4d46c34ad5085df64958ae866ae8e840_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
4d46c34ad5085df64958ae866ae8e840_NeikiAnalytics.exe
Size 43KB
Sample240603-y11rxshe72
SHA256 5fc1162bd3f2429f00668e5e0c4ca835a80df9fd64809afd9df3f830409ccfde
MD5 4d46c34ad5085df64958ae866ae8e840
SHA1 e5ae1284bd37717c969a87e6ec837081a2f77392
SHA512 77a7a12c546478f0ab5e4f618e422d8c3dd2d714bcf0b9251f126e512fff4276635f87f7b0692ec5a6b6f093421e77bb64e25db788483b5ac055ef72e59bab04
SSDEEP 768:2qs72PIb1bt/uRcp032F+DxxpxG7G5Hk8/RbIsZawlxE4N:eIIPuRcp032F+DbLCsZflxE4N
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4d46c34ad5085df64958ae866ae8e840_NeikiAnalytics.exe

File Explorer

4d46c34ad5085df64958ae866ae8e840_NeikiAnalytics.exe

.dll 43KB

4d46c34ad5085df64958ae866ae8e840_NeikiAnalytics.exe

IMPHASH b6429796b541e3f99fcb0b9939205770
SHA256 5fc1162bd3f2429f00668e5e0c4ca835a80df9fd64809afd9df3f830409ccfde
MD5 4d46c34ad5085df64958ae866ae8e840
SHA1 e5ae1284bd37717c969a87e6ec837081a2f77392
SHA512 77a7a12c546478f0ab5e4f618e422d8c3dd2d714bcf0b9251f126e512fff4276635f87f7b0692ec5a6b6f093421e77bb64e25db788483b5ac055ef72e59bab04
SSDEEP 768:2qs72PIb1bt/uRcp032F+DxxpxG7G5Hk8/RbIsZawlxE4N:eIIPuRcp032F+DbLCsZflxE4N
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

29328

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

embeddedmodesvcapi.pdb

api-ms-win-crt-runtime-l1-1-0

_initterm_e _initterm

api-ms-win-crt-private-l1-1-0

_o__callnewh _o__cexit _o__configure_narrow_argv _o__crt_atexit _o__errno _o__execute_onexit_table _o__initialize_narrow_environment _o__initialize_onexit_table _o__invalid_parameter_noinfo _o__purecall _o__register_onexit_function _o__seh_filter_dll memcpy _o___stdio_common_vswprintf _o_free _o_malloc _except_handler4_common _CxxThrowException _o___stdio_common_vsnprintf_s _o___std_type_info_destroy_list _o___std_exception_destroy _o___std_exception_copy __std_terminate __CxxFrameHandler3 memcmp

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress GetModuleHandleW DisableThreadLibraryCalls LoadLibraryExA GetModuleHandleExW FreeLibrary GetModuleFileNameA

api-ms-win-core-synch-l1-1-0

CreateSemaphoreExW WaitForSingleObjectEx OpenSemaphoreW ReleaseSRWLockShared ReleaseMutex ReleaseSRWLockExclusive WaitForSingleObject CreateMutexExW AcquireSRWLockExclusive ReleaseSemaphore AcquireSRWLockShared

api-ms-win-core-heap-l1-1-0

GetProcessHeap HeapFree HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter UnhandledExceptionFilter RaiseException SetLastError GetLastError

api-ms-win-core-com-l1-1-0

CoCreateFreeThreadedMarshaler

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId GetCurrentProcess TerminateProcess GetCurrentProcessId

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW DebugBreak IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError RoOriginateErrorW

rpcrt4

RpcBindingFree NdrClientCall4 RpcBindingCreateW I_RpcExceptionFilter RpcBindingBind

api-ms-win-core-synch-l1-2-0

Sleep InitOnceExecuteOnce

api-ms-win-core-winrt-string-l1-1-0

WindowsStringHasEmbeddedNull WindowsIsStringEmpty WindowsGetStringRawBuffer

api-ms-win-core-util-l1-1-0

EncodePointer DecodePointer

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime GetSystemInfo

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-sysinfo-l1-2-0

GetSystemFirmwareTable

api-ms-win-core-registry-l1-1-0

RegQueryValueExW RegOpenKeyExW RegCreateKeyExW RegSetValueExW RegCloseKey

api-ms-win-core-memory-l1-1-0

VirtualQuery VirtualProtect

Name

.text

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

68B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

4d46c34ad5085df64958ae866ae8e840_NeikiAnalytics.exe

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

rpcrt4

api-ms-win-core-synch-l1-2-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-memory-l1-1-0

generic