7fdd0e2a53697962f8b18a5b8fdc2830_NeikiAnalytics[.]exe

General

Target
7fdd0e2a53697962f8b18a5b8fdc2830_NeikiAnalytics.exe
Size 580KB
Sample240603-s5we4sbc2t
SHA256 564df8f763b19ce31d714bd74ac6b2ecf60205f973ce976413c2792644a3f37b
MD5 7fdd0e2a53697962f8b18a5b8fdc2830
SHA1 913e64c192624f66eb1196259b49d2126839bf5f
SHA512 ceb2b68889acb23ccfb1ed9531195af2f03d84fb166bd4d682e2730bc8b7561b254dfa779303ef91fb81a56ce2ef39df137557942813d47fcbf923426efe6fa0
SSDEEP 12288:CrqMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3Xk:CrfSkQ/7Gb8NLEbeZw
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7fdd0e2a53697962f8b18a5b8fdc2830_NeikiAnalytics.exe

File Explorer

7fdd0e2a53697962f8b18a5b8fdc2830_NeikiAnalytics.exe

.exe 580KB

7fdd0e2a53697962f8b18a5b8fdc2830_NeikiAnalytics.exe

IMPHASH 7920b75022f464aca4fa63e046545d2b
SHA256 564df8f763b19ce31d714bd74ac6b2ecf60205f973ce976413c2792644a3f37b
MD5 7fdd0e2a53697962f8b18a5b8fdc2830
SHA1 913e64c192624f66eb1196259b49d2126839bf5f
SHA512 ceb2b68889acb23ccfb1ed9531195af2f03d84fb166bd4d682e2730bc8b7561b254dfa779303ef91fb81a56ce2ef39df137557942813d47fcbf923426efe6fa0
SSDEEP 12288:CrqMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3Xk:CrfSkQ/7Gb8NLEbeZw
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

5208

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\editbin.pdb

kernel32

GetCommandLineW GetCurrentProcess GetModuleHandleW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter TerminateProcess

vcruntime140

memset __current_exception __current_exception_context __C_specific_handler

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfwprintf __p__commode _set_fmode __acrt_iob_func

api-ms-win-crt-filesystem-l1-1-0

_wsplitpath_s _wmakepath_s

api-ms-win-crt-process-l1-1-0

_wspawnlp _wspawnl

api-ms-win-crt-runtime-l1-1-0

_exit _register_onexit_function __p___argc terminate exit _initterm_e _initterm _seh_filter_exe _register_thread_local_exe_atexit_callback _c_exit _cexit __p__wpgmptr _errno _crt_atexit _get_initial_wide_environment _initialize_wide_environment _configure_wide_argv __p___wargv _initialize_onexit_table _set_app_type

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

Name

.text

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

512B

Virtual Size

432B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

7fdd0e2a53697962f8b18a5b8fdc2830_NeikiAnalytics.exe

kernel32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-process-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic