5b555e2fe7ea298818859964de1d4c34d6d273397b1b46b2107acfaed577f4f8_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

5b555e2fe7ea298818859964de1d4c34d6d273397b1b46b2107acfaed577f4f8_NeikiAnalytics.exe
Size

7.7MB
MD5

679286e76349ba9b9b56887fa2992690
SHA1

e7a3b5f9695ebff260602eae2577f30db8ad28c5
SHA256

5b555e2fe7ea298818859964de1d4c34d6d273397b1b46b2107acfaed577f4f8
SHA512

0de9679912d80494872ee2e077a165503ff8a7049ea2fda86ff1e90a3ca57202d7175ce6ef3d42ceec7cbf9e9a82fc28184205f7df13f5fcda8b89c282c96e6d
SSDEEP

98304:z5hqidY16qnB4lmp2lpTf0c9nHSaiJ/YTuH0vL8BAUZLe/V2vRznco8WZg9xmiel:z5hZY16qnBomp2l39nHVi4L8VyanGw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5b555e2fe7ea298818859964de1d4c34d6d273397b1b46b2107acfaed577f4f8_NeikiAnalytics.exe

Files

5b555e2fe7ea298818859964de1d4c34d6d273397b1b46b2107acfaed577f4f8_NeikiAnalytics.exe
.exe windows:4 windows x86 arch:x86

15d9767d2da1c6e9171b928065faefe8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegOpenKeyExA
RegQueryValueExA

kernel32

ClearCommBreak
ClearCommError
CloseHandle
CreateEventA
CreateFileA
CreateProcessA
CreateThread
DeleteCriticalSection
EnterCriticalSection
EnumResourceLanguagesA
EnumSystemLocalesA
ExitThread
FlushFileBuffers
FormatMessageA
FreeLibrary
GetACP
GetCommState
GetConsoleScreenBufferInfo
GetCurrentProcessId
GetCurrentThreadId
GetExitCodeProcess
GetFileAttributesA
GetFileType
GetFullPathNameA
GetLastError
GetLocaleInfoA
GetModuleFileNameA
GetModuleHandleA
GetModuleHandleW
GetOverlappedResult
GetProcAddress
GetStartupInfoA
GetStdHandle
GetSystemTimeAsFileTime
GetTempPathA
GetThreadLocale
GetTimeZoneInformation
GetVersionExA
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalFree
MultiByteToWideChar
PeekConsoleInputA
PeekNamedPipe
PurgeComm
ReadConsoleInputA
ReadFile
ResetEvent
SetCommBreak
SetCommMask
SetCommState
SetCommTimeouts
SetEvent
SetFilePointer
SetHandleInformation
SetUnhandledExceptionFilter
Sleep
TlsGetValue
TryEnterCriticalSection
VirtualProtect
VirtualQuery
WaitCommEvent
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteFile

msvcrt

__getmainargs
__initenv
__lconv_init
__mb_cur_max
__p__acmdln
__p__commode
__p__fmode
__set_app_type
__setusermatherr
_amsg_exit
_assert
_cexit
_dup
_environ
_errno
_close
_exit
_filelengthi64
_fileno
_findclose
_fstati64
_fullpath
_get_osfhandle
_initterm
_iob
_lock
_lseeki64
_onexit
_open
_open_osfhandle
_pipe
_read
_setjmp3
_stati64
_stricmp
_strnicmp
_sys_nerr
_unlock
_vscprintf
_vsnprintf
_wcsdup
_wgetcwd
_wopen
abort
atof
atoi
atol
bsearch
calloc
clearerr
clock
exit
fclose
feof
ferror
fflush
fgetc
fgetpos
fgets
fopen
fprintf
fputc
fputs
fread
free
frexp
fseek
fsetpos
ftell
fwrite
getc
getenv
isalnum
isalpha
iscntrl
islower
isprint
ispunct
isspace
isupper
iswctype
isxdigit
localeconv
malloc
mbstowcs
memchr
memcmp
memcpy
memmove
memset
_kbhit
putc
putchar
qsort
raise
realloc
remove
rename
setbuf
setlocale
signal
sprintf
strcat
strchr
strcmp
strcpy
strcspn
strerror
strlen
strncat
strncmp
strncpy
strpbrk
strrchr
strspn
strstr
strtok
strtol
strtoul
system
tolower
toupper
towlower
ungetc
vfprintf
time
wcscat
wcschr
wcscmp
wcscpy
wcslen
_findnext
_findfirst
longjmp
_write
_unlink
_umask
_strdup
_read
_putenv
_open
_isatty
_getpid
_getcwd
_getch
_fileno
_fdopen
_close
_chmod
_chdir
_strnicmp
_stricmp

