43512bed57f6de996215e0815f9b2850_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
43512bed57f6de996215e0815f9b2850_NeikiAnalytics.exe
Size 8.0MB
Sample240603-ta18jsbd7w
SHA256 6f7fe9c8beea40619b6592f76afa17b9ac99daf2fbd45cdaede24f1fe21892d9
MD5 43512bed57f6de996215e0815f9b2850
SHA1 51dc6650892d959308e0dbfea8cc61d907cd5d01
SHA512 c8a5581f07e4e721b3bd91abffe5d9d566c76fc01338df3dbc1d5fa5458ca3d64ab5fcc0c77889db3e09de91cab8787cad0ecf6f4c4dae375b9f428269bdadf2
SSDEEP 98304:k6ds+0HDuwSv/1duQfuGAT/xTa1mI9u/A9rkEn4ZeOyhDfXIn2Lhdfu1XuoXcBPe:kASgKGub/o1mE+A1kEK2PmafsXcQonJ8
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
43512bed57f6de996215e0815f9b2850_NeikiAnalytics.exe

File Explorer

43512bed57f6de996215e0815f9b2850_NeikiAnalytics.exe

.exe 8.0MB

43512bed57f6de996215e0815f9b2850_NeikiAnalytics.exe

IMPHASH 44bba91bbe0dbbf7ddda1aaeca21a456
SHA256 6f7fe9c8beea40619b6592f76afa17b9ac99daf2fbd45cdaede24f1fe21892d9
MD5 43512bed57f6de996215e0815f9b2850
SHA1 51dc6650892d959308e0dbfea8cc61d907cd5d01
SHA512 c8a5581f07e4e721b3bd91abffe5d9d566c76fc01338df3dbc1d5fa5458ca3d64ab5fcc0c77889db3e09de91cab8787cad0ecf6f4c4dae375b9f428269bdadf2
SSDEEP 98304:k6ds+0HDuwSv/1duQfuGAT/xTa1mI9u/A9rkEn4ZeOyhDfXIn2Lhdfu1XuoXcBPe:kASgKGub/o1mE+A1kEK2PmafsXcQonJ8
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

90820

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

g:\Company\PCProject\Common\Temp\Release\InstallPreinst.pdb

shlwapi

PathFileExistsW

kernel32

LoadLibraryW GetCurrentProcess DeleteFileW Sleep CloseHandle WriteFile CreateFileW SizeofResource LockResource LoadResource FindResourceW GetTempPathW CreateDirectoryW MultiByteToWideChar GetTickCount CreateProcessW WaitForSingleObject GetLastError GetProcAddress MoveFileExW FormatMessageW CreateMutexW ReleaseMutex CreateThread GetFullPathNameA GetFileInformationByHandle ExitThread FindFirstFileA GetDriveTypeA FreeLibrary GetModuleFileNameW FindFirstFileW FindNextFileW FindClose GetPrivateProfileStringW WritePrivateProfileStringW AreFileApisANSI WideCharToMultiByte GetCurrentDirectoryA TlsSetValue FileTimeToLocalFileTime FileTimeToSystemTime ExpandEnvironmentStringsW WaitForMultipleObjects PeekNamedPipe GetSystemDirectoryA SleepEx InterlockedIncrement InterlockedDecrement InterlockedExchange InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection HeapAlloc HeapFree GetSystemTimeAsFileTime RtlUnwind TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RaiseException MoveFileW GetVersionExA GetProcessHeap GetStartupInfoW LCMapStringA LCMapStringW GetCPInfo VirtualFree VirtualAlloc HeapReAlloc HeapDestroy HeapCreate GetModuleHandleA ExitProcess GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsFree SetLastError GetCurrentThreadId ReadFile GetConsoleCP GetConsoleMode SetHandleCount GetFileType GetStartupInfoA SetFilePointer GetACP GetOEMCP GetTimeZoneInformation GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale IsValidCodePage GetStringTypeA GetStringTypeW HeapSize FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCommandLineW QueryPerformanceCounter GetCurrentProcessId LoadLibraryA CreateFileA SetStdHandle FlushFileBuffers WriteConsoleA GetConsoleOutputCP WriteConsoleW GetLocaleInfoW SetEndOfFile CompareStringA CompareStringW SetEnvironmentVariableA

advapi32

RegQueryValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey RegSetValueExW

shell32

ShellExecuteW SHGetSpecialFolderPathW

ole32

CoInitialize OleUninitialize

ws2_32

sendto recvfrom recv listen getservbyport select ioctlsocket gethostname gethostbyaddr getservbyname htonl inet_ntoa gethostbyname inet_addr WSASetLastError connect setsockopt getpeername getsockopt htons bind ntohs getsockname __WSAFDIsSet send socket closesocket WSAGetLastError WSAStartup WSACleanup accept

wldap32

ord14 ord145 ord216 ord208 ord26 ord133 ord127 ord142 ord79 ord147 ord167 ord301 ord27 ord41 ord46 ord118