325137e5bfb0a47bbff1779bb4952730e4703bc0d7d239a802325945a3130003_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

325137e5bfb0a47bbff1779bb4952730e4703bc0d7d239a802325945a3130003_NeikiAnalytics.exe
Size

500KB
MD5

800ed3b6a8e40e49516d54c83d1c24f0
SHA1

13fdc81a40b436564028e7942e0e6e180488bd15
SHA256

325137e5bfb0a47bbff1779bb4952730e4703bc0d7d239a802325945a3130003
SHA512

a271282f938a8bda94288357a944bee0221ee89355c80799260773496dfc43ad9da1f7b08b6889a1a2a5c5c89519a1feb7bb9b66d44214ebb9c35695c0162e1c
SSDEEP

6144:dFy4NMOloGd0rQP4IMttSwS11SqwfSaWMS3gzSLSaSEhSGSBSUSySWSfSfStStSb:dFyFdYzTQrkdfV/8eNP9Z1t

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
325137e5bfb0a47bbff1779bb4952730e4703bc0d7d239a802325945a3130003_NeikiAnalytics.exe

Files

325137e5bfb0a47bbff1779bb4952730e4703bc0d7d239a802325945a3130003_NeikiAnalytics.exe
.dll windows:6 windows x64 arch:x64

7a1b7e5f9b558289f8e56a3d4af2676f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

libpypy3-c

PyPyErr_NormalizeException
PyPyErr_SetString
PyPyMem_Realloc
PyPyTuple_Type
PyPyCapsule_New
PyPyNumber_Multiply
PyPyImport_GetModuleDict
PyPyFloat_Type
PyPyDict_SetItem
PyPyLong_FromLongLong
PyPyLong_Type
PyPySequence_Contains
PyPyErr_Fetch
PyPyObject_GetIter
PyPyFloat_AS_DOUBLE
PyPyLong_FromLong
PyPyEval_SaveThread
PyPyFloat_FromDouble
PyPyFrame_New
PyPyObject_IsInstance
PyPyOS_snprintf
PyPyLong_AsLongLong
PyPyExc_TypeError
PyPyType_Modified
PyPySequence_List
PyPyErr_WarnFormat
PyPyBool_Type
_PyPy_EllipsisObject
PyPyObject_GetItem
PyPyUnicode_FromFormat
PyPyNumber_InPlaceAdd
PyPyObject_Format
PyPyErr_Occurred
PyPyTraceBack_Here
PyPyThreadState_Get
PyPyType_Ready
PyPyObject_Not
PyPyCapsule_GetName
PyPyFloat_AsDouble
PyPyImport_ImportModuleLevelObject
PyPyExc_SystemError
PyPyErr_Clear
PyPyDict_GetItemString
PyPyExc_StopIteration
PyPyModule_GetDict
PyPyBytes_FromStringAndSize
PyPyCFunction_NewEx
PyPyList_SET_ITEM
PyPyCapsule_Type
PyPyCapsule_IsValid
PyPyUnicode_Decode
PyPyObject_SetAttr
PyPyObject_IsSubclass
PyPyErr_SetObject
PyPyDict_Size
PyPyExc_ImportError
PyPyImport_ImportModule
PyPyImport_AddModule
PyPyTuple_New
PyPyObject_Call
PyPyCode_NewEmpty
PyPyList_Append
PyPySequence_ITEM
_PyPy_FalseStruct
PyPyNumber_Add
PyPyErr_Restore
PyPyExc_RuntimeError
PyPyModule_Create2
PyPyUnicode_FromStringAndSize
PyPyObject_RichCompareBool
PyPyExc_Exception
PyPyEval_RestoreThread
PyPyUnicode_Compare
PyPyDict_Copy
PyPyException_SetTraceback
PyPyModule_GetName
PyPyExc_ValueError
PyPyNumber_InPlaceTrueDivide
PyPyObject_SetItem
_PyPy_TrueStruct
PyPyErr_Format
PyPyNumber_Subtract
PyPyLong_FromSsize_t
PyPyErr_SetExcInfo
PyPyList_AsTuple
PyPyErr_GetExcInfo
PyPyMem_Malloc
PyPyBytes_Type
PyPyObject_RichCompare
PyPyType_IsSubtype
PyPyCapsule_GetPointer
PyPyLong_AsLong
_PyPy_Dealloc
PyPyObject_IsTrue
PyPyUnicode_Format
PyPyDict_SetItemString
PyPyObject_GetAttr
PyPyList_New
PyPyBaseObject_Type
PyPyObject_DelItem
PyPyErr_ExceptionMatches
PyPyDict_GetItem
PyPySequence_Tuple
PyPyErr_WarnEx
PyPyExc_AttributeError
PyPyObject_GetAttrString
PyPyLong_FromString
PyPyNumber_Long
PyPyExc_DeprecationWarning
PyPyNumber_Remainder
PyPyObject_Size
PyPySequence_Size
PyPy_GetVersion
PyPyUnicode_Type
PyPySlice_New
PyPyList_Type
PyPyExc_BaseException
PyPyDict_Next
PyPyTuple_Pack
PyPyObject_SetAttrString
_PyPy_NoneStruct
PyPySequence_Check
PyPyExc_NameError
PyPyUnicode_InternFromString
PyPyUnicode_Join
PyPyObject_Hash
PyPyUnicode_AsUTF8
PyPySequence_GetItem
PyPySequence_SetItem
PyPyDict_New
PyPyCode_New

