6aa8593f4e81f3524b7ff2c0c1ffd5fffb5cb682fe034db521f7b012692ecb0e_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

6aa8593f4e81f3524b7ff2c0c1ffd5fffb5cb682fe034db521f7b012692ecb0e_NeikiAnalytics.exe
Size

165KB
MD5

6279c576c6c3a8e81da7d42644aa3ba0
SHA1

9e6bd2e9bb05af66322d8349bcc3f220e9d6d744
SHA256

6aa8593f4e81f3524b7ff2c0c1ffd5fffb5cb682fe034db521f7b012692ecb0e
SHA512

c5c8b536d0fe917ca28cc9e552f1eb8e7523f3ddcfa0333e6bd8a0d4bde36cb1959bf81f22241b14d57906677489f99d1aa153a408529673e36ccb75c4de0a2a
SSDEEP

3072:TMZUfRWHcYRbSAOqCSqCYCmo3SihpbTcIyXBJo3cU4:s6WnY/tihpbsoM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6aa8593f4e81f3524b7ff2c0c1ffd5fffb5cb682fe034db521f7b012692ecb0e_NeikiAnalytics.exe

Files

6aa8593f4e81f3524b7ff2c0c1ffd5fffb5cb682fe034db521f7b012692ecb0e_NeikiAnalytics.exe
.exe windows:6 windows x86 arch:x86

8481e83b7d7bc67fc195ff0836dbf1e7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

setup16.pdb

Imports

advapi32

RegOpenKeyExA
RegCreateKeyA
RegSetValueA
RegQueryValueA
RegEnumKeyA
RegDeleteKeyA
RegCloseKey

kernel32

_llseek
GetDiskFreeSpaceExA
_lopen
LocalFree
WinExec
GetPrivateProfileStringA
GetSystemInfo
LocalUnlock
LocalLock
SetErrorMode
_lwrite
LocalAlloc
SetFileAttributesA
GetDriveTypeA
_lread
GlobalCompact
GetWindowsDirectoryA
GetPrivateProfileIntA
GetVersion
GetModuleFileNameA
_lclose
LocalReAlloc
ExitProcess
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoA
InterlockedCompareExchange
Sleep
InterlockedExchange
OpenFile
lstrcmpiA
lstrlenA
IsDBCSLeadByte
UnhandledExceptionFilter

gdi32

GetTextExtentPointA
SetBkMode

user32

CreateWindowExA
RegisterClassA
CharPrevA
PostMessageA
IsWindow
DestroyWindow
SendMessageA
SetWindowPos
DrawTextA
UpdateWindow
GetSystemMetrics
GetClientRect
BeginPaint
DefWindowProcA
KillTimer
ShowWindow
GetMessageA
SetTimer
DispatchMessageA
TranslateMessage
OemToCharBuffA
CharToOemA
CharUpperA
LoadStringA
PeekMessageA
FindWindowA
CharNextA
MessageBoxA
EndPaint

msvcrt

rename
_splitpath_s
_rmdir
atoi
toupper
strstr
strchr
memset
_chdrive
_cexit
_exit
_XcptFilter
_ismbblead
exit
_acmdln
_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
?terminate@@YAXXZ
_except_handler4_common
_controlfp
_mkdir
_access
_chdir
fopen
fclose
remove
_tempnam
_mktemp
_ltoa
_itoa
_stat
_chmod
_open
_lseek
_close
_unlink
_write
_read
malloc
_vsnprintf
__getmainargs
free

cabinet

ord22
ord20
ord23

lz32

LZClose
LZOpenFileA
LZCopy

Sections

.text
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 142KB - Virtual size: 141KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8481e83b7d7bc67fc195ff0836dbf1e7

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

gdi32

user32

msvcrt

cabinet

lz32

Sections

.text Size: 19KB - Virtual size: 18KB

.data Size: 512B - Virtual size: 3KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 142KB - Virtual size: 141KB

.text
Size: 19KB - Virtual size: 18KB

.data
Size: 512B - Virtual size: 3KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 142KB - Virtual size: 141KB