bf4eb963df05659bc09c2a1941678330_NeikiAnalytics

Sharing

Copy URL Twitter E-mail

General

Target

bf4eb963df05659bc09c2a1941678330_NeikiAnalytics
Size

3.1MB
MD5

bf4eb963df05659bc09c2a1941678330
SHA1

84bc13d1ed71fcc8b1c18ec086d1b8ea520d4073
SHA256

7dd0337df4f4e58bb273407bda199ad5cc1beaefbd817b3589f3ac60bd20d218
SHA512

026374fae078babfcfa67108d66c3dc4addf562bdfb9aee6f6c802a297d1c025c7388577a48c583a062a7ca0c06b6e1f168826b4c3e2ec3c5fcef11141d9a60e
SSDEEP

49152:lmO05Hzormc+ZpFkgSl3rhl9wOI/uQgwUIlp/XkH0ONNULs1K/LMks/EPN:3aHzop+Zpq/Ll9Kr07NNHE/LE/uN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bf4eb963df05659bc09c2a1941678330_NeikiAnalytics

Files

bf4eb963df05659bc09c2a1941678330_NeikiAnalytics
.exe windows:5 windows x86 arch:x86

3ae20c0fa8048428377cae25a3e4e091

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\svn\nsp.netshield6\trunk\imp\place\code\pc\barclient\barclient\bin\barclient.pdb

Imports

ws2_32

gethostbyaddr
ioctlsocket
WSACleanup
WSASetLastError
__WSAFDIsSet
select
WSAIoctl
getsockname
ntohs
bind
getsockopt
getpeername
freeaddrinfo
getaddrinfo
sendto
recvfrom
gethostbyname
inet_ntoa
send
closesocket
shutdown
htonl
htons
WSAGetLastError
WSAStartup
recv
connect
inet_addr
setsockopt
gethostname
socket
accept
listen

wininet

InternetCloseHandle
InternetReadFile
InternetOpenA
InternetOpenUrlA

psapi

GetModuleFileNameExA
EnumProcesses
EnumProcessModules
GetModuleBaseNameA

iphlpapi

GetAdaptersAddresses

setupapi

SetupDiGetDeviceRegistryPropertyA
SetupDiGetDeviceInstanceIdA
SetupDiEnumDeviceInfo
SetupDiGetClassDevsA
SetupDiDestroyDeviceInfoList

kernel32

CloseHandle
GetTickCount
FindFirstFileA
FindClose
FindNextFileA
Sleep
GetDriveTypeA
GetModuleHandleA
TerminateProcess
GetCurrentProcess
CreateMutexA
GetLastError
SetErrorMode
DeleteFileA
GlobalAlloc
InterlockedExchange
MultiByteToWideChar
WideCharToMultiByte
LoadResource
SizeofResource
FindResourceA
lstrlenA
GetProcAddress
GetModuleHandleW
CreateToolhelp32Snapshot
Process32First
OpenProcess
Process32Next
GetTempPathA
GetSystemDirectoryA
SetFileAttributesA
FreeResource
GetVersionExA
GetLocalTime
GlobalLock
GlobalUnlock
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
WaitForSingleObject
ReleaseMutex
LoadLibraryA
VirtualAlloc
VirtualFree
SetLastError
HeapAlloc
GetProcessHeap
HeapFree
CreateProcessA
GetExitCodeProcess
GetFileAttributesA
GetFileSize
ReadFile
CreateDirectoryA
IsWow64Process
GetCurrentDirectoryA
SetCurrentDirectoryA
GlobalFree
FileTimeToLocalFileTime
FileTimeToSystemTime
LeaveCriticalSection
lstrcatA
GetFullPathNameA
EnterCriticalSection
InterlockedDecrement
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitThread
GetCurrentThreadId
WriteFile
GetSystemTimeAsFileTime
GetFileType
SetFilePointer
HeapReAlloc
GetCommandLineA
GetStartupInfoA
RaiseException
RtlUnwind
LCMapStringA
LCMapStringW
GetCPInfo
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
HeapSize
ExitProcess
GetTimeFormatA
GetDateFormatA
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
GetStdHandle
HeapCreate
HeapDestroy
SetStdHandle
GetConsoleCP
GetConsoleMode
SetEndOfFile
SetHandleCount
FlushFileBuffers
GetTimeZoneInformation
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
SetConsoleCtrlHandler
InitializeCriticalSectionAndSpinCount
GetLocaleInfoW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileW
CompareStringA
CompareStringW
SetEnvironmentVariableA
DeleteCriticalSection
FreeLibrary
InitializeCriticalSection
GetModuleFileNameA
CopyFileA
CreateThread
CreateFileA
InterlockedIncrement
GetStringTypeExA
InterlockedCompareExchange
SleepEx
FormatMessageA
PeekNamedPipe
WaitForMultipleObjects
ExpandEnvironmentStringsA
GetVersion
GlobalMemoryStatus
FlushConsoleInputBuffer
LocalFree
GetFileInformationByHandle
ReadConsoleInputA
SetConsoleMode
lstrcpyA

user32

GetParent
GetWindowRect
ExitWindowsEx
DispatchMessageA
TranslateMessage
GetMessageA
CreateWindowExA
FindWindowExA
EndDialog
DefWindowProcA
GetDesktopWindow
PostMessageA
GetWindowTextA
LoadStringA
FindWindowA
GetUserObjectInformationW
GetProcessWindowStation
MessageBoxA
SetLastErrorEx
EndPaint
GetClientRect
GetSysColor
BeginPaint
SetFocus
MessageBeep
GetFocus
RegisterClassExA
SetDlgItemTextA
GetClassNameA
GetForegroundWindow
PostQuitMessage
UnregisterHotKey
KillTimer
RegisterDeviceNotificationA
SetTimer
GetWindowThreadProcessId
SetWindowPos
SetWindowTextA
DrawTextA
GetSystemMetrics
DialogBoxIndirectParamA
SendMessageA
FindWindowExW
GetWindowLongA
EnumWindows
LoadIconA

advapi32

RegCreateKeyExA
RegCloseKey
RegOpenKeyExW
RegQueryValueExA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegQueryValueExW
RegDeleteValueW
CryptDestroyHash
CryptReleaseContext
CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptDeriveKey
CryptSetKeyParam
CryptEncrypt
CryptDecrypt
RegOpenKeyExA
RegSetValueExA
RegisterEventSourceA
ReportEventA
DeregisterEventSource

shell32

SHFileOperationA
ShellExecuteA

gdi32

SetBkColor
CreateFontIndirectA
SetBkMode
SelectObject
DeleteDC
DeleteObject

gdiplus

GdiplusShutdown

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

winmm

mciSendStringA

wldap32

ord32
ord35
ord30
ord79
ord200
ord33
ord301
ord27
ord41
ord46
ord211
ord26
ord50
ord60
ord143
ord22

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 380KB - Virtual size: 380KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 52KB - Virtual size: 224KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14.3MB - Virtual size: 14.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3ae20c0fa8048428377cae25a3e4e091

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

wininet

psapi

iphlpapi

setupapi

kernel32

user32

advapi32

shell32

gdi32

gdiplus

version

winmm

wldap32

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 380KB - Virtual size: 380KB

.data Size: 52KB - Virtual size: 224KB

.rsrc Size: 14.3MB - Virtual size: 14.3MB

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 380KB - Virtual size: 380KB

.data
Size: 52KB - Virtual size: 224KB

.rsrc
Size: 14.3MB - Virtual size: 14.3MB