52bb29d4b075a47fba26d5ccac65c4b0ad472e28031c13205ebc833d08c69249_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

52bb29d4b075a47fba26d5ccac65c4b0ad472e28031c13205ebc833d08c69249_NeikiAnalytics.exe
Size

22KB
MD5

e5c1d9abb2cfe00547210954aad18270
SHA1

5f7481f5619985dd944c93c7d0f60034ebd2a6d0
SHA256

52bb29d4b075a47fba26d5ccac65c4b0ad472e28031c13205ebc833d08c69249
SHA512

4d9012987537a25e97019486061f4958bb60f7cfdec7b05c3bb94beb68c04279f33d5044dbf5495efd71ec0e4a0d3940aed0ba731b5e2244283dc13385f5605f
SSDEEP

384:5wc3KTY27DrDh731Ni4ZGGJr6JUhxV8Yvu8pcE5Won0/u:wV7bh7FQ4ZBJr6JUh4gnjWJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
52bb29d4b075a47fba26d5ccac65c4b0ad472e28031c13205ebc833d08c69249_NeikiAnalytics.exe

Files

52bb29d4b075a47fba26d5ccac65c4b0ad472e28031c13205ebc833d08c69249_NeikiAnalytics.exe
.dll windows:6 windows x64 arch:x64

36b2ba9609b3f80201e2f4aaeaad80b6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\Users\wag\mozilla\comm-253\sm-obj\comm\ldap\c-sdk\libraries\libprldap\prldap60.pdb

Imports

ldap60

ber_sockbuf_get_option
ldap_get_lderrno
ldap_get_option
ldap_init
ldap_memfree
ldap_set_lderrno
ldap_set_option
ldap_unbind
ldap_x_hostlist_first
ldap_x_hostlist_next
ldap_x_hostlist_statusfree

nss3

PR_AtomicIncrement
PR_CallOnce
PR_Calloc
PR_Close
PR_Connect
PR_DestroyLock
PR_EnumerateAddrInfo
PR_Free
PR_FreeAddrInfo
PR_GetAddrInfoByName
PR_GetCurrentThread
PR_GetError
PR_GetHostByAddr
PR_GetIPNodeByName
PR_GetOSError
PR_GetPeerName
PR_GetThreadPrivate
PR_ImportTCPSocket
PR_Lock
PR_Malloc
PR_MillisecondsToInterval
PR_NetAddrToString
PR_NewLock
PR_NewThreadPrivateIndex
PR_OpenTCPSocket
PR_Poll
PR_Realloc
PR_Recv
PR_Send
PR_SetError
PR_SetSocketOption
PR_SetThreadPrivate
PR_StringToNetAddr
PR_Unlock
PR_htons

kernel32

DisableThreadLibraryCalls
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
TerminateProcess
UnhandledExceptionFilter

vcruntime140

__C_specific_handler
__std_type_info_destroy_list
memcpy
memset

api-ms-win-crt-runtime-l1-1-0

_cexit
_configure_narrow_argv
_execute_onexit_table
_initialize_narrow_environment
_initialize_onexit_table
_initterm
_initterm_e
_seh_filter_dll

Exports

Exports

prldap_get_default_socket_info
prldap_get_session_info
prldap_get_session_option
prldap_get_socket_info
prldap_import_connection
prldap_init
prldap_install_routines
prldap_is_installed
prldap_set_default_socket_info
prldap_set_session_info
prldap_set_session_option
prldap_set_socket_info

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.voltbl
Size: 512B - Virtual size: 14B

.rsrc
Size: 1024B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

36b2ba9609b3f80201e2f4aaeaad80b6

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ldap60

nss3

kernel32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

Exports

Exports

Sections

.text Size: 11KB - Virtual size: 11KB

.rdata Size: 5KB - Virtual size: 5KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 1024B - Virtual size: 936B

.00cfg Size: 512B - Virtual size: 40B

.voltbl Size: 512B - Virtual size: 14B

.rsrc Size: 1024B - Virtual size: 888B

.reloc Size: 512B - Virtual size: 48B

.text
Size: 11KB - Virtual size: 11KB

.rdata
Size: 5KB - Virtual size: 5KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 1024B - Virtual size: 936B

.00cfg
Size: 512B - Virtual size: 40B

.voltbl
Size: 512B - Virtual size: 14B

.rsrc
Size: 1024B - Virtual size: 888B

.reloc
Size: 512B - Virtual size: 48B