7b3a7e57f9cd8597373b4f5f035a5c60_NeikiAnalytics

Sharing

Copy URL Twitter E-mail

General

Target

7b3a7e57f9cd8597373b4f5f035a5c60_NeikiAnalytics
Size

56KB
MD5

7b3a7e57f9cd8597373b4f5f035a5c60
SHA1

def46342e94fd6487655c745698f08f57815355d
SHA256

8f528caa467f1fbdaf370e44e9fa3002b09865947751f876a964a07c16bc97d7
SHA512

3a0574f4cb0d6c4c193e2e8bf777b2207f6abb192ead7c8bc5f6d6843dadd988efe19097ad491a786b70ddefd591d4a3954d71a5ec17e44302efabd8f1195e34
SSDEEP

1536:kSnIkRq3LMu6+bFFs/+zJjJc+/NkZBH+d:kRkRq34u6+bbs/+E2NSBH+d

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7b3a7e57f9cd8597373b4f5f035a5c60_NeikiAnalytics

Files

7b3a7e57f9cd8597373b4f5f035a5c60_NeikiAnalytics
.dll windows:6 windows x64 arch:x64

f70a497367cffe89231c0cb117169877

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\csc\build_msvc\tool_composition.pdb

Imports

qt6qml

??1QQmlModuleRegistration@@QEAA@XZ
??0QQmlModuleRegistration@@QEAA@PEBDP6AXXZ@Z
?qmlRegisterModule@@YAXPEBDHH@Z
?staticMetaObject@QQmlEngineExtensionPlugin@@2UQMetaObject@@B
?qmlregister@QQmlPrivate@@YAHW4RegistrationType@1@PEAX@Z
??1QQmlEngineExtensionPlugin@@UEAA@XZ
??0QQmlEngineExtensionPlugin@@QEAA@PEAVQObject@@@Z
?qt_metacall@QQmlEngineExtensionPlugin@@UEAAHW4Call@QMetaObject@@HPEAPEAX@Z
?qt_metacast@QQmlEngineExtensionPlugin@@UEAAPEAXPEBD@Z
?qmlunregister@QQmlPrivate@@YAXW4RegistrationType@1@_K@Z
?initializeEngine@QQmlEngineExtensionPlugin@@UEAAXPEAVQQmlEngine@@PEBD@Z

qt6core

?customEvent@QObject@@MEAAXPEAVQEvent@@@Z
?connectNotify@QObject@@MEAAXAEBVQMetaMethod@@@Z
?qRegisterResourceData@@YA_NHPEBE00@Z
?disconnectNotify@QObject@@MEAAXAEBVQMetaMethod@@@Z
?childEvent@QObject@@MEAAXPEAVQChildEvent@@@Z
?timerEvent@QObject@@MEAAXPEAVQTimerEvent@@@Z
?eventFilter@QObject@@UEAA_NPEAV1@PEAVQEvent@@@Z
?event@QObject@@UEAA_NPEAVQEvent@@@Z
??0QStaticPlugin@@QEAA@P6APEAVQObject@@XZP6A?AUQPluginMetaData@@XZ@Z
?getAndRef@ExternalRefCountData@QtSharedPointer@@SAPEAU12@PEBVQObject@@@Z
?dynamicMetaObject@QObjectData@@QEBAPEAUQMetaObject@@XZ
?cleanPath@QDir@@SA?AVQString@@AEBV2@@Z
?path@QUrl@@QEBA?AVQString@@V?$QFlags@W4ComponentFormattingOption@QUrl@@@@@Z
?scheme@QUrl@@QEBA?AVQString@@XZ
?qHash@@YA_KVQStringView@@_K@Z
?globalSeed@QHashSeed@@SA?AU1@XZ
?qUnregisterResourceData@@YA_NHPEBE00@Z
?isNull@QString@@QEBA_NXZ
?insert@QString@@QEAAAEAV1@_JVQChar@@@Z
?startsWith@QString@@QEBA_NVQChar@@W4CaseSensitivity@Qt@@@Z
?data@QString@@QEBAPEBVQChar@@XZ
??0QString@@QEAA@$$QEAV0@@Z
??1QString@@QEAA@XZ
??0QString@@QEAA@AEBV0@@Z
?compareStrings@QtPrivate@@YAHVQStringView@@VQLatin1String@@W4CaseSensitivity@Qt@@@Z
?compareStrings@QtPrivate@@YAHVQStringView@@0W4CaseSensitivity@Qt@@@Z
?deallocate@QArrayData@@SAXPEAU1@_J1@Z
??0QChar@@QEAA@UQLatin1Char@@@Z
?qRegisterStaticPluginFunction@@YAXUQStaticPlugin@@@Z
??0QString@@QEAA@$$QEAU?$QArrayDataPointer@_S@@@Z

msvcp140

_Mtx_init_in_situ
_Mtx_destroy_in_situ

vcruntime140

__std_type_info_destroy_list
_CxxThrowException
__std_exception_copy
memset
__current_exception_context
__current_exception
__C_specific_handler
memcpy
_purecall
__std_terminate
__std_exception_destroy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-heap-l1-1-0

free
malloc
_callnewh

api-ms-win-crt-runtime-l1-1-0

_cexit
terminate
_initterm
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_crt_atexit
_execute_onexit_table

kernel32

OpenEventA
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
CreateEventA
RtlCaptureContext
GetProcAddress
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
CloseHandle
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetCurrentThreadId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
InitializeSListHead
HeapFree
GetProcessHeap
GetCurrentProcessId

Exports

Exports

?qCleanupResources_composition_resources@@YAHXZ
?qInitResources_composition_resources@@YAHXZ
?qml_register_types_CompositionTool@@YAXXZ

Sections

.text
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 344B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f70a497367cffe89231c0cb117169877

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

qt6qml

qt6core

msvcp140

vcruntime140

vcruntime140_1

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

kernel32

Exports

Exports

Sections

.text Size: 22KB - Virtual size: 22KB

.rdata Size: 27KB - Virtual size: 26KB

.data Size: 1KB - Virtual size: 3KB

.pdata Size: 2KB - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 344B

.text
Size: 22KB - Virtual size: 22KB

.rdata
Size: 27KB - Virtual size: 26KB

.data
Size: 1KB - Virtual size: 3KB

.pdata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 344B