c0fba00be389f3cf7b4e84253bf2d650_NeikiAnalytics

Sharing

Copy URL

Twitter E-mail

General

Target

c0fba00be389f3cf7b4e84253bf2d650_NeikiAnalytics
Size

338KB
MD5

c0fba00be389f3cf7b4e84253bf2d650
SHA1

fbf11b7979e5cdff81a3c116dcfcbf6f97d87e62
SHA256

6aa220e6642412e1adfdc52346f015dc153cb20afe411412dff8b68d20d8d22e
SHA512

73c244d0e4b0523b9a161569116c260f1ea7ef32669e16e8a7bd472f7619083e3eafbf2adcc8e53136cb69a36d71f4d9b7bd8b3d2e1670f3a013def2cdff8787
SSDEEP

6144:9eub42K2WDe5HOZAQT/hYSzQU++qSJJz4SVpwrqWkk4g4UZd8gZv:9BI2WvhbV1qSJJEIWEg4UZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c0fba00be389f3cf7b4e84253bf2d650_NeikiAnalytics

Files

c0fba00be389f3cf7b4e84253bf2d650_NeikiAnalytics
.dll regsvr32 windows:6 windows x86 arch:x86

9039a5ded8db01c3a1b37136d854b928

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

P:\Target\x86\ship\factoid\x-none\fstock.pdb

Imports

kernel32

FreeLibrary
GetModuleHandleA
GetModuleHandleW
GetProcAddress
LoadLibraryExA
SizeofResource
lstrcmpiA
IsDBCSLeadByte
InitializeCriticalSection
DeleteCriticalSection
LoadLibraryExW
InitializeCriticalSectionAndSpinCount
WideCharToMultiByte
MultiByteToWideChar
FindResourceExA
RaiseException
FindResourceW
FindResourceA
lstrlenW
lstrlenA
lstrcmpA
MulDiv
GlobalFree
GlobalUnlock
GlobalHandle
GlobalLock
GlobalAlloc
LockResource
LoadResource
GetModuleFileNameA
FlushInstructionCache
GetCurrentThreadId
GetCurrentProcess
LeaveCriticalSection
EnterCriticalSection
SetLastError
GetLastError
LocalFree
LoadLibraryA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
Sleep
InterlockedExchange
DecodePointer
EncodePointer
GetModuleFileNameW
WerRegisterMemoryBlock
VirtualProtect
GetTickCount
GetSystemTimeAsFileTime
GetCurrentProcessId
HeapSetInformation
QueryPerformanceCounter
InterlockedPopEntrySList
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
InterlockedPushEntrySList
InterlockedCompareExchange
LocalAlloc

gdi32

GetObjectA
SelectObject
GetStockObject
GetDeviceCaps
DeleteObject
CreateSolidBrush
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
DeleteDC

advapi32

DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegOpenKeyExW
RegQueryValueExW
RegQueryValueExA
RegSetValueExA
RegQueryInfoKeyW
RegQueryInfoKeyA
RegOpenKeyExA
RegEnumKeyExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegCloseKey

ole32

CoCreateInstance
CreateStreamOnHGlobal
CoGetClassObject
CLSIDFromString
CLSIDFromProgID
StringFromGUID2
CoTaskMemAlloc
OleInitialize
OleUninitialize
OleLockRunning
CoUninitialize
CoTaskMemRealloc
CoTaskMemFree
CoInitialize

oleaut32

CreateErrorInfo
GetErrorInfo
SysAllocString
SysAllocStringLen
SysFreeString
SysStringLen
SysStringByteLen
SysAllocStringByteLen
VariantInit
VariantClear
LoadTypeLi
LoadRegTypeLi
OleCreateFontIndirect
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
VariantChangeType

mfc100

ord11180
ord7510
ord1288
ord6835
ord7584
ord1885
ord1861
ord6521
ord10922
ord14075
ord13181
ord11413
ord7144
ord13483
ord13480
ord13482
ord13484
ord13481
ord888
ord6112
ord3409
ord5238
ord11172
ord7355
ord11184
ord11153
ord4622
ord4903
ord5095
ord8439
ord4881
ord5098
ord4625
ord4774
ord4606
ord9449
ord6898
ord6888
ord4772
ord7357
ord9281
ord8304
ord13518
ord322
ord1929
ord1281
ord12097
ord12721
ord880
ord901
ord306
ord310
ord3406
ord2067
ord2061
ord2063
ord266
ord265
ord1294
ord1296
ord11787
ord11726
ord4078
ord7141
ord13767
ord4724
ord2163
ord11421
ord11420
ord13301
ord7073
ord13299
ord8486
ord3676
ord3618
ord11806
ord1297
ord323
ord1867
ord1940
ord2087
ord2089
ord1948
ord408
ord2040
ord1979
ord2079
ord2050
ord2052
ord2090
ord906
ord7091
ord6897
ord1732
ord13485

msvcr100

?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
_crt_debugger_hook
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
vswprintf_s
memcpy
wcsstr
wcsrchr
_mbsstr
_mbsnbcpy_s
wcsncpy_s
strcat_s
strcpy_s
memset
memcmp
__CxxFrameHandler3
_resetstkoflw
_CxxThrowException
_recalloc
malloc
free
calloc
_vsnwprintf
sprintf_s
memcpy_s

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 88KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 237KB - Virtual size: 240KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9039a5ded8db01c3a1b37136d854b928

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

gdi32

advapi32

ole32

oleaut32

mfc100

msvcr100

Exports

Exports

Sections

.text Size: 88KB - Virtual size: 87KB

.data Size: 5KB - Virtual size: 6KB

.rsrc Size: 6KB - Virtual size: 6KB

.reloc Size: 237KB - Virtual size: 240KB

.text
Size: 88KB - Virtual size: 87KB

.data
Size: 5KB - Virtual size: 6KB

.rsrc
Size: 6KB - Virtual size: 6KB

.reloc
Size: 237KB - Virtual size: 240KB