553fd99899eff49eb8cd3415cd8aa4f0_NeikiAnalytics[.]exe

General

Target
553fd99899eff49eb8cd3415cd8aa4f0_NeikiAnalytics.exe
Size 24KB
Sample240602-jqa17aga53
SHA256 ff931eeeeb4dab0545e6261b06ea3f581793406ce9f865ada181972a7b1e7e1e
MD5 553fd99899eff49eb8cd3415cd8aa4f0
SHA1 3d6a2190be821d2133ef5464af878d5f4d13e408
SHA512 4ab56ffba9aca3e9ab0fb3c1ce567f860d83b4f055ada4785ad26e53899d5aa9f5688592e25d21ab1d79dc7b45aef9e12ed0aa1086bfb64cb9c23a7840662719
SSDEEP 384:XtOfB+juJ5j7ICYPUcRlSkSib4bv5ONPWswX/X/:9OsKvALX4LswX/X
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
553fd99899eff49eb8cd3415cd8aa4f0_NeikiAnalytics.exe

File Explorer

553fd99899eff49eb8cd3415cd8aa4f0_NeikiAnalytics.exe

.dll 24KB

553fd99899eff49eb8cd3415cd8aa4f0_NeikiAnalytics.exe

IMPHASH 7e65e0c443ed16a2864c693e578ef397
SHA256 ff931eeeeb4dab0545e6261b06ea3f581793406ce9f865ada181972a7b1e7e1e
MD5 553fd99899eff49eb8cd3415cd8aa4f0
SHA1 3d6a2190be821d2133ef5464af878d5f4d13e408
SHA512 4ab56ffba9aca3e9ab0fb3c1ce567f860d83b4f055ada4785ad26e53899d5aa9f5688592e25d21ab1d79dc7b45aef9e12ed0aa1086bfb64cb9c23a7840662719
SSDEEP 384:XtOfB+juJ5j7ICYPUcRlSkSib4bv5ONPWswX/X/:9OsKvALX4LswX/X
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

