b7606e20729f09995cc3bc8b7016453133c7be0446b0411c66d51d3c07b56632_NeikiAnalytics[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

b7606e20729f09995cc3bc8b7016453133c7be0446b0411c66d51d3c07b56632_NeikiAnalytics.exe
Size

35KB
MD5

c2125b9f9aab07d433bf33c0cffc4500
SHA1

1da8d2a8440616ba7fdd9b07bf1c119d0fcb1311
SHA256

b7606e20729f09995cc3bc8b7016453133c7be0446b0411c66d51d3c07b56632
SHA512

0ead3a5e7b08596e4acc9ded8dba5e00cd3e3effea2ab03766d87e9a319a085e1040f9d9db0f942a834762b8e4adee41ffb1a09f3d1c5b06817e5d122bff4f67
SSDEEP

192:j4Col9lh0re9fjTdP6PWMMGtsQBrFyxc88VJIEcywWxJ4kOqD:QoL+MMnIxyxDEhIeuqD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b7606e20729f09995cc3bc8b7016453133c7be0446b0411c66d51d3c07b56632_NeikiAnalytics.exe

Files

b7606e20729f09995cc3bc8b7016453133c7be0446b0411c66d51d3c07b56632_NeikiAnalytics.exe
.dll windows:6 windows x64 arch:x64

42dc2694fc114913b81d5192836f0808

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

E:\Sandbox\safekit_head\src\tools\nthelpers\buildscripts\build\httpd\mod_authz_user.pdb

Imports

libhttpd

ap_register_auth_provider
ap_log_rerror_
ap_expr_parse_cmd_mi
ap_expr_str_exec
ap_getword_conf

libapr-1

apr_pstrcat
apr_palloc

vcruntime140

__C_specific_handler
memset
__std_type_info_destroy_list

api-ms-win-crt-runtime-l1-1-0

_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
_register_onexit_function
terminate
_initterm_e
_initterm
_initialize_onexit_table
_initialize_narrow_environment
_cexit
_seh_filter_dll
_configure_narrow_argv

kernel32

GetModuleHandleW
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
RtlCaptureContext

Exports

Exports

authz_user_module

Sections

.text
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 641B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 828B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 288B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 283B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 306B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

42dc2694fc114913b81d5192836f0808

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

libhttpd

libapr-1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

kernel32

Exports

Exports

Sections

.text Size: 18KB - Virtual size: 18KB

.rdata Size: 6KB - Virtual size: 6KB

.data Size: 512B - Virtual size: 641B

.pdata Size: 1024B - Virtual size: 828B

.idata Size: 3KB - Virtual size: 2KB

.gfids Size: 512B - Virtual size: 288B

.00cfg Size: 512B - Virtual size: 283B

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 512B - Virtual size: 306B

.text
Size: 18KB - Virtual size: 18KB

.rdata
Size: 6KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 641B

.pdata
Size: 1024B - Virtual size: 828B

.idata
Size: 3KB - Virtual size: 2KB

.gfids
Size: 512B - Virtual size: 288B

.00cfg
Size: 512B - Virtual size: 283B

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 512B - Virtual size: 306B