41cbe8cd13b7113e16efe11542947f30_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

41cbe8cd13b7113e16efe11542947f30_NeikiAnalytics.exe
Size

242KB
MD5

41cbe8cd13b7113e16efe11542947f30
SHA1

0622991afbf760358e479dabee193533d678e3be
SHA256

d36119938961bafdfd35e1fcaa1093ecfc80b58f2c9a05124a4219fc64e78fb1
SHA512

5bc3ee0acc5bc27acd6a3eeed69610b17dff9aac6a67cadcb6694bf3ef55eacd27885fccd6b28e402c8be657a288e8771c81828e2284e2dc8716e04bdbcd5040
SSDEEP

6144:qPylKqZ4gjE13lpmG9MgtODgOkUdCV1sgW6TR1j+CZfF:gylKBgjE1mGOE7QY1sgtTRv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
41cbe8cd13b7113e16efe11542947f30_NeikiAnalytics.exe

Files

41cbe8cd13b7113e16efe11542947f30_NeikiAnalytics.exe
.dll windows:6 windows x86 arch:x86

70d98af6df4f0d998a225640ba0db2fd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\a\orca-rs\orca-rs\target\i686-pc-windows-msvc\release\deps\orca_rs.pdb

Imports

kernel32

SetFileInformationByHandle
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetCurrentThreadId
UnhandledExceptionFilter
GetEnvironmentVariableW
GetCurrentDirectoryW
SetLastError
ReleaseMutex
RtlCaptureContext
GetStdHandle
GetCurrentProcessId
GetCurrentThread
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetProcessHeap
HeapAlloc
HeapFree
AcquireSRWLockExclusive
HeapReAlloc
ReleaseSRWLockShared
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
CreateFileW
GetFileInformationByHandle
GetFileInformationByHandleEx
WaitForSingleObject
GetConsoleMode
GetLastError
GetModuleHandleW
FormatMessageW
GetFullPathNameW
MultiByteToWideChar
WriteConsoleW
InitOnceBeginInitialize
TlsAlloc
InitOnceComplete
TlsFree
QueryPerformanceFrequency
GetSystemTimeAsFileTime
ReleaseSRWLockExclusive
SetUnhandledExceptionFilter
CloseHandle
GetProcAddress
GetModuleHandleA
Sleep
TlsSetValue
AcquireSRWLockShared
TlsGetValue
IsProcessorFeaturePresent

advapi32

SystemFunction036

ntdll

NtReadFile
RtlNtStatusToDosError
NtWriteFile

bcrypt

BCryptGenRandom

python38

PyTuple_New
PyTuple_SetItem
PyExc_ValueError
PyUnicode_FromStringAndSize
PyExc_TypeError
PyGILState_Ensure
PyGILState_Release
_Py_Dealloc
PyErr_Restore
_Py_NoneStruct
PyException_GetTraceback
PyException_SetTraceback
PyErr_Fetch
PyObject_Str
PyErr_PrintEx
PyErr_NewExceptionWithDoc
PyException_GetCause
PyException_SetCause
PyErr_Print
PyFloat_FromDouble
PyLong_FromUnsignedLongLong
PyObject_Repr
PyErr_WriteUnraisable
PyLong_FromLong
PyUnicode_InternInPlace
PyUnicode_AsEncodedString
PyBytes_AsString
PyBytes_Size
PyErr_NormalizeException
PyCFunction_NewEx
PyErr_GivenExceptionMatches
PyModule_GetName
PyObject_GetAttr
PyExc_ImportError
PyModule_Create2
PyDict_New
PyDict_SetItem
PyList_Append
PyObject_SetAttr
PyExc_BaseException
PyList_New
Py_IsInitialized
PyUnicode_AsUTF8AndSize
PyExc_AttributeError
PyExc_SystemError

vcruntime140

memcmp
memcpy
__CxxFrameHandler3
_except_handler4_common
memmove
memset
_CxxThrowException
__std_type_info_destroy_list

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

_initterm
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_execute_onexit_table
_cexit
_initterm_e

api-ms-win-crt-heap-l1-1-0

free

Exports

Exports

PyInit_orca_rs

Sections

.text
Size: 179KB - Virtual size: 179KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

70d98af6df4f0d998a225640ba0db2fd

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

ntdll

bcrypt

python38

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

Exports

Exports

Sections

.text Size: 179KB - Virtual size: 179KB

.rdata Size: 53KB - Virtual size: 53KB

.data Size: 512B - Virtual size: 1KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 179KB - Virtual size: 179KB

.rdata
Size: 53KB - Virtual size: 53KB

.data
Size: 512B - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 7KB