2e0a90509f3f206c746e7ed92b2545d0_NeikiAnalytics

Sharing

Copy URL

Twitter E-mail

General

Target

2e0a90509f3f206c746e7ed92b2545d0_NeikiAnalytics
Size

1.9MB
MD5

2e0a90509f3f206c746e7ed92b2545d0
SHA1

e0539c5d69512c774fa832bc6e4f34e80a6ec99a
SHA256

37836ee7010e17d2eaf9f75ef8ea8fc64d0089f67d9a81d91e3d1d5e32238ddf
SHA512

2529cd459bdb7d42e68689574a76c50ff5b9955da28041e429b81d8b94e1581b702fa823492857190d24bba4a89ebc4db497760936abab1a6ce2de94f316c18c
SSDEEP

49152:yAUr10mRQsvWPz9Z04uALDdPe7aPfN5t:yAtmRQskZ0qNPrPfN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2e0a90509f3f206c746e7ed92b2545d0_NeikiAnalytics

Files

2e0a90509f3f206c746e7ed92b2545d0_NeikiAnalytics
.exe windows:6 windows x64 arch:x64

372eb2415d828ebccdba886fc5e81be6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\j\workspace\y\repos\mono\msvc\build\sgen\x64\bin\Release\monodis-sgen.pdb

Imports

mswsock

TransmitFile

ws2_32

send
recv
inet_addr
ioctlsocket
connect
closesocket
accept
inet_pton
getnameinfo
socket
WSAGetLastError
recvfrom
sendto
WSASetLastError
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSARecv
WSASend
WSAWaitForMultipleEvents
htons
htonl
getsockopt
getsockname
getpeername
bind
__WSAFDIsSet
WSACloseEvent
select
listen
getprotobyname
ntohl
ntohs
setsockopt
shutdown
gethostname
getaddrinfo
freeaddrinfo
WSASocketW
WSAIoctl

ole32

CoTaskMemRealloc
CoUninitialize
CoCreateFreeThreadedMarshaler
CoTaskMemFree
CoInitializeEx
CoTaskMemAlloc

oleaut32

SysAllocStringLen
SysFreeString
SysStringLen
SafeArrayCreate
SafeArrayDestroy
SafeArrayGetDim
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayPutElement
SafeArrayPtrOfIndex

psapi

EnumProcessModules
GetModuleBaseNameW
GetModuleFileNameExW
GetModuleInformation
EnumProcesses

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

advapi32

ImpersonateLoggedOnUser
BuildTrusteeWithSidW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
GetEffectiveRightsFromAclW
SetEntriesInAclW
LookupAccountSidW
GetTokenInformation
GetLengthSid
FreeSid
DuplicateToken
CopySid
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
AllocateAndInitializeSid
OpenThreadToken
OpenProcessToken
CreateProcessWithLogonW
RevertToSelf

