a0fb8f5c4306f8b50947aea97e9351c0_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
a0fb8f5c4306f8b50947aea97e9351c0_NeikiAnalytics.exe
Size 94KB
Sample240603-m3fc8acb2z
SHA256 65dc5181f5cc2e49ce02ebeb5662a8baff5a45ce2b7cbd7bf479b97e31ef6340
MD5 a0fb8f5c4306f8b50947aea97e9351c0
SHA1 b8b8b20e9ac94fb8ba673bb41b43dbd4ec2d1446
SHA512 a5bc413c53d2ddf5de01eef238c907a2f20b9d68f04b749917617689bafd0be08fa5d585b4b6e545b2b673b63716e927e873e36fd507ccbda5ad8a843e9ee8e8
SSDEEP 1536:NlCs0jZ5kcifdUW+kKbb3jbvo30P++b8hKEgG/y6ae/V6ON4Yj:6sYZxUdZDKf3ovgf6B/V6VU
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a0fb8f5c4306f8b50947aea97e9351c0_NeikiAnalytics.exe

File Explorer

a0fb8f5c4306f8b50947aea97e9351c0_NeikiAnalytics.exe

.exe 94KB

a0fb8f5c4306f8b50947aea97e9351c0_NeikiAnalytics.exe

IMPHASH 001f79fcd3f02e15b6ce3a0f62930c1c
SHA256 65dc5181f5cc2e49ce02ebeb5662a8baff5a45ce2b7cbd7bf479b97e31ef6340
MD5 a0fb8f5c4306f8b50947aea97e9351c0
SHA1 b8b8b20e9ac94fb8ba673bb41b43dbd4ec2d1446
SHA512 a5bc413c53d2ddf5de01eef238c907a2f20b9d68f04b749917617689bafd0be08fa5d585b4b6e545b2b673b63716e927e873e36fd507ccbda5ad8a843e9ee8e8
SSDEEP 1536:NlCs0jZ5kcifdUW+kKbb3jbvo30P++b8hKEgG/y6ae/V6ON4Yj:6sYZxUdZDKf3ovgf6B/V6VU
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

67856

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

dnsapi

DnsQuery_A DnsFree

secur32

ApplyControlToken InitializeSecurityContextA DecryptMessage EncryptMessage AcquireCredentialsHandleW FreeContextBuffer QueryContextAttributesW DeleteSecurityContext FreeCredentialsHandle InitializeSecurityContextW

shell32

SHGetFileInfoA ShellExecuteA SHGetSpecialFolderPathW

wininet

InternetQueryDataAvailable HttpQueryInfoA InternetOpenUrlA InternetOpenA HttpQueryInfoW InternetQueryOptionW InternetCloseHandle InternetReadFile

shlwapi

PathAppendW StrStrIA PathAppendA PathFindExtensionA

ws2_32

closesocket connect htons send WSAStartup WSACleanup inet_addr inet_ntoa WSAGetLastError recv setsockopt ioctlsocket select ntohs gethostbyname sendto getpeername socket

msvcrt

strncat isalnum vsprintf strrchr toupper strncmp memmove isxdigit _strnicmp ??2@YAPAXI@Z _snwprintf strchr strtok _stricmp _vsnprintf _wcsnicmp _memicmp strncpy sprintf _snprintf printf _strcmpi sscanf atoi ??3@YAXPAX@Z wcsrchr strstr wcsstr memset

kernel32

GetWindowsDirectoryA GetModuleFileNameA OpenMutexA GetLogicalDriveStringsA CreateDirectoryA GetFileSize LockFile SetCurrentDirectoryA FindFirstFileA FindNextFileA FindClose CopyFileW FlushFileBuffers GetLocaleInfoA GetVolumeInformationW lstrcatA ExitProcess CreateProcessW VirtualAlloc DeviceIoControl SetFilePointer lstrcpynA LocalAlloc LocalFree lstrcpyW SetFileAttributesA DeleteFileA lstrcpynW lstrcatW GetTempFileNameW DeleteFileW GetWindowsDirectoryW CreateThread InterlockedCompareExchange GetModuleFileNameW GetVersionExA CreateMutexA UnmapViewOfFile InterlockedIncrement CreateFileMappingA OpenFileMappingA MapViewOfFile ReleaseMutex WaitForSingleObject OpenProcess CreateRemoteThread IsWow64Process VirtualAllocEx VirtualFreeEx CreateFileA WaitForMultipleObjects GetOverlappedResult DisconnectNamedPipe lstrcpyA MoveFileExA lstrcmpA WideCharToMultiByte MoveFileExW lstrcmpW ExitThread MultiByteToWideChar GetFileAttributesA SetFileAttributesW GetFileAttributesW LoadLibraryW CloseHandle SetFileTime CreateFileW GetFileTime GetSystemTimeAsFileTime WriteFile GetModuleHandleW GetLastError ReadFile GetTickCount HeapAlloc GetProcessHeap HeapFree lstrlenA Sleep WriteProcessMemory ReadProcessMemory InitializeCriticalSection LeaveCriticalSection EnterCriticalSection HeapReAlloc SetEvent ConnectNamedPipe CreateNamedPipeA CreateEventA

user32

RegisterClassExA CreateWindowExA RegisterDeviceNotificationA GetMessageA TranslateMessage DispatchMessageA DefWindowProcA wsprintfW wvsprintfA MessageBoxA

advapi32

RegSetValueExW CryptDestroyHash CryptHashData RegOpenKeyExA RegSetValueExA RegNotifyChangeKeyValue RegCreateKeyExW CryptGetHashParam RegCloseKey OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges CryptAcquireContextA CryptCreateHash CryptReleaseContext

ole32

CoInitialize CoCreateInstance