4944cfca9f3a98917fb751515f2f95e0_NeikiAnalytics

Sharing

Copy URL Twitter E-mail

General

Target

4944cfca9f3a98917fb751515f2f95e0_NeikiAnalytics
Size

4.9MB
MD5

4944cfca9f3a98917fb751515f2f95e0
SHA1

1a0e0f0693ba5589ff046b2504f4a51e92c1d727
SHA256

627ab2e88388e551f38647faf3964c7be731135757ebfa40ba27441e4e0574d6
SHA512

f5be9cf50973312f73b2c57bdc36fd637204234f438a1e7826396861eb5bedaa7ca8751b0f336b8173fc31abc8ea0f9ffc7cc0d9c6db9571a9deae11465b4d04
SSDEEP

49152:U6a8ICaLBpFyle+iBIJExsEhordWD3+AcahVWt0zzp87l6h/9W5OQAzwjPycezBy:QNPBIRMKdWD3+F8Y35VlOcez

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4944cfca9f3a98917fb751515f2f95e0_NeikiAnalytics

Files

4944cfca9f3a98917fb751515f2f95e0_NeikiAnalytics
.dll windows:6 windows x86 arch:x86

d991d3c3419c183242868ce37ad76da0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

cryptography_rust.pdb

Imports

api-ms-win-core-synch-l1-2-0

WaitOnAddress
WakeByAddressAll
WakeByAddressSingle

bcryptprimitives

ProcessPrng

kernel32

QueryPerformanceCounter
GetCurrentProcess
InitializeSListHead
RtlCaptureContext
ReleaseMutex
GetCurrentDirectoryW
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
TlsAlloc
InitializeCriticalSection
TerminateProcess
QueryPerformanceFrequency
HeapFree
ConvertThreadToFiberEx
HeapReAlloc
WaitForSingleObjectEx
lstrlenW
CreateMutexA
GetProcessHeap
HeapAlloc
ConvertFiberToThread
FindNextFileW
FindFirstFileW
LoadLibraryW
FormatMessageW
WriteConsoleW
InitOnceBeginInitialize
InitOnceComplete
SystemTimeToFileTime
GetSystemTime
IsDebuggerPresent
GetACP
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentProcessId
ReadConsoleW
ReadConsoleA
SetConsoleMode
GetConsoleMode
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
WideCharToMultiByte
CreateFiberEx
DeleteFiber
SwitchToFiber
GetEnvironmentVariableW
MultiByteToWideChar
CreateSemaphoreA
GetExitCodeThread
AcquireSRWLockExclusive
AcquireSRWLockShared
GetCurrentThreadId
GetModuleHandleW
WriteFile
GetFileType
GetStdHandle
VirtualFree
WaitForSingleObject
FormatMessageA
LoadLibraryA
FreeLibrary
GetSystemDirectoryA
GetLastError
GetModuleHandleExW
CloseHandle
GetProcAddress
GetModuleHandleA
Sleep
TlsSetValue
TlsGetValue
FindClose
TlsFree
ReleaseSemaphore
GetCurrentThread

ws2_32

shutdown
socket
connect
closesocket
sendto
recvfrom
getpeername
send
recv
WSACleanup
WSAStartup
select
getsockopt
getsockname
ioctlsocket
setsockopt
WSAGetLastError
WSASetLastError
getservbyname
getservbyport
gethostbyname
gethostbyaddr
ntohs
inet_ntoa
inet_addr
htons
htonl

advapi32

RegisterEventSourceW
ReportEventW
DeregisterEventSource
CryptAcquireContextW
CryptGenRandom
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext

user32

MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation

crypt32

CertOpenStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertOpenSystemStoreW
CertFreeCertificateContext
CertGetCertificateContextProperty
CertCloseStore

