5dda542b3e9e3aa5bc8b709b3608a5e0_NeikiAnalytics

Sharing

Copy URL Twitter E-mail

General

Target

5dda542b3e9e3aa5bc8b709b3608a5e0_NeikiAnalytics
Size

793KB
MD5

5dda542b3e9e3aa5bc8b709b3608a5e0
SHA1

dbe0aac599f2981dc18e7228cf9f4bc9c3aaa7cc
SHA256

759c9856a15b6c762c852e8b98920cfad2b78069acc7d48c80df7aa80e5409ad
SHA512

3ac4d7cbeaec59815d12331ee8023485f12f767bafd33c4298d99dfa27ad200fb032d228dc3e775a0deb910c3f90a030e2e8b7f4a90ce58ecc013a75c10399f5
SSDEEP

12288:Qg8rzb2nbI+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:6rzCbhMdIuwe3zfIe7xmvH/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5dda542b3e9e3aa5bc8b709b3608a5e0_NeikiAnalytics

Files

5dda542b3e9e3aa5bc8b709b3608a5e0_NeikiAnalytics
.exe windows:5 windows x64 arch:x64

2ee9948cb64a72a4f93d61d952741f22

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

E:\bld\CDGS-MAS20217-BUILX64\src\out\PROD-X64-VC160\Release\Programs64\CdrConv.pdb

Imports

crlconfig

?GetTrackID@IAppStartupInit@@UEBA?AV?$CrlStringViewT@_W@CrlPlatform@@XZ
?CanLaunch@IAppStartupInit@@UEBA_NXZ
?FindInterface@IAppStartupInit@@UEBAPEBXAEBU_GUID@@@Z
?FindInterface@IAppStartupInit@@UEAAPEAXAEBU_GUID@@@Z
?IsWindowPainterSkinScaleSupported@IAppStartupInit@@UEBA_NXZ
?GetAppResourceXMLName@IAppStartupInit@@UEBA?AV?$CrlStringT@_W@CrlPlatform@@XZ
?GetAppResourceDLLName@IAppStartupInit@@UEBA?AV?$CrlStringT@_W@CrlPlatform@@XZ
?IsSDIDefaultInterfaceMode@IAppStartupInit@@UEBA_NXZ
?GetTypeAssistFileName@IAppStartupInit@@UEBA?AV?$CrlStringT@_W@CrlPlatform@@XZ
?GetDefaultExtension@IAppStartupInit@@UEBA?AV?$CrlStringT@_W@CrlPlatform@@XZ
?GetDDEServerName@IAppStartupInit@@UEBA?AV?$CrlStringT@_W@CrlPlatform@@XZ
?GetClassID@IAppStartupInit@@UEBA?AV?$CrlStringT@_W@CrlPlatform@@XZ
?GetPremiumFeaturesDLL@IAppStartupInit@@UEBA?AV?$CrlStringT@_W@CrlPlatform@@XZ
?GetProgId@IAppStartupInit@@UEBA?AV?$CrlStringT@_W@CrlPlatform@@XZ
?GetAppTlbFilename@IAppStartupInit@@UEBA?AV?$CrlStringT@_W@CrlPlatform@@XZ
?GetAppHintsFile@IAppStartupInit@@UEBA?AV?$CrlStringT@_W@CrlPlatform@@XZ
?GetAppHelpContext@IAppStartupInit@@UEBA?AV?$CrlStringT@_W@CrlPlatform@@XZ
?GetProductSummaryType@IAppStartupInit@@UEBAGXZ
??0BaseAppStartup@@QEAA@AEAUIAppStartupInit@@@Z
??1BaseAppStartup@@UEAA@XZ
??0IAppStartupInit@@QEAA@XZ
?Initialize@BaseAppStartup@@QEAAXPEB_W_N@Z
?Run@BaseAppStartup@@MEAAHXZ
?LoadAppDll@BaseAppStartup@@IEAA_NXZ
?RunAppDll@BaseAppStartup@@IEAAHXZ
?GetAppSkinSettingData@@YAAEAVWAppSkinSettingData@@XZ
?GetFireBallImagePath@WAppSkinSettingData@@QEAA_NAEAV?$CrlStringT@_W@CrlPlatform@@@Z
?BOXIDGetCopyrightInfo@@YAPEB_WXZ
?GetAppUIName@WAppSkinSettingData@@QEAA?AV?$CrlStringT@_W@CrlPlatform@@XZ
?CommandLine@BaseAppStartup@@UEBAAEBUICommandLine@CrlUtils@@XZ
?GetCmdLine@BaseAppStartup@@UEAAPEA_WXZ
?IsSdiMode@BaseAppStartup@@UEBA_NXZ
?StartupInitialActionDisabled@BaseAppStartup@@UEBA_NXZ
?IsDDE@BaseAppStartup@@UEBA_NXZ
?IsCOMAutomation@BaseAppStartup@@UEBA_NXZ
?IsUserMode@BaseAppStartup@@UEBA_NXZ
?IsPrintAndExit@BaseAppStartup@@UEBA_NXZ
?IsNoSplash@BaseAppStartup@@UEBA_NXZ
?IsPrintABB@BaseAppStartup@@UEBA_NXZ
?IsPrintFull@BaseAppStartup@@UEBA_NXZ
?IsEmbedding@BaseAppStartup@@UEBA_NXZ
?IsAutomation@BaseAppStartup@@UEBA_NXZ
?GetBoxVersion@IAppStartupInit@@UEBAXAEAH000@Z
?GetAppVersion@IAppStartupInit@@UEBAXAEAH000@Z
?Initialize@BaseAppStartup@@MEAAXXZ
?GetBoxMajorVersionNum@IAppStartupInit@@UEBAHXZ

