665786c300aab4001c1ce1ce414b5870_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
665786c300aab4001c1ce1ce414b5870_NeikiAnalytics.exe
Size 1.3MB
Sample240613-he5wrasapj
SHA256 92d6644aac9dbf76ad75fc8f634b68dbac3b5cf33b74c342ec78fdd91c687478
MD5 665786c300aab4001c1ce1ce414b5870
SHA1 d76899240c5846c829b211fe03adfea3444b7a3f
SHA512 7d6dc0de8201b74f9eb38990e11b5a5892d1fb3d1efd535df05efeb741883ae1844ac2389b22ab152ce5ef88952c1ffdd1a5f74d1966f15760de569ecd12e560
SSDEEP 24576:2Q342kRC7UTWuKk0fob0gEEVFQmic8WU:2Q3m2UyuFlIAFQmd8WU
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
665786c300aab4001c1ce1ce414b5870_NeikiAnalytics.exe

File Explorer

665786c300aab4001c1ce1ce414b5870_NeikiAnalytics.exe

.exe 1.3MB

665786c300aab4001c1ce1ce414b5870_NeikiAnalytics.exe

IMPHASH 290ed5ed5e77a4ad2a79bf3733c18d20
SHA256 92d6644aac9dbf76ad75fc8f634b68dbac3b5cf33b74c342ec78fdd91c687478
MD5 665786c300aab4001c1ce1ce414b5870
SHA1 d76899240c5846c829b211fe03adfea3444b7a3f
SHA512 7d6dc0de8201b74f9eb38990e11b5a5892d1fb3d1efd535df05efeb741883ae1844ac2389b22ab152ce5ef88952c1ffdd1a5f74d1966f15760de569ecd12e560
SSDEEP 24576:2Q342kRC7UTWuKk0fob0gEEVFQmic8WU:2Q3m2UyuFlIAFQmd8WU
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

82544

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\mspdbsrv.pdb

advapi32

GetTokenInformation OpenThreadToken EqualSid OpenProcessToken

kernel32

InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetCurrentProcessId GetLastError CloseHandle GetCurrentProcess GetCommandLineW GetCurrentThread CreateEventW CreateWaitableTimerW SetPriorityClass CreateMutexW WaitForSingleObject ReleaseMutex WaitForMultipleObjectsEx OpenEventW SetEvent CancelWaitableTimer SetWaitableTimer VirtualQuery GetModuleFileNameW RaiseFailFastException SetErrorMode OpenProcess DuplicateHandle GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetModuleHandleW TerminateProcess QueryPerformanceCounter

vcruntime140

_CxxThrowException __std_exception_destroy __std_exception_copy memset __current_exception_context __current_exception memcpy wcschr memmove __C_specific_handler

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

strncpy_s wcsncpy_s _wcsdup _wcsicmp iswspace

api-ms-win-crt-stdio-l1-1-0

fflush _set_fmode __acrt_iob_func __stdio_common_vsnwprintf_s fclose __stdio_common_vfwprintf _wfopen_s __p__commode

api-ms-win-crt-time-l1-1-0

_wctime64 _time64

api-ms-win-crt-heap-l1-1-0

malloc free _set_new_mode _callnewh

api-ms-win-crt-convert-l1-1-0

wcstoul

api-ms-win-crt-environment-l1-1-0

_wdupenv_s

api-ms-win-crt-runtime-l1-1-0

_crt_atexit terminate _register_thread_local_exe_atexit_callback _c_exit _cexit __p___wargv __p___argc _initialize_onexit_table _exit _register_onexit_function _seh_filter_exe _set_app_type exit _configure_wide_argv _initialize_wide_environment _initterm _get_initial_wide_environment _initterm_e

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

mspdbcore

?CloseAllTimeoutPDB@PDB@@SAHXZ ?SetErrorHandlerAPI@PDB@@SAHP6APEAUIPDBError@@PEAU1@@Z@Z ?OpenEx2W@PDB@@SAHPEBGPEBDJPEAJPEAG_KPEAPEAU1@@Z ?RPC@PDB@@SAHXZ ?OpenValidate4@PDB@@SAHPEBGPEBDPEBU_GUID@@KKPEAJPEAG_KPEAPEAU1@@Z ?open@NameMap@@SAHPEAUPDB@@HPEAPEAU1@@Z ?FOpenW@MREngine@@SAHPEAPEAU1@PEBGAEAJPEAG_KHH@Z ?FOpen@MREngine@@SAHPEAPEAU1@PEAUMreToPdb@@HH@Z ?SetPDBCloseTimeout@PDB@@SAH_K@Z ?FOpen@MREngine@@SAHPEAPEAU1@PEAUPDB@@PEAUNameMap@@HH@Z ?ShutDownTimeoutManager@PDB@@SAHXZ ?OpenNgenPdb@PDB@@SAHPEBG0PEAJPEAG_KPEAPEAU1@@Z

rpcrt4

RpcMgmtStopServerListening RpcServerListen RpcServerRegisterIf2 RpcServerUseProtseqEpW RpcServerUnregisterIf RpcRevertToSelf RpcImpersonateClient NdrClientCall2 NdrServerCall2 RpcBindingInqAuthClientW RpcMgmtInqStats RpcMgmtStatsVectorFree

Name

.text

Size

81KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

65KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.1MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

665786c300aab4001c1ce1ce414b5870_NeikiAnalytics.exe

advapi32

kernel32

vcruntime140

vcruntime140_1

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

mspdbcore

rpcrt4

generic