ntdll

RtlNtStatusToDosError
NtWriteFile

python3

PyTuple_Size
PyTuple_GetItem
PyObject_Repr
PyErr_Restore
PyException_GetCause
PyException_GetTraceback
PyException_SetCause
PyErr_GivenExceptionMatches
PyList_Size
PyList_GetItem
PyList_Append
PyNumber_Index
PyLong_AsLong
PyLong_AsLongLong
PyLong_AsUnsignedLongLong
PyException_SetTraceback
PyErr_Fetch
PyErr_PrintEx
PyErr_NewExceptionWithDoc
PyErr_WarnEx
PyErr_Print
PyExc_StopIteration
PyCMethod_New
PyModule_New
PyExc_AttributeError
PyModule_GetName
PyUnicode_InternInPlace
PyUnicode_AsEncodedString
PyErr_NormalizeException
PyErr_SetString
PyErr_SetObject
PyObject_GetAttr
PyObject_SetAttr
PyObject_RichCompare
PyObject_IsTrue
PyObject_Size
PyObject_GetItem
PyObject_SetItem
PyObject_DelItem
PyObject_Hash
PySequence_Contains
PySet_Add
PyTraceBack_Print
PyObject_SetAttrString
PyLong_FromSsize_t
PyType_GenericAlloc
PyObject_GetIter
PyIter_Next
PyBool_Type
PyDict_New
PyGILState_Release
PyDict_GetItemWithError
PyDict_SetItem
PyDict_Next
Py_GetVersion
PyType_FromSpec
PyFrozenSet_New
PyExc_BaseException
PyModule_Create2
PyGILState_Ensure
Py_IsInitialized
PyObject_CallMethod
PyImport_ImportModule
PyEval_RestoreThread
PyEval_SaveThread
PyArg_UnpackTuple
PyFloat_AsDouble
PyLong_FromVoidPtr
PyLong_FromUnsignedLong
PyLong_FromLong
PyErr_Occurred
PyObject_Free
PyObject_Malloc
_Py_Dealloc
PyExc_Exception
PyLong_FromLongLong
PyExc_RuntimeError
PyObject_GC_UnTrack
PyErr_WriteUnraisable
PySequence_Size
PySequence_Check
PyTuple_SetItem
PyTuple_New
PyList_SetItem
PyList_New
PyType_GetSlot
PyType_IsSubtype
PyObject_Call
PyBytes_FromStringAndSize
PyExc_MemoryError
PyObject_IsInstance
PyExc_NotImplementedError
PyExc_TypeError
PyBaseObject_Type
PyBytes_Size
PyBytes_AsString
PyUnicode_AsUTF8String
PyType_GetFlags
_Py_NotImplementedStruct
PyLong_Type
PySlice_AdjustIndices
PySlice_Unpack
PySlice_Type
PyImport_Import
_Py_FalseStruct
_Py_TrueStruct
PyLong_FromUnsignedLongLong
PyExc_SystemError
PyExc_IndexError
_Py_NoneStruct
PyExc_OverflowError
PyExc_ValueError
PyObject_Str
PyUnicode_FromStringAndSize
PyDict_Size
PyExc_ImportError

vcruntime140

memcpy
_except_handler4_common
memcmp
__CxxFrameHandler3
memset
memmove
strchr
strrchr
memchr
wcsstr
strstr
_CxxThrowException
__std_type_info_destroy_list

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment
strerror_s
_exit
raise
_register_onexit_function
signal
_initterm
_initialize_onexit_table
_crt_atexit
_initterm_e
_execute_onexit_table
_beginthreadex
_errno
_wassert
_seh_filter_dll
_cexit
_configure_narrow_argv

api-ms-win-crt-string-l1-1-0

strcspn
strlen
isspace
strcmp
strcpy_s
strncpy
strspn
strncpy_s
isdigit
tolower
strcat_s
strncmp

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-heap-l1-1-0

free
malloc
calloc
realloc

api-ms-win-crt-time-l1-1-0

_gmtime64_s
_time64

api-ms-win-crt-stdio-l1-1-0

fopen
__stdio_common_vfprintf
fputs
__stdio_common_vsscanf
_setmode
__stdio_common_vsprintf_s
__stdio_common_vsprintf
setvbuf
fwrite
ftell
fseek
fread
__stdio_common_vswprintf
_fileno
fgets
fflush
ferror
feof
fclose
_wfopen
__acrt_iob_func

api-ms-win-crt-convert-l1-1-0

strtol
strtoul
atoi

api-ms-win-crt-filesystem-l1-1-0

_stat64i32

api-ms-win-crt-environment-l1-1-0

getenv

Exports

Exports

PyInit__openssl
PyInit__rust

Sections

.text
Size: 3.9MB - Virtual size: 3.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 847KB - Virtual size: 847KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 35KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 185KB - Virtual size: 184KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d991d3c3419c183242868ce37ad76da0

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

ws2_32

advapi32

user32

crypt32

ntdll

python3

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-environment-l1-1-0

Exports

Exports

Sections

.text Size: 3.9MB - Virtual size: 3.9MB

.rdata Size: 847KB - Virtual size: 847KB

.data Size: 35KB - Virtual size: 42KB

.reloc Size: 185KB - Virtual size: 184KB

.text
Size: 3.9MB - Virtual size: 3.9MB

.rdata
Size: 847KB - Virtual size: 847KB

.data
Size: 35KB - Virtual size: 42KB

.reloc
Size: 185KB - Virtual size: 184KB