27a9aea4d97c4bc63cf98c6c043c4c70922435502eeef0b98d7c6a6ea028b321_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

27a9aea4d97c4bc63cf98c6c043c4c70922435502eeef0b98d7c6a6ea028b321_NeikiAnalytics.exe
Size

200KB
MD5

5da65647cf122e34decdcc81322953c0
SHA1

80c6e06910340f60f1e819a7ff70145d8956511c
SHA256

27a9aea4d97c4bc63cf98c6c043c4c70922435502eeef0b98d7c6a6ea028b321
SHA512

b872ea0be409972b282c0b12913eca67b8c56ef23d92e1cb1af9c0a9bfc007ecdc91730e8c879a2a305c368d3ced60137fa16a80af17241442db39ab3eb48567
SSDEEP

3072:Xznjww3TlUpFxkvjUfRdH5el0H7bHC6zcqJ5YVwwLI9ynDF9YdoUB9:j8siGgfRuS7biWi9TnDFKtB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
27a9aea4d97c4bc63cf98c6c043c4c70922435502eeef0b98d7c6a6ea028b321_NeikiAnalytics.exe

Files

27a9aea4d97c4bc63cf98c6c043c4c70922435502eeef0b98d7c6a6ea028b321_NeikiAnalytics.exe
.dll windows:4 windows x86 arch:x86

24211f35a927083d9269fdda4584c6e6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

winscard

SCardTransmit
SCardReconnect
SCardReleaseContext
SCardEstablishContext
SCardListReadersA
SCardConnectA
SCardStatusA
SCardDisconnect

setupapi

SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsA
SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces

user32

wsprintfA

version

GetFileVersionInfoA
VerQueryValueA

hid

HidD_GetFeature
HidD_SetFeature
HidD_GetHidGuid
HidD_GetAttributes

msvcrt

memchr
strcmp
fopen
fclose
fread
fwrite
fflush
_itoa
ftell
fseek
fgets
_except_handler3
_chkesp
??3@YAXPAX@Z
strcpy
strlen
_stricmp
??2@YAPAXI@Z
_initterm
_adjust_fdiv
realloc
memmove
_ftol
_memicmp
strncmp
time
srand
rand
toupper
sprintf
_findfirst
_findnext
_findclose
malloc
free
_setmode

advapi32

SetSecurityDescriptorDacl
InitializeSecurityDescriptor

kernel32

GetCurrentThreadId
GetCurrentProcessId
GlobalMemoryStatus
GetTickCount
CreateMutexA
LoadLibraryA
GetProcAddress
GetWindowsDirectoryA
Sleep
DeviceIoControl
FreeLibrary
CloseHandle
GetVersionExA
ReleaseMutex
WaitForSingleObject
GetLastError
QueryPerformanceCounter
CreateFileA

Exports

Exports

DES_Decrypt
DES_Encrypt
MWTokenActivateFile
MWTokenAddKey
MWTokenConnect
MWTokenCreateApp
MWTokenCreateBinaryFile
MWTokenCreateDirectory
MWTokenCreatePriKeyFile
MWTokenCreatePubKeyFile
MWTokenCreateRecordFile
MWTokenDecrypt
MWTokenDeleteApp
MWTokenDeleteFile
MWTokenDisconnect
MWTokenEncrypt
MWTokenGeneratePubKey
MWTokenGet
MWTokenGetRnd
MWTokenList
MWTokenLock
MWTokenReadBinary
MWTokenReadRecord
MWTokenReset
MWTokenSHA1Hash
MWTokenSelectApp
MWTokenSelectFile
MWTokenSendApdu
MWTokenSet
MWTokenSetDecrypt
MWTokenSetEncrypt
MWTokenSetPriDecrypt
MWTokenSetPubEncrypt
MWTokenUnblockPin
MWTokenUnlock
MWTokenUpdateBinary
MWTokenUpdateKey
MWTokenUpdatePin
MWTokenUpdatePubKeyFile
MWTokenUpdateRecord
MWTokenVerifyPin
Mw_GetDevState
mw_close
mw_comres
mw_init
mw_protocol
mw_reset

Sections

.text
Size: 168KB - Virtual size: 167KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

24211f35a927083d9269fdda4584c6e6

Headers

File Characteristics

Imports

winscard

setupapi

user32

version

hid

msvcrt

advapi32

kernel32

Exports

Exports

Sections

.text Size: 168KB - Virtual size: 167KB

.rdata Size: 12KB - Virtual size: 11KB

.data Size: 8KB - Virtual size: 39KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 168KB - Virtual size: 167KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 8KB - Virtual size: 39KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 3KB