4bc7b524b6bc29eb939d2f0e26ff3de0_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
4bc7b524b6bc29eb939d2f0e26ff3de0_NeikiAnalytics.exe
Size 712KB
Sample240612-25t2qayanr
SHA256 8fac9884e607a25a837046d3c4efca8e401aeb62ba87c291922fabc7a25032a7
MD5 4bc7b524b6bc29eb939d2f0e26ff3de0
SHA1 0c7284c131852975b5f57c9d763be2cc6960de9b
SHA512 2e834ada125f189c4d530e9533d9b140b46841e223f5d05a6e9c1c648030a72328fdd783e463e5cb58ddb34559dda25fa98beb7a0f95d935b52e707088dc6b7f
SSDEEP 12288:9rskyAGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:9rzynt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4bc7b524b6bc29eb939d2f0e26ff3de0_NeikiAnalytics.exe

File Explorer

4bc7b524b6bc29eb939d2f0e26ff3de0_NeikiAnalytics.exe

.exe 712KB

4bc7b524b6bc29eb939d2f0e26ff3de0_NeikiAnalytics.exe

IMPHASH d76d41e51fc79bf5c56f90fe6a798765
SHA256 8fac9884e607a25a837046d3c4efca8e401aeb62ba87c291922fabc7a25032a7
MD5 4bc7b524b6bc29eb939d2f0e26ff3de0
SHA1 0c7284c131852975b5f57c9d763be2cc6960de9b
SHA512 2e834ada125f189c4d530e9533d9b140b46841e223f5d05a6e9c1c648030a72328fdd783e463e5cb58ddb34559dda25fa98beb7a0f95d935b52e707088dc6b7f
SSDEEP 12288:9rskyAGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:9rzynt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

25984

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

msdtcexe.pdb

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW GetCommandLineA GetCommandLineW

api-ms-win-core-com-l1-1-0

StringFromGUID2 CoGetObjectContext CoInitializeEx CoUninitialize CoCreateInstance CoTaskMemFree CoTaskMemAlloc

msvcrt

_lock _unlock __dllonexit _onexit __C_specific_handler _initterm memcpy _wcmdln _local_unwind __setusermatherr _cexit _CxxThrowException _exit wcschr free ?terminate@@YAXXZ exit _commode __set_app_type _fmode __wgetmainargs _amsg_exit _XcptFilter fopen fflush fclose fprintf fwprintf __CxxFrameHandler3 _vsnwprintf _wcsicmp _stricmp wcsrchr _wstrdate _waccess _wstrtime _purecall ??1exception@@UEAA@XZ ??0exception@@QEAA@AEBQEBDH@Z ??0exception@@QEAA@AEBV0@@Z ?what@exception@@UEBAPEBDXZ strchr _wfopen ??1type_info@@UEAA@XZ _callnewh malloc memset

msdtctm

ord4

ntdll

RtlLookupFunctionEntry RtlCaptureContext RtlVirtualUnwind RtlReportException

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-processthreads-l1-1-0

GetStartupInfoW GetCurrentThread CreateProcessW GetCurrentProcessId TlsFree GetExitCodeProcess OpenProcessToken TlsAlloc TlsGetValue GetCurrentProcess TerminateProcess GetCurrentThreadId

api-ms-win-core-errorhandling-l1-1-0

GetLastError SetUnhandledExceptionFilter UnhandledExceptionFilter

api-ms-win-core-libraryloader-l1-2-0

LoadStringW GetModuleHandleW LockResource LoadResource FindResourceExW LoadLibraryExW GetProcAddress FreeLibrary GetModuleFileNameW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount GetSystemTimeAsFileTime GetSystemWindowsDirectoryA GetLocalTime

api-ms-win-core-registry-l1-1-0

RegQueryValueExW RegOpenKeyExW RegOpenKeyExA RegQueryValueExA RegSetValueExW RegCloseKey

api-ms-win-core-file-l1-1-0

DeleteFileW FindNextFileW CreateDirectoryW GetFullPathNameW FindFirstFileW FindClose SetFileAttributesW CreateFileW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent OutputDebugStringW DebugBreak

api-ms-win-core-synch-l1-1-0

SetEvent WaitForSingleObjectEx EnterCriticalSection WaitForSingleObject LeaveCriticalSection ResetEvent DeleteCriticalSection InitializeCriticalSectionAndSpinCount CreateEventA

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-processthreads-l1-1-1

GetThreadContext

api-ms-win-core-heap-l2-1-0

LocalFree LocalAlloc

api-ms-win-security-base-l1-1-0

GetTokenInformation

kernel32

QueueUserWorkItem UnregisterWaitEx

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Name

.text

Size

25KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

94KB

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

4bc7b524b6bc29eb939d2f0e26ff3de0_NeikiAnalytics.exe

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-com-l1-1-0

msvcrt

msdtctm

ntdll

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-version-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-heap-l2-1-0

api-ms-win-security-base-l1-1-0

kernel32

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

generic