431dcd38e348a09b8d6f38b372d6c2d0_NeikiAnalytics

Sharing

Copy URL Twitter E-mail

General

Target

431dcd38e348a09b8d6f38b372d6c2d0_NeikiAnalytics
Size

364KB
MD5

431dcd38e348a09b8d6f38b372d6c2d0
SHA1

5255b702a5cb2a56dfb7c40807ddc886e86aba2d
SHA256

86d4a8c7b0d03666c20a71397982bc5de5cec2c5045cdb518e3adf0e20afa217
SHA512

e1e91997e3612b93df50a644b6def3e4aa0b8d837c92793ccd1f30561fb2c57f1d0aa5c95cd2adc708922ccc0481c2ac9e98ed71062eb5a54c3b44375891dee2
SSDEEP

6144:tswE22VYPyNG8GS3GAYl9UnEa2RA3Y57GSEdauZdCqn0FZuqZnkcHj:Oy2KPyN/73imnUsSs7ZdCq0FZVBkg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
431dcd38e348a09b8d6f38b372d6c2d0_NeikiAnalytics

Files

431dcd38e348a09b8d6f38b372d6c2d0_NeikiAnalytics
.dll windows:5 windows x86 arch:x86

3565680f8d1184c3a2473751a9dcb018

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\TeamCity\buildAgent\work\6b0e7f79a41115e3\ReworkedSKU\RTFX\PaintBlends\Impressionist\Release Studio\NewBlueImpressionist.pdb

Imports

kernel32

SetLastError
InterlockedExchange
LoadLibraryA
DisableThreadLibraryCalls
FreeLibrary
InterlockedDecrement
FlushFileBuffers
CloseHandle
CreateFileA
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetConsoleMode
GetConsoleCP
SetFilePointer
InitializeCriticalSectionAndSpinCount
GetModuleHandleA
GetStringTypeA
GetLocaleInfoA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
InterlockedIncrement
GetLastError
HeapFree
HeapAlloc
GetCurrentThreadId
GetCommandLineA
RaiseException
RtlUnwind
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
WriteFile
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetACP
GetOEMCP
Sleep
HeapSize
ExitProcess
LCMapStringA
HeapCreate
HeapDestroy
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings

advapi32

RegCloseKey

Exports

Exports

_createEffect@4
_registerEffects@8

Sections

.text
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 273KB - Virtual size: 272KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3565680f8d1184c3a2473751a9dcb018

Headers

File Characteristics

PDB Paths

Imports

kernel32

advapi32

Exports

Exports

Sections

.text Size: 72KB - Virtual size: 72KB

.rdata Size: 273KB - Virtual size: 272KB

.data Size: 6KB - Virtual size: 13KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 11KB - Virtual size: 10KB

.text
Size: 72KB - Virtual size: 72KB

.rdata
Size: 273KB - Virtual size: 272KB

.data
Size: 6KB - Virtual size: 13KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 11KB - Virtual size: 10KB