14984d77bbd4224fc2b857744ec6d2a0_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
14984d77bbd4224fc2b857744ec6d2a0_NeikiAnalytics.exe
Size 1.6MB
Sample240604-aazvyadh9x
SHA256 8fbcdac508759261a04f51d4fd9822309934f05c190112663a445a7ef0ca92a3
MD5 14984d77bbd4224fc2b857744ec6d2a0
SHA1 c5cc00334d3f3d6f9c63e156e64aabb94b6440b5
SHA512 0934bc8cf9730c2df8b3ef5a679379478f84af20a7bd7eaeb2d6a6c6665c05e6d38118dd08c188df190ae564d31a0d77307b3bae7d84480aeedc31d54b5d7492
SSDEEP 49152:XdmRsDwHmj5gDUYmvFur31yAipQCtXxc0H:XdmRtxU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
14984d77bbd4224fc2b857744ec6d2a0_NeikiAnalytics.exe

File Explorer

14984d77bbd4224fc2b857744ec6d2a0_NeikiAnalytics.exe

.exe 1.6MB

14984d77bbd4224fc2b857744ec6d2a0_NeikiAnalytics.exe

IMPHASH b9a558f80ad76a560c39eb5a8a298c70
SHA256 8fbcdac508759261a04f51d4fd9822309934f05c190112663a445a7ef0ca92a3
MD5 14984d77bbd4224fc2b857744ec6d2a0
SHA1 c5cc00334d3f3d6f9c63e156e64aabb94b6440b5
SHA512 0934bc8cf9730c2df8b3ef5a679379478f84af20a7bd7eaeb2d6a6c6665c05e6d38118dd08c188df190ae564d31a0d77307b3bae7d84480aeedc31d54b5d7492
SSDEEP 49152:XdmRsDwHmj5gDUYmvFur31yAipQCtXxc0H:XdmRtxU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

43854

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

GoogleUpdateCore_unsigned.pdb

kernel32

GetModuleHandleW GetProcAddress GetProcessHeap DeleteCriticalSection HeapDestroy DecodePointer HeapAlloc IsDebuggerPresent OutputDebugStringW EnterCriticalSection LeaveCriticalSection UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW RtlUnwind EncodePointer ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW RaiseException LCMapStringW GetFileType SetStdHandle GetStringTypeW FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx CreateFileW WriteConsoleW SizeofResource LockResource FindResourceExW LoadResource FindResourceW lstrlenW lstrcmpiW CreateDirectoryW GetEnvironmentVariableW WaitForSingleObject ReleaseMutex GetTickCount CreateProcessW TryEnterCriticalSection InitializeCriticalSection CreateMutexW Sleep GetSystemDirectoryW VirtualQuery SetFilePointer GetFileAttributesExW MoveFileExW GetPrivateProfileIntW OutputDebugStringA GetFileInformationByHandle GetLocalTime lstrcmpW GetVersionExW VerSetConditionMask VerifyVersionInfoW lstrcpynW GlobalAlloc GlobalFree GlobalLock GlobalUnlock VirtualProtect VirtualAlloc GetSystemInfo CloseHandle HeapReAlloc GetLastError HeapSize InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsW HeapFree

ole32

StringFromGUID2 CoInitializeEx CoUninitialize IIDFromString

user32

wvsprintfW MessageBoxW SetClipboardData EmptyClipboard CloseClipboard OpenClipboard CharUpperW CharLowerW wsprintfW

advapi32

TraceEvent GetTraceLoggerHandle GetTraceEnableFlags GetTraceEnableLevel RegisterTraceGuidsW UnregisterTraceGuids RegQueryValueExW RegEnumValueW RegOpenKeyExW RegSetValueExW RegCreateKeyExW RegQueryInfoKeyW RegCloseKey GetTokenInformation MakeAbsoluteSD MakeSelfRelativeSD GetSecurityDescriptorLength GetLengthSid InitializeAcl InitializeSecurityDescriptor OpenProcessToken AddAce IsValidSid GetSecurityDescriptorOwner InitializeSid CopySid GetSecurityDescriptorControl SetNamedSecurityInfoW GetSidLengthRequired GetSidSubAuthority GetSecurityDescriptorGroup EqualSid GetAclInformation GetSecurityDescriptorDacl SetSecurityDescriptorDacl GetSecurityDescriptorSacl

shell32

SHGetFolderPathW

netapi32

NetApiBufferFree NetGetJoinInformation

shlwapi

PathRemoveFileSpecW PathRemoveExtensionW PathAppendW PathCanonicalizeW SHQueryValueExW PathStripPathW

userenv

UnloadUserProfile

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW