586ac5a309a8901dd435ac621c6707a0_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
586ac5a309a8901dd435ac621c6707a0_NeikiAnalytics.exe
Size 1.2MB
Sample240613-dadjgsvgrn
SHA256 df6ee266fe83094bfb32f0ed83006c2fae47357afb9e5a32f66193db1810b9ab
MD5 586ac5a309a8901dd435ac621c6707a0
SHA1 ffbebea8907b1318741cf7469944ee6e66eb637a
SHA512 a27af4b81d84aa4067c8bbeeac8c1b4f041a07d64e307651e062f44b7289471a94b0ba2b95c8b2d1b658edea90e64d8a059df44c9cf6fcdfa85d0778d10a37a8
SSDEEP 12288:O1fAGQjPviaZTWuKTY0eBgob0gEE64ZKAQmaZ/W3Ig8CidwRisW:5vjiUTWuKk0fob0gEEVFQmic8WU
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
586ac5a309a8901dd435ac621c6707a0_NeikiAnalytics.exe

File Explorer

586ac5a309a8901dd435ac621c6707a0_NeikiAnalytics.exe

.exe 1.2MB

586ac5a309a8901dd435ac621c6707a0_NeikiAnalytics.exe

IMPHASH a22b9c7bc0a60c74233dee9fcb4ec598
SHA256 df6ee266fe83094bfb32f0ed83006c2fae47357afb9e5a32f66193db1810b9ab
MD5 586ac5a309a8901dd435ac621c6707a0
SHA1 ffbebea8907b1318741cf7469944ee6e66eb637a
SHA512 a27af4b81d84aa4067c8bbeeac8c1b4f041a07d64e307651e062f44b7289471a94b0ba2b95c8b2d1b658edea90e64d8a059df44c9cf6fcdfa85d0778d10a37a8
SSDEEP 12288:O1fAGQjPviaZTWuKTY0eBgob0gEE64ZKAQmaZ/W3Ig8CidwRisW:5vjiUTWuKk0fob0gEEVFQmic8WU
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

22784

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\jenkins\workspace\8-2-build-windows-amd64-cygwin\jdk8u261\295\build\windows-amd64\deploy\tmp\javacplexec\obj64\javacpl.pdb

user32

GetWindowThreadProcessId CloseDesktop OpenInputDesktop MessageBoxW wsprintfW LoadStringW GetShellWindow

kernel32

LocalAlloc WideCharToMultiByte GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA InitializeSListHead GetEnvironmentVariableW GetLongPathNameW CloseHandle GetLastError FreeLibrary GetModuleFileNameW GetProcAddress LoadLibraryW FormatMessageW VerSetConditionMask CreateFileW GetShortPathNameW GetTempPathW RaiseException InitializeCriticalSectionAndSpinCount DeleteCriticalSection WaitForSingleObject GetCurrentProcess CreateProcessW OpenProcess GlobalMemoryStatusEx GetLocalTime GetSystemDirectoryW GetWindowsDirectoryW GetVersionExW GetNativeSystemInfo GetModuleHandleW GlobalAlloc GlobalFree MultiByteToWideChar LocalFree lstrlenW VerifyVersionInfoW WTSGetActiveConsoleSessionId OutputDebugStringW GetCurrentProcessId GetCurrentThreadId RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime

ole32

StringFromCLSID CoTaskMemFree

oleaut32

SysAllocStringByteLen VariantClear SysAllocString SysFreeString SysStringLen

vcruntime140

__CxxFrameHandler3 memset memcpy __C_specific_handler __std_exception_copy _CxxThrowException __std_exception_destroy

api-ms-win-crt-stdio-l1-1-0

_set_fmode __stdio_common_vswprintf_s _wfopen_s __stdio_common_vfwprintf_s fclose __stdio_common_vsnwprintf_s __p__commode

api-ms-win-crt-filesystem-l1-1-0

_stat64i32 _wstat64i32 _wsplitpath_s

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment _register_onexit_function _configure_narrow_argv _cexit terminate _set_app_type _crt_atexit _get_narrow_winmain_command_line _initterm _initterm_e exit _exit _errno _c_exit _register_thread_local_exe_atexit_callback _invalid_parameter_noinfo _initialize_onexit_table _seh_filter_exe

api-ms-win-crt-heap-l1-1-0

_set_new_mode free malloc _callnewh

api-ms-win-crt-convert-l1-1-0

_wtoi

api-ms-win-crt-environment-l1-1-0

_wdupenv_s _wputenv

api-ms-win-crt-string-l1-1-0

wcscat_s wcscpy_s wcsncpy_s wcscmp _wcsicmp

api-ms-win-crt-time-l1-1-0

_localtime64 wcsftime _ftime64_s

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

586ac5a309a8901dd435ac621c6707a0_NeikiAnalytics.exe

user32

kernel32

ole32

oleaut32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic