8e6bbc943663ca0ee0ad4c8eea115d56e4f018624d5db0f1831835385aef99de_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

8e6bbc943663ca0ee0ad4c8eea115d56e4f018624d5db0f1831835385aef99de_NeikiAnalytics.exe
Size

108KB
MD5

22bb2f3e4babfdb5dda1f62cdcbb4aa0
SHA1

01ad39d0e23395f4d5aa1be05b785099708f645c
SHA256

8e6bbc943663ca0ee0ad4c8eea115d56e4f018624d5db0f1831835385aef99de
SHA512

c86e988f6f7617158dd35b25f5e78f3e0c73fda6588b4b10a123a49589af61544da4fffe364ea7e2e36af42750b48cfaaa79cc556184641fb0c38049e0de415c
SSDEEP

3072:82lk2arhwICKu67+5Ddj7wB1ZLrIcxAyhJZEFUjX1X:82ybrh0j67+5D97wB1ZLrIcxA/UjFX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8e6bbc943663ca0ee0ad4c8eea115d56e4f018624d5db0f1831835385aef99de_NeikiAnalytics.exe

Files

8e6bbc943663ca0ee0ad4c8eea115d56e4f018624d5db0f1831835385aef99de_NeikiAnalytics.exe
.dll windows:6 windows x64 arch:x64

074a391315509a0b57e1035453d8f474

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

python36

PyDict_Copy
PyDict_Contains
_PyDict_NewPresized
PyDict_GetItemString
PyDict_SetItemString
PyCFunction_NewEx
PyModule_NewObject
PyModule_GetDict
PyModule_GetName
PyModuleDef_Init
PyClassMethod_New
PyMethod_New
PyCapsule_New
PyCapsule_GetPointer
PyCapsule_GetName
PyCapsule_IsValid
PyThreadState_Get
_PyThreadState_UncheckedGet
PyGILState_Ensure
PyGILState_Release
PyTraceBack_Here
PyDescr_NewClassMethod
PyErr_WarnEx
PyErr_WarnFormat
PyErr_SetObject
PyErr_SetString
PyErr_Occurred
PyMethodDescr_Type
PyDict_Size
PyErr_ExceptionMatches
PyException_SetCause
PyErr_Format
PyOS_snprintf
Py_GetVersion
_Py_CheckRecursiveCall
PyEval_EvalFrameEx
PyEval_SaveThread
PyEval_RestoreThread
PyImport_GetModuleDict
PyImport_AddModule
PyImport_ImportModule
PyImport_ImportModuleLevelObject
PyObject_Call
PyObject_CallObject
PyObject_CallFunctionObjArgs
PyObject_GetItem
PyObject_SetItem
PyObject_Format
PyObject_GetIter
PyNumber_Remainder
PyNumber_Index
PyNumber_InPlaceAdd
PyObject_IsSubclass
PyCode_New
PyEval_EvalCodeEx
PyFrame_New
PyTraceBack_Type
PyDict_Next
PyDict_DelItem
_PyDict_SetItem_KnownHash
PyDict_SetItem
PyDict_GetItemWithError
_PyDict_GetItem_KnownHash
PyDict_New
PyList_New
PyTuple_Pack
PyTuple_GetSlice
PyTuple_GetItem
PyTuple_New
PyLong_AsSsize_t
PyLong_AsLong
PyLong_FromSsize_t
PyLong_FromLong
PyUnicode_Format
PyUnicode_Compare
PyUnicode_Decode
PyUnicode_InternFromString
PyUnicode_FromFormat
PyUnicode_FromString
PyUnicode_FromStringAndSize
_PyUnicode_FastCopyCharacters
_PyUnicode_Ready
PyUnicode_New
PyBytes_AsStringAndSize
PyBytes_FromStringAndSize
PyObject_GC_UnTrack
PyObject_GC_Del
PyObject_GC_Track
_PyObject_GC_New
PyObject_Free
PyMem_Realloc
PyMem_Malloc
PyObject_Dir
PyObject_CallFinalizerFromDealloc
PyObject_ClearWeakRefs
PyObject_Not
PyObject_IsTrue
PyObject_Hash
PyObject_GenericGetAttr
_PyObject_GetDictPtr
PyObject_SetAttr
PyObject_GetAttr
PyObject_SetAttrString
PyObject_GetAttrString
PyObject_RichCompareBool
PyObject_RichCompare
PyType_Modified
_PyType_Lookup
PyType_Ready
PyType_IsSubtype
PyFrame_Type
_Py_CheckRecursionLimit
PyExc_DeprecationWarning
PyExc_ValueError
PyExc_TypeError
PyExc_SystemError
PyExc_RuntimeError
PyExc_OverflowError
PyExc_NameError
PyExc_KeyError
PyExc_IndexError
PyExc_ImportError
PyExc_AttributeError
PyErr_GivenExceptionMatches
PyExc_StopIteration
PyMethod_Type
PyFunction_Type
PyCFunction_Type
PyDict_Type
PyList_Type
PyTuple_Type
PyFloat_Type
_Py_TrueStruct
_Py_FalseStruct
PyLong_Type
PyUnicode_Type
_PyByteArray_empty_string
PyByteArray_Type
_Py_NoneStruct
PyBaseObject_Type
PyErr_Clear
PyType_Type

