3387016f49dffcf8e208bcf2a0ee949b109c100a408ee543ca9c5b92fab16687_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

3387016f49dffcf8e208bcf2a0ee949b109c100a408ee543ca9c5b92fab16687_NeikiAnalytics.exe
Size

43KB
MD5

93dd728604a9e0d5d6c978f3793472f0
SHA1

5f480e82691c18ddcd2a0546a0e3ac8c7dd8a757
SHA256

3387016f49dffcf8e208bcf2a0ee949b109c100a408ee543ca9c5b92fab16687
SHA512

362be6b3c2ff6dd4d1383af47c7c0e84950efdf33246413a77134f89066cb6aa910925b12632f4a9c5763f96fe549029ce16e9c7cef4a862fba6dc5644181fe5
SSDEEP

768:ZNAhdHLTYxsFrPgV4mwjb8yW9FM87S3to7aEi3oIEAO7SGrW4jzB2:crTYxsQ4mkb859FadFb3Zp4XB2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3387016f49dffcf8e208bcf2a0ee949b109c100a408ee543ca9c5b92fab16687_NeikiAnalytics.exe

Files

3387016f49dffcf8e208bcf2a0ee949b109c100a408ee543ca9c5b92fab16687_NeikiAnalytics.exe
.dll windows:6 windows x86 arch:x86

1ae628293d83f4210280ca145284deb0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\php-snap-build\php72\vc15\x86\obj\Release_TS\php_gettext.pdb

Imports

php7ts

php_info_print_table_start
zend_parse_arg_str_slow@@8
_emalloc@@4
zend_wrong_parameter_type_error@@16
virtual_getcwd
zend_wrong_parameters_count_error@@16
php_error_docref0
zend_error
zend_parse_parameters
virtual_realpath
php_info_print_table_end
php_info_print_table_row

kernel32

InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
IsDebuggerPresent
UnhandledExceptionFilter
EnumResourceLanguagesA
GetModuleHandleA
GetLastError
GetProcAddress
GetThreadLocale
GetLocaleInfoA

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey

vcruntime140

memcpy
memset
_except_handler4_common
strchr
strstr
__std_type_info_destroy_list

api-ms-win-crt-runtime-l1-1-0

raise
_seh_filter_dll
_errno
abort
_initterm_e
_initterm
_execute_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_cexit
_initialize_onexit_table

api-ms-win-crt-string-l1-1-0

strncmp
_strdup
isupper
isdigit
isalnum
isalpha
tolower
isspace

api-ms-win-crt-heap-l1-1-0

realloc
free
malloc

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-stdio-l1-1-0

fputs
fgets
__stdio_common_vfprintf
feof
putc
fclose
fopen
_open
_close
_read
_getcwd

api-ms-win-crt-filesystem-l1-1-0

_fstat64i32

api-ms-win-crt-convert-l1-1-0

strtoul

api-ms-win-crt-utility-l1-1-0

bsearch
qsort

Exports

Exports

get_module

Sections

.text
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1ae628293d83f4210280ca145284deb0

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

php7ts

kernel32

advapi32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

Exports

Exports

Sections

.text Size: 27KB - Virtual size: 26KB

.rdata Size: 6KB - Virtual size: 5KB

.data Size: 4KB - Virtual size: 4KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 27KB - Virtual size: 26KB

.rdata
Size: 6KB - Virtual size: 5KB

.data
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 3KB - Virtual size: 2KB