dc6c4144acb4a3f7465bd6dbadd02d50_NeikiAnalytics[.]exe | Triage

Sharing

General

Target

dc6c4144acb4a3f7465bd6dbadd02d50_NeikiAnalytics.exe
Size

12KB
MD5

dc6c4144acb4a3f7465bd6dbadd02d50
SHA1

58bee7d02203fbc57584194904cd6a1aa10410b2
SHA256

804ce7ca847a38bdd4bbbfcb277c548658bb2ac307c849bf3b74e21603722cf7
SHA512

f4295f0d5f9a1c2665a8c03afa615dceaa30336d403ddc6c865f135a32dae247c337000b0ef26f5040169a8e1415fb6d5e9fe90c086c204aa00632c6b959e131
SSDEEP

192:5SLI1CCmATr16wmisNH98f8iV118YDPIDO0PUiDDyS1jIWlJdxqHM31x:quJXbsbeCYTwONWlJj+k

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dc6c4144acb4a3f7465bd6dbadd02d50_NeikiAnalytics.exe

Files

dc6c4144acb4a3f7465bd6dbadd02d50_NeikiAnalytics.exe
.exe windows:4 windows x64 arch:x64

9968d5bb8fa4127f19a6bea1c4bbcf64

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

msvcrt

memset
printf
memcpy
memmove
rand
wcslen
strcmp
srand
strtol
_wsystem
_vsnprintf
_vsnwprintf
__set_app_type
_controlfp
__argc
__argv
_environ
__getmainargs
exit

kernel32

FileTimeToSystemTime
GetProcessHeap
HeapAlloc
HeapSize
HeapReAlloc
CreateFileW
GetLastError
Sleep
WriteFile
HeapFree
CloseHandle
SleepEx
GetCommandLineW
ExpandEnvironmentStringsW

ntdll

NtQuerySystemInformation
RtlGetNtVersionNumbers

winhttp

WinHttpOpen
WinHttpConnect
WinHttpOpenRequest
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpCloseHandle

bcrypt

BCryptEncrypt
BCryptDestroyHash
BCryptResolveProviders
BCryptSignHash
BCryptExportKey

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