e3223fd6f30ad1985c6c8159cff143e0_NeikiAnalytics

Sharing

Copy URL Twitter E-mail

General

Target

e3223fd6f30ad1985c6c8159cff143e0_NeikiAnalytics
Size

317KB
MD5

e3223fd6f30ad1985c6c8159cff143e0
SHA1

7598224437f17c046e09f5d6dc2e046d80cb371f
SHA256

178332ed77001cd088e6aa63a5453314fb6a1cb4d24b776bb692910e09231aed
SHA512

3d8e90d8b30b031373ff5293a2d04c69398cd76884cf959d5753de333aaabd46412a7f746f63b1b4e940d8c879c80e96cd87cec57d584ae3d1d2df2789bfbffd
SSDEEP

6144:khLtFaUqY5uqMxuAurX2MRPaBhdeAnoSqDr1a9wOZ:2LiG6EAurfRPQdS1DrM9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e3223fd6f30ad1985c6c8159cff143e0_NeikiAnalytics

Files

e3223fd6f30ad1985c6c8159cff143e0_NeikiAnalytics
.dll windows:4 windows x86 arch:x86

dbcf85d7d2053aa73658ffca382d85b5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

dinput8

DirectInput8Create

kernel32

SetEvent
InitializeCriticalSection
DeleteCriticalSection
SetThreadContext
GetThreadContext
LoadLibraryA
CreateThread
lstrlenW
SetLastError
MapViewOfFile
IsDebuggerPresent
GetFileAttributesW
GetFileAttributesA
SetFilePointer
GetFullPathNameA
lstrlenA
GetLastError
SetFilePointerEx
GetFileSize
GetFileSizeEx
WaitForSingleObject
CreateEventA
ResumeThread
TerminateProcess
CreateProcessA
CreateProcessW
FindNextFileA
FindFirstFileExA
GetFileAttributesExA
GetTickCount
CopyFileA
CopyFileExA
DeleteFileA
MoveFileA
MoveFileExA
ReplaceFileA
LoadLibraryW
GetModuleHandleW
LoadLibraryExA
LoadLibraryExW
MapViewOfFileEx
FindNextFileW
FindFirstFileW
FindFirstFileExW
GetFileAttributesExW
SetFileAttributesW
CopyFileW
CopyFileExW
DeleteFileW
MoveFileW
MoveFileExW
ReplaceFileW
Module32Next
Module32First
CreateToolhelp32Snapshot
GetCurrentProcessId
DisableThreadLibraryCalls
WaitForMultipleObjects
SetFileAttributesA
InterlockedExchange
EnterCriticalSection
TerminateThread
LeaveCriticalSection
VirtualQuery
UnmapViewOfFile
CreateFileMappingW
CreateFileMappingA
GetCurrentThread
FlushInstructionCache
ExitProcess
SetUnhandledExceptionFilter
OutputDebugStringA
FindFirstFileA
FindClose
GetSystemInfo
VirtualAlloc
VirtualProtect
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
MultiByteToWideChar
WideCharToMultiByte
VirtualFree
GetModuleHandleA
GetProcAddress
GetCurrentProcess
CreateFileA
ReadFile
GetModuleFileNameA
GetCurrentDirectoryA
WriteFile
FreeLibrary
LocalFree
VirtualFreeEx
ReadProcessMemory
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
GetWindowsDirectoryA
InterlockedDecrement
GetVolumeInformationA
DeviceIoControl
HeapFree
HeapAlloc
IsBadReadPtr
CreateDirectoryA
CreateMutexA
ReleaseMutex
InterlockedIncrement
RtlUnwind
RaiseException
GetCurrentThreadId
GetCommandLineA
LCMapStringA
LCMapStringW
GetCPInfo
GetStringTypeA
GetStringTypeW
HeapDestroy
HeapCreate
HeapReAlloc
IsBadWritePtr
TlsAlloc
TlsFree
TlsSetValue
TlsGetValue
QueryPerformanceCounter
GetSystemTimeAsFileTime
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
UnhandledExceptionFilter
HeapSize
IsBadCodePtr
GetOEMCP
SetStdHandle
FlushFileBuffers
SetEndOfFile
CloseHandle
Sleep

user32

FindWindowA
CharUpperBuffA
MessageBoxA

advapi32

RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RevertToSelf
ImpersonateSelf
RegSetValueExA
RegSetKeySecurity
RegCloseKey
GetUserNameA
RegQueryMultipleValuesW
RegQueryMultipleValuesA
RegQueryValueExW
RegQueryValueExA
RegQueryValueW
RegQueryValueA
RegQueryInfoKeyW
RegQueryInfoKeyA
RegOpenKeyExW
RegOpenKeyW
RegOpenKeyA
RegCreateKeyExW
RegCreateKeyExA
RegCreateKeyW
RegCreateKeyA

shell32

ShellExecuteExW
ShellExecuteExA
SHGetSpecialFolderPathA
SHGetFolderPathA
SHGetMalloc
ShellExecuteA
ShellExecuteW
SHGetPathFromIDListA
SHGetDesktopFolder

iphlpapi

GetAdaptersInfo

ole32

CoInitializeEx
CoInitializeSecurity
CoUninitialize
CoCreateGuid
CoCreateInstance
CoSetProxyBlanket

oleaut32

SysFreeString
VariantInit
VariantChangeType
VariantClear
SysAllocString

Exports

Exports

_InitAP2@4
_InitAP@0

Sections

.text
Size: 178KB - Virtual size: 177KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.aecode
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pecode
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.aphr
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dbcf85d7d2053aa73658ffca382d85b5

Headers

File Characteristics

Imports

dinput8

kernel32

user32

advapi32

shell32

iphlpapi

ole32

oleaut32

Exports

Exports

Sections

.text Size: 178KB - Virtual size: 177KB

.aecode Size: 38KB - Virtual size: 38KB

.pecode Size: 21KB - Virtual size: 20KB

.rdata Size: 42KB - Virtual size: 42KB

.data Size: 11KB - Virtual size: 19KB

.aphr Size: 4KB - Virtual size: 3KB

.rsrc Size: 1024B - Virtual size: 784B

.reloc Size: 20KB - Virtual size: 19KB

.text
Size: 178KB - Virtual size: 177KB

.aecode
Size: 38KB - Virtual size: 38KB

.pecode
Size: 21KB - Virtual size: 20KB

.rdata
Size: 42KB - Virtual size: 42KB

.data
Size: 11KB - Virtual size: 19KB

.aphr
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 1024B - Virtual size: 784B

.reloc
Size: 20KB - Virtual size: 19KB