09ea9e11557019340fd2f3f2bb6f3e6be02780d7da597e0148e5b96d933706f2_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
09ea9e11557019340fd2f3f2bb6f3e6be02780d7da597e0148e5b96d933706f2_NeikiAnalytics.exe
Size 6.5MB
Sample240623-xdm2wayerf
SHA256 09ea9e11557019340fd2f3f2bb6f3e6be02780d7da597e0148e5b96d933706f2
MD5 c5f6a117a90470a627c24c8f483b1170
SHA1 dafa66e5a90d42bdbc410ef0bcea556fdb93faa7
SHA512 048b63283338924f48e44bf985639bfa26154675a853888d692907d231f235b80ca6ea4379ce6dfc31ed71ba1f323bfc0517da3e3b11968ff3460b410d057e06
SSDEEP 98304:7weN8utrk4E5XVtnFV+wxpybgesmkVMEft:7wQ8uto5XVpbNK9BEf
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
09ea9e11557019340fd2f3f2bb6f3e6be02780d7da597e0148e5b96d933706f2_NeikiAnalytics.exe

File Explorer

09ea9e11557019340fd2f3f2bb6f3e6be02780d7da597e0148e5b96d933706f2_NeikiAnalytics.exe

.exe 6.5MB

09ea9e11557019340fd2f3f2bb6f3e6be02780d7da597e0148e5b96d933706f2_NeikiAnalytics.exe

IMPHASH 47dffab7868b7804237589bb3f685868
SHA256 09ea9e11557019340fd2f3f2bb6f3e6be02780d7da597e0148e5b96d933706f2
MD5 c5f6a117a90470a627c24c8f483b1170
SHA1 dafa66e5a90d42bdbc410ef0bcea556fdb93faa7
SHA512 048b63283338924f48e44bf985639bfa26154675a853888d692907d231f235b80ca6ea4379ce6dfc31ed71ba1f323bfc0517da3e3b11968ff3460b410d057e06
SSDEEP 98304:7weN8utrk4E5XVtnFV+wxpybgesmkVMEft:7wQ8uto5XVpbNK9BEf
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4213786

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\bf1942\OBJ\win32_fin\bf1942.pdb

kernel32

LoadLibraryA CreateDirectoryA ExitProcess CreateProcessA CloseHandle CreateEventA ResetEvent CreateMutexA SetThreadPriority CreateThread GlobalMemoryStatus GetProcAddress SetErrorMode GetPrivateProfileStringA GetDriveTypeA WaitForSingleObject GetSystemTime GetLocaleInfoA GlobalLock GlobalUnlock GetComputerNameA GetLocalTime FreeLibrary GetVersionExA Sleep IsProcessorFeaturePresent GetStartupInfoA RemoveDirectoryA CreatePipe GetCurrentThreadId GetCurrentProcessId GetExitCodeProcess SleepEx GetCurrentDirectoryA ReadFile FindFirstChangeNotificationA FindNextChangeNotification CreateFileA GetLastError CopyFileA MoveFileA DeleteFileA FindClose GetFullPathNameA GetOverlappedResult GetFileSize SetFilePointer WriteFile GetSystemDefaultLCID GetTickCount QueryPerformanceCounter InitializeCriticalSection EnterCriticalSection LeaveCriticalSection QueryPerformanceFrequency GetCurrentProcess GetCurrentThread OutputDebugStringA GetProcessTimes GetThreadTimes GetExitCodeThread FindNextFileA FindFirstFileA ReleaseMutex GetModuleHandleA

user32

GetKeyboardLayout GetKeyboardState MapVirtualKeyExA ToAsciiEx LoadIconA LoadCursorA RegisterClassExA GetSystemMetrics CreateWindowExA ShowCursor UpdateWindow SetWindowPos DefWindowProcA ShowWindow PostQuitMessage DestroyWindow MessageBoxA CallNextHookEx CloseClipboard EmptyClipboard GetClipboardData IsClipboardFormatAvailable GetWindowRect SetCursor FillRect GetWindowDC GetClientRect ReleaseDC SetFocus EnumDisplaySettingsA ChangeDisplaySettingsA GetFocus PeekMessageA TranslateMessage DispatchMessageA SetForegroundWindow UnhookWindowsHookEx SystemParametersInfoA SetWindowsHookExA GetAsyncKeyState OpenClipboard

gdi32

CreateSolidBrush SetBkMode SetBkColor SetTextColor GetStockObject CreateFontA SelectObject TextOutA

advapi32

RegOpenKeyA RegDeleteKeyA RegCreateKeyA RegSetValueExA RegOpenKeyExA RegQueryValueExA RegCloseKey

shell32

ShellExecuteA SHGetSpecialFolderPathA

ole32

CoCreateInstance CoInitialize CoUninitialize

generic

count=6, id=39, version=9162,

count=11, id=64, productName=VS2002 (.NET) build 9466, version=9466,

count=94, id=28, productName=VS2002 (.NET) build 9466, version=9466,

count=4, id=25, productName=VS2002 (.NET) build 9466, version=9466,

count=1, id=95, version=2190,

count=14, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,

count=1, id=18, version=8444,

count=9, productName=Unmarked objects (old),

count=69, id=29, version=9178,

count=21, id=93, version=2179,

count=6, id=25, version=9210,

count=472, id=1, productName=Unmarked objects,

count=4, id=28, version=9178,

count=1007, id=29, productName=VS2002 (.NET) build 9466, version=9466,

count=1, id=63, productName=VS2002 (.NET) build 9466, version=9466,

count=1, id=69, productName=VS2002 (.NET) build 9466, version=9466,

count=1, id=61, productName=VS2002 (.NET) build 9466, version=9466,