011d1a47b25cfd3762824dcb30e95fab8cb83264d04628abaf7241c0ec0e072d_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

011d1a47b25cfd3762824dcb30e95fab8cb83264d04628abaf7241c0ec0e072d_NeikiAnalytics.exe
Size

561KB
MD5

b44eb8f4950e27ad0cc93e203a19d960
SHA1

07023a4289563b26dc62904ba03a7e6c473de537
SHA256

011d1a47b25cfd3762824dcb30e95fab8cb83264d04628abaf7241c0ec0e072d
SHA512

6838b51375746580f67a564ff808c22c0276953547d0536bc05788ef85c1b085fe7fdd55826fe50cf7f58167ca409e05659fcf0ac06fc02357a86b984b91bcde
SSDEEP

12288:gn0CILlf2PtPQeMpOk/MSf5Q8KC5Vz/PTyUvs29noVpfa:yufQtPQeQZ/dqxYT+CoVBa

Score

1^/10

Malware Config

Signatures

Files

011d1a47b25cfd3762824dcb30e95fab8cb83264d04628abaf7241c0ec0e072d_NeikiAnalytics.exe
.exe windows:5 windows x86 arch:x86

3ede871f504dee75b485f08c01cf3ea1

Code Sign

2d:10:e9:fe:f2:84:50:a5:4b:f8:b0:57:54:0a:13:92
Certificate

Issuer

CN=Anthony e Camila Adega ME,O=Anthony e Camila Adega ME,L=Cotia,ST=SP,C=BR

Not Before

21/12/2017, 04:02

Not After

31/12/2039, 23:59

Subject

CN=Anthony e Camila Adega ME,O=Anthony e Camila Adega ME,L=Cotia,ST=SP,C=BR

63:46:22:03:d4:bd:ac:66:4f:ae:28:db:c4:c7:46:94:38:bb:84:73
Signer

Actual PE Digest

63:46:22:03:d4:bd:ac:66:4f:ae:28:db:c4:c7:46:94:38:bb:84:73

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

InitializeCriticalSection
GetProcAddress
LocalFree
RaiseException
LocalAlloc
GetModuleHandleA
LeaveCriticalSection
EnterCriticalSection
GetShortPathNameA
ResumeThread
WriteProcessMemory
GetPrivateProfileSectionA
GetStringTypeA
LCMapStringW
LCMapStringA
RtlUnwind
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW

user32

DefWindowProcA
AdjustWindowRectEx

Sections

0
Size: 325KB - Virtual size: 567KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

1
Size: 62KB - Virtual size: 184KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

2
Size: 2KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

3
Size: 112KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

4
Size: - Virtual size: 28KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

5
Size: 45KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

6
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

7
Size: 7KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

3ede871f504dee75b485f08c01cf3ea1

Code Sign

2d:10:e9:fe:f2:84:50:a5:4b:f8:b0:57:54:0a:13:92Certificate

63:46:22:03:d4:bd:ac:66:4f:ae:28:db:c4:c7:46:94:38:bb:84:73Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

Sections

0 Size: 325KB - Virtual size: 567KB

1 Size: 62KB - Virtual size: 184KB

2 Size: 2KB - Virtual size: 35KB

3 Size: 112KB - Virtual size: 111KB

4 Size: - Virtual size: 28KB

5 Size: 45KB - Virtual size: 70KB

6 Size: 3KB - Virtual size: 3KB

7 Size: 7KB - Virtual size: 28KB

2d:10:e9:fe:f2:84:50:a5:4b:f8:b0:57:54:0a:13:92
Certificate

63:46:22:03:d4:bd:ac:66:4f:ae:28:db:c4:c7:46:94:38:bb:84:73
Signer

0
Size: 325KB - Virtual size: 567KB

1
Size: 62KB - Virtual size: 184KB

2
Size: 2KB - Virtual size: 35KB

3
Size: 112KB - Virtual size: 111KB

4
Size: - Virtual size: 28KB

5
Size: 45KB - Virtual size: 70KB

6
Size: 3KB - Virtual size: 3KB

7
Size: 7KB - Virtual size: 28KB