01080a22d85c59478eb0949c4d80f180_NeikiAnalytics

Sharing

Copy URL Twitter E-mail

General

Target

01080a22d85c59478eb0949c4d80f180_NeikiAnalytics
Size

48KB
MD5

01080a22d85c59478eb0949c4d80f180
SHA1

bc68f177e32052bf690f0d2d995befbbcf5cfc6b
SHA256

5df320bc34d848816a7865a3248ab62f443c5b3854c37b8cb370d8647f387985
SHA512

8b146acbbb848e7fe304c8c0b5a9bb9c4e9541b148a9d61981886bbec8bc1f64741c5539491f84999fe8f33836157fd11030ecf613b02c3f8b8cb7c80a0c8c71
SSDEEP

384:4FhPp3U6RdZAJR789y/3mlEcjeiB9q2OO8uqUpygVXgIo4harFswxh26zSgPBin:4l3RPZM89JSiB9lJ/qCyCxo4MrLjSf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
01080a22d85c59478eb0949c4d80f180_NeikiAnalytics

Files

01080a22d85c59478eb0949c4d80f180_NeikiAnalytics
.dll windows:4 windows x86 arch:x86

fedba6fabc0dfd4583e83d6eabb83bde

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

riebase

??0NCPopup@@QAE@FFF@Z
?Unlock@NDBIsam@@QAEFXZ
?Action@NCPopup@@MAEKPAURTSDATA@@FF@Z
?InternalUserMsg@NCMask@@MAEXF@Z
?Init@NCMask@@UAEHPAURTSDATA@@@Z
?Deinit@NCMask@@UAEXPAURTSDATA@@@Z
?PopRet@NCMask@@UAEXPAURTSDATA@@F@Z
?MsgBoxRet@NCMask@@UAEXPAURTSDATA@@FF@Z
?PrintData@NCMask@@UAEPBDPAURTSDATA@@PBD@Z
?PrintIfFlag@NCMask@@UAEHPAURTSDATA@@PBD@Z
?PrintCntFlag@NCMask@@UAEHPAURTSDATA@@PBD@Z
?PrintGrfDat@NCMask@@UAEPAXPAURTSDATA@@F@Z
?PrintGrfDat2@NCMask@@UAEGPAURTSDATA@@F@Z
?AppRet@NCClient@@UAEHPAURTSDATA@@@Z
?GetGrfDat@NCClient@@UAEPAXXZ
?lpLinkData@NCMask@@2PAVSTDLINK@@A
??0NDatum@@QAE@PBD@Z
?_lpRts@@YAPAURTSDATA@@XZ
?MessageBoxA@NCMask@@SAKPBD0K@Z
?_NSEstrNcpy@@YAXPADPBDPAXI@Z
?DrawMessage@NCClient@@QAEXFPBD0000@Z
?EnableControl@NCClient@@QAEXFW4ControlStatus@NCMask@@@Z
?Run@NCMask@@UAEKPAURTSDATA@@FFPAX@Z
?lpC@NCMask@@2PAVCOMM@@A
?DeleteAll@NDBIsam@@QAEFPBUs_KEY_BESCHREIBUNG@@FPAUSearchkey@NDBBase@@@Z
?Delete@NDBIsam@@QAEFPBUs_KEY_BESCHREIBUNG@@FPAPBX@Z
?Write@NDBIsam@@QAEFPBXPBUs_TAB_BESCHREIBUNG@@PBUs_KEY_BESCHREIBUNG@@FPAPBX@Z
?Update@NDBIsam@@QAEFPBXPBUs_TAB_BESCHREIBUNG@@PBUs_KEY_BESCHREIBUNG@@FPAPBX@Z
?BuildSearchKeyArray@NDBBase@@IAEPAUSearchkey@1@PBXW4Searchflags@1@01010101010101@Z
?Select@NDBIsam@@QAEFPBUs_KEY_BESCHREIBUNG@@FPAUSearchkey@NDBBase@@@Z
?BuildKeyArray@NDBBase@@IAEPAPBXPBX0000000@Z
?Read@NDBIsam@@QAEFPAXPBUs_TAB_BESCHREIBUNG@@PBUs_KEY_BESCHREIBUNG@@FPAPBX@Z
?Fetch@NDBIsam@@QAEFPAXPBUs_TAB_BESCHREIBUNG@@@Z
?Lock@NDBIsam@@QAEFXZ
?BeginTransaction@NDBIsam@@SAFXZ
?EndTransaction@NDBIsam@@SAFXZ

shell32

ShellExecuteA

kernel32

LCMapStringA
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
LoadLibraryA
GetOEMCP
GetACP
GetCPInfo
HeapReAlloc
VirtualAlloc
HeapAlloc
WriteFile
DisableThreadLibraryCalls
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetModuleFileNameA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
HeapFree
VirtualFree
HeapCreate
HeapDestroy
GetCurrentProcess
TerminateProcess
ExitProcess
GetModuleHandleA
GetProcAddress
GetVersion
GetCommandLineA
RtlUnwind
LCMapStringW

Exports

Exports

_RIE00105@16

Sections

.text
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fedba6fabc0dfd4583e83d6eabb83bde

Headers

File Characteristics

Imports

riebase

shell32

kernel32

Exports

Exports

Sections

.text Size: 24KB - Virtual size: 21KB

.rdata Size: 8KB - Virtual size: 4KB

.data Size: 8KB - Virtual size: 9KB

.reloc Size: 4KB - Virtual size: 2KB

.text
Size: 24KB - Virtual size: 21KB

.rdata
Size: 8KB - Virtual size: 4KB

.data
Size: 8KB - Virtual size: 9KB

.reloc
Size: 4KB - Virtual size: 2KB