04e782760e3c872b15519096b43d5130_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

04e782760e3c872b15519096b43d5130_NeikiAnalytics.exe
Size

21KB
MD5

04e782760e3c872b15519096b43d5130
SHA1

82c727f758fcd4713f89f584a13c756458f732e6
SHA256

a6b942bed1646a2ab463df2ce0d893c7c02ed39ebeb862e03386d683acf2c414
SHA512

eaf095a619a1e5a9c4b5991a37060968b5b9a6c35b8710f33a9fe40fa08ccceb16d7f089700a21a42abb1549c760fd6c4eea8cb35e7e3adad0f456d5dbf0875f
SSDEEP

384:atXr3dYYPBI72Sv2/knIhDiplsPLgYh8+8q5wg5w4I46kh4AOAIqmB:a5dQZ4af7kM8x5wg5w4I46sQqs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
04e782760e3c872b15519096b43d5130_NeikiAnalytics.exe

Files

04e782760e3c872b15519096b43d5130_NeikiAnalytics.exe
.dll windows:6 windows x64 arch:x64

f4d115a011567fb7c8f008c63f289e84

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\build24\httpd-2.4.53-x64\modules\session\Release\mod_session.pdb

Imports

libapr-1

apr_strtok
apr_psprintf
apr_pstrdup
apr_table_do
apr_table_unset
apr_table_setn
apr_atoi64
apr_time_now
apr_table_get
apr_table_make
apr_array_append
apr_array_push
apr_array_make
apr_palloc
apr_table_set

libaprutil-1

apr_dynamic_fn_register
apr_hook_debug_show
apr_hook_sort_register
apr_hook_debug_enabled
apr_hook_debug_current
apr_hook_global_pool

libhttpd

ap_log_rerror_
ap_hook_insert_filter
ap_add_output_filter
ap_register_output_filter
ap_pass_brigade
ap_escape_urlencoded_buffer
ap_unescape_urlencoded
ap_hook_fixups
ap_hook_insert_error_filter
ap_remove_output_filter

vcruntime140

__std_type_info_destroy_list
__C_specific_handler
memset

api-ms-win-crt-string-l1-1-0

strncmp

api-ms-win-crt-convert-l1-1-0

atol
atoi

api-ms-win-crt-runtime-l1-1-0

_execute_onexit_table
_initialize_onexit_table
_seh_filter_dll
_initterm_e
_initterm
_cexit
_configure_narrow_argv
_initialize_narrow_environment

kernel32

RtlLookupFunctionEntry
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
QueryPerformanceCounter
RtlCaptureContext
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId

Exports

Exports

ap_hook_get_session_decode
ap_hook_get_session_encode
ap_hook_get_session_load
ap_hook_get_session_save
ap_hook_session_decode
ap_hook_session_encode
ap_hook_session_load
ap_hook_session_save
ap_run_session_decode
ap_run_session_encode
ap_run_session_load
ap_run_session_save
session_module

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 344B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 876B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 84B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f4d115a011567fb7c8f008c63f289e84

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

libapr-1

libaprutil-1

libhttpd

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

kernel32

Exports

Exports

Sections

.text Size: 8KB - Virtual size: 8KB

.rdata Size: 7KB - Virtual size: 7KB

.data Size: 512B - Virtual size: 344B

.pdata Size: 1024B - Virtual size: 876B

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 512B - Virtual size: 84B

.text
Size: 8KB - Virtual size: 8KB

.rdata
Size: 7KB - Virtual size: 7KB

.data
Size: 512B - Virtual size: 344B

.pdata
Size: 1024B - Virtual size: 876B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 512B - Virtual size: 84B