12fc88ab88c184f7f8cdf3c4ace31410_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

12fc88ab88c184f7f8cdf3c4ace31410_NeikiAnalytics.exe
Size

219KB
MD5

12fc88ab88c184f7f8cdf3c4ace31410
SHA1

ae15cb17d531a7911220d18cd1c0a4b53a8e1d6b
SHA256

c41fcd43e966eeb4c791ff3ac093eb8c54e9e62c13a208440980d70cc174bf38
SHA512

258b1346eaba26d423fde5956c3f641b10563a57608e42f069b29b5a2a1d27362a88cfab5cfabe80be16ff50dfb0314cb0a1f4545c30bc4ea1e5941db8dfc9a6
SSDEEP

3072:Ne3hB7u0p2WDVxSadpYIYxS+WwmaLISutcjzm1X2vMr:N2hlu4LQawO+W0zzm1X2vMr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
12fc88ab88c184f7f8cdf3c4ace31410_NeikiAnalytics.exe

Files

12fc88ab88c184f7f8cdf3c4ace31410_NeikiAnalytics.exe
.dll windows:4 windows x64 arch:x64

9b55a4fca9d4ffd5abb14752ab4b27ae

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

x64-msvcrt-ruby270

Sleep
onigenc_get_right_adjust_char_head
rb_alloc_tmp_buffer_with_count
rb_ary_new
rb_ary_push
rb_ascii8bit_encoding
rb_block_given_p
rb_cData
rb_cIO
rb_call_super
rb_check_hash_type
rb_check_string_type
rb_check_typeddata
rb_class_new_instance_kw
rb_convert_type
rb_data_typed_object_wrap
rb_default_external_encoding
rb_define_alloc_func
rb_define_class
rb_define_const
rb_define_method
rb_define_module_under
rb_define_singleton_method
rb_eArgError
rb_eIOError
rb_empty_keyword_given_p
rb_enc_associate
rb_enc_associate_index
rb_enc_codelen
rb_enc_codepoint_len
rb_enc_copy
rb_enc_find_index
rb_enc_from_encoding
rb_enc_from_index
rb_enc_get
rb_enc_mbclen
rb_enc_str_buf_cat
rb_enc_str_new_static
rb_enc_uint_chr
rb_ensure
rb_enumeratorize
rb_enumeratorize_with_size
rb_eof_error
rb_error_arity
rb_extract_keywords
rb_frame_this_func
rb_free_tmp_buffer
rb_funcallv
rb_funcallv_kw
rb_gc_mark
rb_get_kwargs
rb_hash_lookup2
rb_hash_new
rb_id2sym
rb_include_module
rb_int2big
rb_intern
rb_intern2
rb_io_addstr
rb_io_extract_modeenc
rb_io_print
rb_io_printf
rb_io_puts
rb_io_taint_check
rb_io_write
rb_keyword_given_p
rb_lastline_set
rb_mEnumerable
rb_notimplement
rb_num2long
rb_obj_as_string
rb_raise
rb_rs
rb_str_buf_append
rb_str_conv_enc
rb_str_modify
rb_str_modify_expand
rb_str_new
rb_str_new_static
rb_str_resize
rb_str_set_len
rb_str_subseq
rb_str_substr
rb_string_value
rb_syserr_fail
rb_to_encoding
rb_uint2big
rb_utf8_encindex
rb_warn
rb_yield
ruby_malloc_size_overflow
ruby_xfree
ruby_xmalloc

kernel32

DeleteCriticalSection
EnterCriticalSection
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery

msvcrt

__dllonexit
__iob_func
_amsg_exit
_initterm
_lock
_onexit
_unlock
abort
calloc
free
fwrite
malloc
memchr
memcmp
memcpy
memmove
memset
signal
strlen
strncmp
vfprintf

Exports

Exports

Init_stringio

Sections

.text
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 76B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 136B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/4
Size: 512B - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/19
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/31
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/45
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/57
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/70
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/81
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/92
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9b55a4fca9d4ffd5abb14752ab4b27ae

Headers

DLL Characteristics

File Characteristics

Imports

x64-msvcrt-ruby270

kernel32

msvcrt

Exports

Exports

Sections

.text Size: 28KB - Virtual size: 28KB

.data Size: 512B - Virtual size: 88B

.rdata Size: 4KB - Virtual size: 3KB

.pdata Size: 1KB - Virtual size: 1KB

.xdata Size: 1KB - Virtual size: 1KB

.bss Size: - Virtual size: 2KB

.edata Size: 512B - Virtual size: 76B

.idata Size: 5KB - Virtual size: 5KB

.CRT Size: 512B - Virtual size: 88B

.tls Size: 512B - Virtual size: 104B

.reloc Size: 512B - Virtual size: 136B

/4 Size: 512B - Virtual size: 144B

/19 Size: 49KB - Virtual size: 48KB

/31 Size: 1KB - Virtual size: 1KB

/45 Size: 6KB - Virtual size: 5KB

/57 Size: 5KB - Virtual size: 4KB

/70 Size: 1KB - Virtual size: 1KB

/81 Size: 59KB - Virtual size: 58KB

/92 Size: 9KB - Virtual size: 8KB

.text
Size: 28KB - Virtual size: 28KB

.data
Size: 512B - Virtual size: 88B

.rdata
Size: 4KB - Virtual size: 3KB

.pdata
Size: 1KB - Virtual size: 1KB

.xdata
Size: 1KB - Virtual size: 1KB

.bss
Size: - Virtual size: 2KB

.edata
Size: 512B - Virtual size: 76B

.idata
Size: 5KB - Virtual size: 5KB

.CRT
Size: 512B - Virtual size: 88B

.tls
Size: 512B - Virtual size: 104B

.reloc
Size: 512B - Virtual size: 136B

/4
Size: 512B - Virtual size: 144B

/19
Size: 49KB - Virtual size: 48KB

/31
Size: 1KB - Virtual size: 1KB

/45
Size: 6KB - Virtual size: 5KB

/57
Size: 5KB - Virtual size: 4KB

/70
Size: 1KB - Virtual size: 1KB

/81
Size: 59KB - Virtual size: 58KB

/92
Size: 9KB - Virtual size: 8KB