b028d36d1615a249d80cde845d8f5f50_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

b028d36d1615a249d80cde845d8f5f50_NeikiAnalytics.exe
Size

332KB
MD5

b028d36d1615a249d80cde845d8f5f50
SHA1

f3dec7aba4f07302d269a20d597e9a9ba7c1e191
SHA256

a8f92f0955142fd07df08fec9bf58e22a1538b5870eb528f72ba712ebaa9bac0
SHA512

3abe9590c682530a370314144f19de755ac704d76c1be945783336dcb1f2f29908aee611d4350b7fb3548e4e42aa182feccc3219dba037bd6092399a843159ec
SSDEEP

6144:mKnvrVrITs5r7L1os4bd6yyCTU0PxXfG6iqYJOyxFo:RvrV8TsosjyjTU0xXkqYJ5o

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b028d36d1615a249d80cde845d8f5f50_NeikiAnalytics.exe

Files

b028d36d1615a249d80cde845d8f5f50_NeikiAnalytics.exe
.dll windows:4 windows x86 arch:x86

d83d82fb696403f9c6047a6e6bc15f7e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

wldap32

ord46
ord27
ord301
ord33
ord79
ord35
ord32
ord200
ord30
ord26
ord50
ord143
ord211
ord22
ord60
ord41

ws2_32

htonl
inet_ntoa
socket
closesocket
recv
htons
bind
gethostbyname
connect
setsockopt
getsockopt
WSASetLastError
ntohs
getpeername
getsockname
WSAGetLastError
inet_addr
getservbyname
gethostbyaddr
getservbyport
gethostname
WSACleanup
WSAStartup
listen
accept
ioctlsocket
__WSAFDIsSet
select
send
sendto
recvfrom
WSAIoctl

libeay32

ord979
ord869
ord1
ord464
ord1180
ord544
ord543
ord18
ord154
ord7
ord86
ord656
ord88
ord816
ord151
ord421
ord3020
ord2561
ord2598
ord3164
ord3048
ord3025
ord2593
ord2989
ord784
ord808
ord809
ord2435
ord2436
ord2437
ord340
ord342
ord341
ord3712
ord3765
ord3479
ord3212
ord3182
ord3214
ord3226
ord4445
ord224
ord298
ord227
ord222
ord2291
ord52
ord78
ord2596
ord958
ord625
ord556
ord248
ord466
ord2201
ord467
ord2254
ord484
ord956
ord2034
ord280
ord654
ord909
ord641
ord281
ord908
ord1654
ord1291
ord1304
ord1301
ord1309
ord680
ord2454
ord391
ord653
ord1161
ord657
ord66
ord95
ord2431
ord181
ord2442
ord188
ord1951
ord566
ord578
ord579
ord1216
ord2023
ord2075
ord1653
ord1958
ord3173
ord2838
ord2844
ord2647
ord2971

ssleay32

ord30
ord222
ord17
ord235
ord385
ord130
ord127
ord157
ord43
ord154
ord164
ord242
ord61
ord60
ord77
ord108
ord28
ord22
ord5
ord3
ord24
ord49
ord126
ord110
ord116
ord12
ord6
ord266
ord361
ord387
ord15
ord141
ord180
ord21
ord75
ord45
ord90
ord121
ord83
ord87
ord31
ord78
ord58
ord96
ord86
ord48
ord8
ord407
ord74
ord183

msvcrt

_stati64
fputc
gmtime
fflush
_ftol
fwrite
_getpid
strerror
_sys_nerr
atoi
setvbuf
ftell
_initterm
_adjust_fdiv
_write
_strdup
_open
_close
_access
_read
memchr
tolower
getenv
strstr
strtol
fread
fseek
_fstati64
_lseeki64
malloc
realloc
_beginthreadex
strpbrk
sprintf
strtoul
calloc
strncpy
free
fputs
qsort
fgets
_iob
fopen
fclose
memmove
time
strchr
sscanf
strrchr
_isctype
__mb_cur_max
_pctype
strncmp
_errno

kernel32

GetLastError
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
SleepEx
FreeLibrary
DisableThreadLibraryCalls
GetTickCount
GetStdHandle
GetFileType
WaitForMultipleObjects
PeekNamedPipe
ReadFile
GetModuleHandleA
GetVersionExA
LeaveCriticalSection
FormatMessageA
SetLastError
Sleep
ExpandEnvironmentStringsA
WaitForSingleObject
CloseHandle
GetSystemDirectoryA
LoadLibraryA
GetProcAddress

Exports

Exports

curl_easy_cleanup
curl_easy_duphandle
curl_easy_escape
curl_easy_getinfo
curl_easy_init
curl_easy_pause
curl_easy_perform
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_escape
curl_formadd
curl_formfree
curl_formget
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_global_init_mem
curl_global_sslset
curl_maprintf
curl_mfprintf
curl_mime_addpart
curl_mime_data
curl_mime_data_cb
curl_mime_encoder
curl_mime_filedata
curl_mime_filename
curl_mime_free
curl_mime_headers
curl_mime_init
curl_mime_name
curl_mime_subparts
curl_mime_type
curl_mprintf
curl_msnprintf
curl_msprintf
curl_multi_add_handle
curl_multi_assign
curl_multi_cleanup
curl_multi_fdset
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_remove_handle
curl_multi_setopt
curl_multi_socket
curl_multi_socket_action
curl_multi_socket_all
curl_multi_strerror
curl_multi_timeout
curl_multi_wait
curl_mvaprintf
curl_mvfprintf
curl_mvprintf
curl_mvsnprintf
curl_mvsprintf
curl_pushheader_byname
curl_pushheader_bynum
curl_share_cleanup
curl_share_init
curl_share_setopt
curl_share_strerror
curl_slist_append
curl_slist_free_all
curl_strequal
curl_strnequal
curl_unescape
curl_version
curl_version_info

Sections

.text
Size: 264KB - Virtual size: 260KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d83d82fb696403f9c6047a6e6bc15f7e

Headers

File Characteristics

Imports

wldap32

ws2_32

libeay32

ssleay32

msvcrt

kernel32

Exports

Exports

Sections

.text Size: 264KB - Virtual size: 260KB

.rdata Size: 12KB - Virtual size: 9KB

.data Size: 36KB - Virtual size: 35KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 12KB - Virtual size: 11KB

.text
Size: 264KB - Virtual size: 260KB

.rdata
Size: 12KB - Virtual size: 9KB

.data
Size: 36KB - Virtual size: 35KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 12KB - Virtual size: 11KB