21900614e179cc5a521829b0db8a9a50_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

21900614e179cc5a521829b0db8a9a50_NeikiAnalytics.exe
Size

732KB
MD5

21900614e179cc5a521829b0db8a9a50
SHA1

4e0e2a35afa16dd0316b1abe0d705439f252d5fc
SHA256

2471b98ab714877b436457cfe6d2654df1b7bf90af528187f0956c17da06ea87
SHA512

ca2da750b04c2a05398ddb5dc1a53e347268f3d465956d3fcb9cc9fec378692dda171582f16860e749869173fa5567e94aa6d57bcb269eb7c69793faee6c7451
SSDEEP

12288:+XQ3ZN2kRC+Gt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:WQ3L2kRCxt/sBlDqgZQd6XKtiMJYiPU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
21900614e179cc5a521829b0db8a9a50_NeikiAnalytics.exe

Files

21900614e179cc5a521829b0db8a9a50_NeikiAnalytics.exe
.exe windows:6 windows x64 arch:x64

290ed5ed5e77a4ad2a79bf3733c18d20

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\mspdbsrv.pdb

Imports

advapi32

GetTokenInformation
OpenThreadToken
EqualSid
OpenProcessToken

kernel32

InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetCurrentProcessId
GetLastError
CloseHandle
GetCurrentProcess
GetCommandLineW
GetCurrentThread
CreateEventW
CreateWaitableTimerW
SetPriorityClass
CreateMutexW
WaitForSingleObject
ReleaseMutex
WaitForMultipleObjectsEx
OpenEventW
SetEvent
CancelWaitableTimer
SetWaitableTimer
VirtualQuery
GetModuleFileNameW
RaiseFailFastException
SetErrorMode
OpenProcess
DuplicateHandle
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetModuleHandleW
TerminateProcess
QueryPerformanceCounter

vcruntime140

_CxxThrowException
__std_exception_destroy
__std_exception_copy
memset
__current_exception_context
__current_exception
memcpy
wcschr
memmove
__C_specific_handler

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

strncpy_s
wcsncpy_s
_wcsdup
_wcsicmp
iswspace

api-ms-win-crt-stdio-l1-1-0

fflush
_set_fmode
__acrt_iob_func
__stdio_common_vsnwprintf_s
fclose
__stdio_common_vfwprintf
_wfopen_s
__p__commode

api-ms-win-crt-time-l1-1-0

_wctime64
_time64

api-ms-win-crt-heap-l1-1-0

malloc
free
_set_new_mode
_callnewh

api-ms-win-crt-convert-l1-1-0

wcstoul

api-ms-win-crt-environment-l1-1-0

_wdupenv_s

api-ms-win-crt-runtime-l1-1-0

_crt_atexit
terminate
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
__p___wargv
__p___argc
_initialize_onexit_table
_exit
_register_onexit_function
_seh_filter_exe
_set_app_type
exit
_configure_wide_argv
_initialize_wide_environment
_initterm
_get_initial_wide_environment
_initterm_e

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

mspdbcore

?CloseAllTimeoutPDB@PDB@@SAHXZ
?SetErrorHandlerAPI@PDB@@SAHP6APEAUIPDBError@@PEAU1@@Z@Z
?OpenEx2W@PDB@@SAHPEBGPEBDJPEAJPEAG_KPEAPEAU1@@Z
?RPC@PDB@@SAHXZ
?OpenValidate4@PDB@@SAHPEBGPEBDPEBU_GUID@@KKPEAJPEAG_KPEAPEAU1@@Z
?open@NameMap@@SAHPEAUPDB@@HPEAPEAU1@@Z
?FOpenW@MREngine@@SAHPEAPEAU1@PEBGAEAJPEAG_KHH@Z
?FOpen@MREngine@@SAHPEAPEAU1@PEAUMreToPdb@@HH@Z
?SetPDBCloseTimeout@PDB@@SAH_K@Z
?FOpen@MREngine@@SAHPEAPEAU1@PEAUPDB@@PEAUNameMap@@HH@Z
?ShutDownTimeoutManager@PDB@@SAHXZ
?OpenNgenPdb@PDB@@SAHPEBG0PEAJPEAG_KPEAPEAU1@@Z

rpcrt4

RpcMgmtStopServerListening
RpcServerListen
RpcServerRegisterIf2
RpcServerUseProtseqEpW
RpcServerUnregisterIf
RpcRevertToSelf
RpcImpersonateClient
NdrClientCall2
NdrServerCall2
RpcBindingInqAuthClientW
RpcMgmtInqStats
RpcMgmtStatsVectorFree

Sections

.text
Size: 81KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 65KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 568KB - Virtual size: 572KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

290ed5ed5e77a4ad2a79bf3733c18d20

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

vcruntime140

vcruntime140_1

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

mspdbcore

rpcrt4

Sections

.text Size: 81KB - Virtual size: 81KB

.rdata Size: 65KB - Virtual size: 64KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 14KB - Virtual size: 13KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 568KB - Virtual size: 572KB

.text
Size: 81KB - Virtual size: 81KB

.rdata
Size: 65KB - Virtual size: 64KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 14KB - Virtual size: 13KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 568KB - Virtual size: 572KB