203f5fb29e72cb8fb3c3ba377ff149d0_NeikiAnalytics

Sharing

Copy URL Twitter E-mail

General

Target

203f5fb29e72cb8fb3c3ba377ff149d0_NeikiAnalytics
Size

520KB
MD5

203f5fb29e72cb8fb3c3ba377ff149d0
SHA1

f96637c6315a186230b0e3bc06cd25f632c22560
SHA256

9964b81d44af265ff644f138b883b68dcf7f18c732e1ac8a1ac7f723e485b6a9
SHA512

d13bb06e8cf7e9cda5066689d5134a6da99ed5d1d8e028b7454f5a8622377f6e426e05570bb96c0528ec6c7f57f6e457db397a567127eeb082fbed9644297446
SSDEEP

6144:kT2gZXt1D7yukB/Hv7PByI2vjUyY0E4xoGeuX7YZZRh1w9MFGtWrMyv1u8i4D:Wrp7Dkhv7l24TBG/EZQkGuSng

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
203f5fb29e72cb8fb3c3ba377ff149d0_NeikiAnalytics

Files

203f5fb29e72cb8fb3c3ba377ff149d0_NeikiAnalytics
.dll windows:10 windows x64 arch:x64

e849385c799bd29254616128e450c079

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

Microsoft.Bluetooth.UserService.pdb

Imports

msvcp_win

?_Xlength_error@std@@YAXPEBD@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_ceilf
_o_free
_o_iswcntrl
_o_malloc
_o_pow
_o_wcstok_s
__C_specific_handler
_o__configure_narrow_argv
_CxxThrowException
_o__cexit
_o__callnewh
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf_p
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__CxxFrameHandler3
_o__execute_onexit_table
_o__errno
__std_terminate
__CxxFrameHandler4
_o__crt_atexit
memcmp
memcpy
__std_type_info_compare

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-core-libraryloader-l1-2-0

LoadStringW
GetModuleFileNameA
GetModuleHandleExW
DisableThreadLibraryCalls
GetProcAddress
GetModuleHandleW

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionEx
CreateMutexExW
SetEvent
OpenSemaphoreW
WaitForSingleObjectEx
DeleteCriticalSection
ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseMutex
AcquireSRWLockExclusive
WaitForSingleObject
EnterCriticalSection
ReleaseSemaphore
ResetEvent
CreateEventExW
CreateSemaphoreExW
InitializeCriticalSectionAndSpinCount
CreateEventW
LeaveCriticalSection
ReleaseSRWLockExclusive
InitializeCriticalSection

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetLastError
RaiseException

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentThreadId
OpenThreadToken
ProcessIdToSessionId
GetCurrentProcess
OpenProcessToken
TerminateProcess
GetCurrentThread

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolCleanupGroup
CloseThreadpoolCleanupGroup
WaitForThreadpoolWorkCallbacks
CreateThreadpoolWork
SetThreadpoolTimerEx
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolCleanupGroupMembers
CloseThreadpoolWork
CreateThreadpoolTimer
SetThreadpoolTimer
SubmitThreadpoolWork

api-ms-win-eventing-classicprovider-l1-1-0

UnregisterTraceGuids
TraceMessage
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle
RegisterTraceGuidsW

wpprecorderum

WppAutoLogStop
WppAutoLogTrace
WppAutoLogStart

ntdll

RtlUnicodeToUTF8N
RtlPublishWnfStateData
NtQueryWnfStateData
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlSubscribeWnfStateChangeNotification
RtlInitUnicodeString

api-ms-win-service-core-l1-1-0

RegisterServiceCtrlHandlerExW
SetServiceStatus

api-ms-win-core-winrt-l1-1-0

RoRegisterActivationFactories
RoRevokeActivationFactories
RoUninitialize
RoActivateInstance
RoGetActivationFactory
RoInitialize

api-ms-win-core-kernel32-legacy-l1-1-0

UnregisterWait

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount64
GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-com-l1-1-0

StringFromGUID2
CoRevertToSelf
CoDisconnectContext
CoRegisterClassObject
CoResumeClassObjects
CoAddRefServerProcess
CoGetApartmentType
CoImpersonateClient
CoCreateInstance
CoIncrementMTAUsage
CoDecrementMTAUsage
CoWaitForMultipleHandles
CoCreateFreeThreadedMarshaler
CoCreateGuid
CoReleaseServerProcess
CoRevokeClassObject

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString
WindowsDeleteString
WindowsIsStringEmpty
WindowsStringHasEmbeddedNull
WindowsGetStringRawBuffer
WindowsCreateStringReference

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-synch-l1-2-0

InitOnceComplete
InitOnceBeginInitialize
InitOnceExecuteOnce

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
CompareStringOrdinal

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

combase

ord66
ord154
ord67
ord68

policymanager

PolicyManager_FreeGetPolicyData
PolicyManager_GetPolicy

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegGetValueW
RegSetValueExW
RegQueryValueExW
RegCreateKeyExW
RegOpenKeyExW

api-ms-win-power-setting-l1-1-0

PowerSettingRegisterNotification
PowerSettingUnregisterNotification

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventRegister
EventUnregister
EventWriteTransfer

api-ms-win-security-base-l1-1-0

GetTokenInformation
ImpersonateSelf
IsValidSid
RevertToSelf
CopySid
GetLengthSid

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

Exports

Exports

DllMain
ServiceMain
SvchostPushServiceGlobals

Sections

.text
Size: 388KB - Virtual size: 385KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 92KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 168B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e849385c799bd29254616128e450c079

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcp_win

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-eventing-classicprovider-l1-1-0

wpprecorderum

ntdll

api-ms-win-service-core-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

combase

policymanager

api-ms-win-core-registry-l1-1-0

api-ms-win-power-setting-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-synch-l1-2-1

Exports

Exports

Sections

.text Size: 388KB - Virtual size: 385KB

.rdata Size: 92KB - Virtual size: 88KB

.data Size: 4KB - Virtual size: 7KB

.pdata Size: 20KB - Virtual size: 17KB

.didat Size: 4KB - Virtual size: 168B

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 388KB - Virtual size: 385KB

.rdata
Size: 92KB - Virtual size: 88KB

.data
Size: 4KB - Virtual size: 7KB

.pdata
Size: 20KB - Virtual size: 17KB

.didat
Size: 4KB - Virtual size: 168B

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 3KB