6fc77eea81243b098a5b4ece7fa19670_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
6fc77eea81243b098a5b4ece7fa19670_NeikiAnalytics.exe
Size 121KB
Sample240613-k7ldxssdpf
SHA256 add6e480d6359d0ab0ec5c8bed86d94e84cf2302a3f3841c254caa96e3a17a52
MD5 6fc77eea81243b098a5b4ece7fa19670
SHA1 169c67ab93dfda0708c0a5062f9b42514dec7497
SHA512 2588285377d667e566c0be6ab83bb76d46ef4fb5c77e501ff638c151b778b3d2ed1c37f912459b03974cfb77bc1fafafee2f8bf4435c6cb39dd5d93ebc9561b2
SSDEEP 3072:r/Nora0wU1zKPOPPqranL6TVF6ICiypA3ctMm+yEij:TNSMqYOnsTVxy23cGij
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6fc77eea81243b098a5b4ece7fa19670_NeikiAnalytics.exe

File Explorer

6fc77eea81243b098a5b4ece7fa19670_NeikiAnalytics.exe

.exe 121KB

6fc77eea81243b098a5b4ece7fa19670_NeikiAnalytics.exe

IMPHASH 1ac96dc78a84e3f36d04a1a12aca3a97
SHA256 add6e480d6359d0ab0ec5c8bed86d94e84cf2302a3f3841c254caa96e3a17a52
MD5 6fc77eea81243b098a5b4ece7fa19670
SHA1 169c67ab93dfda0708c0a5062f9b42514dec7497
SHA512 2588285377d667e566c0be6ab83bb76d46ef4fb5c77e501ff638c151b778b3d2ed1c37f912459b03974cfb77bc1fafafee2f8bf4435c6cb39dd5d93ebc9561b2
SSDEEP 3072:r/Nora0wU1zKPOPPqranL6TVF6ICiypA3ctMm+yEij:TNSMqYOnsTVxy23cGij
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

20116

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_AGGRESIVE_WS_TRIM IMAGE_FILE_32BIT_MACHINE

PDB paths

msvcrt

towupper wcsspn _wcsicmp wcslen wcsncpy wcscat exit swprintf __p___initenv _exit _XcptFilter __setusermatherr __getmainargs _initterm __p__fmode _adjust_fdiv __p__commode _controlfp __set_app_type _except_handler3 _wtol wcspbrk memmove _ultow wcsrchr wcschr ??2@YAPAXI@Z _purecall _wcsrev ??3@YAXPAX@Z _wcsnicmp wcscpy _itow

advapi32

GetSidLengthRequired EqualSid ImpersonateSelf AddAce GetSecurityDescriptorDacl RegEnumKeyExW RegOpenKeyExA RegCreateKeyExW GetUserNameW LookupAccountSidW LsaStorePrivateData LsaRetrievePrivateData CreateProcessAsUserW LogonUserW ImpersonateLoggedOnUser GetKernelObjectSecurity IsTokenRestricted LsaQueryInformationPolicy LookupAccountNameW CryptGetHashParam CryptReleaseContext CryptAcquireContextW CryptGenKey CryptDestroyKey LsaFreeMemory GetSidIdentifierAuthority AdjustTokenPrivileges LookupPrivilegeValueW FreeSid SetKernelObjectSecurity SetFileSecurityW SetSecurityDescriptorDacl InitializeSecurityDescriptor AddAccessAllowedAce InitializeAcl GetLengthSid SetNamedSecurityInfoW AllocateAndInitializeSid RevertToSelf OpenThreadToken CryptDestroyHash RegQueryValueExW RegCloseKey RegSetValueExW CheckTokenMembership SetServiceStatus RegisterServiceCtrlHandlerExW StartServiceCtrlDispatcherW CryptCreateHash CryptHashData CryptSignHashW DeregisterEventSource LsaOpenPolicy LsaAddAccountRights LsaClose GetFileSecurityW GetSecurityDescriptorOwner IsValidSid GetSidSubAuthorityCount GetSidSubAuthority ReportEventW RegisterEventSourceW GetTokenInformation CopySid OpenProcessToken RegDeleteValueW RegOpenKeyExW RegConnectRegistryW

