eea4f0ff251dfe6a5889b77f7651dc60_NeikiAnalytics

Sharing

Copy URL Twitter E-mail

General

Target

eea4f0ff251dfe6a5889b77f7651dc60_NeikiAnalytics
Size

348KB
MD5

eea4f0ff251dfe6a5889b77f7651dc60
SHA1

d14c8717eb9d5f22166c515bddd01697560d5d09
SHA256

db428cf87a3c3f7e32c14cb1a29ace8142ffc459e6bdd78031e7c23dbc6674bd
SHA512

4689a04c7b425abec5b8a087679a301667f74d0f1b786388c0b50a3baa70c1c05cc0b46ffc0a172ea6c70228d9e0679fd7a7b7c6956fd46d49ae9c252b11d7ae
SSDEEP

6144:9NvkADebH2u23/UGLn7dX9K5Wp+ConVqbSZt2hc9m5mRQP+5B2HRexv:9NvkAabH2u2cKvp+Cq3yGs+bmRov

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
eea4f0ff251dfe6a5889b77f7651dc60_NeikiAnalytics

Files

eea4f0ff251dfe6a5889b77f7651dc60_NeikiAnalytics
.dll regsvr32 windows:4 windows x86 arch:x86

6df230e4eb1d704df0a17dff2a8316e4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LocalAlloc
LoadLibraryA
GetVersionExA
RaiseException
GetFileSize
ReadFile
CloseHandle
InterlockedDecrement
InterlockedIncrement
DisableThreadLibraryCalls
GetProcAddress
DeleteCriticalSection
InitializeCriticalSection
GetLastError
FreeLibrary
InterlockedExchange
GetCurrentThreadId
LeaveCriticalSection
EnterCriticalSection
GetCurrentProcess
FlushInstructionCache
lstrlenA
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
WideCharToMultiByte
SizeofResource
LockResource
LoadResource
MultiByteToWideChar
GetSystemDefaultLCID

gdi32

GetTextColor
GetBkMode
SetTextColor
SetBkMode
MoveToEx
LineTo
TextOutW
CreatePen
GetStockObject
GetDeviceCaps
SelectObject
CreateSolidBrush
Rectangle
CreatePalette
SelectPalette
RealizePalette
DeleteObject

user32

GetClientRect
IsRectEmpty
SetRectEmpty
UnregisterClassA
ShowWindow
GetParent
IsWindowEnabled
GetActiveWindow
SendMessageA
IsChild
IsWindowVisible
DestroyWindow
MapWindowPoints
SetWindowPos
OffsetRect
BringWindowToTop
EndDialog
IsWindowUnicode
EnableWindow
GetWindowRect
ScreenToClient
MoveWindow
FillRect
IsWindow
SetScrollPos
GetDlgItem
EnumChildWindows
GetSysColorBrush
SetFocus
BeginPaint
GetSysColor
InflateRect
GetFocus
DrawFocusRect
EndPaint
GetDC
InvalidateRect
ReleaseDC

comctl32

ImageList_Destroy

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey

ole32

OleRun
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree

oleaut32

VarBstrCat
VariantCopy
RegisterTypeLi
LoadTypeLi
VarUI4FromStr
SysFreeString
SysAllocStringLen
SysAllocString
SysStringLen
VariantInit
VariantClear
VariantChangeType
LoadRegTypeLi

msvcr70

wcscat
towlower
wcsncmp
_wcsnicmp
vswprintf
_vscwprintf
wcschr
wcsstr
wcscmp
memmove
_purecall
realloc
free
wcsrchr
_except_handler3
wcslen
memset
wcsncpy
wcstoul
_wcsicmp
wcscpy
swprintf
??2@YAPAXI@Z
??_U@YAPAXI@Z
??_V@YAXPAX@Z
??3@YAXPAX@Z
_initterm
_adjust_fdiv
__dllonexit
_onexit
malloc

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
VSDllRegisterServer
VSDllUnregisterServer

Sections

.text
Size: 88KB - Virtual size: 85KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 232KB - Virtual size: 232KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6df230e4eb1d704df0a17dff2a8316e4

Headers

File Characteristics

Imports

kernel32

gdi32

user32

comctl32

advapi32

ole32

oleaut32

msvcr70

Exports

Exports

Sections

.text Size: 88KB - Virtual size: 85KB

.data Size: 12KB - Virtual size: 10KB

.rsrc Size: 12KB - Virtual size: 10KB

.reloc Size: 232KB - Virtual size: 232KB

.text
Size: 88KB - Virtual size: 85KB

.data
Size: 12KB - Virtual size: 10KB

.rsrc
Size: 12KB - Virtual size: 10KB

.reloc
Size: 232KB - Virtual size: 232KB