eeba9272bec764473d7de79189ed3150_NeikiAnalytics

Sharing

Copy URL Twitter E-mail

General

Target

eeba9272bec764473d7de79189ed3150_NeikiAnalytics
Size

165KB
MD5

eeba9272bec764473d7de79189ed3150
SHA1

c5fdbd156dbd60cbb3529e70b9778f5a968e5847
SHA256

8c01781b5971c643788c2fdc7b7842b3a4db088efc0afe1add92b20211952cf9
SHA512

452bef111d86989ef2763fdba559d592f3739739b672e0f7b974ba40da3724473f48ed8efd54c2e1e3fc7a2ef337048640df7d7deba84be84471a36215cbf9cc
SSDEEP

3072:IVFzdFzsgVJNFiSgjSg7xaSTyEwWU6av5GPnd3q8:odF5VJN+jSg4Sg6av4Pndp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
eeba9272bec764473d7de79189ed3150_NeikiAnalytics

Files

eeba9272bec764473d7de79189ed3150_NeikiAnalytics
.dll windows:5 windows x86 arch:x86

e65e6428c3a43a8db60c1e874a68f99e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\CIMCOPRJ\ncfilter\ncfilter_iso\Release\ncfilter_iso.pdb

Imports

kernel32

GetTickCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
CloseHandle
DeleteCriticalSection
CreateEventW
GetModuleHandleW
GetProcAddress
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
GetSystemTimeAsFileTime
InitializeSListHead

vcruntime140

__std_type_info_destroy_list
__CxxFrameHandler3
memcpy
memmove
strstr
memset
strchr
_purecall
__vcrt_InitializeCriticalSectionEx
__std_exception_copy
__std_exception_destroy
_except_handler4_common
_CxxThrowException

api-ms-win-crt-string-l1-1-0

_stricmp
isspace
_strnicmp
strncpy
isdigit
isalpha
strncmp
strspn
toupper
isalnum

api-ms-win-crt-convert-l1-1-0

atoi
atof

api-ms-win-crt-heap-l1-1-0

free
_callnewh
malloc

api-ms-win-crt-runtime-l1-1-0

_execute_onexit_table
_initterm
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm_e

api-ms-win-crt-math-l1-1-0

_libm_sse2_tan_precise
floor
_libm_sse2_sin_precise
_libm_sse2_cos_precise
_libm_sse2_acos_precise
_libm_sse2_sqrt_precise

Exports

Exports

GetInfo
getFilterFactory

Sections

.text
Size: 150KB - Virtual size: 149KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 76B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e65e6428c3a43a8db60c1e874a68f99e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

Exports

Exports

Sections

.text Size: 150KB - Virtual size: 149KB

.rdata Size: 7KB - Virtual size: 6KB

.data Size: 512B - Virtual size: 1KB

.tls Size: 512B - Virtual size: 9B

.gfids Size: 512B - Virtual size: 76B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 150KB - Virtual size: 149KB

.rdata
Size: 7KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 1KB

.tls
Size: 512B - Virtual size: 9B

.gfids
Size: 512B - Virtual size: 76B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 4KB