59d9b601b9d828e2fd6d94644be1d670_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
59d9b601b9d828e2fd6d94644be1d670_NeikiAnalytics.exe
Size 712KB
Sample240613-dqa4aswcmm
SHA256 fb43ad13e53445763075908d10a121e4acfa81c3e6c10b2f10348f39eb6b5953
MD5 59d9b601b9d828e2fd6d94644be1d670
SHA1 8928a9f217cae4d40fd7f53da699e7c71bfa1c43
SHA512 c6d9889aa57367b9cf709f2fc8201cabfdc68657568d215c7a9850036fff10e522c653a6091e16ad674373690dedbea72db37f4dd2c7d21769de34ac0f1d7bd4
SSDEEP 12288:QrskyY+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:QrzyRMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
59d9b601b9d828e2fd6d94644be1d670_NeikiAnalytics.exe

File Explorer

59d9b601b9d828e2fd6d94644be1d670_NeikiAnalytics.exe

.exe 712KB

59d9b601b9d828e2fd6d94644be1d670_NeikiAnalytics.exe

IMPHASH d76d41e51fc79bf5c56f90fe6a798765
SHA256 fb43ad13e53445763075908d10a121e4acfa81c3e6c10b2f10348f39eb6b5953
MD5 59d9b601b9d828e2fd6d94644be1d670
SHA1 8928a9f217cae4d40fd7f53da699e7c71bfa1c43
SHA512 c6d9889aa57367b9cf709f2fc8201cabfdc68657568d215c7a9850036fff10e522c653a6091e16ad674373690dedbea72db37f4dd2c7d21769de34ac0f1d7bd4
SSDEEP 12288:QrskyY+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:QrzyRMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

25984

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

msdtcexe.pdb

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW GetCommandLineA GetCommandLineW

api-ms-win-core-com-l1-1-0

StringFromGUID2 CoGetObjectContext CoInitializeEx CoUninitialize CoCreateInstance CoTaskMemFree CoTaskMemAlloc

msvcrt

_lock _unlock __dllonexit _onexit __C_specific_handler _initterm memcpy _wcmdln _local_unwind __setusermatherr _cexit _CxxThrowException _exit wcschr free ?terminate@@YAXXZ exit _commode __set_app_type _fmode __wgetmainargs _amsg_exit _XcptFilter fopen fflush fclose fprintf fwprintf __CxxFrameHandler3 _vsnwprintf _wcsicmp _stricmp wcsrchr _wstrdate _waccess _wstrtime _purecall ??1exception@@UEAA@XZ ??0exception@@QEAA@AEBQEBDH@Z ??0exception@@QEAA@AEBV0@@Z ?what@exception@@UEBAPEBDXZ strchr _wfopen ??1type_info@@UEAA@XZ _callnewh malloc memset

msdtctm

ord4

ntdll

RtlLookupFunctionEntry RtlCaptureContext RtlVirtualUnwind RtlReportException

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-processthreads-l1-1-0

GetStartupInfoW GetCurrentThread CreateProcessW GetCurrentProcessId TlsFree GetExitCodeProcess OpenProcessToken TlsAlloc TlsGetValue GetCurrentProcess TerminateProcess GetCurrentThreadId

api-ms-win-core-errorhandling-l1-1-0

GetLastError SetUnhandledExceptionFilter UnhandledExceptionFilter

api-ms-win-core-libraryloader-l1-2-0

LoadStringW GetModuleHandleW LockResource LoadResource FindResourceExW LoadLibraryExW GetProcAddress FreeLibrary GetModuleFileNameW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount GetSystemTimeAsFileTime GetSystemWindowsDirectoryA GetLocalTime

api-ms-win-core-registry-l1-1-0

RegQueryValueExW RegOpenKeyExW RegOpenKeyExA RegQueryValueExA RegSetValueExW RegCloseKey

api-ms-win-core-file-l1-1-0

DeleteFileW FindNextFileW CreateDirectoryW GetFullPathNameW FindFirstFileW FindClose SetFileAttributesW CreateFileW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent OutputDebugStringW DebugBreak

api-ms-win-core-synch-l1-1-0

SetEvent WaitForSingleObjectEx EnterCriticalSection WaitForSingleObject LeaveCriticalSection ResetEvent DeleteCriticalSection InitializeCriticalSectionAndSpinCount CreateEventA

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-processthreads-l1-1-1

GetThreadContext

api-ms-win-core-heap-l2-1-0

LocalFree LocalAlloc

api-ms-win-security-base-l1-1-0

GetTokenInformation

kernel32

QueueUserWorkItem UnregisterWaitEx

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Name

.text

Size

25KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

94KB

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

59d9b601b9d828e2fd6d94644be1d670_NeikiAnalytics.exe

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-com-l1-1-0

msvcrt

msdtctm

ntdll

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-version-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-heap-l2-1-0

api-ms-win-security-base-l1-1-0

kernel32

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

generic