4b166d04f5fe570c2beeedf961bc0592b7fa05092d08cb75260a1fdc5699e888_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

4b166d04f5fe570c2beeedf961bc0592b7fa05092d08cb75260a1fdc5699e888_NeikiAnalytics.exe
Size

516KB
MD5

4217b6c7ff4a1778a44f151f2c36bd30
SHA1

1f2147a65780d3d56b3d06bf0be3bdafc90cc281
SHA256

4b166d04f5fe570c2beeedf961bc0592b7fa05092d08cb75260a1fdc5699e888
SHA512

a9a464f74ad7ae2e452bc53ecebd23a9665bb7c7e96805597caae1fbbbb2cdd18396cca837449f5331272846610e411628b8cb36bd7a15c93c772eeb52e8e66b
SSDEEP

6144:PJ+0vqL7Vacpmk29QClxhmE0c9Gdkwv//gayBhLIAHDDhe+Tb16PeWIH1pGp0TXl:P8v+proLYayBhLIGDhhllPN9P1TLsj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4b166d04f5fe570c2beeedf961bc0592b7fa05092d08cb75260a1fdc5699e888_NeikiAnalytics.exe

Files

4b166d04f5fe570c2beeedf961bc0592b7fa05092d08cb75260a1fdc5699e888_NeikiAnalytics.exe
.dll windows:6 windows x64 arch:x64

7784435a0a35915d3dde584a843e53e9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\builds\build-sourcemod-msvc12\windows-1.11\OUTPUT\extensions\pgsql\dbi.pgsql.ext\windows-x86_64\dbi.pgsql.ext.pdb

Imports

wsock32

inet_ntoa
select
ntohs
gethostbyname
htons
WSAGetLastError
WSASetLastError
WSAStartup
socket
setsockopt
send
recv
htonl
getsockopt
getsockname
WSACleanup
ntohl
connect
closesocket

ws2_32

WSAIoctl

secur32

AcquireCredentialsHandleA
DeleteSecurityContext
FreeCredentialsHandle
InitializeSecurityContextA
FreeContextBuffer

kernel32

SetThreadAffinityMask
SetEndOfFile
ReadConsoleW
ReadFile
HeapSize
GetTimeZoneInformation
WriteConsoleW
SetFilePointerEx
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
FindClose
GetProcessHeap
GetFileAttributesExA
CloseHandle
GetLastError
FormatMessageA
MultiByteToWideChar
WideCharToMultiByte
GetLocaleInfoEx
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
FreeLibrary
GetProcAddress
LoadLibraryA
LoadLibraryExA
TryEnterCriticalSection
DeleteCriticalSection
QueryPerformanceCounter
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
Sleep
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
SetEvent
WaitForSingleObjectEx
SignalObjectAndWait
SwitchToThread
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
DecodePointer
RegisterWaitForSingleObject
UnregisterWait
EncodePointer
GetCurrentThread
GetThreadTimes
FreeLibraryAndExitThread
GetModuleFileNameW
GetModuleHandleA
LoadLibraryExW
GetVersionExW
VirtualAlloc
VirtualFree
VirtualProtect
DuplicateHandle
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
CreateTimerQueue
LoadLibraryW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
CreateFileW
GetDriveTypeW
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetACP
GetStdHandle
GetStringTypeW
HeapReAlloc
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
WriteFile
GetConsoleCP
GetConsoleMode
GetCurrentDirectoryW
GetFullPathNameW
SetStdHandle

advapi32

GetUserNameA

shell32

SHGetFolderPathA

Exports

Exports

GetSMExtAPI

Sections

.text
Size: 352KB - Virtual size: 352KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 122KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7784435a0a35915d3dde584a843e53e9

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

wsock32

ws2_32

secur32

kernel32

advapi32

shell32

Exports

Exports

Sections

.text Size: 352KB - Virtual size: 352KB

.rdata Size: 122KB - Virtual size: 121KB

.data Size: 10KB - Virtual size: 16KB

.pdata Size: 21KB - Virtual size: 21KB

.gfids Size: 3KB - Virtual size: 2KB

.rsrc Size: 1024B - Virtual size: 1000B

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 352KB - Virtual size: 352KB

.rdata
Size: 122KB - Virtual size: 121KB

.data
Size: 10KB - Virtual size: 16KB

.pdata
Size: 21KB - Virtual size: 21KB

.gfids
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 1024B - Virtual size: 1000B

.reloc
Size: 5KB - Virtual size: 4KB