arrow

?GetSessionToken@S3Options@fs@arrow@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
??0Status@arrow@@QEAA@XZ
?FinalizeS3@fs@arrow@@YA?AVStatus@2@XZ
?InitializeS3@fs@arrow@@YA?AVStatus@2@AEBUS3GlobalOptions@12@@Z
?Make@S3FileSystem@fs@arrow@@SA?AV?$Result@V?$shared_ptr@VS3FileSystem@fs@arrow@@@std@@@3@AEBUS3Options@23@AEBUIOContext@io@3@@Z
?region@S3FileSystem@fs@arrow@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?options@S3FileSystem@fs@arrow@@QEBA?AUS3Options@23@XZ
??4S3Options@fs@arrow@@QEAAAEAU012@$$QEAU012@@Z
??1S3Options@fs@arrow@@QEAA@XZ
??0S3Options@fs@arrow@@QEAA@XZ
?FromAssumeRole@S3Options@fs@arrow@@SA?AU123@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@00HAEBV?$shared_ptr@VSTSClient@STS@Aws@@@5@@Z
?FromAccessKey@S3Options@fs@arrow@@SA?AU123@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@00@Z
?Anonymous@S3Options@fs@arrow@@SA?AU123@XZ
?Defaults@S3Options@fs@arrow@@SA?AU123@XZ
?default_io_context@io@arrow@@YAAEBUIOContext@12@XZ
?GetSecretKey@S3Options@fs@arrow@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?GetAccessKey@S3Options@fs@arrow@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
??4S3ProxyOptions@fs@arrow@@QEAAAEAU012@$$QEAU012@@Z
??4S3ProxyOptions@fs@arrow@@QEAAAEAU012@AEBU012@@Z
??0S3ProxyOptions@fs@arrow@@QEAA@$$QEAU012@@Z
??1S3ProxyOptions@fs@arrow@@QEAA@XZ
??0S3ProxyOptions@fs@arrow@@QEAA@XZ
?FromUri@S3ProxyOptions@fs@arrow@@SA?AV?$Result@US3ProxyOptions@fs@arrow@@@3@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?CopyFrom@Status@arrow@@AEAAXAEBV12@@Z
??4Status@arrow@@QEAAAEAV01@$$QEAV01@@Z
??1Status@arrow@@QEAA@XZ

arrow_python

?check_status@internal@py@arrow@@YAHAEBVStatus@3@@Z

msvcp140

?_Xlength_error@std@@YAXPEBD@Z

vcruntime140

__std_terminate
strchr
__CxxFrameHandler3
memcpy
memmove
__C_specific_handler
__std_exception_copy
__std_exception_destroy
_CxxThrowException
__std_type_info_destroy_list
memset

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_execute_onexit_table
_cexit
_invalid_parameter_noinfo_noreturn

api-ms-win-crt-heap-l1-1-0

_callnewh
malloc
free

kernel32

IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

Exports

Exports

PyInit__s3fs

Sections

.text
Size: 70KB - Virtual size: 69KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 776B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

074a391315509a0b57e1035453d8f474

Headers

DLL Characteristics

File Characteristics

Imports

python36

arrow

arrow_python

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

kernel32

Exports

Exports

Sections

.text Size: 70KB - Virtual size: 69KB

.rdata Size: 26KB - Virtual size: 25KB

.data Size: 7KB - Virtual size: 12KB

.pdata Size: 2KB - Virtual size: 2KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 1024B - Virtual size: 776B

.text
Size: 70KB - Virtual size: 69KB

.rdata
Size: 26KB - Virtual size: 25KB

.data
Size: 7KB - Virtual size: 12KB

.pdata
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 1024B - Virtual size: 776B