26a2a81d6480e964ed5e6f221ba645b0_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

26a2a81d6480e964ed5e6f221ba645b0_NeikiAnalytics.exe
Size

100KB
MD5

26a2a81d6480e964ed5e6f221ba645b0
SHA1

10db76bef921817cc0bcc9406010e312c64cc85a
SHA256

dd6a5550a32a5e0c022c15c1a12fe618d46bdb9f5b8e9fa76675ec121dca79af
SHA512

ab70b06363b20c18f4fc0c3d2c3579452ec0ab5f5280f79a30106405cf715c2d560bfe47eda55ce9d18daddc1c936a222fb91fdfe092eb1b3484c700d2218227
SSDEEP

1536:ocUXBowgFqL3aqx6eVaV3uOmroChKd1AUF11uQNknhGvi8wbw:ocUXBodtfm1hKdKU9ugkhGvi8o

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
26a2a81d6480e964ed5e6f221ba645b0_NeikiAnalytics.exe

Files

26a2a81d6480e964ed5e6f221ba645b0_NeikiAnalytics.exe
.exe windows:4 windows x86 arch:x86

6e8576e7dfe644afe73841958a4d101b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_AGGRESIVE_WS_TRIM
IMAGE_FILE_32BIT_MACHINE

PDB Paths

exe\sqladhlp.pdb

Imports

advapi32

StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerW
SetServiceStatus
RegCloseKey
RegSetValueExW
RegCreateKeyW
RegDeleteKeyW
RegOpenKeyExW
CloseServiceHandle
CreateServiceW
OpenSCManagerW
RegQueryValueExW
DeleteService
QueryServiceStatus
ControlService
OpenServiceW
QueryServiceConfigW
RegEnumKeyExW
DeregisterEventSource
ReportEventW
RegisterEventSourceW

ole32

CoCreateInstance
CoUninitialize
CoInitialize

oleaut32

VariantInit
VariantClear
GetErrorInfo
SysFreeString

kernel32

GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
ExitProcess
GetSystemTimeAsFileTime
GetVersionExW
GetLastError
FreeLibrary
GetProcAddress
OutputDebugStringW
Sleep
LocalFree
lstrlenW
FormatMessageW
LoadLibraryW
GetSystemDirectoryW
lstrcpynW
GetComputerNameW

msvcr71

_XcptFilter
_controlfp
wprintf
_wtoi
_onexit
wcslen
_ultow
wcsncpy
swprintf
wcscat
wcscpy
_vsnwprintf
??3@YAXPAX@Z
??2@YAPAXI@Z
div
memset
wcscmp
wcsncat
_itow
free
malloc
wcschr
__security_error_handler
_except_handler3
_c_exit
_exit
_wcsicmp
_cexit
exit
__p___winitenv
_amsg_exit
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
__dllonexit

netapi32

NetGetAnyDCName
NetApiBufferFree

Sections

.text
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

6e8576e7dfe644afe73841958a4d101b

Headers

File Characteristics

PDB Paths

Imports

advapi32

ole32

oleaut32

kernel32

msvcr71

netapi32

Sections

.text Size: 36KB - Virtual size: 36KB

.rdata Size: 20KB - Virtual size: 18KB

.data Size: 8KB - Virtual size: 5KB

.rsrc Size: 32KB - Virtual size: 32KB

.text
Size: 36KB - Virtual size: 36KB

.rdata
Size: 20KB - Virtual size: 18KB

.data
Size: 8KB - Virtual size: 5KB

.rsrc
Size: 32KB - Virtual size: 32KB