541eb3833e53a61d6c495fc69456c420_NeikiAnalytics

Sharing

Copy URL Twitter E-mail

General

Target

541eb3833e53a61d6c495fc69456c420_NeikiAnalytics
Size

32KB
MD5

541eb3833e53a61d6c495fc69456c420
SHA1

261e70c97d54d2dcf2021199aa6ba6d28ea06d51
SHA256

24641fe6046240584498f12df55aefa6b15a6f55cdb952df3b80096ac7cbb356
SHA512

75d9ad926ab09dfc881abf5eaa4c2764971dfb3b3aeb51c39520e8f5905c5a30cfd3f5d8865d8130878d464a2d90a7a2c5cb8277da3b087d206132c89bba2f46
SSDEEP

384:VWMMXoLttpPC563dBcNLYGb18q7TvQa3lFDqhN+vhTxArj0P03rrqC56P+CE:cNYtpPCsve18UTvQmFDiNCfArjyeuCQc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
541eb3833e53a61d6c495fc69456c420_NeikiAnalytics

Files

541eb3833e53a61d6c495fc69456c420_NeikiAnalytics
.exe windows:4 windows x64 arch:x64

f5a7a342157084603b6f818892b8e96e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetLastError
GetModuleHandleA
GetProcAddress
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
__C_specific_handler

msvcrt

__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_cexit
_commode
_fmode
_initterm
_onexit
abort
calloc
exit
fprintf
free
fwrite
malloc
memcmp
memcpy
signal
strlen
strncmp
vfprintf

libgcc_s_seh-1

_Unwind_Resume

libstdc++-6

_ZNSt3_V215system_categoryEv
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE10_M_disposeEv
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE12_M_constructEyc
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE13_S_copy_charsEPcPKcS7_
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE9_M_createERyy
_ZSt17__throw_bad_allocv
_ZSt25__throw_bad_function_callv
_ZSt28__throw_bad_array_new_lengthv
_ZTVN10__cxxabiv117__class_type_infoE
_ZTVN10__cxxabiv120__si_class_type_infoE
_ZdlPvy
_Znwy
__cxa_begin_catch
__cxa_end_catch
__cxa_rethrow
__gxx_personality_seh0

libllvmanalysis

_ZN4llvm12IRSimilarity22IRSimilarityIdentifier14findSimilarityERNS_6ModuleE

libllvmcore

_ZN4llvm10BasicBlock24instructionsWithoutDebugEb
_ZN4llvm11LLVMContextC1Ev
_ZN4llvm11LLVMContextD1Ev
_ZN4llvm6ModuleD1Ev

libllvmirreader

_ZN4llvm11parseIRFileENS_9StringRefERNS_12SMDiagnosticERNS_11LLVMContextENS_15ParserCallbacksE

libllvmsupport

_ZN4llvm11raw_ostream5writeEPKcy
_ZN4llvm11raw_ostream5writeEh
_ZN4llvm14ToolOutputFile16CleanupInstallerD1Ev
_ZN4llvm14ToolOutputFileC1ENS_9StringRefERSt10error_codeNS_3sys2fs9OpenFlagsE
_ZN4llvm14raw_fd_ostreamD1Ev
_ZN4llvm15SmallVectorBaseIjE8grow_podEPvyy
_ZN4llvm15allocate_bufferEyy
_ZN4llvm17deallocate_bufferEPvyy
_ZN4llvm2cl18GenericOptionValue6anchorEv
_ZN4llvm2cl18getGeneralCategoryEv
_ZN4llvm2cl23ParseCommandLineOptionsEiPKPKcNS_9StringRefEPNS_11raw_ostreamES2_b
_ZN4llvm2cl3optINSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEELb0ENS0_6parserIS7_EEE15setInitialValueERKS7_
_ZN4llvm2cl6Option11addArgumentEv
_ZN4llvm2cl6Option9setArgStrENS_9StringRefE
_ZN4llvm4errsEv
_ZN4llvm4json5Value7destroyEv
_ZN4llvm4json7OStream10arrayBeginEv
_ZN4llvm4json7OStream11objectBeginEv
_ZN4llvm4json7OStream12attributeEndEv
_ZN4llvm4json7OStream14attributeBeginENS_9StringRefE
_ZN4llvm4json7OStream5valueERKNS0_5ValueE
_ZN4llvm4json7OStream8arrayEndEv
_ZN4llvm4json7OStream9objectEndEv
_ZN4llvm8InitLLVMC1ERiRPPKcb
_ZN4llvm8InitLLVMD1Ev
_ZNK4llvm12SMDiagnostic5printEPKcRNS_11raw_ostreamEbb
_ZTVN4llvm2cl11OptionValueINSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEEE
_ZTVN4llvm2cl17basic_parser_implE
_ZTVN4llvm2cl3optINSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEELb0ENS0_6parserIS7_EEEE
_ZTVN4llvm2cl6OptionE
_ZTVN4llvm2cl6parserINSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEEE

Sections

.text
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 608B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 416B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f5a7a342157084603b6f818892b8e96e

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

libgcc_s_seh-1

libstdc++-6

libllvmanalysis

libllvmcore

libllvmirreader

libllvmsupport

Sections

.text Size: 17KB - Virtual size: 16KB

.data Size: 1024B - Virtual size: 608B

.rdata Size: 2KB - Virtual size: 2KB

/4 Size: 512B - Virtual size: 4B

.pdata Size: 1KB - Virtual size: 1KB

.xdata Size: 2KB - Virtual size: 1KB

.bss Size: - Virtual size: 416B

.idata Size: 5KB - Virtual size: 5KB

.CRT Size: 512B - Virtual size: 96B

.tls Size: 512B - Virtual size: 16B

.reloc Size: 512B - Virtual size: 144B

.text
Size: 17KB - Virtual size: 16KB

.data
Size: 1024B - Virtual size: 608B

.rdata
Size: 2KB - Virtual size: 2KB

/4
Size: 512B - Virtual size: 4B

.pdata
Size: 1KB - Virtual size: 1KB

.xdata
Size: 2KB - Virtual size: 1KB

.bss
Size: - Virtual size: 416B

.idata
Size: 5KB - Virtual size: 5KB

.CRT
Size: 512B - Virtual size: 96B

.tls
Size: 512B - Virtual size: 16B

.reloc
Size: 512B - Virtual size: 144B