kernel32

SetHandleInformation
VerLanguageNameW
DuplicateHandle
GetComputerNameW
OutputDebugStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetConsoleMode
GlobalFree
GlobalReAlloc
GlobalAlloc
GetVersionExW
WakeConditionVariable
ReplaceFileW
MoveFileW
CopyFileW
CreatePipe
WriteFile
UnlockFile
OpenFileMappingW
SetFilePointer
SetFileAttributesW
SetEndOfFile
RemoveDirectoryW
ReadFile
LockFile
GetVolumeInformationW
GetLogicalDriveStringsW
GetFileType
GetFileAttributesExW
GetDriveTypeW
GetDiskFreeSpaceExW
FlushFileBuffers
FindNextFileW
FindFirstFileW
FindClose
DeleteFileW
CreateDirectoryW
GetCurrentDirectoryW
SetCurrentDirectoryW
GetStdHandle
SetProcessWorkingSetSize
GetProcessWorkingSetSize
FlushViewOfFile
GetFileInformationByHandleEx
CreateFileA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
FormatMessageW
GetProcessId
GetPriorityClass
SetFileTime
GetFileAttributesW
GetEnvironmentVariableW
SetEnvironmentVariableW
GetLastError
GetLocaleInfoA
GetThreadLocale
GetACP
TlsAlloc
TlsGetValue
TlsSetValue
CloseHandle
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
TryEnterCriticalSection
InitializeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
ReleaseSemaphore
WaitForSingleObjectEx
Sleep
CreateSemaphoreW
SetEvent
ResetEvent
WaitForMultipleObjectsEx
CreateEventW
RaiseException
QueueUserAPC
SwitchToThread
CreateThread
GetCurrentThreadId
OpenThread
ExitThread
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualFree
VirtualProtect
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
GetTickCount64
GetCurrentProcessId
GetSystemTimes
DeleteCriticalSection
FreeLibrary
LoadLibraryW
SetErrorMode
GetCommandLineW
CreateFileW
GetFileSize
SetLastError
ExitProcess
DisableThreadLibraryCalls
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LocalFree
GlobalMemoryStatusEx
SignalObjectAndWait
GetCurrentThread
SetThreadPriority
ReleaseMutex
CreateMutexW
OpenMutexW
OpenSemaphoreW
OpenEventW
GetProcessTimes
GetCurrentProcess
TerminateProcess
GetExitCodeProcess
CreateProcessW
SetPriorityClass
OpenProcess

user32

SendMessageTimeoutW
WaitForInputIdle
MessageBoxW

shell32

SHGetFolderPathW
ShellExecuteExW
CommandLineToArgvW
SHGetKnownFolderPath

vcruntime140

strrchr
memmove
memcpy
memset
strchr
wcschr
__C_specific_handler
strstr
memcmp

api-ms-win-crt-math-l1-1-0

sin
pow
tan
sinh
creal
log
_Cbuild
__setusermatherr
tanh
fmod
sqrt
floor
cimag
log10
_dclass
cosh
exp
_cabs
copysign
modf
acos
asin
atan
atan2
ceil
cos

api-ms-win-crt-string-l1-1-0

wcscpy
isalpha
wcscmp
wcscat
strlen
strcat
strcmp
isdigit
wcslen
strtok_s
tolower
isxdigit
strncpy
isspace
strpbrk
strncmp
strcpy
isprint
isalnum
_strdup

api-ms-win-crt-stdio-l1-1-0

fgets
fflush
__stdio_common_vsprintf
fclose
__acrt_iob_func
__stdio_common_vfprintf
fopen
__p__commode
_wfopen
ferror
_get_osfhandle
fread
__stdio_common_vsscanf
ftell
_close
_open
_read
_getcwd
_set_fmode
_write
fwrite
_fileno

api-ms-win-crt-runtime-l1-1-0

_errno
terminate
_crt_atexit
_register_onexit_function
_initialize_onexit_table
exit
_register_thread_local_exe_atexit_callback
_c_exit
abort
_cexit
__p___argv
_seh_filter_exe
_set_app_type
__p___argc
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_initterm_e
_exit
strerror

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-convert-l1-1-0

atoi
strtod
strtoul
strtol
strtoull
atol

api-ms-win-crt-heap-l1-1-0

calloc
_set_new_mode
free
malloc
realloc

api-ms-win-crt-filesystem-l1-1-0

_unlink
_access
_fstat64i32
_wmkdir
_stat64i32

api-ms-win-crt-time-l1-1-0

_localtime64
_time64
strftime
_utime64

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 665KB - Virtual size: 665KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

372eb2415d828ebccdba886fc5e81be6

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mswsock

ws2_32

ole32

oleaut32

psapi

version

advapi32

kernel32

user32

shell32

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 665KB - Virtual size: 665KB

.data Size: 8KB - Virtual size: 79KB

.pdata Size: 64KB - Virtual size: 64KB

.gfids Size: 512B - Virtual size: 28B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 665KB - Virtual size: 665KB

.data
Size: 8KB - Virtual size: 79KB

.pdata
Size: 64KB - Virtual size: 64KB

.gfids
Size: 512B - Virtual size: 28B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 6KB - Virtual size: 5KB