6040aac2be50c9c8917727ceff732850_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
6040aac2be50c9c8917727ceff732850_NeikiAnalytics.exe
Size 2.3MB
Sample240613-flnvpsydqm
SHA256 c5816e8f42baed9b05ba39613b86b148a840e8c48a7f7e0e6c2f4c569698c634
MD5 6040aac2be50c9c8917727ceff732850
SHA1 85b01ca0d7333ed7c692a3f4527e2d5b830fccbf
SHA512 048a9d51e5b2c56f40373d826e6d10cfdb3c42a3d5a24731d8414676fe11e49f2a1816f7775fb9a34c0bf331264d044509a6f6c732a4b12720bb20ba9f24d8ed
SSDEEP 49152:J7aIKRVygfktbIiWyl4JoDFI3NU13ZPyekw8Zo0iSRvDIjtrGR1RPwnveJn7:fSzaDrxG1PQvy7
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6040aac2be50c9c8917727ceff732850_NeikiAnalytics.exe

File Explorer

6040aac2be50c9c8917727ceff732850_NeikiAnalytics.exe

.exe 2.3MB

6040aac2be50c9c8917727ceff732850_NeikiAnalytics.exe

IMPHASH ec0e7aa6ecb803ce5b956d6de2f52f04
SHA256 c5816e8f42baed9b05ba39613b86b148a840e8c48a7f7e0e6c2f4c569698c634
MD5 6040aac2be50c9c8917727ceff732850
SHA1 85b01ca0d7333ed7c692a3f4527e2d5b830fccbf
SHA512 048a9d51e5b2c56f40373d826e6d10cfdb3c42a3d5a24731d8414676fe11e49f2a1816f7775fb9a34c0bf331264d044509a6f6c732a4b12720bb20ba9f24d8ed
SSDEEP 49152:J7aIKRVygfktbIiWyl4JoDFI3NU13ZPyekw8Zo0iSRvDIjtrGR1RPwnveJn7:fSzaDrxG1PQvy7
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1088192

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

mt2.pdb

ntdll

RtlDowncaseUnicodeChar DbgPrintEx RtlMultiByteToUnicodeN RtlMultiByteToUnicodeSize RtlUpcaseUnicodeChar RtlHashUnicodeString NtQueryPerformanceCounter RtlFreeAnsiString NtClose RtlUnicodeStringToAnsiString RtlNtStatusToDosErrorNoTeb RtlPcToFileHeader RtlCaptureContext NtCreateFile DbgPrint NtWriteFile

bcrypt

BCryptCreateHash BCryptDestroyHash BCryptFinishHash BCryptHashData

kernel32

EnumResourceLanguagesExW SwitchToThread SetEnvironmentVariableW GetLastError FormatMessageW GetModuleHandleW CreateFileW WriteFile SetEndOfFile CloseHandle LocalFree GetStdHandle GetEnvironmentVariableW SetStdHandle GetFileType GetConsoleMode HeapSetInformation GetCurrentDirectoryW GetFileSize ReadFile FreeEnvironmentStringsW GetEnvironmentStringsW FindNextFileW LoadLibraryA GetProcAddress FindResourceExW LoadResource SizeofResource LockResource MapViewOfFile FindFirstFileExW MultiByteToWideChar GetCommandLineW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection DuplicateHandle GetCurrentProcess RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent SetLastError GetCurrentThreadId HeapAlloc HeapFree InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime FreeLibrary CreateFileA CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetStartupInfoW GetModuleFileNameW FlushFileBuffers GetConsoleOutputCP GetFileSizeEx SetFilePointerEx GetStringTypeW IsValidCodePage GetACP GetOEMCP GetCPInfo GetProcessHeap OutputDebugStringW WideCharToMultiByte ExitProcess GetModuleHandleExW WriteConsoleW HeapSize HeapReAlloc SetEvent ResetEvent WaitForSingleObjectEx CreateEventW QueryPerformanceCounter GetCurrentProcessId InitializeSListHead RtlUnwindEx FlsAlloc FlsGetValue FlsSetValue EnumResourceNamesW EncodePointer RaiseException InitializeCriticalSectionEx InitializeCriticalSection FindClose HeapDestroy GetModuleFileNameA CreateFileMappingA UnmapViewOfFile GetFileAttributesW DebugBreak LoadLibraryExW FlsFree EnumResourceLanguagesW GetFullPathNameW GetCommandLineA LCMapStringEx DecodePointer InitOnceExecuteOnce BeginUpdateResourceW UpdateResourceW EndUpdateResourceW lstrcmpiA

ole32

CLSIDFromString CoInitialize StringFromIID CoUninitialize CoCreateInstance CoTaskMemAlloc CoTaskMemFree StringFromCLSID

advapi32

CryptReleaseContext CryptDestroyHash CryptHashData CryptCreateHash CryptAcquireContextA CryptGetHashParam ConvertStringSecurityDescriptorToSecurityDescriptorW

shell32

CommandLineToArgvW

imagehlp

ImageDirectoryEntryToData ImageRvaToVa ImageGetDigestStream ImageNtHeader

oleaut32

VariantInit LoadTypeLibEx SysStringLen VariantChangeType VariantClear SysFreeString VarBstrCat SysAllocStringLen SysAllocStringByteLen SysAllocString

user32

UnregisterClassA CharNextA CharNextW

midlrtmd

MetaDataGetDispenser

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

524KB

Virtual Size

524KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

36KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

48KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

580KB

Virtual Size

584KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

6040aac2be50c9c8917727ceff732850_NeikiAnalytics.exe

ntdll

bcrypt

kernel32

ole32

advapi32

shell32

imagehlp

oleaut32

user32

midlrtmd

generic