a5cb82d67cbcd79a189253518bedf1e0_NeikiAnalytics

Sharing

Copy URL Twitter E-mail

General

Target

a5cb82d67cbcd79a189253518bedf1e0_NeikiAnalytics
Size

243KB
MD5

a5cb82d67cbcd79a189253518bedf1e0
SHA1

9b4c24b30c9a90e371b094fe9c6fd81aad9fd6b4
SHA256

c21a21bd40af3302037bbb95fe225284efda5a459e315b4245aa7f5cde44c6db
SHA512

9e099e66e74f541ee89212f0eaa6ca117b5072bf002ac852b059cbb8c26fa1bed3d5cab0257884f8fb62c22687cc5096a7ad935522eda90064809cb9b1b2aeab
SSDEEP

3072:O6O2tEkTK6hp/ocr5m+sLloBAa3JZnlzv1L5AJB4U+h8I:O6bekT57/xr5m+sLaAa3JZnhNuMUi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a5cb82d67cbcd79a189253518bedf1e0_NeikiAnalytics

Files

a5cb82d67cbcd79a189253518bedf1e0_NeikiAnalytics
.exe windows:5 windows x86 arch:x86

93372523f59a23c2d02a908f1d367c4b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\main\driver\bin\ssdal.exe.pdb

Imports

kernel32

GetLocaleInfoA
FlushFileBuffers
InterlockedDecrement
LocalAlloc
lstrlenW
FormatMessageW
MultiByteToWideChar
SizeofResource
LockResource
LoadResource
FindResourceW
InterlockedIncrement
GetProfileStringW
GetLastError
GetVersionExW
LCMapStringW
CreateFileW
SetEndOfFile
CloseHandle
ReadFile
WriteFile
SetFilePointer
GetFileSize
GetModuleFileNameW
CreateProcessW
GetCurrentProcessId
GetStringTypeA
GetModuleHandleW
GetCurrentProcess
GetACP
WideCharToMultiByte
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetComputerNameW
GetTickCount
TlsGetValue
TlsSetValue
TlsAlloc
TlsFree
GetConsoleMode
CreateFileA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
InitializeCriticalSectionAndSpinCount
LoadLibraryA
GetModuleHandleA
IsValidLocale
GetConsoleCP
GetProcAddress
EnumSystemLocalesA
GetUserDefaultLCID
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineW
Sleep
lstrlenA
HeapFree
GetProcessHeap
RtlUnwind
RaiseException
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapReAlloc
HeapAlloc
LCMapStringA
GetCPInfo
SetLastError
GetCurrentThreadId
GetOEMCP
IsValidCodePage
HeapSize
ExitProcess
HeapCreate
VirtualFree
VirtualAlloc
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetStringTypeW

user32

GetSystemMetrics
wvsprintfW

winspool.drv

GetPrinterDataExW
GetPrinterDriverW
SetPrinterDataW
GetPrinterDataW
ord203
EnumPrintersW
OpenPrinterW
ClosePrinter
GetPrinterW

ole32

CoCreateInstance
CoInitialize
CoUninitialize
OleRun

oleaut32

VariantClear
SysAllocString
SysFreeString
SysStringByteLen
SysAllocStringByteLen
GetErrorInfo

Sections

.text
Size: 167KB - Virtual size: 166KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

93372523f59a23c2d02a908f1d367c4b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

winspool.drv

ole32

oleaut32

Sections

.text Size: 167KB - Virtual size: 166KB

.rdata Size: 35KB - Virtual size: 34KB

.data Size: 8KB - Virtual size: 15KB

.rsrc Size: 32KB - Virtual size: 32KB

.text
Size: 167KB - Virtual size: 166KB

.rdata
Size: 35KB - Virtual size: 34KB

.data
Size: 8KB - Virtual size: 15KB

.rsrc
Size: 32KB - Virtual size: 32KB