496bbb12bae13cbed69ca15ca8df9220_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
496bbb12bae13cbed69ca15ca8df9220_NeikiAnalytics.exe
Size 622KB
Sample240602-hbpelaee27
SHA256 97c25f46d264fb5b2f53cac9b9a0f695512820bb1ae240628aa861db6b7f2fa8
MD5 496bbb12bae13cbed69ca15ca8df9220
SHA1 232a668a432d3280be5dd50dbf54139b08472ccc
SHA512 3bb7d50f85fa2e592dfd4df01c64f0f9238e132ee600647bbc21908aa02fa189369e6e5341b3970e6d88374f5cd8fdffd92acb21840f7d38d8f1b907f4462b87
SSDEEP 12288:bJOiGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:bJOlt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
496bbb12bae13cbed69ca15ca8df9220_NeikiAnalytics.exe

File Explorer

496bbb12bae13cbed69ca15ca8df9220_NeikiAnalytics.exe

.exe 622KB

496bbb12bae13cbed69ca15ca8df9220_NeikiAnalytics.exe

IMPHASH 9f00f41a6b62080b1defb3b42f19f265
SHA256 97c25f46d264fb5b2f53cac9b9a0f695512820bb1ae240628aa861db6b7f2fa8
MD5 496bbb12bae13cbed69ca15ca8df9220
SHA1 232a668a432d3280be5dd50dbf54139b08472ccc
SHA512 3bb7d50f85fa2e592dfd4df01c64f0f9238e132ee600647bbc21908aa02fa189369e6e5341b3970e6d88374f5cd8fdffd92acb21840f7d38d8f1b907f4462b87
SSDEEP 12288:bJOiGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:bJOlt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

31360

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

MakeCert.pdb

advapi32

CryptReleaseContext CryptGenKey CryptGetProvParam CryptSetKeyParam CryptAcquireContextW CryptGetKeyParam CryptAcquireContextA CryptGetUserKey CryptDestroyKey

kernel32

MultiByteToWideChar LocalAlloc MapViewOfFile WideCharToMultiByte GetFileSize CreateFileMappingA WriteFile GetTickCount GetCurrentThreadId GetCurrentProcessId FreeResource LocalFileTimeToFileTime GetLastError FileTimeToSystemTime LoadLibraryA LockResource DeleteFileW UnmapViewOfFile QueryPerformanceCounter GetModuleHandleW TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext Sleep SizeofResource CompareFileTime GetModuleHandleA GetSystemTimeAsFileTime FreeLibrary SystemTimeToFileTime GetProcessHeap LocalFree GetProcAddress FileTimeToLocalFileTime LoadResource HeapSetInformation CloseHandle CreateFileW FindResourceA SetLastError

msvcrt

strcmp _wcsnicmp memcmp memcpy strtok _wtol malloc _callnewh free _XcptFilter _amsg_exit __wgetmainargs __set_app_type exit _exit _cexit memset ?terminate@@YAXXZ _commode _fmode __C_specific_handler _initterm __setusermatherr wprintf _vsnwprintf _wcsicmp vwprintf

mssign32

FreeCryptProvFromCert PvkPrivateKeySave PvkFreeCryptProv PvkPrivateKeyAcquireContextFromMemory GetCryptProvFromCert PvkGetCryptProv SignError

crypt32

CertComparePublicKeyInfo CertGetCertificateContextProperty CryptHashCertificate CertStrToNameW CertOpenStore CertCompareIntegerBlob CertCreateCRLContext CertFindCertificateInStore CertSetCertificateContextProperty CryptEncodeObject CertCloseStore CertDuplicateCertificateContext CryptQueryObject CertEnumCertificatesInStore CryptSignAndEncodeCertificate CertFreeCertificateContext CertFreeCRLContext CryptExportPublicKeyInfo CertGetPublicKeyLength CertAddEncodedCertificateToStore CryptDecodeObject CryptHashPublicKeyInfo CertCreateCertificateContext

user32

LoadStringA LoadStringW

ole32

CoInitialize CoCreateGuid CoUninitialize

oleaut32

VarDateFromStr

rpcrt4

UuidToStringW UuidCreate

Name

.text

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1024B

Virtual Size

792B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

496bbb12bae13cbed69ca15ca8df9220_NeikiAnalytics.exe

advapi32

kernel32

msvcrt

mssign32

crypt32

user32

ole32

oleaut32

rpcrt4

generic