906dfb28a856ae96bf55d6902ea14850_NeikiAnalytics

Sharing

Copy URL Twitter E-mail

General

Target

906dfb28a856ae96bf55d6902ea14850_NeikiAnalytics
Size

574KB
MD5

906dfb28a856ae96bf55d6902ea14850
SHA1

2832867450bf3442e30af02a131e8e7cc6ec7120
SHA256

edeb1e311fa347e11de11cb27ce2c20b74cb8b1178b24010e7fb77bf38024fb8
SHA512

6eb34ed3a67bf88287e0c5186e914efaf43348e7dc97b5369460785f7d985e510ce302022107656022a3e8d5851da62f28c4301e3df49f04603ce3d1180ebbcf
SSDEEP

12288:EKJq9ic9JLfD7h9E4dE9IYqH2X8mSVJ9zXyXlcttY:rsic9dfD/RhWXkEXlcttY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
906dfb28a856ae96bf55d6902ea14850_NeikiAnalytics

Files

906dfb28a856ae96bf55d6902ea14850_NeikiAnalytics
.dll regsvr32 windows:6 windows x86 arch:x86

ede47f715d14052027725b8aebadbe1b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

P:\Target\x86\ship\mscdm\x-none\mscdm.pdb

Imports

msvcr100

?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
__clean_type_info_names_internal
_crt_debugger_hook
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
vswprintf_s
calloc
_vsnwprintf_s
_wtol
??_V@YAXPAX@Z
??2@YAPAXI@Z
memcpy_s
wcscat_s
wcscpy_s
wcsncpy_s
wcsstr
free
malloc
_recalloc
??_U@YAPAXI@Z
__CxxFrameHandler3
memset
iswspace
memcpy
realloc
memcmp
memmove
wcschr
wcscspn
??3@YAXPAX@Z

kernel32

GetCurrentProcessId
LocalAlloc
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
DecodePointer
EncodePointer
HeapFree
HeapAlloc
WerRegisterMemoryBlock
VirtualProtect
GetTickCount
GetSystemTimeAsFileTime
LoadLibraryA
HeapSetInformation
GetProcessHeap
QueryPerformanceCounter
GetModuleFileNameA
RaiseException
GetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
DisableThreadLibraryCalls
FreeLibrary
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LoadLibraryExW
LoadResource
SizeofResource
lstrcmpiW
lstrlenW
FindResourceW
MultiByteToWideChar
WaitForSingleObject
GetCurrentThreadId
GetSystemDefaultLCID
SetEvent
WaitForMultipleObjects
Sleep
CompareStringW
WideCharToMultiByte
GetUserDefaultLCID
InitializeCriticalSection

ole32

CoCreateGuid
CoTaskMemFree
CoTaskMemRealloc
StringFromCLSID
CoGetMalloc
CoCreateInstance
CoTaskMemAlloc
StringFromGUID2

oleaut32

VariantClear
VariantCopy
VariantInit
VarCmp
SysAllocStringLen
SysStringByteLen
SysAllocStringByteLen
VariantChangeType
VarSu
SafeArrayDestroy
SafeArrayGetUBound
SafeArrayGetElement
VarBstrCmp
SetErrorInfo
GetErrorInfo
CreateErrorInfo
VariantChangeTypeEx
UnRegisterTypeLi
RegisterTypeLi
LoadTypeLi
VarUI4FromStr
SysStringLen
SysAllocString
SysFreeString
VarAdd

advapi32

RegOpenKeyExA
RegCreateKeyExW
RegDeleteKeyW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
RegSetValueExA
RegQueryValueExW
RegQueryValueExA
RegCloseKey
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW

mfc100u

ord3413
ord2068
ord2062
ord2064

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 281KB - Virtual size: 280KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 277KB - Virtual size: 280KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ede47f715d14052027725b8aebadbe1b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcr100

kernel32

ole32

oleaut32

advapi32

mfc100u

Exports

Exports

Sections

.text Size: 281KB - Virtual size: 280KB

.data Size: 10KB - Virtual size: 11KB

.rsrc Size: 4KB - Virtual size: 4KB

.reloc Size: 277KB - Virtual size: 280KB

.text
Size: 281KB - Virtual size: 280KB

.data
Size: 10KB - Virtual size: 11KB

.rsrc
Size: 4KB - Virtual size: 4KB

.reloc
Size: 277KB - Virtual size: 280KB