2e2468fb33bb93939dade531ca4f15aefec69ca53749c97405a9692d9aacc3ca_NeikiAnalytics[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

2e2468fb33bb93939dade531ca4f15aefec69ca53749c97405a9692d9aacc3ca_NeikiAnalytics.exe
Size

1.5MB
MD5

049da7224397cd68ea690d96313b3470
SHA1

83f177c7649df03b37de33ba0d933fdbf131de3f
SHA256

2e2468fb33bb93939dade531ca4f15aefec69ca53749c97405a9692d9aacc3ca
SHA512

0d287e64c90848c42cda7f4c10028ad3a8b887eaaa1c5888480b70651aa2f834ecc7fab5634729c01871d6dba604f5e93b17232024890e5f7abdf1888ca9bd04
SSDEEP

24576:1zuxsss+jG+SuH9JnL5DzlKHp/i328ab4F+rM/aXq6bJfBUam6:RMssA1uzBlKJ/i3da1YS6ozB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2e2468fb33bb93939dade531ca4f15aefec69ca53749c97405a9692d9aacc3ca_NeikiAnalytics.exe

Files

2e2468fb33bb93939dade531ca4f15aefec69ca53749c97405a9692d9aacc3ca_NeikiAnalytics.exe
.exe windows:10 windows x64 arch:x64

7e43f6bbea9d1e7aab6db0933316a62b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

MakePri.pdb

Imports

msvcrt

_commode
_fmode
__C_specific_handler
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
_CxxThrowException
_unlock
_onexit
?terminate@@YAXXZ
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBQEBDH@Z
malloc
free
_wtoi
_fileno
_setmode
fflush
_vsnprintf_s
??0exception@@QEAA@AEBV0@@Z
??1type_info@@UEAA@XZ
memset
_lock
_callnewh
??0exception@@QEAA@XZ
__iob_func
vswprintf_s
??0exception@@QEAA@AEBQEBD@Z
memmove_s
memmove
fwprintf_s
swprintf_s
_purecall
_wcsicmp
_getwche
towupper
wcsstr
wprintf
wcsncmp
_wfopen
fgetwc
_errno
fclose
_wcsnicmp
towlower
wcscpy_s
_vscwprintf_l
wcschr
iswdigit
wcscspn
_wfopen_s
fwprintf
iswctype
wcsrchr
iswalnum
iswspace
qsort_s
isalpha
_ui64tow_s
wcsncpy_s
bsearch
_wtof
memcpy
memcmp
__CxxFrameHandler3
??1exception@@UEAA@XZ
memcpy_s
__dllonexit
_vsnwprintf
strcspn
localeconv
sprintf_s
fread
_filelengthi64
isxdigit
strtol
isdigit
vwprintf_s
wprintf_s
__pctype_func
___lc_handle_func
___lc_codepage_func
__mb_cur_max
setlocale
__uncaught_exception
__crtGetStringTypeW
__crtLCMapStringW
___mb_cur_max_func
abort
wcsnlen
memchr
wcscmp

oleaut32

SysStringByteLen
GetErrorInfo
SysFreeString
SysStringLen
SysAllocString
VariantClear
VariantChangeTypeEx
SysAllocStringByteLen
VariantChangeType
VariantInit

rpcrt4

UuidCreate
UuidToStringW
RpcStringFreeW

kernel32

EnterCriticalSection
LeaveCriticalSection
CompareFileTime
SystemTimeToFileTime
DeleteCriticalSection
GetSystemTime
OutputDebugStringA
WideCharToMultiByte
FlushFileBuffers
WriteFile
GetFinalPathNameByHandleW
GetFileAttributesExW
GetDriveTypeW
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
GetFileSizeEx
LCMapStringEx
GetSystemWindowsDirectoryW
ReleaseSRWLockShared
AcquireSRWLockShared
InitializeCriticalSection
CompareStringOrdinal
MultiByteToWideChar
SetFilePointer
ReadFile
GetFileSize
GetModuleFileNameA
CreateSemaphoreExW
HeapFree
SetLastError
ReleaseSemaphore
GetModuleHandleExW
WaitForSingleObject
GetCurrentThreadId
ReleaseMutex
FormatMessageW
GetLastError
OutputDebugStringW
WaitForSingleObjectEx
OpenSemaphoreW
CloseHandle
HeapAlloc
GetProcAddress
CreateMutexExW
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
DebugBreak
IsDebuggerPresent
CreateFileW
SetThreadPreferredUILanguages
SetConsoleCtrlHandler
GetFullPathNameW
CompareStringW
Sleep
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
GetFileAttributesW
LocalAlloc
LocalSize
LocalFree
CompareStringEx
InitializeSRWLock
FindFirstFileW
FindClose
RemoveDirectoryW
FindNextFileW
CopyFileExW
DeleteFileW
GetTempPathW
CreateDirectoryW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive

ole32

CoCreateInstance
CoUninitialize
CoInitializeEx

user32

LoadStringW

shlwapi

StrChrW
PathRemoveBackslashW
PathIsNetworkPathW
PathFileExistsW
PathRelativePathToW
PathIsRelativeW
SHCreateStreamOnFileW

advapi32

AllocateAndInitializeSid
FreeSid
RegGetValueW
GetNamedSecurityInfoW
GetAce
EqualSid
GetLengthSid
AddAccessAllowedAceEx
SetNamedSecurityInfoW
RegCreateKeyExW
RegSetValueExW
RegCloseKey

Sections

.text
Size: 659KB - Virtual size: 659KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 217KB - Virtual size: 217KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 572KB - Virtual size: 576KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

7e43f6bbea9d1e7aab6db0933316a62b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

oleaut32

rpcrt4

kernel32

ole32

user32

shlwapi

advapi32

Sections

.text Size: 659KB - Virtual size: 659KB

.rdata Size: 217KB - Virtual size: 217KB

.data Size: 6KB - Virtual size: 8KB

.pdata Size: 24KB - Virtual size: 24KB

.rsrc Size: 34KB - Virtual size: 33KB

.reloc Size: 572KB - Virtual size: 576KB

.text
Size: 659KB - Virtual size: 659KB

.rdata
Size: 217KB - Virtual size: 217KB

.data
Size: 6KB - Virtual size: 8KB

.pdata
Size: 24KB - Virtual size: 24KB

.rsrc
Size: 34KB - Virtual size: 33KB

.reloc
Size: 572KB - Virtual size: 576KB