28fef06dd60ee4338664e5d2e6f28b70_NeikiAnalytics[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

28fef06dd60ee4338664e5d2e6f28b70_NeikiAnalytics.exe
Size

51KB
MD5

28fef06dd60ee4338664e5d2e6f28b70
SHA1

932b7c83f1afa936a8bb2653d891e31792fabf97
SHA256

8beb52740279bfa378bfa088aef1b49d65abe602115b0c0b95dcb3c77df2d7cb
SHA512

799803e1d759237c1a74375b966c1f0cd11516534974c72634fcc399e62e4e03940b3ac43eff0dcd90877d24da57c40bca941b9b3ef8280c8fcc801959a99715
SSDEEP

768:373OtJDvhzNsyXk58sCuSw26eWp12hzORvmGpsmC2317dR8:3a/DvVNe58kSw2tw21ORvmgDxI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
28fef06dd60ee4338664e5d2e6f28b70_NeikiAnalytics.exe

Files

28fef06dd60ee4338664e5d2e6f28b70_NeikiAnalytics.exe
.exe windows:5 windows x86 arch:x86

bbc712c81dbe5f313d887223f25de84e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleW
GetStartupInfoW
RtlUnwind
DecodePointer
EncodePointer
EnterCriticalSection
ExitProcess
GetACP
GetCPInfo
GetCurrentProcess
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetOEMCP
GetProcessHeap
GetSystemPowerStatus
HeapFree
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
LeaveCriticalSection
LoadLibraryExA
LoadLibraryExW
OutputDebugStringW
SetLastError
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
VirtualAlloc
VirtualFree
VirtualProtect

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 800B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