6238

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

??0TiXmlAttribute@@QAE@PBD0@Z ??0TiXmlAttribute@@QAE@XZ ??0TiXmlAttributeSet@@QAE@XZ ??0TiXmlBase@@QAE@XZ ??0TiXmlComment@@QAE@ABV0@@Z ??0TiXmlComment@@QAE@PBD@Z ??0TiXmlComment@@QAE@XZ ??0TiXmlDeclaration@@QAE@ABV0@@Z ??0TiXmlDeclaration@@QAE@PBD00@Z ??0TiXmlDeclaration@@QAE@XZ ??0TiXmlDocument@@IAE@PBD@Z ??0TiXmlDocument@@QAE@ABV0@@Z ??0TiXmlDocument@@QAE@XZ ??0TiXmlElement@@QAE@ABV0@@Z ??0TiXmlElement@@QAE@PBD@Z ??0TiXmlNode@@IAE@W4NodeType@0@@Z ??0TiXmlPrinter@@QAE@ABV0@@Z ??0TiXmlPrinter@@QAE@XZ ??0TiXmlText@@QAE@ABV0@@Z ??0TiXmlText@@QAE@PBD@Z ??0TiXmlUnknown@@QAE@ABV0@@Z ??0TiXmlUnknown@@QAE@XZ ??1TiXmlAttribute@@UAE@XZ ??1TiXmlAttributeSet@@QAE@XZ ??1TiXmlBase@@UAE@XZ ??1TiXmlComment@@UAE@XZ ??1TiXmlDeclaration@@UAE@XZ ??1TiXmlDocument@@UAE@XZ ??1TiXmlElement@@UAE@XZ ??1TiXmlNode@@UAE@XZ ??1TiXmlPrinter@@UAE@XZ ??1TiXmlText@@UAE@XZ ??1TiXmlUnknown@@UAE@XZ ??4TiXmlComment@@QAEXABV0@@Z ??4TiXmlDeclaration@@QAEXABV0@@Z ??4TiXmlDocument@@QAEXABV0@@Z ??4TiXmlElement@@QAEXABV0@@Z ??4TiXmlPrinter@@QAEAAV0@ABV0@@Z ??4TiXmlText@@QAEXABV0@@Z ??4TiXmlUnknown@@QAEXABV0@@Z ??8TiXmlAttribute@@QBE_NABV0@@Z ??MTiXmlAttribute@@QBE_NABV0@@Z ??OTiXmlAttribute@@QBE_NABV0@@Z ??_7TiXmlAttribute@@6B@ ??_7TiXmlBase@@6B@ ??_7TiXmlComment@@6B@ ??_7TiXmlDeclaration@@6B@ ??_7TiXmlDocument@@6B@ ??_7TiXmlElement@@6B@ ??_7TiXmlNode@@6B@ ??_7TiXmlPrinter@@6B@ ??_7TiXmlText@@6B@ ??_7TiXmlUnknown@@6B@ ?Accept@TiXmlComment@@UBE_NPAVTiXmlVisitor@@@Z ?Accept@TiXmlDeclaration@@UBE_NPAVTiXmlVisitor@@@Z ?Accept@TiXmlDocument@@UBE_NPAVTiXmlVisitor@@@Z ?Accept@TiXmlElement@@UBE_NPAVTiXmlVisitor@@@Z ?Accept@TiXmlText@@UBE_NPAVTiXmlVisitor@@@Z ?Accept@TiXmlUnknown@@UBE_NPAVTiXmlVisitor@@@Z ?Add@TiXmlAttributeSet@@QAEXPAVTiXmlAttribute@@@Z ?Attribute@TiXmlElement@@QBEPBDPBD@Z ?Attribute@TiXmlElement@@QBEPBDPBDPAH@Z ?Attribute@TiXmlElement@@QBEPBDPBDPAN@Z ?Blank@TiXmlText@@IBE_NXZ ?CDATA@TiXmlText@@QBE_NXZ ?CStr@TiXmlPrinter@@QAEPBDXZ ?Clear@TiXmlNode@@QAEXXZ ?ClearError@TiXmlDocument@@QAEXXZ ?ClearThis@TiXmlElement@@IAEXXZ ?Clone@TiXmlComment@@UBEPAVTiXmlNode@@XZ ?Clone@TiXmlDeclaration@@UBEPAVTiXmlNode@@XZ ?Clone@TiXmlDocument@@MBEPAVTiXmlNode@@XZ ?Clone@TiXmlElement@@UBEPAVTiXmlNode@@XZ ?Clone@TiXmlText@@MBEPAVTiXmlNode@@XZ ?Clone@TiXmlUnknown@@UBEPAVTiXmlNode@@XZ ?Column@TiXmlBase@@QBEHXZ ?ConvertUTF32ToUTF8@TiXmlBase@@KAXKPADPAH@Z ?CopyTo@TiXmlComment@@IBEXPAV1@@Z ?CopyTo@TiXmlDeclaration@@IBEXPAV1@@Z ?CopyTo@TiXmlDocument@@ABEXPAV1@@Z ?CopyTo@TiXmlElement@@IBEXPAV1@@Z ?CopyTo@TiXmlNode@@IBEXPAV1@@Z ?CopyTo@TiXmlText@@IBEXPAV1@@Z ?CopyTo@TiXmlUnknown@@IBEXPAV1@@Z ?DoIndent@TiXmlPrinter@@AAEXXZ ?DoLineBreak@TiXmlPrinter@@AAEXXZ ?DoubleValue@TiXmlAttribute@@QBENXZ ?EncodeString@TiXmlBase@@SAXABVTiXmlString@@PAV2@@Z ?Encoding@TiXmlDeclaration@@QBEPBDXZ ?Error@TiXmlDocument@@QBE_NXZ ?ErrorCol@TiXmlDocument@@QBEHXZ ?ErrorDesc@TiXmlDocument@@QBEPBDXZ ?ErrorId@TiXmlDocument@@QBEHXZ ?ErrorRow@TiXmlDocument@@QBEHXZ ?Find@TiXmlAttributeSet@@QAEPAVTiXmlAttribute@@PBD@Z ?Find@TiXmlAttributeSet@@QBEPBVTiXmlAttribute@@PBD@Z ?First@TiXmlAttributeSet@@QAEPAVTiXmlAttribute@@XZ ?First@TiXmlAttributeSet@@QBEPBVTiXmlAttribute@@XZ ?FirstAttribute@TiXmlElement@@QAEPAVTiXmlAttribute@@XZ ?FirstAttribute@TiXmlElement@@QBEPBVTiXmlAttribute@@XZ ?FirstChild@TiXmlNode@@QAEPAV1@PBD@Z ?FirstChild@TiXmlNode@@QAEPAV1@XZ ?FirstChild@TiXmlNode@@QBEPBV1@PBD@Z ?FirstChild@TiXmlNode@@QBEPBV1@XZ ?FirstChildElement@TiXmlNode@@QAEPAVTiXmlElement@@PBD@Z ?FirstChildElement@TiXmlNode@@QAEPAVTiXmlElement@@XZ ?FirstChildElement@TiXmlNode@@QBEPBVTiXmlElement@@PBD@Z ?FirstChildElement@TiXmlNode@@QBEPBVTiXmlElement@@XZ ?GetChar@TiXmlBase@@KAPBDPBDPADPAHW4TiXmlEncoding@@@Z ?GetDocument@TiXmlNode@@QAEPAVTiXmlDocument@@XZ ?GetDocument@TiXmlNode@@QBEPBVTiXmlDocument@@XZ ?GetEntity@TiXmlBase@@KAPBDPBDPADPAHW4TiXmlEncoding@@@Z ?GetText@TiXmlElement@@QBEPBDXZ ?GetUserData@TiXmlBase@@QAEPAXXZ ?GetUserData@TiXmlBase@@QBEPBXXZ ?Identify@TiXmlNode@@IAEPAV1@PBDW4TiXmlEncoding@@@Z ?Indent@TiXmlPrinter@@QAEPBDXZ ?InsertAfterChild@TiXmlNode@@QAEPAV1@PAV1@ABV1@@Z ?InsertBeforeChild@TiXmlNode@@QAEPAV1@PAV1@ABV1@@Z ?InsertEndChild@TiXmlNode@@QAEPAV1@ABV1@@Z ?IntValue@TiXmlAttribute@@QBEHXZ ?IsAlpha@TiXmlBase@@KAHEW4TiXmlEncoding@@@Z ?IsAlphaNum@TiXmlBase@@KAHEW4TiXmlEncoding@@@Z ?IsWhiteSpace@TiXmlBase@@KA_ND@Z ?IsWhiteSpace@TiXmlBase@@KA_NH@Z ?IsWhiteSpaceCondensed@TiXmlBase@@SA_NXZ ?IterateChildren@TiXmlNode@@QAEPAV1@PBDPBV1@@Z ?IterateChildren@TiXmlNode@@QAEPAV1@PBV1@@Z ?IterateChildren@TiXmlNode@@QBEPBV1@PBDPBV1@@Z ?IterateChildren@TiXmlNode@@QBEPBV1@PBV1@@Z ?Last@TiXmlAttributeSet@@QAEPAVTiXmlAttribute@@XZ ?Last@TiXmlAttributeSet@@QBEPBVTiXmlAttribute@@XZ ?LastAttribute@TiXmlElement@@QAEPAVTiXmlAttribute@@XZ ?LastAttribute@TiXmlElement@@QBEPBVTiXmlAttribute@@XZ ?LastChild@TiXmlNode@@QAEPAV1@PBD@Z ?LastChild@TiXmlNode@@QAEPAV1@XZ ?LastChild@TiXmlNode@@QBEPBV1@PBD@Z ?LastChild@TiXmlNode@@QBEPBV1@XZ ?LineBreak@TiXmlPrinter@@QAEPBDXZ ?LinkEndChild@TiXmlNode@@QAEPAV1@PAV1@@Z ?LoadFile@TiXmlDocument@@QAE_NPAU_iobuf@@W4TiXmlEncoding@@@Z ?LoadFile@TiXmlDocument@@QAE_NPB_WW4TiXmlEncoding@@@Z ?LoadXML@TiXmlDocument@@QAE_NPADHW4TiXmlEncoding@@@Z ?Name@TiXmlAttribute@@QBEPBDXZ ?NameTStr@TiXmlAttribute@@QBEABVTiXmlString@@XZ ?Next@TiXmlAttribute@@QAEPAV1@XZ ?Next@TiXmlAttribute@@QBEPBV1@XZ ?NextSibling@TiXmlNode@@QAEPAV1@PBD@Z ?NextSibling@TiXmlNode@@QAEPAV1@XZ ?NextSibling@TiXmlNode@@QBEPBV1@PBD@Z ?NextSibling@TiXmlNode@@QBEPBV1@XZ ?NextSiblingElement@TiXmlNode@@QAEPAVTiXmlElement@@PBD@Z ?NextSiblingElement@TiXmlNode@@QAEPAVTiXmlElement@@XZ ?NextSiblingElement@TiXmlNode@@QBEPBVTiXmlElement@@PBD@Z ?NextSiblingElement@TiXmlNode@@QBEPBVTiXmlElement@@XZ ?NoChildren@TiXmlNode@@QBE_NXZ ?Parent@TiXmlNode@@QAEPAV1@XZ ?Parent@TiXmlNode@@QBEPBV1@XZ ?Parse@TiXmlAttribute@@UAEPBDPBDPAVTiXmlParsingData@@W4TiXmlEncoding@@@Z ?Parse@TiXmlComment@@UAEPBDPBDPAVTiXmlParsingData@@W4TiXmlEncoding@@@Z ?Parse@TiXmlDeclaration@@UAEPBDPBDPAVTiXmlParsingData@@W4TiXmlEncoding@@@Z ?Parse@TiXmlDocument@@UAEPBDPBDPAVTiXmlParsingData@@W4TiXmlEncoding@@@Z ?Parse@TiXmlElement@@UAEPBDPBDPAVTiXmlParsingData@@W4TiXmlEncoding@@@Z ?Parse@TiXmlText@@UAEPBDPBDPAVTiXmlParsingData@@W4TiXmlEncoding@@@Z ?Parse@TiXmlUnknown@@UAEPBDPBDPAVTiXmlParsingData@@W4TiXmlEncoding@@@Z ?Previous@TiXmlAttribute@@QAEPAV1@XZ ?Previous@TiXmlAttribute@@QBEPBV1@XZ ?PreviousSibling@TiXmlNode@@QAEPAV1@PBD@Z ?PreviousSibling@TiXmlNode@@QAEPAV1@XZ ?PreviousSibling@TiXmlNode@@QBEPBV1@PBD@Z ?PreviousSibling@TiXmlNode@@QBEPBV1@XZ ?Print@TiXmlAttribute@@QBEXPAU_iobuf@@HPAVTiXmlString@@@Z ?Print@TiXmlAttribute@@UBEXPAU_iobuf@@H@Z ?Print@TiXmlComment@@UBEXPAU_iobuf@@H@Z ?Print@TiXmlDeclaration@@UBEXPAU_iobuf@@H@Z ?Print@TiXmlDeclaration@@UBEXPAU_iobuf@@HPAVTiXmlString@@@Z ?Print@TiXmlDocument@@QBEXXZ ?Print@TiXmlDocument@@UBEXPAU_iobuf@@H@Z ?Print@TiXmlElement@@UBEXPAU_iobuf@@H@Z ?Print@TiXmlText@@UBEXPAU_iobuf@@H@Z ?Print@TiXmlUnknown@@UBEXPAU_iobuf@@H@Z ?QueryDoubleAttribute@TiXmlElement@@QBEHPBDPAN@Z ?QueryDoubleValue@TiXmlAttribute@@QBEHPAN@Z ?QueryFloatAttribute@TiXmlElement@@QBEHPBDPAM@Z ?QueryIntAttribute@TiXmlElement@@QBEHPBDPAH@Z ?QueryIntValue@TiXmlAttribute@@QBEHPAH@Z ?ReadName@TiXmlBase@@KAPBDPBDPAVTiXmlString@@W4TiXmlEncoding@@@Z ?ReadText@TiXmlBase@@KAPBDPBDPAVTiXmlString@@_N02W4TiXmlEncoding@@@Z ?ReadValue@TiXmlElement@@IAEPBDPBDPAVTiXmlParsingData@@W4TiXmlEncoding@@@Z ?Remove@TiXmlAttributeSet@@QAEXPAVTiXmlAttribute@@@Z ?RemoveAttribute@TiXmlElement@@QAEXPBD@Z ?RemoveChild@TiXmlNode@@QAE_NPAV1@@Z ?ReplaceChild@TiXmlNode@@QAEPAV1@PAV1@ABV1@@Z ?RootElement@TiXmlDocument@@QAEPAVTiXmlElement@@XZ ?RootElement@TiXmlDocument@@QBEPBVTiXmlElement@@XZ ?Row@TiXmlBase@@QBEHXZ ?SaveFile@TiXmlDocument@@QBE_NPAU_iobuf@@@Z ?SaveFile@TiXmlDocument@@QBE_NPB_W@Z ?SetAttribute@TiXmlElement@@QAEXPBD0@Z ?SetAttribute@TiXmlElement@@QAEXPBDH@Z ?SetCDATA@TiXmlText@@QAEX_N@Z ?SetCondenseWhiteSpace@TiXmlBase@@SAX_N@Z ?SetDocument@TiXmlAttribute@@QAEXPAVTiXmlDocument@@@Z ?SetDoubleAttribute@TiXmlElement@@QAEXPBDN@Z ?SetDoubleValue@TiXmlAttribute@@QAEXN@Z ?SetError@TiXmlDocument@@QAEXHPBDPAVTiXmlParsingData@@W4TiXmlEncoding@@@Z ?SetIndent@TiXmlPrinter@@QAEXPBD@Z ?SetIntValue@TiXmlAttribute@@QAEXH@Z ?SetLineBreak@TiXmlPrinter@@QAEXPBD@Z ?SetName@TiXmlAttribute@@QAEXPBD@Z ?SetStreamPrinting@TiXmlPrinter@@QAEXXZ ?SetTabSize@TiXmlDocument@@QAEXH@Z ?SetUserData@TiXmlBase@@QAEXPAX@Z ?SetValue@TiXmlAttribute@@QAEXPBD@Z ?SetValue@TiXmlNode@@QAEXPBD@Z ?Size@TiXmlPrinter@@QAEIXZ ?SkipWhiteSpace@TiXmlBase@@KAPBDPBDW4TiXmlEncoding@@@Z ?Standalone@TiXmlDeclaration@@QBEPBDXZ ?StringEqual@TiXmlBase@@KA_NPBD0_NW4TiXmlEncoding@@@Z ?TabSize@TiXmlDocument@@QBEHXZ ?ToComment@TiXmlComment@@UAEPAV1@XZ ?ToComment@TiXmlComment@@UBEPBV1@XZ ?ToComment@TiXmlNode@@UAEPAVTiXmlComment@@XZ ?ToComment@TiXmlNode@@UBEPBVTiXmlComment@@XZ ?ToDeclaration@TiXmlDeclaration@@UAEPAV1@XZ ?ToDeclaration@TiXmlDeclaration@@UBEPBV1@XZ ?ToDeclaration@TiXmlNode@@UAEPAVTiXmlDeclaration@@XZ ?ToDeclaration@TiXmlNode@@UBEPBVTiXmlDeclaration@@XZ ?ToDocument@TiXmlDocument@@UAEPAV1@XZ ?ToDocument@TiXmlDocument@@UBEPBV1@XZ ?ToDocument@TiXmlNode@@UAEPAVTiXmlDocument@@XZ ?ToDocument@TiXmlNode@@UBEPBVTiXmlDocument@@XZ ?ToElement@TiXmlElement@@UAEPAV1@XZ ?ToElement@TiXmlElement@@UBEPBV1@XZ ?ToElement@TiXmlNode@@UAEPAVTiXmlElement@@XZ ?ToElement@TiXmlNode@@UBEPBVTiXmlElement@@XZ ?ToLower@TiXmlBase@@KAHHW4TiXmlEncoding@@@Z ?ToText@TiXmlNode@@UAEPAVTiXmlText@@XZ ?ToText@TiXmlNode@@UBEPBVTiXmlText@@XZ ?ToText@TiXmlText@@UAEPAV1@XZ ?ToText@TiXmlText@@UBEPBV1@XZ ?ToUnknown@TiXmlNode@@UAEPAVTiXmlUnknown@@XZ ?ToUnknown@TiXmlNode@@UBEPBVTiXmlUnknown@@XZ ?ToUnknown@TiXmlUnknown@@UAEPAV1@XZ ?ToUnknown@TiXmlUnknown@@UBEPBV1@XZ ?Type@TiXmlNode@@QBEHXZ ?Value@TiXmlAttribute@@QBEPBDXZ ?Value@TiXmlNode@@QBEPBDXZ ?ValueTStr@TiXmlNode@@QBEABVTiXmlString@@XZ ?Version@TiXmlDeclaration@@QBEPBDXZ ?Visit@TiXmlPrinter@@UAE_NABVTiXmlComment@@@Z ?Visit@TiXmlPrinter@@UAE_NABVTiXmlDeclaration@@@Z ?Visit@TiXmlPrinter@@UAE_NABVTiXmlText@@@Z ?Visit@TiXmlPrinter@@UAE_NABVTiXmlUnknown@@@Z ?VisitEnter@TiXmlPrinter@@UAE_NABVTiXmlDocument@@@Z ?VisitEnter@TiXmlPrinter@@UAE_NABVTiXmlElement@@PBVTiXmlAttribute@@@Z ?VisitExit@TiXmlPrinter@@UAE_NABVTiXmlDocument@@@Z ?VisitExit@TiXmlPrinter@@UAE_NABVTiXmlElement@@@Z ?condenseWhiteSpace@TiXmlBase@@0_NA ?entity@TiXmlBase@@0PAUEntity@1@A ?errorString@TiXmlBase@@1PAPBDA ?utf8ByteTable@TiXmlBase@@2QBHB DebugCreate

553fd99899eff49eb8cd3415cd8aa4f0_NeikiAnalytics.exe

kernel32

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

generic

Sharing

General

Malware Config

Signatures

File Explorer

553fd99899eff49eb8cd3415cd8aa4f0_NeikiAnalytics.exe

kernel32

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

generic