005f9b16919c1d2653ba6e45d9c68b0f472bae139f7d0a75c8b981d992c1754d_NeikiAnalytics[.]exe

General

Target

005f9b16919c1d2653ba6e45d9c68b0f472bae139f7d0a75c8b981d992c1754d_NeikiAnalytics.exe
Size

654KB
MD5

9f7c2668e7332e7ba180bf4988f3b280
SHA1

adf1fd925a3f79d829d5d964799f3a0f564fa792
SHA256

005f9b16919c1d2653ba6e45d9c68b0f472bae139f7d0a75c8b981d992c1754d
SHA512

c21351ac274d3c7e7b4a8aed215b4253b277ce8321033a1fba181decf719cd072792b1e9a92e9cb7e0f476661c5f22c287b9d201d258136a808e3e6802969f2f
SSDEEP

12288:TJlHNZW9noptw2ZBbdcQm0vuJfFGlmYWX2XA6LrcDXpdmso9:9lHNZW9op/vbazOKFGVWGbk5/o9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
005f9b16919c1d2653ba6e45d9c68b0f472bae139f7d0a75c8b981d992c1754d_NeikiAnalytics.exe

Files

005f9b16919c1d2653ba6e45d9c68b0f472bae139f7d0a75c8b981d992c1754d_NeikiAnalytics.exe
.exe windows:5 windows x86 arch:x86

b9fc3ca40b42c695757684751c6ff467

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\perforce\cc\oem\iron\tablerock\sw\trunk\tablerock\win\3rdParty\HP\HPNotes\Release\HPNotes.pdb

Imports

kernel32

GetPrivateProfileStringA
GetSystemDefaultLangID
GetCurrentDirectoryA
GetCommandLineA
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
GetLastError
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
LeaveCriticalSection
EnterCriticalSection
GetLocaleInfoA
LoadLibraryA
InitializeCriticalSectionAndSpinCount
HeapAlloc
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize

shell32

ShellExecuteA

Sections

.text
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 616KB - Virtual size: 620KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

b9fc3ca40b42c695757684751c6ff467

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

shell32

Sections

.text Size: 26KB - Virtual size: 26KB

.rdata Size: 7KB - Virtual size: 7KB

.data Size: 3KB - Virtual size: 6KB

.rsrc Size: 616KB - Virtual size: 620KB

.text
Size: 26KB - Virtual size: 26KB

.rdata
Size: 7KB - Virtual size: 7KB

.data
Size: 3KB - Virtual size: 6KB

.rsrc
Size: 616KB - Virtual size: 620KB