04a1aff2a2d4d2b44119d2e48a0d9c70_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
04a1aff2a2d4d2b44119d2e48a0d9c70_NeikiAnalytics.exe
Size 1.3MB
Sample240603-1b8gkshf3w
SHA256 434fd08e50ef914d58065d5c01ef211f9afbb7683f5dbb27d859ff943d023843
MD5 04a1aff2a2d4d2b44119d2e48a0d9c70
SHA1 44dd9a71fe1c12aebe07713936dd22595ce964a7
SHA512 387ba0298371f2cf0c931e47cc6e30073852159f4c98a45db7adc32065477b22808a5a0b916604f75637191cef0a75b381c5acd9cd589684cb5380c58deabf7f
SSDEEP 12288:Lqz2DWUl83AZQxPq4yqZ+kM4rGwSvyaY9S/TG50IevAs7q6s9UtcQhOUVNH:mz2DWvNxPq4yqF9p9OTG6WiqUtcQX
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
04a1aff2a2d4d2b44119d2e48a0d9c70_NeikiAnalytics.exe

File Explorer

04a1aff2a2d4d2b44119d2e48a0d9c70_NeikiAnalytics.exe

.exe 1.3MB

04a1aff2a2d4d2b44119d2e48a0d9c70_NeikiAnalytics.exe

IMPHASH c54f40d6023142651a792ae38ae262de
SHA256 434fd08e50ef914d58065d5c01ef211f9afbb7683f5dbb27d859ff943d023843
MD5 04a1aff2a2d4d2b44119d2e48a0d9c70
SHA1 44dd9a71fe1c12aebe07713936dd22595ce964a7
SHA512 387ba0298371f2cf0c931e47cc6e30073852159f4c98a45db7adc32065477b22808a5a0b916604f75637191cef0a75b381c5acd9cd589684cb5380c58deabf7f
SSDEEP 12288:Lqz2DWUl83AZQxPq4yqZ+kM4rGwSvyaY9S/TG50IevAs7q6s9UtcQhOUVNH:mz2DWvNxPq4yqF9p9OTG6WiqUtcQX
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

30784

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

mscorsvw.pdb

mscoree

GetRequestedRuntimeInfo GetRealProcAddress

msvcr80

?_type_info_dtor_internal_method@type_info@@QEAAXXZ __crt_debugger_hook _decode_pointer _onexit _lock __dllonexit _unlock ?terminate@@YAXXZ __set_app_type _encode_pointer _fmode _commode __setusermatherr _configthreadlocale _initterm_e _initterm _acmdln exit _cexit _ismbblead _exit _XcptFilter __C_specific_handler __getmainargs _amsg_exit free malloc _vsnprintf _snwprintf_s wcstoul wcscat_s towupper _vsnwprintf_s _errno _vsnprintf_s strcpy_s wcsncpy_s wcscpy_s memmove _purecall _wcsicmp memcmp memcpy _CxxThrowException __CxxFrameHandler3 memset

advapi32

RegOpenKeyExA RegDeleteKeyW RegSetValueExW RegCreateKeyExW RegQueryValueExW RegOpenKeyExW RegCloseKey

kernel32

VirtualAlloc SleepEx ReleaseMutex CreateMutexW WaitForSingleObjectEx HeapFree GetProcessHeap HeapAlloc TlsFree TlsAlloc TlsSetValue ReleaseSemaphore CreateSemaphoreW ResetEvent DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection GetCurrentProcessId VirtualFree GetVersionExA RaiseException CloseHandle GetSystemTimeAsFileTime QueryPerformanceCounter GetCurrentThreadId VirtualQuery VirtualProtect HeapCreate HeapDestroy HeapValidate Sleep GetStartupInfoA SetUnhandledExceptionFilter GetTickCount UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext LoadLibraryExW GetCommandLineW GetCurrentProcess SetEvent GetModuleHandleW OpenProcess LoadLibraryW TerminateProcess GetModuleFileNameW GetProcAddress CreateEventW WaitForMultipleObjects IsDebuggerPresent OpenEventW DebugBreak CreateThread TlsGetValue FreeLibrary GetLastError SetLastError LocalFree MultiByteToWideChar GetACP GetCPInfo WideCharToMultiByte FormatMessageW GetEnvironmentVariableW lstrlenW

user32

LoadStringW PeekMessageW DispatchMessageW MessageBoxW MsgWaitForMultipleObjects

ole32

CoRegisterClassObject CoInitializeEx CoReleaseServerProcess CoAddRefServerProcess CoUninitialize CoRevokeClassObject

oleaut32

SetErrorInfo SysStringLen