43734e00a17f6ba0273d65639400f270_NeikiAnalytics

Sharing

Copy URL Twitter E-mail

General

Target

43734e00a17f6ba0273d65639400f270_NeikiAnalytics
Size

4.9MB
MD5

43734e00a17f6ba0273d65639400f270
SHA1

ae09a4f3e664ee938d15c4bffcc72bea16e109a7
SHA256

4c8d0278853a52a0017edec197d2ac31b2ff82f9da7e39fa4d2ec2804308171d
SHA512

6e76d03fedb8716b076848cd066b8ae7416f25970fb9c1460e2cbe44a4a73e076fc63cb96197292da0895500b695df99dcff6a02d82789fe0d52b004be40d1cc
SSDEEP

98304:HGWrbexvFFYzbq8cJRTinfOVYcPMQslAaGfudHlYXv8BFLOAkGkzdnEVomFHKnPG:JCTMPuaGfudHlYAFLOyomFHKnPft0ZjH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
43734e00a17f6ba0273d65639400f270_NeikiAnalytics

Files

43734e00a17f6ba0273d65639400f270_NeikiAnalytics
.dll windows:6 windows x86 arch:x86

34a02ba965af70be796577386364727f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

mfc140.i386.pdb

Imports

advapi32

RegCloseKey
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegEnumValueA
RegQueryValueExA
RegDeleteKeyA
RegDeleteValueA
RegEnumKeyExA
RegEnumKeyA
RegQueryValueA
RegSetValueA
GetFileSecurityA
SetFileSecurityA
RegOpenKeyExW
IsTextUnicode

kernel32

OutputDebugStringW
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsDebuggerPresent
ExpandEnvironmentStringsA
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateEventW
WaitForSingleObjectEx
ResetEvent
GetSystemInfo
VirtualQuery
IsProcessorFeaturePresent
GetLastError
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
SizeofResource
LockResource
LoadResource
FindResourceW
MultiByteToWideChar
WideCharToMultiByte
SetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
LoadLibraryA
LoadLibraryW
GetModuleFileNameW
OutputDebugStringA
lstrcpyA
GlobalAlloc
GlobalLock
GlobalUnlock
GetCurrentThreadId
InitializeCriticalSection
GetACP
DeleteFileA
GetCPInfo
GetOEMCP
MulDiv
VerSetConditionMask
VerifyVersionInfoA
FreeLibrary
CloseHandle
GetTempPathA
GetTempFileNameA
CreateFileA
SetFilePointer
Sleep
GetCurrentDirectoryA
lstrcmpA
GetSystemDirectoryW
LoadLibraryExW
DecodePointer
EncodePointer
FindResourceA
GlobalFree
GetTickCount
GetWindowsDirectoryA
lstrcmpiA
SetThreadPriority
GetModuleFileNameA
LocalAlloc
LocalFree
TlsAlloc
TlsFree
GlobalHandle
GlobalReAlloc
TlsGetValue
LocalReAlloc
TlsSetValue
GetEnvironmentVariableA
GetEnvironmentVariableW
GlobalFlags
GlobalFindAtomA
GetSystemTime
LocalUnlock
LocalLock
GlobalGetAtomNameA
GetAtomNameA
SuspendThread
ResumeThread
SetEvent
CopyFileA
WaitForMultipleObjects
CreateEventA
ReleaseMutex
CreateMutexA
ReleaseSemaphore
CreateSemaphoreA
WaitForSingleObject
FormatMessageA
SetFileAttributesA
LocalFileTimeToFileTime
GetFileAttributesExA
GetFileSizeEx
FindNextFileA
SystemTimeToTzSpecificLocalTime
FileTimeToLocalFileTime
FileTimeToSystemTime
GetShortPathNameA
GetStringTypeExA
GetThreadLocale
FindClose
FindFirstFileA
GetVolumeInformationA
LoadLibraryExA
MoveFileA
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
WriteFile
ReadFile
GetCurrentProcess
DuplicateHandle
GetProfileIntA
SystemTimeToFileTime
ReplaceFileA
SetFileTime
GetFileTime
GetFullPathNameA
GetDiskFreeSpaceA
VirtualProtect
RaiseException
lstrcpyW
lstrcmpW
IsDBCSLeadByte
GetUserDefaultLCID
FindResourceExW
WritePrivateProfileStringA
GetPrivateProfileStringA
GetPrivateProfileIntA
GlobalAddAtomA
GetCurrentProcessId
SetErrorMode
GlobalDeleteAtom
CompareStringA
GetFileSize
GetFileAttributesA
GlobalSize
GetVersionExA
SearchPathA
GetLocaleInfoW
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetCurrentThread
InitializeCriticalSectionAndSpinCount