crlplatform

??0?$CrlStringT@_W@CrlPlatform@@QEAA@XZ
??0?$CrlStringT@_W@CrlPlatform@@QEAA@AEBV01@@Z
??0?$CrlStringT@_W@CrlPlatform@@QEAA@PEB_WH@Z
?GetBuffer@?$CrlStringT@_W@CrlPlatform@@QEAAPEA_WXZ
?ReleaseBuffer@?$CrlStringT@_W@CrlPlatform@@QEAAXH@Z
??1?$CrlStringT@_W@CrlPlatform@@QEAA@XZ
??B?$CrlStringT@_W@CrlPlatform@@QEBAPEB_WXZ
??4?$CrlStringT@_W@CrlPlatform@@QEAAAEAV01@PEB_W@Z
?IsEmpty@?$CrlStringT@_W@CrlPlatform@@QEBA_NXZ
??4?$CrlStringT@_W@CrlPlatform@@QEAAAEAV01@$$QEAV01@@Z
?FormatInternal@?$CrlStringT@_W@CrlPlatform@@AEAAXPEB_WZZ
??4?$CrlStringT@_W@CrlPlatform@@QEAAAEAV01@AEBV01@@Z
?Empty@?$CrlStringT@_W@CrlPlatform@@QEAAXXZ
?GetLength@?$CrlStringT@_W@CrlPlatform@@QEBAHXZ
??0?$CrlStringT@_W@CrlPlatform@@QEAA@PEB_W@Z
?GetString@?$CrlStringT@_W@CrlPlatform@@QEBAPEB_WXZ

crlutils

?wait@StickyEvent@CrlUtils@@UEAAXXZ
??1StickyEvent@CrlUtils@@UEAA@XZ
?set@StickyEvent@CrlUtils@@QEAAXXZ
?GetThreadID@CrlThread@CrlUtils@@YAKAEAPEAX@Z
?Join@CrlThread@CrlUtils@@YAXAEAPEAX_N@Z
?tryWait@StickyEvent@CrlUtils@@UEAA_NXZ
??0StickyEvent@CrlUtils@@QEAA@_N0@Z
?wait_for@StickyEvent@CrlUtils@@UEAA_NK@Z
?DeleteAllSingletons@CrlUtils@@YAXXZ
?GetFolderName@Path@SystemIO@@YA?AV?$CrlStringT@_W@CrlPlatform@@PEB_W@Z
?Combine@Path@SystemIO@@YA?AV?$CrlStringT@_W@CrlPlatform@@PEB_W0@Z
?GetFileName@Path@SystemIO@@YA?AV?$CrlStringT@_W@CrlPlatform@@PEB_W@Z
?GetUserLocaleID@CrlLocale@@YAKXZ
?GetWorkAreaSizeWithoutTaskBarAndToolbarRectPixels@System@CrlUtils@@YA_NPEAX@Z
?GetProcessFileName@Path@SystemIO@@YA?AV?$CrlStringT@_W@CrlPlatform@@PEAUHINSTANCE__@@@Z
?Create@CrlThread@CrlUtils@@YAPEAXV?$function@$$A6AKPEAX@Z@std@@PEAX@Z
?getNativeHandle@StickyEvent@CrlUtils@@UEAAPEAXXZ
?set@InterProcessEvent@CrlUtils@@QEAAXXZ
?Exists@File@SystemIO@@YA_NPEB_W@Z

crlutl

?CreateSilentEvent@IGLB_UILanguage@@SAPEAVInterProcessEvent@CrlUtils@@XZ
?GetInst@IGLB_UILanguage@@SAAEAV1@XZ
?CRLUTLIsCurLangFarEast@@YAHXZ

crlresources

?Preload@Resources@Framework@@SA_NXZ
?GetString@Resources@Framework@@SA?AV?$CrlStringT@_W@CrlPlatform@@AEBV34@@Z

gdiplus

GdipAlloc
GdipCloneImage
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromFile
GdiplusStartup
GdiplusShutdown
GdipFree
GdipDisposeImage

