6fe87775c625ed5c1bc51c379019c8c4391104494e709e7a74524ea188f0c301_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

6fe87775c625ed5c1bc51c379019c8c4391104494e709e7a74524ea188f0c301_NeikiAnalytics.exe
Size

56KB
MD5

577c195932768260eddd780f75af07d0
SHA1

cf6f5541c220846868f8e66b30270bbd15007c94
SHA256

6fe87775c625ed5c1bc51c379019c8c4391104494e709e7a74524ea188f0c301
SHA512

3a90d87c588d5ba25b3938e93b2662ef675fb37809b2c23db818b94830912d7f432086fc6645bbfb6ed94a128c91f2ee5abf8b46f4f4e54ad4dcb5b950cbb5e3
SSDEEP

1536:PCuRuS6hMfrBgeYrZ1/m5GPHw+xNOfOS0BDZbIZh:KIuHgaeYrZ1/m5GPHw+xNRbG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6fe87775c625ed5c1bc51c379019c8c4391104494e709e7a74524ea188f0c301_NeikiAnalytics.exe

Files

6fe87775c625ed5c1bc51c379019c8c4391104494e709e7a74524ea188f0c301_NeikiAnalytics.exe
.dll windows:4 windows x86 arch:x86

44d9aaae797a04778751021bc1c30821

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

TlsGetValue
GetLastError
TlsSetValue
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
TlsAlloc
DeleteCriticalSection
TlsFree
CreateMutexA
CloseHandle
WaitForSingleObject
ReleaseMutex
GetSystemDirectoryA
GetProcAddress
FormatMessageA
LocalFree
LoadLibraryA
GetSystemTimeAsFileTime
FreeLibrary
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess

msvcr80

_crt_debugger_hook
_vsnprintf
strerror_s
_errno
realloc
strerror
malloc
free
_wassert
abort
_strdup
_open
_getpid
isdigit
memmove
sprintf_s
memset
strncpy_s
strtoul
strcpy_s
strcat_s
__iob_func
fprintf
_stat32
strlen
strchr
memcpy
calloc
strcmp
strcspn
strncmp
strrchr
_findfirst32
strcat
strcpy
strncpy
_findnext32
_findclose

ws2_32

ntohl
ntohs
getservbyport
gethostbyaddr
gethostbyname
WSAGetLastError
inet_addr
htons
getservbyname
htonl
WSASetLastError
inet_ntoa

Exports

Exports

k5_base64_decode
k5_base64_encode
k5_bcmp
k5_buf_add
k5_buf_add_fmt
k5_buf_add_len
k5_buf_free
k5_buf_get_space
k5_buf_init_dynamic
k5_buf_init_fixed
k5_buf_status
k5_buf_truncate
k5_clear_error
k5_free_error
k5_get_error
k5_json_array_add
k5_json_array_create
k5_json_array_fmt
k5_json_array_get
k5_json_array_length
k5_json_array_set
k5_json_bool_create
k5_json_bool_value
k5_json_decode
k5_json_encode
k5_json_get_tid
k5_json_null_create
k5_json_null_create_val
k5_json_number_create
k5_json_number_value
k5_json_object_count
k5_json_object_create
k5_json_object_get
k5_json_object_iterate
k5_json_object_set
k5_json_release
k5_json_retain
k5_json_string_create
k5_json_string_create_base64
k5_json_string_create_len
k5_json_string_unbase64
k5_json_string_utf8
k5_path_isabs
k5_path_join
k5_path_split
k5_set_error
k5_set_error_info_callout_fn
k5_strerror_r
k5_vset_error
krb5int_asprintf
krb5int_close_plugin
krb5int_close_plugin_dirs
krb5int_free_plugin_dir_data
krb5int_free_plugin_dir_func
krb5int_freeaddrinfo
krb5int_gai_strerror
krb5int_get_plugin_data
krb5int_get_plugin_dir_data
krb5int_get_plugin_dir_func
krb5int_get_plugin_func
krb5int_getaddrinfo
krb5int_getnameinfo
krb5int_getspecific
krb5int_gettimeofday
krb5int_gmt_mktime
krb5int_in6addr_any
krb5int_ipc_stream_data
krb5int_ipc_stream_free_string
krb5int_ipc_stream_new
krb5int_ipc_stream_read
krb5int_ipc_stream_read_int32
krb5int_ipc_stream_read_int64
krb5int_ipc_stream_read_string
krb5int_ipc_stream_read_uint32
krb5int_ipc_stream_release
krb5int_ipc_stream_size
krb5int_ipc_stream_write
krb5int_ipc_stream_write_int32
krb5int_ipc_stream_write_int64
krb5int_ipc_stream_write_string
krb5int_ipc_stream_write_uint32
krb5int_key_delete
krb5int_key_register
krb5int_mkstemp
krb5int_mutex_alloc
krb5int_mutex_free
krb5int_mutex_lock
krb5int_mutex_unlock
krb5int_open_plugin
krb5int_open_plugin_dirs
krb5int_pthread_loaded
krb5int_setspecific
krb5int_strlcat
krb5int_strlcpy
krb5int_ucs2lecs_to_utf8s
krb5int_ucs4_to_utf8
krb5int_utf8_lentab
krb5int_utf8_mintab
krb5int_utf8_next
krb5int_utf8_to_ucs4
krb5int_utf8cs_to_ucs2les
krb5int_utf8s_to_ucs2les
krb5int_vasprintf
krb5int_zap

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

44d9aaae797a04778751021bc1c30821

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcr80

ws2_32

Exports

Exports

Sections

.text Size: 28KB - Virtual size: 27KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 8KB - Virtual size: 6KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 1KB

.text
Size: 28KB - Virtual size: 27KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 8KB - Virtual size: 6KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 1KB