673f02c5f7150bf1172ccb78a0467a88918e31e5d5360f77634a8c90ce0bb81e_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

673f02c5f7150bf1172ccb78a0467a88918e31e5d5360f77634a8c90ce0bb81e_NeikiAnalytics.exe
Size

200KB
MD5

605ab4a0f3f220aac691ee0c4ebcaf20
SHA1

cb7fe50feaa063b9f056a6b387e303d02fce6339
SHA256

673f02c5f7150bf1172ccb78a0467a88918e31e5d5360f77634a8c90ce0bb81e
SHA512

c55136e03b552cb5df6ed5eb045aa106497888e3f0f031638f5e7792b01b1cf3587f3d653eff8331afafca6198b162392bafbd1c1bf6e4906a79b0ebca420582
SSDEEP

3072:HGK0yZdQ8KurgE+bpzRf3bmAUwCGsvk7zeA+xehLzK7:mK0a6UR+bxRfrmAUwCGlhLzK7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
673f02c5f7150bf1172ccb78a0467a88918e31e5d5360f77634a8c90ce0bb81e_NeikiAnalytics.exe

Files

673f02c5f7150bf1172ccb78a0467a88918e31e5d5360f77634a8c90ce0bb81e_NeikiAnalytics.exe
.dll windows:6 windows x64 arch:x64

43d941b3991e0205cceac01a85e4395a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

ws2_32

htonl
htons
WSACleanup
__WSAFDIsSet
FreeAddrInfoW
bind
WSAIoctl
WSAGetLastError
setsockopt
sendto
getsockopt
recvfrom
GetAddrInfoW
WSAAddressToStringW
ntohs
socket
WSAStartup
ntohl
select
closesocket

kernel32

GetSystemTime
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCurrentProcessorNumber
QueryPerformanceCounter
SystemTimeToFileTime
QueryPerformanceFrequency
GetTimeZoneInformation
TryEnterCriticalSection
OpenMutexW
MapViewOfFile
EnterCriticalSection
GetCurrentProcess
ReleaseSemaphore
GetModuleFileNameW
WaitForMultipleObjects
LeaveCriticalSection
InitializeCriticalSection
WaitForSingleObject
CreateEventW
SetEvent
CloseHandle
ResetEvent
DeleteCriticalSection
GetCurrentProcessId
GetModuleHandleW
CreateSemaphoreW
GetTickCount
GetProcessTimes
CreateDirectoryW
ReadFile
FindFirstFileW
GetFileSizeEx
FindNextFileW
WriteFile
SetFilePointer
FindClose
CreateFileW
GetFileAttributesW
SetFileAttributesW
GetLastError
GetFileAttributesExW
DeleteFileW
GetLocalTime
GetComputerNameW
FlushFileBuffers
FileTimeToSystemTime
FileTimeToLocalFileTime
GetCommandLineW
SetErrorMode
CreateMutexW
GetCurrentThreadId
ReleaseMutex
OpenFileMappingW
UnmapViewOfFile
Sleep
OutputDebugStringW
AddVectoredExceptionHandler
CreateFileMappingW

vcruntime140

__C_specific_handler
_set_purecall_handler
__std_exception_copy
__std_exception_destroy
_CxxThrowException
memcpy
memset
__std_type_info_destroy_list
wcsrchr
__CxxFrameHandler3
_purecall
__std_terminate

api-ms-win-crt-runtime-l1-1-0

exit
_set_invalid_parameter_handler
_endthread
_invalid_parameter_noinfo
_beginthreadex
_errno
_set_new_handler
signal
_beginthread
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_endthreadex
_cexit
_initterm
_initterm_e
_crt_atexit

api-ms-win-crt-string-l1-1-0

wcscpy_s
wcsncmp
_wcsicmp
strcpy_s
_wcsdup

api-ms-win-crt-convert-l1-1-0

_wtoi

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsnwprintf_s
__stdio_common_vsprintf_s
__stdio_common_vfprintf
__stdio_common_vswscanf
__acrt_iob_func
__stdio_common_vsnprintf_s
__stdio_common_vswprintf_s
__stdio_common_vfwprintf
__stdio_common_vswprintf

api-ms-win-crt-heap-l1-1-0

free
malloc
_callnewh
realloc
_set_new_mode

Exports

Exports

P7_Client_Add_Ref
P7_Client_Create
P7_Client_Flush
P7_Client_Get_Shared
P7_Client_Release
P7_Client_Share
P7_Clr_Crash_Handler
P7_Create_Client
P7_Create_Telemetry
P7_Create_Trace
P7_Exceptional_Flush
P7_Flush
P7_Get_Shared
P7_Get_Shared_Telemetry
P7_Get_Shared_Trace
P7_Last_Error
P7_Set_Crash_Handler
P7_Telemetry_Add_Ref
P7_Telemetry_Create
P7_Telemetry_Create_Counter
P7_Telemetry_Find_Counter
P7_Telemetry_Get_Shared
P7_Telemetry_Put_Value
P7_Telemetry_Release
P7_Telemetry_Share
P7_Trace_Add
P7_Trace_Add_Ref
P7_Trace_Create
P7_Trace_Embedded
P7_Trace_Get_Shared
P7_Trace_Get_Verbosity
P7_Trace_Managed
P7_Trace_Register_Module
P7_Trace_Register_Thread
P7_Trace_Release
P7_Trace_Set_Verbosity
P7_Trace_Share
P7_Trace_Unregister_Thread

Sections

.text
Size: 124KB - Virtual size: 124KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

43d941b3991e0205cceac01a85e4395a

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

kernel32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

Exports

Exports

Sections

.text Size: 124KB - Virtual size: 124KB

.rdata Size: 54KB - Virtual size: 53KB

.data Size: 12KB - Virtual size: 13KB

.pdata Size: 7KB - Virtual size: 6KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 124KB - Virtual size: 124KB

.rdata
Size: 54KB - Virtual size: 53KB

.data
Size: 12KB - Virtual size: 13KB

.pdata
Size: 7KB - Virtual size: 6KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 1KB - Virtual size: 1KB