4f8aba2de26514737f2e23e6292fbff96a340fccc90db7fafff38e96b13188cf_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

4f8aba2de26514737f2e23e6292fbff96a340fccc90db7fafff38e96b13188cf_NeikiAnalytics.exe
Size

35KB
MD5

9d4fb16feeaf321410de31655617eb20
SHA1

b1f1d402e661b611404ed81702114507c7bd53a4
SHA256

4f8aba2de26514737f2e23e6292fbff96a340fccc90db7fafff38e96b13188cf
SHA512

b0970943be52f1a17972a395d2b3892714282d0bdbe3c8b9a20f0e0b5cf853ae00a30babfee1f36df8e6c4b028948f99b3216a6d35b38a88e3e6e996061b5acc
SSDEEP

384:PZzdKdNlRCKpF5cd5b0+Z5a6pJ4Nskc1riW9/mzEVF8iZLxPi2x8Na1g0gFdN7Zc:PlgXvgnu6pJTiKmzEVF8iZrx8NaJMvu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4f8aba2de26514737f2e23e6292fbff96a340fccc90db7fafff38e96b13188cf_NeikiAnalytics.exe

Files

4f8aba2de26514737f2e23e6292fbff96a340fccc90db7fafff38e96b13188cf_NeikiAnalytics.exe
.exe windows:6 windows x86 arch:x86

fd0675c3898ddd8b7d18c906ec23297d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\Paul\Desktop\Toast\Sending toast notifications from desktop apps sample\C++\Release\L2ToastNotification.pdb

Imports

api-ms-win-core-winrt-l1-1-0

RoUninitialize
RoGetActivationFactory
RoInitialize

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString
WindowsCreateStringReference

shlwapi

SHStrDupW
PathFindExtensionW
PathFindFileNameW

kernel32

EncodePointer
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
IsDebuggerPresent
DecodePointer
GetCommandLineW
GetModuleFileNameW
GetEnvironmentVariableW
GetFileAttributesW
K32GetModuleFileNameExW
GetCurrentProcess
RaiseException

user32

PostQuitMessage
EndPaint
DefWindowProcW
GetWindowLongW
SetWindowLongW
DispatchMessageW
TranslateMessage
GetMessageW
UpdateWindow
BeginPaint
CreateWindowExW
RegisterClassExW
LoadCursorW
LoadIconW
MessageBoxW
ShowWindow

gdi32

GetStockObject

shell32

CommandLineToArgvW

ole32

PropVariantClear
CoCreateInstance

msvcp120

?_Xlength_error@std@@YAXPBD@Z
?_Winerror_map@std@@YAPBDH@Z
?_Syserror_map@std@@YAPBDH@Z
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z

msvcr120

__crtTerminateProcess
__crtUnhandledException
_crt_debugger_hook
_commode
_fmode
_wcmdln
_initterm
_initterm_e
__setusermatherr
_configthreadlocale
_except_handler4_common
__crtSetUnhandledExceptionFilter
_cexit
_exit
__set_app_type
__wgetmainargs
_amsg_exit
_invoke_watson
_controlfp_s
_CxxThrowException
__CxxFrameHandler3
memcpy
?terminate@@YAXXZ
memset
??3@YAXPAX@Z
memmove
??2@YAPAXI@Z
wcscat_s
exit
_wfullpath
_purecall
??1type_info@@UAE@XZ
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
_XcptFilter
__crtGetShowWindowMode

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fd0675c3898ddd8b7d18c906ec23297d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

shlwapi

kernel32

user32

gdi32

shell32

ole32

msvcp120

msvcr120

Sections

.text Size: 11KB - Virtual size: 10KB

.rdata Size: 5KB - Virtual size: 5KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 16KB - Virtual size: 15KB

.reloc Size: 1024B - Virtual size: 992B

.text
Size: 11KB - Virtual size: 10KB

.rdata
Size: 5KB - Virtual size: 5KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 16KB - Virtual size: 15KB

.reloc
Size: 1024B - Virtual size: 992B