5d5854cef67f68aa0d37bf540b518520_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
5d5854cef67f68aa0d37bf540b518520_NeikiAnalytics.exe
Size 1.2MB
Sample240613-esfx1axejk
SHA256 e44fa43fbcb6cea7183ba40a31544c6fd8a890ea4cabbb1953fcbda830ce523d
MD5 5d5854cef67f68aa0d37bf540b518520
SHA1 182b403b331ff79028672c8b4d6505b63538eb3c
SHA512 f3b4bbcde3c5bbb97f1cd953f93815dba7cff234b3568e8edd1b6cd56962d80ea4383c739cbfbe07f8f675f885cc5b3bb45d782baee6eea8dc584e8917d5df52
SSDEEP 24576:C/mQuRVldlnXfH9gPwCn7vOb7HHcp/CGXQp:C/mQuRVlbnXf9gPTTW7H1GXC
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5d5854cef67f68aa0d37bf540b518520_NeikiAnalytics.exe

File Explorer

5d5854cef67f68aa0d37bf540b518520_NeikiAnalytics.exe

.exe 1.2MB

5d5854cef67f68aa0d37bf540b518520_NeikiAnalytics.exe

IMPHASH 63879732bf2bfd01cf874c563a6cac5b
SHA256 e44fa43fbcb6cea7183ba40a31544c6fd8a890ea4cabbb1953fcbda830ce523d
MD5 5d5854cef67f68aa0d37bf540b518520
SHA1 182b403b331ff79028672c8b4d6505b63538eb3c
SHA512 f3b4bbcde3c5bbb97f1cd953f93815dba7cff234b3568e8edd1b6cd56962d80ea4383c739cbfbe07f8f675f885cc5b3bb45d782baee6eea8dc584e8917d5df52
SSDEEP 24576:C/mQuRVldlnXfH9gPwCn7vOb7HHcp/CGXQp:C/mQuRVlbnXf9gPTTW7H1GXC
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51392

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ALG.pdb

msvcrt

_cexit _amsg_exit _exit _onexit __set_app_type __dllonexit _XcptFilter _wcmdln _CxxThrowException _unlock _lock ??1type_info@@UEAA@XZ __wgetmainargs exit __CxxFrameHandler3 _initterm ?terminate@@YAXXZ _commode __setusermatherr isdigit _callnewh ??0exception@@QEAA@AEBQEBDH@Z memmove ??0exception@@QEAA@XZ memmove_s memcpy_s _wcsicmp ?what@exception@@UEBAPEBDXZ realloc wcscat_s malloc free ??0exception@@QEAA@AEBV0@@Z ??1exception@@UEAA@XZ ??0exception@@QEAA@AEBQEBD@Z __C_specific_handler _fmode memcmp memcpy memset

api-ms-win-core-synch-l1-2-0

WaitForSingleObject SetEvent EnterCriticalSection Sleep LeaveCriticalSection CreateEventW InitializeCriticalSection DeleteCriticalSection

api-ms-win-core-libraryloader-l1-2-0

LoadResource GetModuleHandleW LoadLibraryExW GetProcAddress SizeofResource GetModuleFileNameW FindResourceExW FreeLibrary

api-ms-win-core-string-l2-1-0

CharPrevW CharNextW

api-ms-win-core-errorhandling-l1-1-1

GetLastError RaiseException UnhandledExceptionFilter SetUnhandledExceptionFilter

api-ms-win-core-registry-l1-1-0

RegEnumKeyExW RegCloseKey RegQueryValueExW RegOpenKeyExW RegEnumValueW RegSetValueExW RegQueryInfoKeyW RegCreateKeyExW RegDeleteValueW RegNotifyChangeKeyValue

api-ms-win-core-memory-l1-1-2

VirtualQuery VirtualProtect VirtualAlloc

api-ms-win-core-sysinfo-l1-2-1

GetSystemInfo GetSystemTimeAsFileTime GetTickCount GetVersionExW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-handle-l1-1-0

DuplicateHandle CloseHandle

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-heap-l1-2-0

HeapFree HeapDestroy HeapAlloc GetProcessHeap HeapSetInformation

api-ms-win-core-processthreads-l1-1-2

GetCurrentThreadId GetStartupInfoW GetCurrentProcess GetCurrentProcessId TerminateProcess CreateThread

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-rtlsupport-l1-2-0

RtlLookupFunctionEntry RtlVirtualUnwind RtlCaptureContext

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueEx DeleteTimerQueueTimer CreateTimerQueue CreateTimerQueueTimer

api-ms-win-core-string-obsolete-l1-1-0

lstrcpynW lstrcmpiW

cryptbase

SystemFunction036

mswsock

AcceptEx GetAcceptExSockaddrs

api-ms-win-core-file-l1-2-1

ReadFile WriteFile

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI DelayLoadFailureHook

api-ms-win-core-kernel32-legacy-l1-1-1

BindIoCompletionCallback

Name

.text

Size

52KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

280B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

5d5854cef67f68aa0d37bf540b518520_NeikiAnalytics.exe

msvcrt

api-ms-win-core-synch-l1-2-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-registry-l1-1-0

api-ms-win-core-memory-l1-1-2

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-string-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-heap-l1-2-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-profile-l1-1-0

api-ms-win-core-rtlsupport-l1-2-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

cryptbase

mswsock

api-ms-win-core-file-l1-2-1

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-kernel32-legacy-l1-1-1

generic