0287e769014e506df583a4ed9d05f8734a494c72b608cfc74b6a2e24753d2e06_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

0287e769014e506df583a4ed9d05f8734a494c72b608cfc74b6a2e24753d2e06_NeikiAnalytics.exe
Size

61KB
MD5

c24f33883a28dc496b74466452a729f0
SHA1

f61a3de8e9a5d0e7b011f436c21ac6608b222bda
SHA256

0287e769014e506df583a4ed9d05f8734a494c72b608cfc74b6a2e24753d2e06
SHA512

8060f7e2d5d14371263bc4a1ebc02b0182dbdd0d3ccda92dce2de6e942cde8467d59f991e4c1f307f062b028c86590e2f1e7232d62234385f2217288eff36052
SSDEEP

1536:jIUxsdOYLJIgkiyuendEdHKhf/EyeKxKW/w7lYs6YVL:jYOYLJIg1enuqmCxKWo7j

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0287e769014e506df583a4ed9d05f8734a494c72b608cfc74b6a2e24753d2e06_NeikiAnalytics.exe

Files

0287e769014e506df583a4ed9d05f8734a494c72b608cfc74b6a2e24753d2e06_NeikiAnalytics.exe
.exe windows:6 windows x86 arch:x86

52f928d102c0dc3369c62f3f5af38bb3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

evcreate.pdb

Imports

advapi32

RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegEnumKeyExW
RegOpenKeyExW
RegConnectRegistryW
CloseEventLog
DeregisterEventSource
ReportEventW
GetTokenInformation
OpenProcessToken
OpenEventLogW
RegisterEventSourceW

kernel32

GetCurrentProcess
GetComputerNameExW
GetModuleFileNameW
SetConsoleMode
ReadFile
ReadConsoleW
WriteConsoleW
ExitProcess
GetConsoleOutputCP
HeapReAlloc
GetLastError
HeapSize
HeapAlloc
GetProcessHeap
HeapValidate
WideCharToMultiByte
MultiByteToWideChar
CompareStringA
GetThreadLocale
CompareStringW
lstrlenW
lstrlenA
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
InterlockedCompareExchange
GetFileType
GetStdHandle
GetConsoleMode
VerSetConditionMask
VerifyVersionInfoW
FormatMessageW
LocalFree
SetThreadUILanguage
UnhandledExceptionFilter
Sleep
InterlockedExchange
CloseHandle
SetLastError
HeapFree
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetTickCount

msvcrt

_controlfp
_except_handler4_common
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
memset
_iob
_memicmp
_get_osfhandle
_errno
_fileno
_vsnwprintf
fflush
fprintf
__iob_func
wcstod
wcstoul
wcstol
wcstok

user32

CharUpperW
LoadStringW

mpr

WNetCancelConnection2W
WNetAddConnection2W
WNetGetLastErrorW

secur32

GetUserNameExW

ws2_32

WSACleanup
GetAddrInfoW
WSAGetLastError
WSAStartup
GetNameInfoW
FreeAddrInfoW

netapi32

NetServerGetInfo
NetApiBufferFree

shlwapi

StrChrIW
StrStrW
StrStrIW
StrChrW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

Sections

.text
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 29KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

52f928d102c0dc3369c62f3f5af38bb3

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

msvcrt

user32

mpr

secur32

ws2_32

netapi32

shlwapi

version

Sections

.text Size: 28KB - Virtual size: 28KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 29KB - Virtual size: 30KB

.text
Size: 28KB - Virtual size: 28KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 29KB - Virtual size: 30KB