a1a70c97ec7f7c48cc35e7357cac9890_NeikiAnalytics[.]exe

General

Target
a1a70c97ec7f7c48cc35e7357cac9890_NeikiAnalytics.exe
Size 1.6MB
Sample240603-ngv28aea32
SHA256 d21f280e6f47985a54377251364f1c409691d3102d71c739df68179219b50bc8
MD5 a1a70c97ec7f7c48cc35e7357cac9890
SHA1 d2d81e490412dc6d847109eca74cf3a1234cba44
SHA512 95b1e4925b6496fb7b71427bf386b237dc57449a898133ea649dfee3f9b57428755c8efdf969fd7464a86cf6ff1014a702b28ce7d834c79dd1d5787294499c2f
SSDEEP 49152:Wd2Cq2JAi9tsKSDAwOdo0zegOxKl5G+1ps:nCqirtV5SsegOxZ+1ps
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a1a70c97ec7f7c48cc35e7357cac9890_NeikiAnalytics.exe

File Explorer

a1a70c97ec7f7c48cc35e7357cac9890_NeikiAnalytics.exe

.dll 1.6MB

a1a70c97ec7f7c48cc35e7357cac9890_NeikiAnalytics.exe

IMPHASH 7e3ccf50c08bdce11bf1d3cdf5866c06
SHA256 d21f280e6f47985a54377251364f1c409691d3102d71c739df68179219b50bc8
MD5 a1a70c97ec7f7c48cc35e7357cac9890
SHA1 d2d81e490412dc6d847109eca74cf3a1234cba44
SHA512 95b1e4925b6496fb7b71427bf386b237dc57449a898133ea649dfee3f9b57428755c8efdf969fd7464a86cf6ff1014a702b28ce7d834c79dd1d5787294499c2f
SSDEEP 49152:Wd2Cq2JAi9tsKSDAwOdo0zegOxKl5G+1ps:nCqirtV5SsegOxZ+1ps
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

5472

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Name

.text

Size

32KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

536KB

Virtual Size

536KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

4KB

Virtual Size

4B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=71, id=221, productName=VS2013 build 21005, version=21005,

count=52, id=257, productName=VS2015 [14.0] build 23026, version=23026,

count=309, id=125, productName=VS2005 build 50727, version=50727,

count=366, id=1, productName=Unmarked objects,

count=26, id=205, productName=VS2012 UPD1 build 51106, version=51106,

count=400, id=155, productName=VS2010 SP1 build 40219, version=40219,

count=167, id=203, productName=VS2012 UPD3 build 60610, version=60610,

count=64, id=225, productName=VS2013 build 21005, version=21005,

count=475, id=225, productName=VS2013 UPD5 build 40629, version=40629,

count=131, id=156, productName=VS2010 SP1 build 40219, version=40219,

count=35, id=260, productName=VS2017 v15.5.4 build 25834, version=25834,

count=124, id=204, productName=VS2012 UPD1 build 51106, version=51106,

count=192, id=203, productName=VS2012 UPD4 build 61030, version=61030,

count=460, id=202, productName=VS2012 UPD1 build 51106, version=51106,

count=140, id=220, productName=VS2013 build 21005, version=21005,

count=102, id=259, productName=VS2015 [14.0] build 23026, version=23026,

count=13, id=225, productName=VS2013 UPD5 build 40629, version=40629,

count=130, id=206, productName=VS2012 UPD2 build 60315, version=60315,

count=462, id=154, productName=VS2010 SP1 build 40219, version=40219,

count=170, id=221, productName=VS2013 build 21005, version=21005,

count=365, id=224, productName=VS2013 UPD4 build 31101, version=31101,

count=501, id=221, productName=VS2013 UPD2 build 30501, version=30501,

count=318, id=145, productName=VS2008 SP1 build 30729, version=30729,

count=407, id=257, productName=VS2015 UPD3 build 24213, version=24213,

count=282, id=206, productName=VS2012 UPD1 build 51106, version=51106,

count=500, id=258, productName=VS2017 v15.5.4 build 25834, version=25834,

count=480, id=224, productName=VS2013 UPD5 build 40629, version=40629,

count=252, id=205, productName=VS2012 UPD2 build 60315, version=60315,

count=38, id=225, productName=VS2013 UPD3 build 30723, version=30723,

count=304, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,

a1a70c97ec7f7c48cc35e7357cac9890_NeikiAnalytics.exe

shlwapi

user32

gdi32

kernel32

ole32

generic

Sharing

General

Malware Config

Signatures

File Explorer

a1a70c97ec7f7c48cc35e7357cac9890_NeikiAnalytics.exe

shlwapi

user32

gdi32

kernel32

ole32

generic