2ee90d92a1f420bd22f4f9801689f840_NeikiAnalytics

General

Target

2ee90d92a1f420bd22f4f9801689f840_NeikiAnalytics
Size

44KB
MD5

2ee90d92a1f420bd22f4f9801689f840
SHA1

c47c480921e02d6f1889860df9dee30a472cad59
SHA256

7392de92d6c7d6586fa4dda7088bbaf6c7038a5e73afda5b7568870c7cd22797
SHA512

76f865f626fe871316b41dd8d52bd4768fd23f45ec1ac473b15c986df0f11ab5d0094024a7324cea03054860e39d54b66243075a3f859796d36661367f3d36d0
SSDEEP

768:Cf17CkhiHWFA6NzxjNLaOtcwfUXN/rMekoQpBBQARQknElAo:q17zXN4TMekoQpBBQAR0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2ee90d92a1f420bd22f4f9801689f840_NeikiAnalytics

Files

2ee90d92a1f420bd22f4f9801689f840_NeikiAnalytics
.dll windows:4 windows x86 arch:x86

04736d883c6a00309bc1a9500e3179a3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

sscanf
RtlNumberGenericTableElements
RtlInsertElementGenericTable
RtlInitializeGenericTable
RtlGetElementGenericTable
RtlDeleteElementGenericTable
memcpy
_snprintf
RtlZeroMemory
RtlUnwind
ZwQuerySystemInformation
memcmp
strlen
strstr

kernel32

WideCharToMultiByte
SuspendThread
OpenThread
MoveFileExA
MapViewOfFile
IsBadReadPtr
GetTempPathA
GetTempFileNameA
GetSystemDirectoryA
GetStartupInfoA
lstrcpynA
WriteFile
VirtualProtectEx
VirtualFree
VirtualAlloc
GlobalAlloc
GlobalFree
CloseHandle
CreateThread
DeleteCriticalSection
EnterCriticalSection
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
Sleep
TerminateThread
WaitForSingleObject
lstrcatA
lstrcmpA
lstrcmpiA
lstrcpyA
lstrlenA
GetPrivateProfileStringA
GetLastError
CreateFileA
GetFileSize
ReadFile
CreateFileMappingA
CreateProcessA
DeleteFileA
GetCurrentProcessId
GetExitCodeThread
UnmapViewOfFile

user32

wsprintfA
GetWindowThreadProcessId
KillTimer
RegisterWindowMessageA
SendMessageA
SetTimer
UnhookWindowsHookEx

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 12B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 886B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

04736d883c6a00309bc1a9500e3179a3

Headers

File Characteristics

Imports

ntdll

kernel32

user32

Sections

.text Size: 28KB - Virtual size: 27KB

.bss Size: - Virtual size: 12B

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 4KB - Virtual size: 3KB

.reloc Size: 4KB - Virtual size: 886B

.text
Size: 28KB - Virtual size: 27KB

.bss
Size: - Virtual size: 12B

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 4KB - Virtual size: 3KB

.reloc
Size: 4KB - Virtual size: 886B