14d98839f357d93a2b63f51110162660_NeikiAnalytics

Sharing

Copy URL

Twitter E-mail

General

Target

14d98839f357d93a2b63f51110162660_NeikiAnalytics
Size

2.2MB
MD5

14d98839f357d93a2b63f51110162660
SHA1

9a34bdbfe61764d17164547ee13bafef8d49a73c
SHA256

98f88c7bcbcccbebbb88381bf59696b4187a6d93f35fc582f3e1c045dc1c5d1f
SHA512

b062bf804c06211ad2df32c115b3ea3c5c8fb5770560af6ef364a4468d51ba5f2d3c9a1c7b7a1390d3072cba140a875c3abf997bc01c0be92cdd9c327566b25e
SSDEEP

49152:yPofOdoADbyaSUceDAvwfeOAy9iZztpPGWwBRm39:Co2DSHeXAy9iZztpPGWwBRm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
14d98839f357d93a2b63f51110162660_NeikiAnalytics

Files

14d98839f357d93a2b63f51110162660_NeikiAnalytics
.dll windows:6 windows x86 arch:x86

78f1925ec1b5b141215c4ca89bffe532

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

shell32

SHGetFolderPathW
SHGetKnownFolderPath
SHGetFolderPathA

ole32

CoTaskMemFree

advapi32

OpenProcessToken
GetLengthSid
GetTokenInformation
CopySid
RegGetValueW
RegCreateKeyExW
SetThreadToken
OpenThreadToken
AllocateAndInitializeSid
CreateRestrictedToken
CreateWellKnownSid
FreeSid
GetSecurityDescriptorDacl
ImpersonateSelf
InitializeSecurityDescriptor
RevertToSelf
SetSecurityDescriptorDacl
GetUserNameA
GetUserNameW
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
SetEntriesInAclA

user32

LoadStringW
GetWindow
GetDC
GetWindowTextW
IsWindowVisible
GetWindowDisplayAffinity
GetRegisteredRawInputDevices
RegisterRawInputDevices
EnumChildWindows
EnumWindows
GetShellWindow
FindWindowExW
FindWindowExA
SetWindowLongA
ClipCursor
MapVirtualKeyA
SendInput
GetAsyncKeyState
DestroyWindow
CreateWindowExA
RegisterClassExA
UnregisterClassA
DefWindowProcA
GetRawInputData
PostMessageA
SendNotifyMessageA
SendMessageA
DispatchMessageA
TranslateMessage
GetMessageA
FindWindowA
GetWindowLongA
SetForegroundWindow
GetForegroundWindow
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExA
GetCursorInfo
IsProcessDPIAware
SystemParametersInfoA
EnumDisplaySettingsA
GetWindowThreadProcessId
WindowFromPhysicalPoint
GetPhysicalCursorPos
SetCursor
ShowCursor
RedrawWindow
IsWindow
AttachThreadInput
PostThreadMessageA
GetDesktopWindow
GetWindowRect
GetSystemMetrics
LoadBitmapA
ReleaseDC

shlwapi

PathFileExistsA
PathFindFileNameA

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

kernel32

SetStdHandle
SetFilePointerEx
HeapSize
SetEnvironmentVariableW
GetConsoleCP
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetTimeZoneInformation
HeapReAlloc
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
SetConsoleCtrlHandler
ExitProcess
WriteConsoleW
GetModuleHandleExW
GetFileType
GetStdHandle
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
GetConsoleMode
ReadConsoleW
FreeEnvironmentStringsW
lstrcmpA
InitializeSListHead
TerminateProcess
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
WaitForSingleObjectEx
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
EncodePointer
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SwitchToThread
InitializeCriticalSectionAndSpinCount
FormatMessageW
OpenFileMappingW
CreateFileMappingW
OpenEventW
CreateEventW
OpenMutexW
CreateMutexW
CreateNamedPipeA
CreateFileMappingA
OpenMutexA
GetCurrentProcessId
GetModuleFileNameA
CloseHandle
GetLastError
QueryPerformanceCounter
QueryPerformanceFrequency
InitializeCriticalSection
DeleteCriticalSection
OpenProcess
FreeLibrary
GetModuleFileNameW
GetProcAddress
LoadLibraryA
MultiByteToWideChar
WideCharToMultiByte
CreateToolhelp32Snapshot
Process32First
Process32Next
GetSystemDirectoryA
GetSystemDirectoryW
GetModuleHandleA
VerSetConditionMask
ExpandEnvironmentStringsW
CreateFileW
GetFileAttributesW
GetFullPathNameW
OutputDebugStringW
SetLastError
GetCurrentProcess
CreateProcessA
CreateProcessW
GetModuleHandleW
LoadLibraryExW
LocalAlloc
LocalFree
SetEndOfFile
lstrcmpW
VerifyVersionInfoW
FileTimeToSystemTime
EnterCriticalSection
LeaveCriticalSection
CreateDirectoryA
GetModuleHandleExA
CreateFileA
DeleteFileA
GetFileAttributesA
GetFileSizeEx
GetFinalPathNameByHandleA
WriteFile
OutputDebugStringA
GetCurrentThread
GetCurrentThreadId
GetLocalTime
CopyFileA
MoveFileExA
SetEvent
ResetEvent
WaitForSingleObject
CreateEventA
CreateThread
GetThreadId
Thread32First
Thread32Next
Process32FirstW
Process32NextW
QueryFullProcessImageNameA
K32GetProcessImageFileNameA
GetErrorMode
SetErrorMode
InitOnceExecuteOnce
GetTickCount64
GetTickCount
ReadFile
DecodePointer
RaiseException
InitializeCriticalSectionEx
WaitForMultipleObjects
Sleep
FlushFileBuffers
DisconnectNamedPipe
ReleaseMutex
UnmapViewOfFile
OpenFileMappingA
ConnectNamedPipe
HeapAlloc
HeapFree
GetProcessHeap
CreateMutexA
OpenEventA
MapViewOfFile

Exports

Exports

CreateShadowPlayProxyShimInterface
QueryShadowPlayDdiShimInterface
QueryShadowPlayDdiShimStatus

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 232KB - Virtual size: 232KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 92KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

78f1925ec1b5b141215c4ca89bffe532

Headers

DLL Characteristics

File Characteristics

Imports

shell32

ole32

advapi32

user32

shlwapi

version

kernel32

Exports

Exports

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.rdata Size: 232KB - Virtual size: 232KB

.data Size: 64KB - Virtual size: 64KB

.idata Size: 12KB - Virtual size: 12KB

.tls Size: 4KB - Virtual size: 4KB

.00cfg Size: 4KB - Virtual size: 4KB

.rsrc Size: 76KB - Virtual size: 76KB

.reloc Size: 92KB - Virtual size: 92KB

.text
Size: 1.7MB - Virtual size: 1.7MB

.rdata
Size: 232KB - Virtual size: 232KB

.data
Size: 64KB - Virtual size: 64KB

.idata
Size: 12KB - Virtual size: 12KB

.tls
Size: 4KB - Virtual size: 4KB

.00cfg
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 76KB - Virtual size: 76KB

.reloc
Size: 92KB - Virtual size: 92KB