6eec07eecb920a9ecfa5a81c55a6dc30_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
6eec07eecb920a9ecfa5a81c55a6dc30_NeikiAnalytics.exe
Size 1.3MB
Sample240613-ky5ffasbma
SHA256 7cbf41f959348c58bf4d3974a24483442c9d424f11a5ec2a70598a2eebbea51c
MD5 6eec07eecb920a9ecfa5a81c55a6dc30
SHA1 37890f80a5716f990fb80fed38c8c07b0fc1aa6f
SHA512 75593dd2489a283b874dd0d782b7a4166de09b2d85be2378b5e574a8817e819bd8c542331ea483cc5641886b285d03688fe6ae3a2fa163907beb767f84eef61f
SSDEEP 24576:KLfUfy3LutmkEz+PAVV/OOInO4Xs2ztR4iegxLHgZpJE4VDd+:KLfUqbutmkO+wAOInO4XrztygxLHkJEm
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6eec07eecb920a9ecfa5a81c55a6dc30_NeikiAnalytics.exe

File Explorer

6eec07eecb920a9ecfa5a81c55a6dc30_NeikiAnalytics.exe

.exe 1.3MB

6eec07eecb920a9ecfa5a81c55a6dc30_NeikiAnalytics.exe

IMPHASH 962ded2e727f180e5b6d49d6a8ebc365
SHA256 7cbf41f959348c58bf4d3974a24483442c9d424f11a5ec2a70598a2eebbea51c
MD5 6eec07eecb920a9ecfa5a81c55a6dc30
SHA1 37890f80a5716f990fb80fed38c8c07b0fc1aa6f
SHA512 75593dd2489a283b874dd0d782b7a4166de09b2d85be2378b5e574a8817e819bd8c542331ea483cc5641886b285d03688fe6ae3a2fa163907beb767f84eef61f
SSDEEP 24576:KLfUfy3LutmkEz+PAVV/OOInO4Xs2ztR4iegxLHgZpJE4VDd+:KLfUqbutmkO+wAOInO4XrztygxLHkJEm
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

89912

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

AppVShNotify.pdb

kernel32

SubmitThreadpoolWork DecodePointer InitializeCriticalSectionEx CreateThreadpoolWork CloseThreadpoolWork GetCurrentProcessId GetLocalTime LocalFree HeapReAlloc HeapAlloc GetCurrentProcess HeapFree GetModuleHandleW GetCurrentThread GetProcessHeap Sleep HeapDestroy GetProcAddress HeapSize CloseHandle EncodePointer IsDebuggerPresent IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime OutputDebugStringW DebugBreak GetCurrentThreadId DeleteCriticalSection CloseThreadpool HeapSetInformation SetThreadpoolThreadMinimum EnterCriticalSection CloseThreadpoolCleanupGroupMembers CreateThreadpoolCleanupGroup GetLastError LeaveCriticalSection SetThreadpoolThreadMaximum CreateThreadpool InitializeCriticalSection CloseThreadpoolCleanupGroup

user32

DispatchMessageW GetMessageW TranslateMessage

advapi32

GetLengthSid GetSecurityDescriptorSacl AddAce InitializeSid GetSidLengthRequired IsValidSid GetSecurityDescriptorOwner SetSecurityDescriptorOwner InitializeAcl MakeAbsoluteSD SetSecurityDescriptorDacl InitializeSecurityDescriptor GetSecurityDescriptorControl GetSecurityDescriptorDacl EventUnregister EventRegister CopySid EventWrite GetAclInformation GetTokenInformation SetSecurityDescriptorGroup OpenThreadToken GetSidSubAuthority OpenProcessToken GetSecurityDescriptorGroup ConvertSidToStringSidW

ole32

CoInitializeEx CoCreateInstance CoUninitialize

msvcp120

?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ ?_Getfalse@_Locinfo@std@@QEBAPEBDXZ ?_Gettrue@_Locinfo@std@@QEBAPEBDXZ ??1_Facet_base@std@@UEAA@XZ ??Bid@locale@std@@QEAA_KXZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ??0facet@locale@std@@IEAA@_K@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z ??_7_Facet_base@std@@6B@ _Mbrtowc ??_7facet@locale@std@@6B@ ?classic@locale@std@@SAAEBV12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?id@?$numpunct@_W@std@@2V0locale@2@A ?exceptions@ios_base@std@@QEAAXH@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?setg@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W00@Z ?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W0@Z ?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ?uncaught_exception@std@@YA_NXZ ?_BADOFF@std@@3_JB ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Orphan_all@_Container_base0@std@@QEAAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ?_Syserror_map@std@@YAPEBDH@Z ?_Winerror_map@std@@YAPEBDH@Z ??1facet@locale@std@@MEAA@XZ

msvcr120

__crtSetUnhandledExceptionFilter ?_type_info_dtor_internal_method@type_info@@QEAAXXZ memset memmove_s _wcsicmp calloc malloc _resetstkoflw memcpy_s __crtCapturePreviousContext __crtTerminateProcess __crtUnhandledException __crt_debugger_hook _commode _fmode _wcmdln _initterm _initterm_e __setusermatherr _configthreadlocale _cexit _exit exit __CxxFrameHandler3 __set_app_type __wgetmainargs _amsg_exit __crtGetShowWindowMode _XcptFilter _onexit __C_specific_handler __dllonexit _calloc_crt _unlock _lock free ??0bad_cast@std@@QEAA@AEBV01@@Z ??0bad_cast@std@@QEAA@PEBD@Z ??1bad_cast@std@@UEAA@XZ swprintf_s ??_V@YAXPEAX@Z iswdigit _wtoi ??2@YAPEAX_K@Z ?terminate@@YAXXZ strrchr ??3@YAXPEAX@Z _purecall memmove ??0exception@std@@QEAA@AEBV01@@Z ??0exception@std@@QEAA@AEBQEBDH@Z ??1exception@std@@UEAA@XZ ?what@exception@std@@UEBAPEBDXZ _stricmp _CxxThrowException memcmp memcpy

rpcrt4

NdrServerCall2 RpcServerUseProtseqEpW RpcServerUnregisterIf RpcServerRegisterAuthInfoW RpcServerRegisterIf2 RpcImpersonateClient RpcBindingInqAuthClientW RpcServerListen RpcRevertToSelf

shell32

SHCreateItemFromParsingName SHChangeNotify

userenv

UnloadUserProfile