1ddd082c8ecdc08a2065922e214bef16d77bd33d1804814ceb07b2be45391381_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

1ddd082c8ecdc08a2065922e214bef16d77bd33d1804814ceb07b2be45391381_NeikiAnalytics.exe
Size

362KB
MD5

a182910b32998d8220d96789895e5360
SHA1

dfb7548c1647d746315e84797aeed44801190d40
SHA256

1ddd082c8ecdc08a2065922e214bef16d77bd33d1804814ceb07b2be45391381
SHA512

9a4a42cda946f6b5f06f9c7441a576e89d954b2352377f8bd3ee1cc88e3a28ef46526a897f70e9da0eb61ac1aa28fdbc45debb543358adf14d2e0cbedf2ba70c
SSDEEP

6144:vpatEcloc0UxDxgmaZHdCIUe48M2M2aYp5GZdTMwBo4dl5jMVtuDp/iUzxWm5yYJ:sl8bZH1fM2M2aY+ZLo1wDp/i6fyKb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1ddd082c8ecdc08a2065922e214bef16d77bd33d1804814ceb07b2be45391381_NeikiAnalytics.exe

Files

1ddd082c8ecdc08a2065922e214bef16d77bd33d1804814ceb07b2be45391381_NeikiAnalytics.exe
.exe windows:6 windows x64 arch:x64

368fcb3e2e4edf7ef826f5b4bea2d0e6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcp140

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?_Raise_handler@std@@3P6AXAEBVexception@stdext@@@ZEA
?_Syserror_map@std@@YAPEBDH@Z
?_Throw_C_error@std@@YAXH@Z
?_Winerror_map@std@@YAHH@Z
?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?fail@ios_base@std@@QEBA_NXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?set_new_handler@std@@YAP6AXXZP6AXXZ@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
_Mtx_destroy_in_situ
_Mtx_init_in_situ
_Mtx_lock
_Mtx_unlock

kernel32

AssignProcessToJobObject
CloseHandle
CreateDirectoryW
CreateEventW
CreateFileMappingW
CreateFileW
CreateJobObjectW
CreateProcessW
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
ExpandEnvironmentStringsW
FindClose
FindFirstFileExW
FindFirstFileW
FindNextFileW
FlushFileBuffers
FormatMessageA
FreeLibrary
GetCommandLineW
GetConsoleMode
GetConsoleScreenBufferInfo
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDriveTypeW
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesW
GetFileInformationByHandle
GetFileType
GetFinalPathNameByHandleW
GetLastError
GetLongPathNameW
GetModuleFileNameW
GetModuleHandleW
GetNativeSystemInfo
GetProcAddress
GetProcessTimes
GetStdHandle
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetVolumePathNameW
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
K32GetProcessMemoryInfo
LeaveCriticalSection
LoadLibraryExA
LoadLibraryW
LocalFree
MapViewOfFile
MultiByteToWideChar
QueryPerformanceCounter
RaiseException
ReadFile
ResetEvent
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SearchPathW
SetConsoleCtrlHandler
SetConsoleTextAttribute
SetCurrentDirectoryW
SetErrorMode
SetEvent
SetFileTime
SetInformationJobObject
SetLastError
SetProcessAffinityMask
SetUnhandledExceptionFilter
SystemTimeToFileTime
TerminateProcess
UnhandledExceptionFilter
UnmapViewOfFile
VirtualProtect
VirtualQuery
WaitForSingleObject
WaitForSingleObjectEx
WideCharToMultiByte
WriteConsoleW

advapi32

CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
RegCloseKey
RegGetValueW
RegOpenKeyExA

vcruntime140

_CxxThrowException
__C_specific_handler
__current_exception
__current_exception_context
__std_exception_copy
__std_exception_destroy
_purecall
memchr
memcmp
memcpy
memmove
memset
strchr

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
__p__commode
__stdio_common_vsprintf
_close
_fileno
_get_osfhandle
_lseek
_lseeki64
_open_osfhandle
_set_fmode
_setmode
_write
fflush

api-ms-win-crt-runtime-l1-1-0

__p___argc
__p___argv
_c_exit
_cexit
_configure_narrow_argv
_crt_atexit
_errno
_exit
_get_initial_narrow_environment
_initialize_narrow_environment
_initialize_onexit_table
_initterm
_initterm_e
_invalid_parameter_noinfo_noreturn
_invoke_watson
_register_onexit_function
_register_thread_local_exe_atexit_callback
_seh_filter_exe
_set_abort_behavior
_set_app_type
_set_error_mode
abort
exit
signal
terminate

api-ms-win-crt-heap-l1-1-0

_aligned_free
_aligned_malloc
_callnewh
_set_new_mode
calloc
free
malloc
realloc

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-string-l1-1-0

isalpha
isxdigit
strcmp
strlen
wcslen

api-ms-win-crt-utility-l1-1-0

qsort
rand
srand

api-ms-win-crt-math-l1-1-0

__setusermatherr
log10

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 307KB - Virtual size: 306KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 33B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.voltbl
Size: 512B - Virtual size: 26B

.rsrc
Size: 1024B - Virtual size: 608B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

368fcb3e2e4edf7ef826f5b4bea2d0e6

Headers

DLL Characteristics

File Characteristics

Imports

msvcp140

kernel32

advapi32

vcruntime140

vcruntime140_1

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 307KB - Virtual size: 306KB

.rdata Size: 38KB - Virtual size: 38KB

.data Size: 1KB - Virtual size: 6KB

.pdata Size: 9KB - Virtual size: 9KB

.tls Size: 512B - Virtual size: 33B

.voltbl Size: 512B - Virtual size: 26B

.rsrc Size: 1024B - Virtual size: 608B

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 307KB - Virtual size: 306KB

.rdata
Size: 38KB - Virtual size: 38KB

.data
Size: 1KB - Virtual size: 6KB

.pdata
Size: 9KB - Virtual size: 9KB

.tls
Size: 512B - Virtual size: 33B

.voltbl
Size: 512B - Virtual size: 26B

.rsrc
Size: 1024B - Virtual size: 608B

.reloc
Size: 3KB - Virtual size: 2KB