117996d2fa1b42845fdfcfe1daf17470_NeikiAnalytics

Sharing

Copy URL Twitter E-mail

General

Target

117996d2fa1b42845fdfcfe1daf17470_NeikiAnalytics
Size

470KB
MD5

117996d2fa1b42845fdfcfe1daf17470
SHA1

a0c337efff72a16a87840e5c07985408c7a99c1d
SHA256

c57a9641f77e0d8ad45bfd01bddd86f007cea23d1ec35ea62ac8323e45f8fa4a
SHA512

21fc35658981b9b0770eb5a9f60dad7135c44e087aefa98b81e19043049d5cbff9aead9c41ea61ea651876d2787f536506c3c48d84ee64515dbc8f7943b872b1
SSDEEP

12288:TdT3RpHcRyJ06n5ysqmZ1NOI7MxBTJgpSXYxOZOE:BT3zGyb5yaAI+0xv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
117996d2fa1b42845fdfcfe1daf17470_NeikiAnalytics

Files

117996d2fa1b42845fdfcfe1daf17470_NeikiAnalytics
.dll windows:6 windows x86 arch:x86

fe26754542be893e8c63d5e68ff3a138

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

P:\Target\x86\ship\filters\en-us\png32.pdb

Imports

advapi32

RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
RegEnumKeyExA
RegSetValueExA
EventWrite

comctl32

ord17

gdi32

GetViewportExtEx
GetWindowExtEx
CreateCompatibleDC
DeleteDC
DeleteObject
GetDeviceCaps
GetMetaFileBitsEx
SelectObject
SetMapMode
PlayMetaFileRecord
EnumMetaFile
DeleteEnhMetaFile
EnumEnhMetaFile
CreateMetaFileA
GetEnhMetaFileHeader
PlayEnhMetaFileRecord
GetTextExtentPoint32A
SetViewportExtEx
SetWindowExtEx
SetWindowOrgEx
GetObjectA
SetMetaFileBitsEx
Escape
GdiComment
CloseMetaFile
CreateDIBSection
DeleteMetaFile
RealizePalette
SelectPalette

gdiplus

GdipEmfToWmfBits
GdipRecordMetafile
GdipGetHemfFromMetafile
GdipDrawImageRectRectI
GdipDeleteGraphics
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromFileICM
GdipGetImageFlags
GdipGetImageVerticalResolution
GdipGetImageHorizontalResolution
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageBounds
GdipGetImageGraphicsContext
GdipDisposeImage
GdipLoadImageFromFileICM
GdiplusShutdown
GdiplusStartup

kernel32

FindClose
FindFirstFileA
FreeLibrary
GetModuleHandleW
GetProcAddress
LoadLibraryExA
lstrcmpA
lstrlenA
Sleep
DecodePointer
EncodePointer
LoadLibraryA
RaiseFailFastException
HeapReAlloc
MultiByteToWideChar
MulDiv
GlobalHandle
GetLastError
GetTickCount
_llseek
_lwrite
_lread
CloseHandle
CreateFileA
GlobalFree
GlobalAlloc
GlobalUnlock
GlobalLock
DeleteFileA
GetProcessHeap
HeapFree
HeapAlloc
RaiseException
GetCurrentThreadId
QueryPerformanceCounter
HeapSetInformation
GetCurrentProcessId
GetSystemTimeAsFileTime
VirtualProtect
WerRegisterMemoryBlock
InterlockedExchange
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
LocalAlloc

msvcr100

?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
__clean_type_info_names_internal
_except_handler4_common
_crt_debugger_hook
_onexit
_lock
__dllonexit
_unlock
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
strtod
malloc
free
_CIpow
abort
strncpy
longjmp
fprintf
__iob_func
fread
fflush
sprintf
__CxxFrameHandler3
_CxxThrowException
strstr
atol
_vsnprintf
_setjmp3
memcmp
memset
memcpy
ceil
strcpy_s
fwrite

Exports

Exports

ExportGr
GetFilterInfo
GetFilterPref
ImportGr
MSFFClose
MSFFControl
MSFFGetLine
MSFFOpen
MSFFPutLine
MSFFSeek
RegisterPercentCallback
SetFilterPref

Sections

.text
Size: 194KB - Virtual size: 194KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 270KB - Virtual size: 272KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fe26754542be893e8c63d5e68ff3a138

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

comctl32

gdi32

gdiplus

kernel32

msvcr100

Exports

Exports

Sections

.text Size: 194KB - Virtual size: 194KB

.data Size: 3KB - Virtual size: 4KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 270KB - Virtual size: 272KB

.text
Size: 194KB - Virtual size: 194KB

.data
Size: 3KB - Virtual size: 4KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 270KB - Virtual size: 272KB