kernel32

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
InitializeSListHead
IsDebuggerPresent

vcruntime140

__std_type_info_destroy_list
__C_specific_handler
memcpy
memset

api-ms-win-crt-math-l1-1-0

log1p
log1pf
expm1
acos
ceil
cos
exp
expf
floor
fmod
log
logf
pow
sqrtf
sqrt
powf

api-ms-win-crt-runtime-l1-1-0

_cexit
_execute_onexit_table
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_initterm

Exports

Exports

PyInit_mtrand
random_beta
random_binomial
random_bounded_bool_fill
random_bounded_uint16_fill
random_bounded_uint32_fill
random_bounded_uint64
random_bounded_uint64_fill
random_bounded_uint8_fill
random_buffered_bounded_bool
random_buffered_bounded_uint16
random_buffered_bounded_uint32
random_buffered_bounded_uint8
random_chisquare
random_exponential
random_f
random_gamma
random_gamma_f
random_geometric
random_geometric_search
random_gumbel
random_interval
random_laplace
random_logistic
random_lognormal
random_logseries
random_multinomial
random_negative_binomial
random_noncentral_chisquare
random_noncentral_f
random_normal
random_pareto
random_poisson
random_positive_int
random_positive_int32
random_positive_int64
random_power
random_rayleigh
random_standard_cauchy
random_standard_exponential
random_standard_exponential_f
random_standard_exponential_fill
random_standard_exponential_fill_f
random_standard_exponential_inv_fill
random_standard_exponential_inv_fill_f
random_standard_gamma
random_standard_gamma_f
random_standard_normal
random_standard_normal_f
random_standard_normal_fill
random_standard_normal_fill_f
random_standard_t
random_standard_uniform
random_standard_uniform_f
random_standard_uniform_fill
random_standard_uniform_fill_f
random_triangular
random_uint
random_uniform
random_vonmises
random_wald
random_weibull
random_zipf

Sections

.text
Size: 157KB - Virtual size: 156KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 178KB - Virtual size: 177KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 156KB - Virtual size: 162KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7a1b7e5f9b558289f8e56a3d4af2676f

Headers

DLL Characteristics

File Characteristics

Imports

libpypy3-c

kernel32

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

Exports

Exports

Sections

.text Size: 157KB - Virtual size: 156KB

.rdata Size: 178KB - Virtual size: 177KB

.data Size: 156KB - Virtual size: 162KB

.pdata Size: 5KB - Virtual size: 4KB

.rsrc Size: 512B - Virtual size: 248B

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 157KB - Virtual size: 156KB

.rdata
Size: 178KB - Virtual size: 177KB

.data
Size: 156KB - Virtual size: 162KB

.pdata
Size: 5KB - Virtual size: 4KB

.rsrc
Size: 512B - Virtual size: 248B

.reloc
Size: 2KB - Virtual size: 2KB