7bc5d4640b91ee5257cc019f3661ee60_NeikiAnalytics

Sharing

Copy URL

Twitter E-mail

General

Target

7bc5d4640b91ee5257cc019f3661ee60_NeikiAnalytics
Size

67KB
MD5

7bc5d4640b91ee5257cc019f3661ee60
SHA1

c768fe5a56d4c9851e972f56534f45f982e5e140
SHA256

e49507349b308be441faf4e3279f828365f247cf0cc72ddbd1fc1915bb27076c
SHA512

1e6195e121a515700e3c4e666199a5de062288fbdda8fcab0f78139d56be8063144c20fa2567ebf9650b58215002308f0560f88f91eb84388eb232c445dc5e3b
SSDEEP

768:Xn+EQSBTUAdQeuOYsHKs5S0Pccc3CL29q4yDsT1ekO+fr3fu1t0s5F+G3eaPRfTz:X+EbmsHKs40Pay+qs4kO+T0lTuaPRz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7bc5d4640b91ee5257cc019f3661ee60_NeikiAnalytics

Files

7bc5d4640b91ee5257cc019f3661ee60_NeikiAnalytics
.exe windows:6 windows x86 arch:x86

75d3fa38fabc8aa4d617f9edc09c4993

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\四電工\NEXT\source\DevEnv\AC\xLib\XlsSvr\Release\XlsSvr.pdb

Imports

xlsxcrt

XlsxCreate
XlsxGetSheetNameW
XlsxPutSheetNameW
XlsxPutSheetNo
XlsxCloseBook
XlsxOpenBookW
XlsxCreateBookW
XlsxRelease
XlsxGetSheetName2W
XlsxGetSheetNo2W
XlsxPutActiveSheet
XlsxGetActiveSheet
XlsxAddSheet
XlsxDelSheet
XlsxCopySheetW
XlsxPrintArea
XlsxRowInsert
XlsxRowCopy
XlsxRowPaste
XlsxColumnDelete
XlsxGetMaxData
XlsxGetErrorMessageW
XlsxCellW
XlsxPos
XlsxPutDouble
XlsxGetDouble
XlsxPutStringW
XlsxGetStringW
XlsxPutBreak
XlsxAttrPutFormat
XlsxAttrPutFormatW
XlsxAttrPutLineTop
XlsxAttrPutLineBottom
XlsxAttrPutLineLeft
XlsxAttrPutLineRight
XlsxAttrPutBackColor
XlsxAttrPutPosHorz
XlsxAttrPutJoint
XlsxSetOnErrorProc
XlsxGetSheetCount

kernel32

GetStartupInfoW
IsProcessorFeaturePresent
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
ResetEvent
OutputDebugStringW
QueryPerformanceCounter
InitializeSListHead
LocalFree
WideCharToMultiByte
LockResource
FindResourceExW
LeaveCriticalSection
EnterCriticalSection
MultiByteToWideChar
FindResourceW
lstrcmpiW
SizeofResource
LoadResource
LoadLibraryExW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
FreeLibrary
GetCurrentThreadId
CreateThread
DecodePointer
RaiseException
GetLastError
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionEx
DeleteCriticalSection
GetCommandLineW
CloseHandle
SetEvent
WaitForSingleObject
CreateEventW
Sleep
IsDebuggerPresent

user32

GetMessageW
TranslateMessage
DispatchMessageW
PostThreadMessageW
CharUpperW
CharNextW

advapi32

RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegCreateKeyExW

ole32

CoInitialize
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
StringFromGUID2
CoCreateInstance
CoAddRefServerProcess
CoResumeClassObjects
CoRevokeClassObject
CoRegisterClassObject
CoUninitialize
CoReleaseServerProcess

oleaut32

SysAllocString
SysStringLen
VarUI4FromStr
LoadTypeLi
RegisterTypeLi
UnRegisterTypeLi
SafeArrayCreate
SafeArrayAccessData
SafeArrayUnaccessData
VariantInit
LoadRegTypeLi
SysFreeString
VariantClear

vcruntime140

__CxxFrameHandler3
wcsstr
__std_terminate
memcpy
memset
_purecall
memmove
__vcrt_InitializeCriticalSectionEx
_except_handler4_common
__std_exception_copy
__std_exception_destroy
_CxxThrowException

api-ms-win-crt-heap-l1-1-0

_callnewh
malloc
_recalloc
free
_set_new_mode

api-ms-win-crt-runtime-l1-1-0

terminate
_initialize_onexit_table
_register_onexit_function
_controlfp_s
_crt_atexit
_cexit
_errno
_seh_filter_exe
_set_app_type
_configure_wide_argv
_initialize_wide_environment
_get_wide_winmain_command_line
_initterm
_initterm_e
exit
_exit
_c_exit
_register_thread_local_exe_atexit_callback
_invalid_parameter_noinfo

api-ms-win-crt-string-l1-1-0

wmemcpy_s
wcsncpy_s
wcscpy_s
wcscat_s

api-ms-win-crt-stdio-l1-1-0

__p__commode
__stdio_common_vswprintf_s
__stdio_common_vswprintf
_set_fmode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 108B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

75d3fa38fabc8aa4d617f9edc09c4993

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

xlsxcrt

kernel32

user32

advapi32

ole32

oleaut32

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 35KB - Virtual size: 35KB

.rdata Size: 13KB - Virtual size: 13KB

.data Size: 2KB - Virtual size: 2KB

.gfids Size: 512B - Virtual size: 108B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 10KB - Virtual size: 10KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 35KB - Virtual size: 35KB

.rdata
Size: 13KB - Virtual size: 13KB

.data
Size: 2KB - Virtual size: 2KB

.gfids
Size: 512B - Virtual size: 108B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 10KB - Virtual size: 10KB

.reloc
Size: 3KB - Virtual size: 3KB