f0db41dde3923a9cebcd2050c5ee8110_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

f0db41dde3923a9cebcd2050c5ee8110_NeikiAnalytics.exe
Size

5.2MB
MD5

f0db41dde3923a9cebcd2050c5ee8110
SHA1

b2dd40d48b7a93814cd67f7c7d9e0f79d07fc0a3
SHA256

b210ede89cf296770546f325a0b47bfc8ba8ca74ba023ae965219f6c98d27d23
SHA512

300d73e62217b6b971e9dc29aff5721360ba1611bf8254b69b94a1b03e6adab6e62705df8e56021e108313742a93a9bcb76c52ecef9ace0c7f1921118c7b2529
SSDEEP

49152:w9HQ2AalW3A7z9Sh/RmbYQjY3HocMjuHDcc4A5k/QcS9afoSYSOfwze8XRbjmLoT:cwkbYP4sIJYSPaU0D60Kvb3dYi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f0db41dde3923a9cebcd2050c5ee8110_NeikiAnalytics.exe

Files

f0db41dde3923a9cebcd2050c5ee8110_NeikiAnalytics.exe
.exe windows:6 windows x64 arch:x64

dbc728b022623a8e33b06bdf98a2dbd6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

plox.pdb

Imports

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle
WakeByAddressAll
WaitOnAddress

ntdll

NtCreateFile
NtDeviceIoControlFile
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
NtReadFile
NtWriteFile
NtCancelIoFileEx
RtlNtStatusToDosError

kernel32

GetSystemInfo
CloseHandle
PostQueuedCompletionStatus
CreateIoCompletionPort
GetQueuedCompletionStatusEx
GetCurrentThreadId
GetSystemTimeAsFileTime
SetFileCompletionNotificationModes
InitializeSListHead
IsDebuggerPresent
lstrlenW
SetFileTime
GetConsoleMode
SetConsoleMode
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
AddVectoredExceptionHandler
SetThreadStackGuarantee
SwitchToThread
WaitForSingleObject
QueryPerformanceCounter
SetLastError
GetCurrentDirectoryW
GetEnvironmentVariableW
GetCommandLineW
SetFileInformationByHandle
GetCurrentProcess
SetFilePointerEx
GetStdHandle
GetCurrentProcessId
QueryPerformanceFrequency
GetSystemTimePreciseAsFileTime
HeapFree
SetHandleInformation
HeapReAlloc
ReleaseMutex
GetProcessHeap
HeapAlloc
FindNextFileW
FindClose
CreateFileW
GetFileInformationByHandle
GetFileInformationByHandleEx
CreateDirectoryW
FindFirstFileW
GetFinalPathNameByHandleW
GetFileType
GetModuleHandleW
FormatMessageW
GetModuleFileNameW
MultiByteToWideChar
WriteConsoleW
WideCharToMultiByte
ReadConsoleW
CreateThread
GetCurrentThread
GetFullPathNameW
GetModuleHandleA
GetProcAddress
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
IsProcessorFeaturePresent

ws2_32

WSAStartup
connect
bind
WSASocketW
getsockname
send
shutdown
setsockopt
WSAIoctl
WSAGetLastError
closesocket
WSASend
freeaddrinfo
getsockopt
WSACleanup
recv
getaddrinfo
getpeername
ioctlsocket

advapi32

RegCloseKey
RegQueryValueExW
RegOpenKeyExW

secur32

ApplyControlToken
EncryptMessage
AcceptSecurityContext
InitializeSecurityContextW
FreeContextBuffer
DecryptMessage
DeleteSecurityContext
QueryContextAttributesW
AcquireCredentialsHandleA
FreeCredentialsHandle

crypt32

CertEnumCertificatesInStore
CertDuplicateCertificateChain
CertAddCertificateContextToStore
CertVerifyCertificateChainPolicy
CertGetCertificateChain
CertFreeCertificateContext
CertOpenStore
CertCloseStore
CertDuplicateStore
CertFreeCertificateChain
CertDuplicateCertificateContext

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree

vcruntime140

__current_exception_context
__current_exception
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
memcpy
memmove
memcmp
memset

api-ms-win-crt-math-l1-1-0

__setusermatherr
pow

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_initterm_e
_set_app_type
_initialize_onexit_table
exit
_exit
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
terminate
_crt_atexit
_seh_filter_exe
_register_onexit_function

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode
free

Sections

.text
Size: 3.3MB - Virtual size: 3.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 165KB - Virtual size: 165KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dbc728b022623a8e33b06bdf98a2dbd6

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

bcryptprimitives

api-ms-win-core-synch-l1-2-0

ntdll

kernel32

ws2_32

advapi32

secur32

crypt32

shell32

ole32

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 3.3MB - Virtual size: 3.3MB

.rdata Size: 1.7MB - Virtual size: 1.7MB

.data Size: 9KB - Virtual size: 9KB

.pdata Size: 165KB - Virtual size: 165KB

.reloc Size: 42KB - Virtual size: 41KB

.text
Size: 3.3MB - Virtual size: 3.3MB

.rdata
Size: 1.7MB - Virtual size: 1.7MB

.data
Size: 9KB - Virtual size: 9KB

.pdata
Size: 165KB - Virtual size: 165KB

.reloc
Size: 42KB - Virtual size: 41KB