vcruntime140

__telemetry_main_invoke_trigger
__telemetry_main_return_trigger
__vcrt_InitializeCriticalSectionEx
__std_type_info_destroy_list
wcsstr
wcschr
wcsrchr
__CxxFrameHandler3
memcmp
_purecall
__std_terminate
memmove
memset
memcpy
_CxxThrowException
_except_handler4_common

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment
_seh_filter_dll
_initialize_onexit_table
abort
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
terminate
_initterm
_initterm_e
_invalid_parameter_noinfo
_errno
_resetstkoflw
_endthreadex
__p___argc
__p___argv
__doserrno
_beginthreadex
_beginthread
_endthread

api-ms-win-crt-string-l1-1-0

wcsspn
strcat_s
_strnicmp
wcscoll
_wcslwr_s
wcscspn
wcscmp
_wcsupr_s
wcscpy_s
strcpy_s
wcspbrk
iswspace
_wcsrev
_strdup
_wcsicoll
strlen
toupper
strncpy_s
strnlen
wcslen
wcscat_s
wcsnlen
wmemcpy_s
wcsncpy_s
_wcsicmp

api-ms-win-crt-multibyte-l1-1-0

_mbsnbicmp
_mbscoll
_mbsnbcpy_s
_ismbblead
_mbsicoll
_mbsnbcmp
_ismbcdigit
_mbsdec
_ismbcalpha
_ismbcalnum
_ismbcprint
_mbctoupper
_mbsstr
_mbctolower
_ismbcspace
_mbscmp
_mbsupr_s
_mbsinc
_mbschr
_mbslwr_s
_mbsrev
_mbsicmp
_mbspbrk
_mbsrchr
_mbscspn
_mbsspn

api-ms-win-crt-stdio-l1-1-0

ftell
__stdio_common_vsprintf_s
__stdio_common_vsprintf
clearerr_s
ferror
fclose
__stdio_common_vsscanf
feof
fread
_open_osfhandle
_fileno
__stdio_common_vswprintf_s
_get_osfhandle
fputs
fflush
fgets
__stdio_common_vswprintf
__stdio_common_vsnprintf_s
fseek
fwrite
__stdio_common_vsnwprintf_s

