50925f8c539539b9ecad33859a36a1b7b3a4a74cfc2980f7ecd2637de0685093_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

50925f8c539539b9ecad33859a36a1b7b3a4a74cfc2980f7ecd2637de0685093_NeikiAnalytics.exe
Size

108KB
MD5

68bf8b64c0afe15969c84ec1e72f9de0
SHA1

1b781af9da6f36c887d47d6108b981686ba64e30
SHA256

50925f8c539539b9ecad33859a36a1b7b3a4a74cfc2980f7ecd2637de0685093
SHA512

ec5905ced9a3ee43c7d91eb2b6d96781f6eb7fefaf7f0431ca454ff1e8e97d259f6703186ef7f111a19b541dcea723efad8cf9bd608c27cdff39ecad0a7af784
SSDEEP

1536:SeBCWZA6LTKZkCiBpxP3JnJ4/Q9CZnI3daHCp3cw1pSWuFykdqf6wAspZO:SEC6vKZInx3JJ4wezHCp3c+pf6Zsp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
50925f8c539539b9ecad33859a36a1b7b3a4a74cfc2980f7ecd2637de0685093_NeikiAnalytics.exe

Files

50925f8c539539b9ecad33859a36a1b7b3a4a74cfc2980f7ecd2637de0685093_NeikiAnalytics.exe
.exe windows:6 windows x64 arch:x64

a43752d323a9c2c69620e7b71bf81339

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

E:\coding\c++\.LINK\stick_agem\stick_agem\build\stick_agem.pdb

Imports

kernel32

SetWaitableTimer
SetLastError
EnterCriticalSection
WaitForMultipleObjects
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
GetQueuedCompletionStatus
WaitForSingleObject
PostQueuedCompletionStatus
CreateEventW
MultiByteToWideChar
FormatMessageW
GetLastError
SetEvent
TerminateThread
CloseHandle
QueueUserAPC
LocalFree
DeleteCriticalSection
WideCharToMultiByte
SleepEx
FormatMessageA
CreateIoCompletionPort
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetLocaleInfoEx

user32

GetAsyncKeyState

msvcp140

_Cnd_do_broadcast_at_thread_exit
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAG@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??Bid@locale@std@@QEAA_KXZ
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Throw_Cpp_error@std@@YAXH@Z
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?good@ios_base@std@@QEBA_NXZ
?_Winerror_map@std@@YAHH@Z
?_Xbad_function_call@std@@YAXXZ
?id@?$ctype@D@std@@2V0locale@2@A
?_Xlength_error@std@@YAXPEBD@Z
?_Syserror_map@std@@YAPEBDH@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z

ws2_32

WSASend
ntohl
WSASetLastError
WSAStringToAddressW
WSASendTo
WSASocketW
closesocket
ntohs
WSAAddressToStringW
htonl
WSARecvFrom
htons
ioctlsocket
setsockopt
WSAGetLastError
WSAStartup
WSACleanup
bind
select

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_type_info_compare
_purecall
__std_terminate
__std_exception_copy
__current_exception
__current_exception_context
memset
__std_exception_destroy
_CxxThrowException
memcpy
memcmp
__RTDynamicCast
__C_specific_handler
memmove

api-ms-win-crt-heap-l1-1-0

malloc
free
_set_new_mode
_aligned_free
_callnewh
_aligned_malloc

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf
_set_fmode
__acrt_iob_func
__p__commode
__stdio_common_vfprintf

api-ms-win-crt-runtime-l1-1-0

__p___argc
_exit
_beginthreadex
__p___argv
_c_exit
exit
_set_app_type
_seh_filter_exe
_initterm_e
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_initterm
_get_initial_narrow_environment
_invalid_parameter_noinfo_noreturn
strerror
_register_thread_local_exe_atexit_callback
terminate
system

api-ms-win-crt-string-l1-1-0

strncpy
strcmp

api-ms-win-crt-math-l1-1-0

ceilf
__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 804B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a43752d323a9c2c69620e7b71bf81339

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

msvcp140

ws2_32

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 63KB - Virtual size: 63KB

.rdata Size: 33KB - Virtual size: 32KB

.data Size: 4KB - Virtual size: 5KB

.pdata Size: 4KB - Virtual size: 4KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 1024B - Virtual size: 804B

.text
Size: 63KB - Virtual size: 63KB

.rdata
Size: 33KB - Virtual size: 32KB

.data
Size: 4KB - Virtual size: 5KB

.pdata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 1024B - Virtual size: 804B