kernel32

UnmapViewOfFile OpenEventW WaitForMultipleObjects DeleteFileW CreateThread GetSystemPowerStatus InterlockedExchange DeleteAtom SetConsoleCtrlHandler GetFullPathNameW MultiByteToWideChar ResetEvent VirtualFree GetDriveTypeW IsBadWritePtr LoadLibraryExW FormatMessageA GetLocaleInfoW GetUserDefaultLCID GetVersionExW TlsGetValue TlsSetValue GetVolumeInformationW GetModuleHandleW CreateProcessW SearchPathW lstrcpynW SetFileAttributesW GetSystemTime GetFileInformationByHandle SetCurrentDirectoryW GetEnvironmentVariableW SetEnvironmentVariableW SetLastError SetThreadPriority GetComputerNameW GetCurrentProcess TerminateProcess GetExitCodeProcess GetTickCount InterlockedDecrement InterlockedIncrement VirtualAlloc SetEvent WriteFile CreateFileW GetFileSize CreateFileMappingW MapViewOfFile ExpandEnvironmentStringsW CreateDirectoryW GetFileAttributesW WaitForSingleObject ReleaseMutex GetCurrentThread CloseHandle HeapFree GetProcessHeap HeapAlloc CreateEventW GetLastError CreateMutexW FindClose GetStartupInfoW FindNextFileW FindFirstFileW ProcessIdToSessionId LocalReAlloc OpenProcess FreeLibrary FindNextChangeNotification LoadLibraryW TlsFree LocalAlloc TlsAlloc FormatMessageW SetEndOfFile LocalFree GetTimeFormatW SetFilePointer GetDateFormatW FindFirstChangeNotificationW LocalFileTimeToFileTime ReadFile lstrcmpiW GetLocalTime CompareFileTime FileTimeToLocalFileTime GetSystemTimeAsFileTime InitializeCriticalSection SystemTimeToFileTime CancelWaitableTimer SetWaitableTimer FileTimeToSystemTime FindCloseChangeNotification Sleep lstrcpyW lstrcatW LeaveCriticalSection EnterCriticalSection DeleteCriticalSection lstrlenW GetCurrentDirectoryW CreateWaitableTimerW GetProcAddress

gdi32

GetStockObject

user32

CreateWindowExW MessageBoxW wsprintfA CreateDesktopW PostQuitMessage DestroyWindow SetProcessWindowStation SetUserObjectSecurity CloseWindowStation CreateWindowStationW CloseDesktop GetWindowThreadProcessId EnumWindows EnumThreadWindows LoadStringA wsprintfW LoadStringW DispatchMessageW MessageBoxA PostMessageW UpdateWindow TranslateMessage GetMessageW LoadCursorW ShowWindow RegisterClassW RegisterWindowMessageW SendMessageW DefWindowProcW

ntdll

RtlSetGroupSecurityDescriptor RtlSetDaclSecurityDescriptor RtlSetOwnerSecurityDescriptor RtlSetSaclSecurityDescriptor RtlLengthSid RtlDeleteSecurityObject RtlSubAuthorityCountSid RtlCopySid RtlAddAce RtlCreateSecurityDescriptor RtlInitializeSid NtDuplicateObject NtDuplicateToken NtSetInformationThread NtClose RtlNtStatusToDosError NtQuerySystemInformation NtSetSystemInformation RtlCreateAcl RtlNewSecurityObject NtOpenProcessToken RtlSubAuthoritySid RtlLengthRequiredSid RtlGetVersion NtAccessCheck NtOpenThreadToken

netapi32

DsGetDcNameW NetUserGetInfo NetApiBufferFree

secur32

GetUserNameExW

ntdsapi

DsFreeNameResultW DsBindW DsCrackNamesW DsUnBindW

shlwapi

PathFindExtensionW

shell32

SHChangeNotify FindExecutableW

rpcrt4

RpcEpRegisterW RpcServerRegisterAuthInfoW RpcBindingVectorFree RpcServerRegisterIf RpcServerUseProtseqW RpcEpUnregister RpcServerListen RpcMgmtStopServerListening RpcRevertToSelf RpcServerUnregisterIf RpcRaiseException I_RpcGetBuffer RpcImpersonateClient NdrPointerUnmarshall NdrConvert NdrConformantStringUnmarshall NdrConformantArrayMarshall NdrConformantArrayBufferSize NdrServerInitializeNew RpcServerUseProtseqEpW NdrPointerMarshall NdrPointerFree NdrSimpleStructBufferSize NdrSimpleStructUnmarshall NdrPointerBufferSize UuidCreate NdrConformantArrayUnmarshall RpcServerInqBindings NdrSimpleStructMarshall

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock UnloadUserProfile LoadUserProfileW