api-ms-win-crt-heap-l1-1-0

_recalloc
free
calloc
malloc
realloc
_msize
_expand

api-ms-win-crt-utility-l1-1-0

ldiv
abs
labs

api-ms-win-crt-convert-l1-1-0

atoi
_ltoa_s
atol
strtoul
wcstombs_s
strtol
_ultoa_s
strtod
_itoa_s

api-ms-win-crt-math-l1-1-0

_fdopen
floor
fabs
sin
cos
sqrt
ceil
atan2
exp

api-ms-win-crt-time-l1-1-0

_mktime64
clock
_localtime64_s
_time64

api-ms-win-crt-filesystem-l1-1-0

_splitpath_s
_makepath_s
_fullpath

user32

SetClipboardData
CloseClipboard
DrawStateA
GetCapture
LoadAcceleratorsW
TranslateAcceleratorA
GetSystemMetrics
DestroyMenu
LoadMenuW
GetSubMenu
PostThreadMessageA
GetWindowRect
DefWindowProcA
GetWindow
GetMenuItemCount
GetMenuItemID
IsIconic
GetForegroundWindow
DrawIcon
GetMonitorInfoA
MonitorFromPoint
SystemParametersInfoA
LoadCursorA
ValidateRect
SetLayeredWindowAttributes
CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx
GetUpdateRect
UnionRect
SetWindowPos
LockWindowUpdate
GetKeyState
BeginDeferWindowPos
EndDeferWindowPos
AppendMenuA
CreatePopupMenu
IntersectRect
SetScrollPos
EnableMenuItem
GetNextDlgTabItem
GetSystemMenu
IsMenu
IsZoomed
ModifyMenuA
DeleteMenu
SetWindowRgn
DestroyAcceleratorTable
GetTopWindow
DestroyWindow
EnumDisplayMonitors
GetSysColor
GetClassLongA
IsClipboardFormatAvailable
DestroyCursor
CreateAcceleratorTableA
CopyAcceleratorTableA
GetKeyboardState
ToAsciiEx
MapVirtualKeyA
CharUpperA
LoadImageW
LoadIconW
SetWindowTextA
GetMenuState
CheckMenuItem
SetFocus
GetMenuItemInfoA
DrawFrameControl
SubtractRect
GetLastActivePopup
GetMessageA
UpdateLayeredWindow
EnableScrollBar
GetScrollPos
GetMenuDefaultItem
SetMenuDefaultItem
HideCaret
InvertRect
EnumChildWindows
GetWindowTextA
GetDoubleClickTime
GetDC
ReleaseDC
GetWindowRgn
FrameRect
ShowScrollBar
IsWindowEnabled
InsertMenuA
RegisterClipboardFormatA
GetComboBoxInfo
CharUpperBuffA
DrawEdge
EmptyClipboard
UnregisterClassA
ShowOwnedPopups
GetWindowThreadProcessId
MessageBoxA
SetWindowLongA
SetMenuItemBitmaps
SetMenuItemInfoA
GetMenuCheckMarkDimensions
CallWindowProcA
SetActiveWindow
CreateMenu
MoveWindow
InvalidateRgn
TabbedTextOutA
DrawTextA
DrawTextExA
GrayStringA
GetWindowTextLengthA
GetTabbedTextExtentW
GetDlgItem
CreateDialogIndirectParamA
GetActiveWindow
EndDialog
GetPropA
RemovePropA
SetPropA
MapDialogRect
GetMessageTime
GetMessagePos
GetDialogBaseUnits
GetDCEx
RemoveMenu
MsgWaitForMultipleObjectsEx
CharNextA
SetWindowContextHelpId
IsDialogMessageA
ClipCursor
SendNotifyMessageA
InSendMessage
GetMenuStringA
WindowFromDC
SetScrollRange
AdjustWindowRectEx
GetTabbedTextExtentA
CountClipboardFormats
LoadBitmapA
GetMenu
SetMenu
GetClassInfoExA
CreateWindowExA
SetWindowPlacement
TrackPopupMenuEx
RegisterClassA
WinHelpA
GetScrollRange
SetScrollInfo
GetScrollInfo
ScrollWindow
MonitorFromWindow
BeginPaint
EndPaint
SendDlgItemMessageA
LoadAcceleratorsA
LoadMenuA
UnpackDDElParam
ReuseDDElParam
InsertMenuItemA
GetMenuBarInfo
GetWindowDC
DefFrameProcA
TranslateMDISysAccel
DrawMenuBar
DefMDIChildProcA
CheckDlgButton
CheckRadioButton
GetDlgItemInt
GetDlgItemTextA
SetDlgItemInt
SetDlgItemTextA
IsDlgButtonChecked
ScrollWindowEx
RealChildWindowFromPoint
CharToOemBuffA
OemToCharBuffA
SendMessageA
InvalidateRect
RedrawWindow
IsWindow
SetRect
EnableWindow
GetKeyNameTextA
GetKeyboardLayout
MapVirtualKeyExA
OpenClipboard
GetAsyncKeyState
GetDesktopWindow
WaitMessage
DispatchMessageA
TranslateMessage
PeekMessageA
SetForegroundWindow
LoadCursorW
GetFocus
IsChild
TrackPopupMenu
LoadIconA
GetNextDlgGroupItem
DrawFocusRect
SetCursor
GetWindowLongA
CopyImage
GetIconInfo
FillRect
LoadImageA
NotifyWinEvent
CopyRect
LoadBitmapW
MapWindowPoints
MessageBeep
SetCursorPos
WindowFromPoint
ClientToScreen
SetCapture
ReleaseCapture
CopyIcon
BringWindowToTop
RegisterWindowMessageA
DestroyIcon
GetClassNameA
SetParent
ShowWindow
GetWindowPlacement
IsRectEmpty
GetDlgCtrlID
PostMessageA
DeferWindowPos
EqualRect
GetSysColorBrush
SetClassLongA
GetParent
DrawIconEx
InflateRect
OffsetRect
PtInRect
UpdateWindow
SetTimer
TrackMouseEvent
ScreenToClient
GetCursorPos
IsWindowVisible
GetClientRect
KillTimer
PostQuitMessage
SetRectEmpty
GetClassInfoA
IsCharLowerA