python27

PyArg_UnpackTuple
PyBool_FromLong
PyBool_Type
PyBuffer_FromReadWriteObject
PyCallable_Check
PyCode_New
PyDict_New
PyDict_SetItemString
PyErr_Clear
PyErr_ExceptionMatches
PyErr_Fetch
PyErr_Format
PyErr_GivenExceptionMatches
PyErr_NewException
PyErr_Occurred
PyErr_Print
PyErr_Restore
PyErr_SetFromErrno
PyErr_SetInterrupt
PyErr_SetObject
PyErr_SetString
PyEval_InitThreads
PyEval_ReleaseLock
PyEval_RestoreThread
PyEval_SaveThread
PyExc_AttributeError
PyExc_IOError
PyExc_KeyError
PyExc_KeyboardInterrupt
PyExc_MemoryError
PyExc_NotImplementedError
PyExc_OverflowError
PyExc_RuntimeError
PyExc_StopIteration
PyExc_SystemError
PyExc_TypeError
PyExc_ValueError
PyFile_AsFile
PyFile_FromString
PyFloat_AsDouble
PyFloat_FromDouble
PyFloat_Type
PyFrame_New
PyGILState_Ensure
PyGILState_Release
PyImport_AddModule
PyImport_ImportModule
PyInt_AsLong
PyInt_FromLong
PyInt_GetMax
PyIter_Next
PyList_Append
PyList_AsTuple
PyList_GetItem
PyList_Insert
PyList_New
PyList_Size
PyLong_AsLongLong
PyLong_AsUnsignedLongLong
PyLong_FromLong
PyLong_FromLongLong
PyLong_FromUnsignedLong
PyLong_FromUnsignedLongLong
PyMem_Malloc
PyModule_AddIntConstant
PyModule_AddObject
PyModule_AddStringConstant
PyModule_GetDict
PyNumber_Long
PyOS_InterruptOccurred
PyOS_ReadlineFunctionPointer
PyObject_AsReadBuffer
PyObject_Call
PyObject_CallFunctionObjArgs
PyObject_CallMethodObjArgs
PyObject_CallObject
PyObject_CheckReadBuffer
PyObject_GenericGetAttr
PyObject_GenericSetAttr
PyObject_GetAttr
PyObject_GetAttrString
PyObject_GetIter
PyObject_HasAttr
PyObject_HasAttrString
PyObject_IsTrue
PyObject_RichCompareBool
PyObject_SetAttrString
PyObject_Str
PyRun_InteractiveLoopFlags
PyRun_SimpleFileExFlags
PyRun_SimpleStringFlags
PyRun_StringFlags
PySequence_Check
PySequence_DelItem
PySequence_GetItem
PySequence_Index
PySequence_List
PySequence_Size
PyString_AsString
PyString_Decode
PyString_FromFormat
PyString_FromString
PyString_Size
PySys_GetObject
PySys_SetPath
PyThreadState_Swap
PyTuple_GetItem
PyTuple_New
PyTuple_SetItem
PyTuple_Size
PyType_GenericNew
PyType_IsSubtype
PyType_Ready
PyUnicodeUCS2_AsEncodedString
PyUnicodeUCS2_Decode
PyUnicodeUCS2_FromEncodedObject
Py_Finalize
Py_FlushLine
Py_InitModule4
Py_Initialize
_PyArg_ParseTupleAndKeywords_SizeT
_PyArg_ParseTuple_SizeT
_PyOS_ReadlineTState
_PyObject_CallMethod_SizeT
_PyObject_New
_PyThreadState_Current
_Py_BuildValue_SizeT
_Py_NoneStruct
_Py_NotImplementedStruct
_Py_TrueStruct
_Py_ZeroStruct

user32

CharLowerBuffA

ws2_32

WSAEnumNetworkEvents
WSAEventSelect
WSAGetLastError
WSAStartup
__WSAFDIsSet
closesocket
connect
gethostbyname
getsockopt
htons
ioctlsocket
recv
select
send
setsockopt
socket

Sections

.text
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 239KB - Virtual size: 239KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 100KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

/4
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/19
Size: 963KB - Virtual size: 963KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/31
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/45
Size: 262KB - Virtual size: 261KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/57
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/70
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/81
Size: 356KB - Virtual size: 355KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/92
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

15d9767d2da1c6e9171b928065faefe8

Headers

File Characteristics

Imports

advapi32

kernel32

msvcrt

python27

user32

ws2_32

Sections

.text Size: 3.1MB - Virtual size: 3.1MB

.data Size: 239KB - Virtual size: 239KB

.rdata Size: 1.9MB - Virtual size: 1.9MB

.bss Size: - Virtual size: 100KB

.idata Size: 10KB - Virtual size: 10KB

.CRT Size: 512B - Virtual size: 52B

.tls Size: 512B - Virtual size: 8B

/4 Size: 3KB - Virtual size: 3KB

/19 Size: 963KB - Virtual size: 963KB

/31 Size: 52KB - Virtual size: 52KB

/45 Size: 262KB - Virtual size: 261KB

/57 Size: 42KB - Virtual size: 41KB

/70 Size: 6KB - Virtual size: 6KB

/81 Size: 356KB - Virtual size: 355KB

/92 Size: 38KB - Virtual size: 38KB

.text
Size: 3.1MB - Virtual size: 3.1MB

.data
Size: 239KB - Virtual size: 239KB

.rdata
Size: 1.9MB - Virtual size: 1.9MB

.bss
Size: - Virtual size: 100KB

.idata
Size: 10KB - Virtual size: 10KB

.CRT
Size: 512B - Virtual size: 52B

.tls
Size: 512B - Virtual size: 8B

/4
Size: 3KB - Virtual size: 3KB

/19
Size: 963KB - Virtual size: 963KB

/31
Size: 52KB - Virtual size: 52KB

/45
Size: 262KB - Virtual size: 261KB

/57
Size: 42KB - Virtual size: 41KB

/70
Size: 6KB - Virtual size: 6KB

/81
Size: 356KB - Virtual size: 355KB

/92
Size: 38KB - Virtual size: 38KB