4fbcfc3bee5fc3c0d582df33fde5d20f78946148bbea0d91fe07edd5e5556128_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

4fbcfc3bee5fc3c0d582df33fde5d20f78946148bbea0d91fe07edd5e5556128_NeikiAnalytics.exe
Size

2.1MB
MD5

e337a8576244ae32a3006af21f4c65a0
SHA1

54d874b021d78bf5d9b161e351fe50539cfc5317
SHA256

4fbcfc3bee5fc3c0d582df33fde5d20f78946148bbea0d91fe07edd5e5556128
SHA512

51a38c01a8a6fc593e3cad274e43aa5eef37c1f41d786db8bbd97fd51b00a520c50b7d2547b5f7347324bc87702053975088c6f17eaeb2ce89a7ec50ddde425c
SSDEEP

49152:fe77F502yJjr9hUrnG6ZyCJVaILQbJknNW9etjoRvuTfNHgCu/zYqBO9DugN+mTu:fHc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4fbcfc3bee5fc3c0d582df33fde5d20f78946148bbea0d91fe07edd5e5556128_NeikiAnalytics.exe

Files

4fbcfc3bee5fc3c0d582df33fde5d20f78946148bbea0d91fe07edd5e5556128_NeikiAnalytics.exe
.exe windows:6 windows x64 arch:x64

ba823fd13d7d2be44c611714ce714762

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

gameserver.pdb

Imports

ntdll

NtClose
NtCreateFile
NtCreateSection
NtDeviceIoControlFile
NtFsControlFile
NtLockFile
NtMapViewOfSection
NtQueryInformationFile
NtQueryObject
NtQueryVolumeInformationFile
NtUnmapViewOfSection
RtlCaptureContext
RtlEqualUnicodeString
RtlExitUserProcess
RtlGetFullPathName_U
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlWaitOnAddress

ws2_32

WSAGetLastError
WSASocketW
WSAStartup
accept
bind
closesocket
getsockname
ioctlsocket
listen
setsockopt

kernel32

AcquireSRWLockExclusive
AddVectoredExceptionHandler
CreateThread
CreateToolhelp32Snapshot
ExitProcess
FormatMessageW
GetConsoleMode
GetConsoleScreenBufferInfo
GetCurrentProcess
GetCurrentThreadId
GetFileSizeEx
GetLastError
GetProcessHeap
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
K32GetModuleFileNameExW
Module32First
Module32Next
ReadFile
ReleaseSRWLockExclusive
RemoveVectoredExceptionHandler
SetConsoleMode
SetConsoleTextAttribute
SetFilePointerEx
Sleep
VirtualAlloc
VirtualFree
WriteFile

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 379KB - Virtual size: 379KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.CRT
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 17B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 860B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ba823fd13d7d2be44c611714ce714762

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntdll

ws2_32

kernel32

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.rdata Size: 379KB - Virtual size: 379KB

.data Size: 512B - Virtual size: 8KB

.pdata Size: 42KB - Virtual size: 42KB

.CRT Size: 512B - Virtual size: 16B

.tls Size: 512B - Virtual size: 17B

.reloc Size: 1024B - Virtual size: 860B

.text
Size: 1.7MB - Virtual size: 1.7MB

.rdata
Size: 379KB - Virtual size: 379KB

.data
Size: 512B - Virtual size: 8KB

.pdata
Size: 42KB - Virtual size: 42KB

.CRT
Size: 512B - Virtual size: 16B

.tls
Size: 512B - Virtual size: 17B

.reloc
Size: 1024B - Virtual size: 860B