4c6ba6c4db41f317366b1b238b99d13d5026ba81f628347784963ec1117cd1d8_NeikiAnalytics[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

4c6ba6c4db41f317366b1b238b99d13d5026ba81f628347784963ec1117cd1d8_NeikiAnalytics.exe
Size

9.6MB
MD5

34f46f4cff6830a5a57b61a707e9b0f0
SHA1

afba3acf7104250aea7b602bd8bd194ebf7c7d90
SHA256

4c6ba6c4db41f317366b1b238b99d13d5026ba81f628347784963ec1117cd1d8
SHA512

d259550728003a95593f0fc01f6d59639e31c8cfe40fc027754b0d7573fd981fada9ab34d59a874e9288c05d1305be3b7fb80e688d3d8ac39d71ea799743a29d
SSDEEP

196608:Nex1YsSAsZaK59GJQDH4h556A04ngw54tWz0UPreDBnqRDvyVjbP+b+waLOBb:w4sSlZx5AJQDH4hD2tWQU8Bde97b

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4c6ba6c4db41f317366b1b238b99d13d5026ba81f628347784963ec1117cd1d8_NeikiAnalytics.exe

Files

4c6ba6c4db41f317366b1b238b99d13d5026ba81f628347784963ec1117cd1d8_NeikiAnalytics.exe
.exe windows:5 windows x64 arch:x64

a93b2d5e21f0fb9a7ac2067a02d458ef

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

c:\emodels\EModels\EModelSelfExtracter\Release64\EModelSelfExtracter.pdb

Imports

kernel32

MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetModuleFileNameW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
CreateFileW
SetFilePointer
ReadFile
GetLastError
GetTempFileNameW
DeleteFileW
CreateDirectoryW
lstrcpyW
lstrcatW
lstrcmpW
CreateProcessW
CloseHandle
WriteFile
EnterCriticalSection
RaiseException
LeaveCriticalSection
lstrcmpiW
GetModuleHandleW
GetProcAddress
lstrlenW
GetTempPathW
FreeLibrary
GetStringTypeW
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
RtlPcToFileHeader
HeapAlloc
HeapFree
EncodePointer
DecodePointer
GetCommandLineA
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
ExitProcess
GetStdHandle
HeapSetInformation
GetVersion
HeapCreate
HeapReAlloc
HeapSize
Sleep
RtlUnwindEx
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
FlsGetValue
FlsSetValue
FlsFree
SetLastError
GetCurrentThreadId
FlsAlloc
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LoadLibraryW

user32

CharNextW

advapi32

RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW

ole32

CoTaskMemRealloc
CoTaskMemFree
CoCreateInstance
CoTaskMemAlloc
CoInitialize

oleaut32

VarUI4FromStr

Sections

.text
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a93b2d5e21f0fb9a7ac2067a02d458ef

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

ole32

oleaut32

Sections

.text Size: 54KB - Virtual size: 53KB

.rdata Size: 30KB - Virtual size: 30KB

.data Size: 4KB - Virtual size: 8KB

.pdata Size: 3KB - Virtual size: 2KB

.rsrc Size: 21KB - Virtual size: 21KB

.text
Size: 54KB - Virtual size: 53KB

.rdata
Size: 30KB - Virtual size: 30KB

.data
Size: 4KB - Virtual size: 8KB

.pdata
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 21KB - Virtual size: 21KB