msvcp140

?_Xlength_error@std@@YAXPEBD@Z

mfc140u

ord6631
ord11406
ord13354
ord5723
ord2629
ord11806
ord3279
ord3172
ord11850
ord5080
ord5363
ord5552
ord9041
ord5339
ord5582
ord5083
ord5229
ord5062
ord5916
ord7460
ord7461
ord7450
ord5227
ord7922
ord9946
ord8900
ord3278
ord2316
ord3812
ord13864
ord4859
ord1454
ord7651
ord9975
ord6549
ord6320
ord12761
ord12762
ord886
ord1369
ord878
ord13767
ord7813
ord1086
ord438
ord4721
ord13757
ord12746
ord2473
ord4726
ord2475
ord4656
ord1033
ord296
ord3756
ord2212
ord14211
ord4782
ord4837
ord4853
ord2369
ord2270
ord1489
ord1491
ord4794
ord14217
ord2967
ord4352
ord9384
ord4360
ord4828
ord4767
ord4752
ord990
ord4814
ord4800
ord4806
ord4788
ord4843
ord4776
ord1755
ord1734
ord1748
ord1722
ord1700
ord11940
ord11944
ord13513
ord3173
ord8947
ord10691
ord6729
ord11902
ord8656
ord14209
ord11625
ord3718
ord11415
ord11414
ord5451
ord9979
ord9977
ord9978
ord9976
ord14360
ord2698
ord7913
ord3209
ord3212
ord13401
ord6002
ord8830
ord266
ord265
ord7182
ord6247

kernel32

DeleteCriticalSection
OutputDebugStringA
QueryActCtxW
GetModuleHandleExW
GetModuleFileNameW
SetLastError
CreateActCtxW
FindActCtxSectionStringW
LoadLibraryW
DeactivateActCtx
ActivateActCtx
GetLastError
InitializeCriticalSectionEx
OutputDebugStringW
ReleaseActCtx
GetCurrentThreadId
lstrcmpiW
GetACP
lstrcpyW
GetCurrentProcess
ExpandEnvironmentStringsW
SetEnvironmentVariableW
GetEnvironmentVariableW
GetSystemDirectoryW
CloseHandle
GetWindowsDirectoryW
SetDllDirectoryW
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
LeaveCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
GetProcAddress
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW

user32

DispatchMessageW
GetSysColor
DdeUninitialize
DdeCmpStringHandles
DdeAccessData
DdeUnaccessData
GetMessageW
TranslateMessage
SendMessageW
GetDC
ReleaseDC
PostThreadMessageW
IsWindow
SetPropW
CopyRect
DrawTextW
GetClientRect
UpdateWindow
InvalidateRect
DdeCreateStringHandleW
GetWindowLongW
SetLayeredWindowAttributes
GetSystemMetrics
CreateDialogParamW
SetWindowLongW
DdeInitializeW
ShowWindow
DestroyWindow
EndDialog
InflateRect
SetWindowTextW
SetRect
AdjustWindowRect
SetWindowPos
OffsetRect
IsRectEmpty
GetWindowRect
LoadCursorW
UpdateLayeredWindow
DdeNameService
DdeEnableCallback
EnableWindow
PeekMessageW
GetParent
DdeFreeStringHandle

gdi32

CreateSolidBrush
CreateFontIndirectW
CreateCompatibleBitmap
CreateCompatibleDC
SelectObject
GetNearestColor
GetStockObject
Rectangle
BitBlt
GetTextFaceW
GetTextMetricsW
SaveDC
RestoreDC
DeleteObject
GetDeviceCaps
RectVisible
CreateDIBSection
SetBkMode
SetTextColor
SetTextAlign
SetBkColor
DeleteDC

advapi32

OpenProcessToken

ole32

CoUninitialize
CoInitialize
CoCreateInstance

userenv

ExpandEnvironmentStringsForUserW

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__C_specific_handler
__std_terminate
memset
wcschr
__current_exception_context
__current_exception
_CxxThrowException

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode

api-ms-win-crt-runtime-l1-1-0

_crt_atexit
_c_exit
_initialize_onexit_table
terminate
_exit
exit
_initterm_e
_initterm
_get_wide_winmain_command_line
_initialize_wide_environment
_configure_wide_argv
_cexit
_set_app_type
_seh_filter_exe
_register_onexit_function
_register_thread_local_exe_atexit_callback

api-ms-win-crt-string-l1-1-0

isalpha
wcscat_s
wcsncpy
wcscpy_s

api-ms-win-crt-math-l1-1-0

round
__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 168KB - Virtual size: 167KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 568KB - Virtual size: 572KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

2ee9948cb64a72a4f93d61d952741f22

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

crlconfig

crlplatform

crlutils

crlutl

crlresources

gdiplus

msvcp140

mfc140u

kernel32

user32

gdi32

advapi32

ole32

userenv

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 27KB - Virtual size: 27KB

.rdata Size: 25KB - Virtual size: 24KB

.data Size: 1KB - Virtual size: 9KB

.pdata Size: 2KB - Virtual size: 1KB

.rsrc Size: 168KB - Virtual size: 167KB

.reloc Size: 568KB - Virtual size: 572KB

.text
Size: 27KB - Virtual size: 27KB

.rdata
Size: 25KB - Virtual size: 24KB

.data
Size: 1KB - Virtual size: 9KB

.pdata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 168KB - Virtual size: 167KB

.reloc
Size: 568KB - Virtual size: 572KB