aeeb43d47ffd09b76ba73144b2b534f0_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

aeeb43d47ffd09b76ba73144b2b534f0_NeikiAnalytics.exe
Size

1.8MB
MD5

aeeb43d47ffd09b76ba73144b2b534f0
SHA1

eba54eab48cd06b8ef300efb54b066c4c931a722
SHA256

4ee95d3ba1ea909bbe9c4e293d5d875ef603e73d0429b3122c0aa33ab1d4d3c1
SHA512

f2a1f5488552529eb0eabd041c6843a83f4dbd474c82b6260345592afb3457a1792f0eb19c96ae936fef9babf3c2825225660af174477d4f6a3d3b4983baff50
SSDEEP

24576:8JD5lUbdx4+L6VMRCPU6CENltmVVdpx7fLrQWd:QD5lUbdxn6ZU6CENlc7dpJLrQWd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aeeb43d47ffd09b76ba73144b2b534f0_NeikiAnalytics.exe

Files

aeeb43d47ffd09b76ba73144b2b534f0_NeikiAnalytics.exe
.exe windows:10 windows x64 arch:x64

702a07ff266ecfbceeac19b4bdb17820

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

vshadow.pdb

Imports

kernel32

GetLastError
GetVolumePathNamesForVolumeNameW
WriteFile
CloseHandle
CreateFileW
WideCharToMultiByte
QueryDosDeviceW
GetFileAttributesW
FindFirstFileW
FindClose
FindNextFileW
GetThreadLocale
GetTimeFormatW
GetDateFormatW
FileTimeToSystemTime
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
GetVolumePathNameW
ExpandEnvironmentStringsW
VerSetConditionMask
VerifyVersionInfoW
HeapSetInformation
GetExitCodeProcess
LocalFree
CreateProcessW
ReadFile
GetFileSize
GetCommandLineW
GetCurrentProcess
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
SetUnhandledExceptionFilter
Sleep
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
DecodePointer
EncodePointer
InitializeCriticalSectionEx
GetStringTypeW
MultiByteToWideChar
WaitForSingleObject
FormatMessageW
TerminateProcess

msvcrt

??0exception@@QEAA@AEBQEBDH@Z
_CxxThrowException
memcpy
memmove
_errno
___mb_cur_max_func
___lc_handle_func
___lc_codepage_func
_ismbblead
__uncaught_exception
setlocale
_lock
_unlock
_fsopen
fseek
__pctype_func
isupper
calloc
__iob_func
fputc
memset
islower
__mb_cur_max
__crtLCMapStringW
__crtLCMapStringA
_wsetlocale
abort
_callnewh
_XcptFilter
_amsg_exit
__wgetmainargs
__set_app_type
exit
_exit
_cexit
__setusermatherr
_initterm
__C_specific_handler
_fmode
_commode
__dllonexit
_onexit
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
strcspn
fputwc
ungetwc
fclose
localeconv
??_V@YAXPEAX@Z
__CxxFrameHandler3
??3@YAXPEAX@Z
_purecall
_vsnwprintf
wprintf
??0exception@@QEAA@AEBV0@@Z
?what@exception@@UEBAPEBDXZ
malloc
getchar
_wcsnicmp
_wcsicmp
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBQEBD@Z
fflush
setvbuf
free
??0bad_cast@@QEAA@PEBD@Z
??1bad_cast@@UEAA@XZ
??0bad_cast@@QEAA@AEBV0@@Z
sprintf_s
fwrite
memcpy_s
ungetc
fgetc
fgetwc
fgetpos
_fseeki64
fsetpos
_wcsdup

atl

ord30

oleaut32

SysFreeString
SysAllocString

ole32

CLSIDFromString
CoInitializeSecurity
CoInitialize
CoUninitialize
CoTaskMemFree
CoCreateInstance

vssapi

VssFreeSnapshotPropertiesInternal
CreateVssBackupComponentsInternal
ShouldBlockRevertInternal

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

resutils

ClusterPrepareSharedVolumeForBackup
ClusterIsPathOnSharedVolume
ClusterGetVolumePathName
ClusterGetVolumeNameForVolumeMountPoint

shlwapi

PathFileExistsW

Sections

.text
Size: 210KB - Virtual size: 210KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 119KB - Virtual size: 119KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

702a07ff266ecfbceeac19b4bdb17820

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

msvcrt

atl

oleaut32

ole32

vssapi

ntdll

resutils

shlwapi

Sections

.text Size: 210KB - Virtual size: 210KB

.rdata Size: 119KB - Virtual size: 119KB

.data Size: 512B - Virtual size: 3KB

.pdata Size: 6KB - Virtual size: 5KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1.4MB - Virtual size: 1.4MB

.text
Size: 210KB - Virtual size: 210KB

.rdata
Size: 119KB - Virtual size: 119KB

.data
Size: 512B - Virtual size: 3KB

.pdata
Size: 6KB - Virtual size: 5KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1.4MB - Virtual size: 1.4MB