21f6b0c0d332d6bccfe4c085dcbea900_NeikiAnalytics

Sharing

Copy URL

Twitter E-mail

General

Target

21f6b0c0d332d6bccfe4c085dcbea900_NeikiAnalytics
Size

657KB
MD5

21f6b0c0d332d6bccfe4c085dcbea900
SHA1

44e572bc4fe3459d3d9998ce90fd48b30221eb7b
SHA256

043d2a38d208ff47e65597b2760d6551a28998f0e62960c328207ff3665fe3c0
SHA512

bf68fa99e1d272ba0830a651e71d26d0203afe831029a4da410d672c205df57d77f79ad68cd0c87548acb667bf459e2cd3c5dd1cede06378864ae1a2ccacf3c5
SSDEEP

12288:Ni6e3VV7lTQ5432XiVrgC/gn+Mmu0UQwZWP3ZxuoGRt7f65TUeaJR+nheyVD:Ni6e3VV7lMU2s/gnRroyRtzFgF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
21f6b0c0d332d6bccfe4c085dcbea900_NeikiAnalytics

Files

21f6b0c0d332d6bccfe4c085dcbea900_NeikiAnalytics
.dll windows:5 windows x86 arch:x86

f2186254fa17d4ca86ab6e2f83b250ac

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

AcquireSRWLockExclusive
CloseHandle
CreateEventW
CreateFileW
CreateIoCompletionPort
CreateThread
DecodePointer
DeleteCriticalSection
DeleteFileW
DuplicateHandle
EncodePointer
EnterCriticalSection
EnumSystemLocalesW
ExitProcess
ExpandEnvironmentStringsW
FindClose
FindFirstFileExW
FindNextFileW
FlushFileBuffers
FormatMessageA
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleCP
GetConsoleMode
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDriveTypeW
GetEnvironmentStringsW
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesW
GetFileSizeEx
GetFileType
GetFullPathNameW
GetLastError
GetLocalTime
GetLocaleInfoW
GetModuleFileNameW
GetModuleHandleExA
GetModuleHandleExW
GetModuleHandleW
GetNativeSystemInfo
GetOEMCP
GetProcAddress
GetProcessId
GetProcessTimes
GetQueuedCompletionStatus
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemDirectoryW
GetSystemInfo
GetSystemTimeAsFileTime
GetTempPathW
GetThreadId
GetThreadPriority
GetTickCount
GetUserDefaultLCID
GetVersionExW
GetWindowsDirectoryW
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSetInformation
HeapSize
InitializeCriticalSectionAndSpinCount
InitializeSListHead
InterlockedFlushSList
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
LCMapStringW
LeaveCriticalSection
LoadLibraryExA
LoadLibraryExW
LocalFree
MultiByteToWideChar
OutputDebugStringA
PostQueuedCompletionStatus
QueryPerformanceCounter
QueryPerformanceFrequency
QueryThreadCycleTime
RaiseException
ReadConsoleW
ReadFile
ReleaseSRWLockExclusive
ResetEvent
RtlCaptureStackBackTrace
RtlUnwind
SetEnvironmentVariableW
SetErrorMode
SetEvent
SetFilePointerEx
SetLastError
SetProcessShutdownParameters
SetStdHandle
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SwitchToThread
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryAcquireSRWLockExclusive
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WaitForSingleObject
WaitForSingleObjectEx
WideCharToMultiByte
WriteConsoleW
WriteFile

chrome_elf

GetInstallDetailsPayload

shell32

CommandLineToArgvW
SHGetFolderPathW
SHGetKnownFolderPath

user32

CreateWindowExW
DefWindowProcW
DestroyWindow
DispatchMessageW
GetQueueStatus
GetWindowLongW
KillTimer
MsgWaitForMultipleObjectsEx
PeekMessageW
PostMessageW
PostQuitMessage
RegisterClassExW
SetTimer
SetWindowLongW
TranslateMessage
UnregisterClassW

advapi32

EventRegister
EventUnregister
EventWrite
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegisterTraceGuidsW
SystemFunction036
TraceEvent
UnregisterTraceGuids

ole32

CoInitializeEx
CoTaskMemFree
CoUninitialize

winmm

timeBeginPeriod
timeEndPeriod
timeGetTime

dbghelp

SymCleanup
SymFromAddr
SymGetLineFromAddr64
SymGetSearchPathW
SymInitialize
SymSetOptions
SymSetSearchPathW

Exports

Exports

GetHandleVerifier
WatcherMain

Sections

.text
Size: 513KB - Virtual size: 512KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 95KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.voltbl
Size: 512B - Virtual size: 322B

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f2186254fa17d4ca86ab6e2f83b250ac

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

chrome_elf

shell32

user32

advapi32

ole32

winmm

dbghelp

Exports

Exports

Sections

.text Size: 513KB - Virtual size: 512KB

.rdata Size: 95KB - Virtual size: 94KB

.data Size: 7KB - Virtual size: 17KB

.00cfg Size: 512B - Virtual size: 4B

.gfids Size: 16KB - Virtual size: 15KB

.tls Size: 512B - Virtual size: 9B

.voltbl Size: 512B - Virtual size: 322B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 21KB - Virtual size: 21KB

.text
Size: 513KB - Virtual size: 512KB

.rdata
Size: 95KB - Virtual size: 94KB

.data
Size: 7KB - Virtual size: 17KB

.00cfg
Size: 512B - Virtual size: 4B

.gfids
Size: 16KB - Virtual size: 15KB

.tls
Size: 512B - Virtual size: 9B

.voltbl
Size: 512B - Virtual size: 322B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 21KB - Virtual size: 21KB