9b911a0a26d91514b52c654209b454466880d5afef409585e679cd27f00f01c4_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

9b911a0a26d91514b52c654209b454466880d5afef409585e679cd27f00f01c4_NeikiAnalytics.exe
Size

732KB
MD5

01887903ad0558048e7eb7a16f17ed90
SHA1

2e1872edd082d62f6efe0bf7eb2acc5254f42ac9
SHA256

9b911a0a26d91514b52c654209b454466880d5afef409585e679cd27f00f01c4
SHA512

25d865f6f49fc244119d0e01d782d788b0cf964d312f9c67977e42da603e62ea02fafc1b93f9a809318b5e49580347573dc51b5efb2da934f901cb81a632d055
SSDEEP

12288:KXQ3ZN2kRCSXVDw0mnTuHify/qJHkshCVaA2KfXqlnggu+wi:CQ3L2kRCSOTgifOqdksSTfXiggu+5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9b911a0a26d91514b52c654209b454466880d5afef409585e679cd27f00f01c4_NeikiAnalytics.exe

Files

9b911a0a26d91514b52c654209b454466880d5afef409585e679cd27f00f01c4_NeikiAnalytics.exe
.exe windows:6 windows x64 arch:x64

290ed5ed5e77a4ad2a79bf3733c18d20

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\mspdbsrv.pdb

Imports

advapi32

GetTokenInformation
OpenThreadToken
EqualSid
OpenProcessToken

kernel32

InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetCurrentProcessId
GetLastError
CloseHandle
GetCurrentProcess
GetCommandLineW
GetCurrentThread
CreateEventW
CreateWaitableTimerW
SetPriorityClass
CreateMutexW
WaitForSingleObject
ReleaseMutex
WaitForMultipleObjectsEx
OpenEventW
SetEvent
CancelWaitableTimer
SetWaitableTimer
VirtualQuery
GetModuleFileNameW
RaiseFailFastException
SetErrorMode
OpenProcess
DuplicateHandle
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetModuleHandleW
TerminateProcess
QueryPerformanceCounter

vcruntime140

_CxxThrowException
__std_exception_destroy
__std_exception_copy
memset
__current_exception_context
__current_exception
memcpy
wcschr
memmove
__C_specific_handler

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

strncpy_s
wcsncpy_s
_wcsdup
_wcsicmp
iswspace

api-ms-win-crt-stdio-l1-1-0

fflush
_set_fmode
__acrt_iob_func
__stdio_common_vsnwprintf_s
fclose
__stdio_common_vfwprintf
_wfopen_s
__p__commode

api-ms-win-crt-time-l1-1-0

_wctime64
_time64

api-ms-win-crt-heap-l1-1-0

malloc
free
_set_new_mode
_callnewh

api-ms-win-crt-convert-l1-1-0

wcstoul

api-ms-win-crt-environment-l1-1-0

_wdupenv_s

api-ms-win-crt-runtime-l1-1-0

_crt_atexit
terminate
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
__p___wargv
__p___argc
_initialize_onexit_table
_exit
_register_onexit_function
_seh_filter_exe
_set_app_type
exit
_configure_wide_argv
_initialize_wide_environment
_initterm
_get_initial_wide_environment
_initterm_e

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

mspdbcore

?CloseAllTimeoutPDB@PDB@@SAHXZ
?SetErrorHandlerAPI@PDB@@SAHP6APEAUIPDBError@@PEAU1@@Z@Z
?OpenEx2W@PDB@@SAHPEBGPEBDJPEAJPEAG_KPEAPEAU1@@Z
?RPC@PDB@@SAHXZ
?OpenValidate4@PDB@@SAHPEBGPEBDPEBU_GUID@@KKPEAJPEAG_KPEAPEAU1@@Z
?open@NameMap@@SAHPEAUPDB@@HPEAPEAU1@@Z
?FOpenW@MREngine@@SAHPEAPEAU1@PEBGAEAJPEAG_KHH@Z
?FOpen@MREngine@@SAHPEAPEAU1@PEAUMreToPdb@@HH@Z
?SetPDBCloseTimeout@PDB@@SAH_K@Z
?FOpen@MREngine@@SAHPEAPEAU1@PEAUPDB@@PEAUNameMap@@HH@Z
?ShutDownTimeoutManager@PDB@@SAHXZ
?OpenNgenPdb@PDB@@SAHPEBG0PEAJPEAG_KPEAPEAU1@@Z

rpcrt4

RpcMgmtStopServerListening
RpcServerListen
RpcServerRegisterIf2
RpcServerUseProtseqEpW
RpcServerUnregisterIf
RpcRevertToSelf
RpcImpersonateClient
NdrClientCall2
NdrServerCall2
RpcBindingInqAuthClientW
RpcMgmtInqStats
RpcMgmtStatsVectorFree

Sections

.text
Size: 81KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 65KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 568KB - Virtual size: 572KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

290ed5ed5e77a4ad2a79bf3733c18d20

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

vcruntime140

vcruntime140_1

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

mspdbcore

rpcrt4

Sections

.text Size: 81KB - Virtual size: 81KB

.rdata Size: 65KB - Virtual size: 64KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 14KB - Virtual size: 13KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 568KB - Virtual size: 572KB

.text
Size: 81KB - Virtual size: 81KB

.rdata
Size: 65KB - Virtual size: 64KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 14KB - Virtual size: 13KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 568KB - Virtual size: 572KB