336c19fb20db41eb0a8dd5947a1032e0_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

336c19fb20db41eb0a8dd5947a1032e0_NeikiAnalytics.exe
Size

17KB
MD5

336c19fb20db41eb0a8dd5947a1032e0
SHA1

dabdfcc29897e4537b8bdf9f4ece6d84108f54d8
SHA256

912d5a0f0d6c0feb0d442ba15d8a008d78d7ba04f54f67b55eb66af6fd49226a
SHA512

4d9aad4e7376d0c9353b4270fab035dd67c652d95fbea5fe3a20200642fa2f4995da781e59d9c274fb415d78f2b6c56f33c73454ea18ccc81a0713e239bc0548
SSDEEP

192:wJiCRpo+03qOXAJJRlqnnz0LoB1UeJ2JxccYICKn3fv/pRZZZZZZZZZZZEZZZS8u:wJRRp0nAJJYYLotEhNzumelC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
336c19fb20db41eb0a8dd5947a1032e0_NeikiAnalytics.exe

Files

336c19fb20db41eb0a8dd5947a1032e0_NeikiAnalytics.exe
.dll windows:4 windows x86 arch:x86

a2d4ceb078d95311fd32d3444aa0aa1c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

msvcrt-ruby240

Sleep@4
onigenc_always_true_is_allowed_reverse_match
onigenc_apply_all_case_fold_with_map
onigenc_get_case_fold_codes_by_str_with_map
onigenc_is_mbc_newline_0x0a
onigenc_minimum_property_name_to_ctype
onigenc_not_support_get_ctype_code_range
onigenc_single_byte_code_to_mbc
onigenc_single_byte_code_to_mbclen
onigenc_single_byte_left_adjust_char_head
onigenc_single_byte_mbc_enc_len
onigenc_single_byte_mbc_to_code
rb_enc_register

kernel32

DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
QueryPerformanceCounter
SetUnhandledExceptionFilter
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery

msvcrt

_amsg_exit
_initterm
_iob
_lock
_unlock
abort
calloc
free
fwrite
realloc
strlen
strncmp
vfprintf

Exports

Exports

Init_iso_8859_13

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.eh_fram
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 976B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 82B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 576B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a2d4ceb078d95311fd32d3444aa0aa1c

Headers

File Characteristics

Imports

msvcrt-ruby240

kernel32

msvcrt

Exports

Exports

Sections

.text Size: 6KB - Virtual size: 5KB

.data Size: 512B - Virtual size: 48B

.rdata Size: 2KB - Virtual size: 2KB

.eh_fram Size: 2KB - Virtual size: 2KB

.bss Size: - Virtual size: 976B

.edata Size: 512B - Virtual size: 82B

.idata Size: 2KB - Virtual size: 1KB

.CRT Size: 512B - Virtual size: 44B

.tls Size: 512B - Virtual size: 8B

.reloc Size: 1024B - Virtual size: 576B

.text
Size: 6KB - Virtual size: 5KB

.data
Size: 512B - Virtual size: 48B

.rdata
Size: 2KB - Virtual size: 2KB

.eh_fram
Size: 2KB - Virtual size: 2KB

.bss
Size: - Virtual size: 976B

.edata
Size: 512B - Virtual size: 82B

.idata
Size: 2KB - Virtual size: 1KB

.CRT
Size: 512B - Virtual size: 44B

.tls
Size: 512B - Virtual size: 8B

.reloc
Size: 1024B - Virtual size: 576B