@AEBQEBDH@Z memmove ??0exception@@QEAA@XZ memmove_s memcpy_s _wcsicmp ?what@exception@@UEBAPEBDXZ realloc wcscat_s malloc free ??0exception@@QEAA@AEBV0@@Z ??1exception@@UEAA@XZ ??0exception@@QEAA@AEBQEBD@Z __C_specific_handler _fmode memcmp memcpy memset

api-ms-win-core-synch-l1-2-0

WaitForSingleObject SetEvent EnterCriticalSection Sleep LeaveCriticalSection CreateEventW InitializeCriticalSection DeleteCriticalSection

api-ms-win-core-libraryloader-l1-2-0

LoadResource GetModuleHandleW LoadLibraryExW GetProcAddress SizeofResource GetModuleFileNameW FindResourceExW FreeLibrary

api-ms-win-core-string-l2-1-0

CharPrevW CharNextW

api-ms-win-core-errorhandling-l1-1-1

GetLastError RaiseException UnhandledExceptionFilter SetUnhandledExceptionFilter

api-ms-win-core-registry-l1-1-0

RegEnumKeyExW RegCloseKey RegQueryValueExW RegOpenKeyExW RegEnumValueW RegSetValueExW RegQueryInfoKeyW RegCreateKeyExW RegDeleteValueW RegNotifyChangeKeyValue

api-ms-win-core-memory-l1-1-2

VirtualQuery VirtualProtect VirtualAlloc

api-ms-win-core-sysinfo-l1-2-1

GetSystemInfo GetSystemTimeAsFileTime GetTickCount GetVersionExW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-handle-l1-1-0

DuplicateHandle CloseHandle

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-heap-l1-2-0

HeapFree HeapDestroy HeapAlloc GetProcessHeap HeapSetInformation

api-ms-win-core-processthreads-l1-1-2

GetCurrentThreadId GetStartupInfoW GetCurrentProcess GetCurrentProcessId TerminateProcess CreateThread

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-rtlsupport-l1-2-0

RtlLookupFunctionEntry RtlVirtualUnwind RtlCaptureContext

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueEx DeleteTimerQueueTimer CreateTimerQueue CreateTimerQueueTimer

api-ms-win-core-string-obsolete-l1-1-0

lstrcpynW lstrcmpiW

cryptbase

SystemFunction036

mswsock

AcceptEx GetAcceptExSockaddrs

api-ms-win-core-file-l1-2-1

ReadFile WriteFile

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI DelayLoadFailureHook

api-ms-win-core-kernel32-legacy-l1-1-1

BindIoCompletionCallback

Name

.text

Size

52KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

280B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

872764e1d7ced44cc515cfc70101ad80_NeikiAnalytics.exe

msvcrt

api-ms-win-core-synch-l1-2-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-registry-l1-1-0

api-ms-win-core-memory-l1-1-2

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-string-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-heap-l1-2-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-profile-l1-1-0

api-ms-win-core-rtlsupport-l1-2-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

cryptbase

mswsock

api-ms-win-core-file-l1-2-1

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-kernel32-legacy-l1-1-1

generic