gdi32

DeleteMetaFile
CloseMetaFile
CreateMetaFileA
LPtoDP
GetCharWidthA
CreateFontA
StretchDIBits
RoundRect
CreateEllipticRgn
CreateHatchBrush
ExtTextOutA
Polyline
GetDIBits
SelectPalette
SetBkColor
CreateBitmap
SetDIBColorTable
StretchBlt
EnumFontFamiliesExA
CreateRoundRectRgn
SetRectRgn
FillRgn
GetBoundsRect
CombineRgn
CreateRectRgn
PatBlt
GetCurrentObject
EndDoc
EndPage
StartPage
ExtFloodFill
SetPaletteEntries
CreateDIBitmap
CreatePatternBrush
CreatePen
EnumFontFamiliesA
GetTextCharsetInfo
GetDeviceCaps
CreateFontIndirectA
GetBkColor
Ellipse
SetPixel
CreateDIBSection
OffsetRgn
CreateRectRgnIndirect
GetRgnBox
BitBlt
SetPixelV
CreateCompatibleBitmap
FrameRgn
PtInRegion
CreatePolygonRgn
GetPixel
GetSystemPaletteEntries
GetNearestPaletteIndex
RealizePalette
CreatePalette
GetPaletteEntries
GetStockObject
Rectangle
Polygon
GetTextColor
GetObjectType
SelectObject
DeleteObject
CreateCompatibleDC
CreateSolidBrush
GetObjectA
GetTextExtentPoint32A
GetTextMetricsA
DeleteDC
GetViewportOrgEx
PtVisible
RectVisible
TextOutA
Escape
GetClipBox
GetTextAlign
GetCurrentPositionEx
MoveToEx
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SaveDC
RestoreDC
GetROP2
GetBkMode
GetPolyFillMode
GetStretchBltMode
GetNearestColor
GetTextFaceA
GetWindowExtEx
GetViewportExtEx
SetTextColor
SetMapMode
SetWindowExtEx
ScaleWindowExtEx
GetTextExtentPoint32W
GetTextExtentPointA
GetWindowOrgEx
SetWindowOrgEx
IntersectClipRect
CreateDCA
SetBrushOrgEx
SetAbortProc
StartDocA
DPtoLP
AbortDoc
CopyMetaFileA
UnrealizeObject
SetBkMode
SetPolyFillMode
SetROP2
SetStretchBltMode
SetGraphicsMode
SetWorldTransform
ModifyWorldTransform
OffsetWindowOrgEx
SelectClipRgn
ExcludeClipRect
OffsetClipRgn
LineTo
SetTextAlign
SetTextJustification
SetTextCharacterExtra
SetMapperFlags
GetLayout
SetLayout
ArcTo
SetArcDirection
PolyDraw
PolylineTo
SetColorAdjustment
PolyBezierTo
SelectClipPath
GetClipRgn
ExtSelectClipRgn
PlayMetaFileRecord
PlayMetaFile
EnumMetaFile
ExtCreatePen
CreateDIBPatternBrushPt
GetMapMode

