7bff215d144c3da1b3f6a6ad69e0c580_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
7bff215d144c3da1b3f6a6ad69e0c580_NeikiAnalytics.exe
Size 14KB
Sample240613-plwd8aydja
SHA256 dae8235a641b870aa32deb73067c48349e5f5a44d4ed525d6bb33519efa0a4e2
MD5 7bff215d144c3da1b3f6a6ad69e0c580
SHA1 9ac75e392853669679d964c05e2c38262f90dc9a
SHA512 a70908c0e626258a9a758e7a857bc2c64b7256b48af3d359bb2dd3a8a06b654a360e9cac042788a10c043934a80ff8c921984acd81f4c91728b46713be33199b
SSDEEP 192:AAX+C1i2FQqwvSlsxDeopb0rKCwz5R/Hh/rYdFFassgAV2hcji3Q5tfMcqXSL:IC42FQqwVxZbTCwHPadP3
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7bff215d144c3da1b3f6a6ad69e0c580_NeikiAnalytics.exe

File Explorer

7bff215d144c3da1b3f6a6ad69e0c580_NeikiAnalytics.exe

.exe 14KB

7bff215d144c3da1b3f6a6ad69e0c580_NeikiAnalytics.exe

IMPHASH 968df533d2ec9cff6c5102eb0e301c98
SHA256 dae8235a641b870aa32deb73067c48349e5f5a44d4ed525d6bb33519efa0a4e2
MD5 7bff215d144c3da1b3f6a6ad69e0c580
SHA1 9ac75e392853669679d964c05e2c38262f90dc9a
SHA512 a70908c0e626258a9a758e7a857bc2c64b7256b48af3d359bb2dd3a8a06b654a360e9cac042788a10c043934a80ff8c921984acd81f4c91728b46713be33199b
SSDEEP 192:AAX+C1i2FQqwvSlsxDeopb0rKCwz5R/Hh/rYdFFassgAV2hcji3Q5tfMcqXSL:IC42FQqwVxZbTCwHPadP3
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6080

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Fatimah\source\repos\ReverseShell\x64\Release\ReverseShell.pdb

kernel32

WaitForSingleObject GetLastError CloseHandle CreateProcessW RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetModuleHandleW RtlCaptureContext

msvcp140

?good@ios_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?uncaught_exception@std@@YA_NXZ ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z

ws2_32

WSACleanup inet_pton htons WSAStartup socket WSAGetLastError closesocket connect

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception __C_specific_handler memcpy __std_terminate __current_exception_context memset

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function terminate _get_initial_narrow_environment _crt_atexit _initialize_onexit_table _register_thread_local_exe_atexit_callback _initialize_narrow_environment _configure_narrow_argv _set_app_type _seh_filter_exe _c_exit _cexit __p___argv __p___argc _exit exit _initterm_e _initterm

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode