1822d7a1b2ded7be01691155ab564e2086a6bba02bcb2f0dc100cf0c850aaa8f_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

1822d7a1b2ded7be01691155ab564e2086a6bba02bcb2f0dc100cf0c850aaa8f_NeikiAnalytics.exe
Size

20KB
MD5

fb050bc4d288694733262f8ddb285b60
SHA1

560cc012682b5addb8078fab089d068902d16320
SHA256

1822d7a1b2ded7be01691155ab564e2086a6bba02bcb2f0dc100cf0c850aaa8f
SHA512

627712a113d8f651173dba48672b6012a369309e87187312c1b0863260964713c16802594ba2dde95e461363bd634277f86d74a9c15a55bac26226bf5b88204c
SSDEEP

384:pWDPkYlK8wNV5hAIlaEgLN4hglFJEzrZlue+dF:kz5TwttlanB4hglFJEpENj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1822d7a1b2ded7be01691155ab564e2086a6bba02bcb2f0dc100cf0c850aaa8f_NeikiAnalytics.exe

Files

1822d7a1b2ded7be01691155ab564e2086a6bba02bcb2f0dc100cf0c850aaa8f_NeikiAnalytics.exe
.exe windows:1 windows x86 arch:x86

fad3f78ecc7e2998c9c26d0dbd8b5393

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

cw3220

@__unlockDebuggerData$qv
_strcpy
@string@$bctr$qpxc
__setargv
_fclose
_strcat
_cos
_abort
___debuggerDisableTerminateCallback
__startup
@string@assign$qrx6stringuiui
@_CatchCleanup$qv
@__lockDebuggerData$qv
_flushall
_fopen
_fabs
__ftol
__Return_unwind
__exitargv
_strchr
__argc
__argv
_fprintf
_sin
@xmsg@$bdtr$qv
__ExceptionHandler
@string@$bdtr$qv
_fputc

kernel32

GetProcAddress
GetModuleHandleA

generalv

@Round$qf
@LlavePostprCorrecta$quci
@LeerUnTexto$qpcrit1
@LeerUnReal$qpcrirf
@LeerUnEntero$qpcrit2
@LeerLineaDeCfg$qp4FILEpcrcrit4

ltgeolib

@TraslacionPuntoPolares$qr6TPuntofft1

librpost

@FormatValue$qfiiiipc
@FiniPostCut$qrp7TRegPstii
@EraseListPostFiles$qrp12TRegFilePostt1
@DamePuntoDeEstructuraRejilla$qfffffiirft8
@DamePuntoDeEstructuraLineal$qffffirft6
@DamePuntoDeEstructuraCircular$qffffffiirft9t9
@DamePuntoBaseDeRutina$qp7TRegPstirft3
@DameNumeroLineasDeSub$qp7TRegPstiri
@DameNumeroDeSub$qp7TRegPstri
@DameNumeroDePunzonesUtilizados$qp7TRegPstri
@DameNibblingsIntermediosDeVaciadoCircular$qp7TRegPstrirft3
@DameLineaNumeroDeSub$qp7TRegPstiipc
@DameDatosDeUnPunzon$qp7TRegPstipcra7$frft5t5rit5t5t5t5t5t5t5t5t5t5t5t8t8t5t5t5t8t5t5t5
@TransformarAnguloSegunFormaDePunzon$qfp7TRegPst
@DameDatosDeNibblingsIntermediosDeVaciadoCircular$qp7TRegPstiffrft5t5ri
@SubHaSidoEjec$qp7TRegPstiri
@ScanMecCut$qp7TRegPstrit2
@DameDatosDeNibblingFinalDeVaciadoCircular$qp7TRegPstrft2t2ri
@InsertLineCnc$qpcip7TRegPstri
@InitPostCut$qpct1t1t1rp7TRegPstri
@CreateListPostFiles$qpcrp12TRegFilePostt2ri

bds501f

@TStreamableBase@$bdtr$qv

owl501f

@TModule@$bdtr$qv
@TModule@$bctr$qpxcp11HINSTANCE__
@TApplication@InitCmdShow
@TApplication@InitHPrevInstance
@TApplication@InitHInstance
@TApplication@GetInitCmdLine$qv
@HandleGlobalException$qr4xmsgpct2

Exports

Exports

__DebuggerHookData
__GetExceptDLLinfo

Sections

CODE
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fad3f78ecc7e2998c9c26d0dbd8b5393

Headers

File Characteristics

Imports

cw3220

kernel32

generalv

ltgeolib

librpost

bds501f

owl501f

Exports

Exports

Sections

CODE Size: 12KB - Virtual size: 12KB

DATA Size: 1024B - Virtual size: 4KB

.idata Size: 3KB - Virtual size: 4KB

.edata Size: 512B - Virtual size: 4KB

.reloc Size: 1024B - Virtual size: 4KB

CODE
Size: 12KB - Virtual size: 12KB

DATA
Size: 1024B - Virtual size: 4KB

.idata
Size: 3KB - Virtual size: 4KB

.edata
Size: 512B - Virtual size: 4KB

.reloc
Size: 1024B - Virtual size: 4KB