ole32

CoDisconnectObject
CoRegisterMessageFilter
CoTreatAsClass
SetConvertStg
OleDuplicateData
WriteClassStg
GetRunningObjectTable
OleTranslateAccelerator
IsAccelerator
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoRevokeClassObject
CoRegisterClassObject
OleRegEnumVerbs
RegisterDragDrop
CoLockObjectExternal
DoDragDrop
CoGetMalloc
OleRegGetMiscStatus
StgOpenStorage
StgIsStorageFile
StgCreateDocfile
OleIsCurrentClipboard
OleFlushClipboard
OleSetClipboard
OleRegGetUserType
GetClassFile
CreateBindCtx
CreateFileMoniker
OleRun
OleDraw
RevokeDragDrop
OleIsRunning
OleQueryLinkFromData
OleQueryCreateFromData
OleSetMenuDescriptor
CreateGenericComposite
CreateItemMoniker
WriteClassStm
OleGetIconOfClass
GetHGlobalFromILockBytes
ReadClassStg
OleLoad
OleSave
OleCreate
OleCreateLinkToFile
OleCreateFromFile
OleCreateStaticFromData
OleCreateLinkFromData
OleCreateFromData
OleSetContainedObject
StringFromCLSID
OleLockRunning
StgOpenStorageOnILockBytes
CLSIDFromString
CLSIDFromProgID
PropVariantCopy
CoInitializeEx
CoGetClassObject
StringFromGUID2
ReadFmtUserTypeStg
OleLoadFromStream
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
ReadClassStm
OleSaveToStream
CreateOleAdviseHolder
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
ReleaseStgMedium
CreateDataAdviseHolder
CoTaskMemAlloc
CreateDataCache
CreateStreamOnHGlobal
CoUninitialize
CoInitialize
PropVariantClear
CoCreateGuid
CoTaskMemFree
CoCreateInstance
WriteFmtUserTypeStg
OleGetClipboard

oleaut32

SafeArrayUnaccessData
SysAllocString
SysStringLen
SysFreeString
VariantChangeType
VariantClear
VariantTimeToSystemTime
SystemTimeToVariantTime
VarBstrFromDate
VarParseNumFromStr
SafeArrayCreateVector
VarBstrFromDec
VarDecFromStr
VarDateFromStr
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayUnlock
SafeArrayLock
SafeArrayPutElement
SafeArrayPtrOfIndex
SafeArrayGetElement
SafeArrayAllocDescriptor
SafeArrayAllocData
SafeArrayCopy
VarBstrFromCy
VarCyFromStr
SysReAllocStringLen
SafeArrayRedim
SafeArrayCreate
SysAllocStringLen
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetElemsize
SafeArrayGetDim
SysStringByteLen
SysAllocStringByteLen
SafeArrayDestroy
VariantCopy
VarBstrCmp
DispCallFunc
VariantInit
LoadRegTypeLi
RegisterTypeLi
LoadTypeLi
OleLoadPicture
OleCreatePictureIndirect
OleCreateFontIndirect
OleTranslateColor
OleCreatePropertyFrame

shlwapi

SHStrDupW
StrFormatKBSizeA
PathFindExtensionA
PathFindFileNameA
PathRemoveExtensionA
PathRemoveFileSpecW
PathIsUNCA
PathStripToRootA
UrlUnescapeA

imm32

ImmGetContext
ImmReleaseContext
ImmGetOpenStatus

uxtheme

DrawThemeText
GetWindowTheme
DrawThemeBackground
IsAppThemed
GetThemeColor
OpenThemeData
CloseThemeData
GetCurrentThemeName
GetThemeSysColor
IsThemeBackgroundPartiallyTransparent
GetThemePartSize
DrawThemeParentBackground

Sections

.text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 41KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 976KB - Virtual size: 976KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

34a02ba965af70be796577386364727f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

user32

gdi32

ole32

oleaut32

shlwapi

imm32

uxtheme

Sections

.text Size: 2.6MB - Virtual size: 2.6MB

.data Size: 41KB - Virtual size: 62KB

.idata Size: 21KB - Virtual size: 21KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 1.3MB - Virtual size: 1.3MB

.reloc Size: 976KB - Virtual size: 976KB

.text
Size: 2.6MB - Virtual size: 2.6MB

.data
Size: 41KB - Virtual size: 62KB

.idata
Size: 21KB - Virtual size: 21KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

.reloc
Size: 976KB - Virtual size: 976KB