0b5fdeb337e76179cab2b870cb9634786094a389eb6f0379cf953292e0509b35_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

0b5fdeb337e76179cab2b870cb9634786094a389eb6f0379cf953292e0509b35_NeikiAnalytics.exe
Size

1.2MB
MD5

2675dc97761871071036b785048816c0
SHA1

1618c3fbf0001191ad0ac10a9b4e88f8d573d03c
SHA256

0b5fdeb337e76179cab2b870cb9634786094a389eb6f0379cf953292e0509b35
SHA512

8432a022e05436fbafc84828bb1af250d5446d7fe5b324b3289188603e9cd5e519152365a1f63c95dfd464f6213b65e67d33ddebf6a697a2f99381bb776a45bb
SSDEEP

12288:6V3dLeW35LPm6yBP3K0fxTGf+0b5K8pV0:6TKq5LPms

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0b5fdeb337e76179cab2b870cb9634786094a389eb6f0379cf953292e0509b35_NeikiAnalytics.exe

Files

0b5fdeb337e76179cab2b870cb9634786094a389eb6f0379cf953292e0509b35_NeikiAnalytics.exe
.exe windows:5 windows x86 arch:x86

3e0ec40fce4f8fba18a02b698984cca8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

DbgPrint
RtlAssert
RtlIsDosDeviceName_U
vDbgPrintExWithPrefix

advapi32

RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegSetValueExW

kernel32

AddConsoleAliasW
AllocConsole
Beep
CloseHandle
CopyFileExW
CopyFileW
CreateDirectoryW
CreateFileW
CreatePipe
CreateProcessW
DeleteCriticalSection
DeleteFileW
DeviceIoControl
DuplicateHandle
EnterCriticalSection
ExitProcess
FileTimeToLocalFileTime
FileTimeToSystemTime
FillConsoleOutputAttribute
FillConsoleOutputCharacterW
FindClose
FindFirstFileW
FindNextFileW
FindResourceExW
FlushConsoleInputBuffer
FlushFileBuffers
FormatMessageW
FreeConsole
FreeEnvironmentStringsW
FreeLibrary
GetCommandLineW
GetConsoleAliasW
GetConsoleAliasesLengthW
GetConsoleAliasesW
GetConsoleCP
GetConsoleMode
GetConsoleOutputCP
GetConsoleScreenBufferInfo
GetConsoleTitleW
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDateFormatW
GetDiskFreeSpaceW
GetEnvironmentStringsW
GetEnvironmentVariableA
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesW
GetFileSize
GetFileTime
GetFileType
GetFullPathNameW
GetLastError
GetLocalTime
GetLocaleInfoW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetSystemTime
GetSystemTimeAsFileTime
GetTickCount
GetVersionExW
GetVolumeInformationW
GetVolumePathNameW
GlobalMemoryStatus
HeapAlloc
HeapFree
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryW
LoadResource
LocalAlloc
LocalFree
LocalReAlloc
LockResource
MoveFileExW
MoveFileW
MultiByteToWideChar
QueryPerformanceCounter
ReadConsoleInputW
ReadFile
RemoveDirectoryW
ResumeThread
RtlUnwind
SearchPathW
SetConsoleCtrlHandler
SetConsoleCursorInfo
SetConsoleCursorPosition
SetConsoleMode
SetConsoleTextAttribute
SetConsoleTitleW
SetCurrentDirectoryW
SetEnvironmentVariableW
SetFileApisToOEM
SetFileAttributesW
SetFilePointer
SetFileTime
SetHandleInformation
SetLastError
SetLocalTime
SetProcessAffinityMask
SetStdHandle
SetUnhandledExceptionFilter
Sleep
SystemTimeToFileTime
TerminateProcess
TlsGetValue
TryEnterCriticalSection
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteConsoleInputW
WriteConsoleOutputCharacterW
WriteConsoleW
WriteFile
lstrcmpiW
lstrlenW

msvcrt

__dllonexit
__lconv_init
__set_app_type
__setusermatherr
__wgetmainargs
__winitenv
_amsg_exit
_cexit
_fmode
_fpreset
_initterm
_iob
_itow
_lock
_onexit
_pclose
_snwprintf
_unlock
_vsnprintf
_vsnwprintf
_wchdir
_wcmdln
_wcsicmp
_wcslwr
_wcsnicmp
_wcsnset
_wcsupr
_wfopen
_wgetdcwd
_wpopen
_wtoi
_wtol
abort
bsearch
calloc
exit
fclose
fgetws
fprintf
free
fwrite
isalnum
isalpha
iswctype
malloc
memchr
memcmp
memcpy
memmove
memset
qsort
rand
realloc
signal
sprintf
strchr
strcmp
strcpy
strcspn
strncmp
swprintf
towlower
towupper
vfprintf
vswprintf
wcscat
wcschr
wcscmp
wcscpy
wcscspn
wcslen
wcsncat
wcsncmp
wcsncpy
wcspbrk
wcsrchr
wcsspn
wcsstr
wcstok
wcstol
wcstoul

user32

LoadStringW
MessageBeep

Sections

.text
Size: 133KB - Virtual size: 132KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 79KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 913KB - Virtual size: 912KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rossym
Size: 177KB - Virtual size: 177KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3e0ec40fce4f8fba18a02b698984cca8

Headers

File Characteristics

Imports

ntdll

advapi32

kernel32

msvcrt

user32

Sections

.text Size: 133KB - Virtual size: 132KB

.data Size: 2KB - Virtual size: 1KB

.rdata Size: 14KB - Virtual size: 13KB

/4 Size: 512B - Virtual size: 80B

.bss Size: - Virtual size: 79KB

.idata Size: 6KB - Virtual size: 6KB

.CRT Size: 512B - Virtual size: 52B

.tls Size: 512B - Virtual size: 8B

.rsrc Size: 913KB - Virtual size: 912KB

.rossym Size: 177KB - Virtual size: 177KB

.text
Size: 133KB - Virtual size: 132KB

.data
Size: 2KB - Virtual size: 1KB

.rdata
Size: 14KB - Virtual size: 13KB

/4
Size: 512B - Virtual size: 80B

.bss
Size: - Virtual size: 79KB

.idata
Size: 6KB - Virtual size: 6KB

.CRT
Size: 512B - Virtual size: 52B

.tls
Size: 512B - Virtual size: 8B

.rsrc
Size: 913KB - Virtual size: 912KB

.rossym
Size: 177KB - Virtual size: 177KB