9ead5d837b1228c8462fb7524f5ddab0_NeikiAnalytics[.]exe | Triage

Sharing

General

Target

9ead5d837b1228c8462fb7524f5ddab0_NeikiAnalytics.exe
Size

5.7MB
MD5

9ead5d837b1228c8462fb7524f5ddab0
SHA1

8a5f21e9ae6333c62de86350882ec146e2b6d570
SHA256

bc2068ff282a5057822e21a59b74b4f6e65b0002b7712bc37293257345795f6e
SHA512

a817b47c4a3571b7b38015fecab6953502cca8b48b96ccb277b103756e0856b226df09294405daa608c4a58543d55b90b2477d2aef478453b56aee8fad26da25
SSDEEP

98304:z04VhN/AF1O+hyaf8UkTsUAc9HZKbaI0b4ekMZcGEjIC0OG/iyAC8LR34Z:z0WxAF1OAyaf8MUAGZAajEMdOQi5PI

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9ead5d837b1228c8462fb7524f5ddab0_NeikiAnalytics.exe

Files

9ead5d837b1228c8462fb7524f5ddab0_NeikiAnalytics.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 601KB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 1.8MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 575KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 61KB - Virtual size: 299KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.imports
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 284KB - Virtual size: 284KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 3.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