a5c4bf9df211b323e9fad0f049a368b0_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
a5c4bf9df211b323e9fad0f049a368b0_NeikiAnalytics.exe
Size 4.2MB
Sample240603-rc1npagh51
SHA256 0470001910e45be090093bd876b505df28cb8265c086a97331670a10634efe13
MD5 a5c4bf9df211b323e9fad0f049a368b0
SHA1 44e691c5bd24b30b7b995e69dfd062ba5c880266
SHA512 e39bda63adbb3133307e8af5b2ddf0aefed241921392b2186b04f507551dffcb7ef5cc3d5d04cb8a8b285619067acf47a311ea43c80f0da6bbf6bc03060062d8
SSDEEP 49152:BIH080XuWKBk6ZcyjJJVSL6VlIWi7C2nDTp402U/Gn3ucfH9EMDLSjwMUskHAOhN:xuXBekJVI6iC2DTpMuumjwMUsk1/
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a5c4bf9df211b323e9fad0f049a368b0_NeikiAnalytics.exe

File Explorer

a5c4bf9df211b323e9fad0f049a368b0_NeikiAnalytics.exe

.exe 4.2MB

a5c4bf9df211b323e9fad0f049a368b0_NeikiAnalytics.exe

IMPHASH f8077778452df96cff92fb34fe332e80
SHA256 0470001910e45be090093bd876b505df28cb8265c086a97331670a10634efe13
MD5 a5c4bf9df211b323e9fad0f049a368b0
SHA1 44e691c5bd24b30b7b995e69dfd062ba5c880266
SHA512 e39bda63adbb3133307e8af5b2ddf0aefed241921392b2186b04f507551dffcb7ef5cc3d5d04cb8a8b285619067acf47a311ea43c80f0da6bbf6bc03060062d8
SSDEEP 49152:BIH080XuWKBk6ZcyjJJVSL6VlIWi7C2nDTp402U/Gn3ucfH9EMDLSjwMUskHAOhN:xuXBekJVI6iC2DTpMuumjwMUsk1/
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

224168

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

D:\dbs\sh\ddvsm\0128_230433\cmd\2z\out\binaries\x86ret\bin\i386\Opt\rdajgpzw.d3y\Output\msvsmon.pdb

kernel32

FreeLibrary LoadLibraryW GetComputerNameExW GetVersionExW LoadLibraryExW LocalFree GetCurrentThreadId Sleep UnmapViewOfFile CreateEventW CreateFileMappingW MapViewOfFile GetCurrentProcessId SetEvent WaitForMultipleObjectsEx GetExitCodeProcess TerminateProcess OpenProcess MultiByteToWideChar CreateThread WaitForSingleObject GetExitCodeThread GetTempPathW GetModuleFileNameW GetFileAttributesW InterlockedExchange SwitchToThread InterlockedCompareExchange GetTickCount CreateFileW GetFileSize ReadFile FindFirstFileExW FindNextFileW FindClose HeapSetInformation SetErrorMode CreateNamedPipeW WriteFile FlushFileBuffers InitializeCriticalSectionEx DisconnectNamedPipe CancelSynchronousIo GetProcessId GetCommandLineW OpenEventW SetEnvironmentVariableW WideCharToMultiByte LocalAlloc GetDateFormatW GetTimeFormatW GlobalFree GlobalAlloc GlobalLock GlobalUnlock GetLocalTime ExpandEnvironmentStringsW GetThreadLocale RaiseException lstrcmpiW SizeofResource LoadResource FindResourceW QueryFullProcessImageNameW GetLongPathNameW GetThreadContext GetCurrentThread SetLastError SetUnhandledExceptionFilter SetThreadPriority SuspendThread IsDebuggerPresent DecodePointer GetFileInformationByHandle DeleteCriticalSection GetProcAddress GetModuleHandleW LeaveCriticalSection EnterCriticalSection InterlockedDecrement InterlockedIncrement ResumeThread CreateProcessW ConnectNamedPipe MulDiv GetCurrentProcess GetSystemDirectoryW FindFirstFileW FormatMessageA GetComputerNameW IsWow64Process GetVersion OpenFileMappingW WriteProcessMemory VirtualAllocEx DeleteFileW WaitForMultipleObjects SetThreadAffinityMask GetProcessAffinityMask GetThreadPriority SetFilePointer RegisterWaitForSingleObject UnregisterWaitEx QueueUserWorkItem OpenThread ResetEvent GetEnvironmentVariableW InitializeCriticalSection lstrcmpW FormatMessageW GetEnvironmentVariableA VirtualAlloc VirtualFree GetVersionExA FindResourceExW LockResource FindResourceA IsDBCSLeadByte lstrcmpiA GetModuleHandleA WriteConsoleW ReadConsoleW SetEndOfFile SetFilePointerEx GetConsoleMode GetConsoleCP SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA OutputDebugStringW GetStringTypeW GetFileType GetACP GetModuleHandleExW ExitProcess GetModuleFileNameA GetStdHandle TlsFree CompareStringOrdinal TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer RtlUnwind GetStartupInfoW InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter IsProcessorFeaturePresent UnhandledExceptionFilter LoadLibraryExA VirtualQuery VirtualProtect GetSystemInfo SetHandleInformation DuplicateHandle GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy CloseHandle UpdateProcThreadAttribute DeleteProcThreadAttributeList InitializeProcThreadAttributeList GetLastError

vsdebugeng

DkmDllEnsureInitialized DkmDllSetRootProcessId DkmDllUninitialize ProcDkmString3

gdiplus

GdiplusShutdown

user32

GetDlgItem EnableWindow CheckDlgButton GetWindowLongW SendMessageW SetWindowLongW EndDialog SetDlgItemTextW DialogBoxParamW SetDlgItemInt GetDlgItemInt SetCursor ReleaseDC GetDC CharUpperBuffW PeekMessageW PostThreadMessageW LoadStringW PeekMessageA CharNextA MessageBoxW OpenClipboard CharNextW KillTimer SetTimer TrackPopupMenu GetCursorPos SetMenuDefaultItem GetSubMenu PostMessageW PostQuitMessage CloseClipboard SetClipboardData EmptyClipboard SetFocus GetSystemMetrics SetMenu LoadMenuW DefWindowProcW MoveWindow DestroyWindow RegisterClassW LoadIconW EnableMenuItem GetMenu SetForegroundWindow DispatchMessageW TranslateMessage TranslateAcceleratorW GetMessageW LoadAcceleratorsW UpdateWindow CreateWindowExW DestroyMenu CheckRadioButton SetWindowTextW GetParent NotifyWinEvent ShowWindow LoadCursorW

oleaut32

VarUI2FromDec VarUI4FromDec VarR4FromDec VarR8FromDec VarDecAdd VarDecSu VarDecMul VarDecDiv VarDecCmp VarBstrCmp VariantCopy SafeArrayCreate SafeArrayAccessData SafeArrayUnaccessData SafeArrayDestroy SafeArrayRedim VariantChangeType CreateErrorInfo SysAllocString VarUI1FromDec VarI1FromDec VarDecFix VarDecFromR8 VarDecFromR4 VarDecFromUI4 VarDecFromI4 GetErrorInfo VarI4FromDec VarBstrFromDec VarR8FromStr SetErrorInfo VarUI4FromStr VariantClear VarI2FromDec SysFreeString SysStringLen SysAllocStringByteLen SysStringByteLen VarBstrCat VariantInit SysAllocStringLen

comctl32

ord17

ws2_32

inet_addr ntohs getsockname bind htonl closesocket setsockopt socket htons WSAStartup WSAGetLastError

gdi32

DeleteDC GetDeviceCaps SelectObject

generic

count=4, id=188, version=30716,

count=14, id=261, version=30034,

count=2, id=206, version=65500,

count=1, id=260, version=25025,

count=2, id=257, version=30146,

count=16, id=260, productName=VS2019 v16.9.5 build 29915, version=29915,

count=15, id=241, version=40116,

count=164, id=243, version=40116,

count=26, id=242, version=40116,

count=19, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,

count=24, id=259, productName=VS2019 v16.9.2 build 29913, version=29913,

count=182, id=261, productName=VS2019 v16.9.5 build 29915, version=29915,

count=55, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,

count=15, id=185, version=30716,

count=527, id=1, productName=Unmarked objects,

count=1, id=259, productName=VS2019 v16.9.5 build 29915, version=29915,

count=207, id=265, version=29915,

count=1, id=256, productName=VS2019 v16.9.5 build 29915, version=29915,

count=1, id=255, productName=VS2019 v16.9.5 build 29915, version=29915,

count=1, id=258, productName=VS2019 v16.9.5 build 29915, version=29915,