1dcb0ab5bc81cfb09992df4712912610_NeikiAnalytics

Sharing

Copy URL Twitter E-mail

General

Target

1dcb0ab5bc81cfb09992df4712912610_NeikiAnalytics
Size

368KB
MD5

1dcb0ab5bc81cfb09992df4712912610
SHA1

561f29aa28cfcc1c5699531925c839b39dfb8fa1
SHA256

46ae32cd62396b02cd046fa13980998ba931942a8245608dd9d73a927a06db1d
SHA512

23265f141350eabb4ac3ac080b6efddee312c75b29b89b81e2d389c2d25e296710b3e3cebc8ab19288469e420b2b6c20740aa008979154947f2e3b9577203ef4
SSDEEP

6144:tKlkeEQK709d7t5b6J2pNQwL6XiZVAbW7ydI+72awDfLYoHJdjt8qWrrwuTdDG:tKTp9Ft5mJ2pNQwmXiDb7PapwHLJdtti

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1dcb0ab5bc81cfb09992df4712912610_NeikiAnalytics

Files

1dcb0ab5bc81cfb09992df4712912610_NeikiAnalytics
.exe windows:6 windows x86 arch:x86

a1a395d3ca198fecf2bbd9d45f4d2434

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ole32

CoInitializeEx
CoCreateInstance
CLSIDFromString
CoTaskMemFree
CoCreateGuid
CLSIDFromProgID
CoUninitialize

comctl32

InitCommonControlsEx

crypt32

CertCloseStore
CertFindExtension
CryptDecodeObjectEx
CryptBinaryToStringA
CryptStringToBinaryA
CertEnumCertificatesInStore
CertFreeCertificateContext
CertOpenStore
PFXImportCertStore
CertFindCertificateInStore

wininet

HttpQueryInfoA
HttpEndRequestA
HttpSendRequestExA
HttpSendRequestA
HttpAddRequestHeadersA
HttpOpenRequestA
InternetSetStatusCallback
InternetSetOptionA
InternetWriteFile
InternetReadFileExA
InternetConnectA
InternetCloseHandle
InternetReadFile
InternetSetCookieA
InternetFindNextFileW
InternetGetLastResponseInfoA
FtpFindFirstFileW
FtpGetFileW
FtpPutFileW
FtpDeleteFileW
FtpRenameFileW
FtpCreateDirectoryW
FtpRemoveDirectoryW
FtpSetCurrentDirectoryW
FtpGetCurrentDirectoryW
FtpCommandW
InternetCrackUrlW
InternetCrackUrlA
InternetCanonicalizeUrlA
InternetOpenA

ws2_32

inet_pton
inet_ntop
__WSAFDIsSet
inet_addr
gethostbyname
gethostname
WSAStartup
WSACleanup
accept
closesocket
getnameinfo
WSAAddressToStringA
connect
ioctlsocket
getsockopt
htonl
htons
WSAGetLastError
inet_ntoa
listen
ntohs
recv
select
send
setsockopt
shutdown
socket
WSASetLastError
bind

secur32

AcquireCredentialsHandleA
InitializeSecurityContextA
AcceptSecurityContext
DeleteSecurityContext
DecryptMessage
EncryptMessage
FreeContextBuffer
QueryContextAttributesA
FreeCredentialsHandle

dnsapi

DnsQuery_A
DnsFree

iphlpapi

GetAdaptersAddresses

urlmon

FindMimeFromData

sensapi

IsNetworkAlive

shlwapi

PathIsRelativeW
PathFindExtensionW
PathRemoveFileSpecW
PathFindFileNameW
PathIsDirectoryEmptyW
PathFindFileNameA

advapi32

LookupPrivilegeValueA
RegCloseKey
OpenProcessToken
AdjustTokenPrivileges
RegSetKeyValueW
CryptHashData
CryptCreateHash
CryptGenRandom
RegDeleteTreeW
RegGetValueW
CryptDestroyKey
CryptSetKeyParam
CryptImportKey
CryptEncrypt
CryptDestroyHash
CryptAcquireContextA
RegDeleteKeyValueW
CryptReleaseContext
CryptGetHashParam
RegOpenKeyExW

gdi32

GetDeviceCaps
AddFontResourceExW
RemoveFontResourceW
EnumFontFamiliesExW

kernel32

CreatePipe
SetHandleInformation
WriteFile
ReadConsoleW
FileTimeToSystemTime
MoveFileW
CopyFileW
SetFileTime
SetFileAttributesW
RemoveDirectoryW
GetFullPathNameW
GetFileTime
GetFileSizeEx
FileTimeToLocalFileTime
CreateFileW
GetTimeFormatW
GetDateFormatW
SystemTimeToFileTime
GetLocalTime
CompareFileTime
WideCharToMultiByte
FindNextFileW
SetCurrentDirectoryA
FindClose
CreateDirectoryW
PeekNamedPipe
SetCurrentConsoleFontEx
GetCurrentConsoleFontEx
SetConsoleTitleW
GetConsoleTitleW
SetConsoleTextAttribute
SetConsoleCursorPosition
GetConsoleScreenBufferInfo
SetConsoleCursorInfo
GetConsoleCursorInfo
FillConsoleOutputAttribute
FillConsoleOutputCharacterA
ReadConsoleInputW
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
AllocConsole
MulDiv
Sleep
ReadFile
CreateFileA
SetStdHandle
GetStdHandle
GetCurrentDirectoryW
SetLastError
lstrcmpiW
GetConsoleWindow
TerminateProcess
SetConsoleOutputCP
MultiByteToWideChar
CreateJobObjectA
LocalFree
GlobalLock
GlobalUnlock
GlobalAlloc
GetModuleHandleA
SetInformationJobObject
AssignProcessToJobObject
GetTickCount64
InitializeSListHead
LoadResource
LockResource
SizeofResource
LoadLibraryW
FindResourceA
DeleteFileA
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetTickCount
CreateThread
GetExitCodeThread
LocalAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetModuleHandleW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
FindFirstFileW
VirtualProtect
FreeLibrary
GetModuleFileNameW
GetProcAddress
LoadLibraryA
GetLastError
GetModuleFileNameA
LoadLibraryExA
FormatMessageA
SetCurrentDirectoryW
CreateDirectoryA
DeleteFileW
GetFileAttributesW
GetTempFileNameW
GetTempPathW
Beep
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
GetCurrentProcess
GetExitCodeProcess
CreateProcessW

user32

CharUpperBuffW
CharLowerBuffW
ExitWindowsEx
OpenClipboard
CloseClipboard
SetClipboardData
GetClipboardData
EmptyClipboard
keybd_event
GetSystemMenu
DeleteMenu
GetDC
ReleaseDC
ShowScrollBar
GetWindowRect
GetDesktopWindow

oleaut32

SysAllocString
VariantChangeType
VariantInit
VariantTimeToSystemTime
VariantClear
SysFreeString
VarDateFromStr
GetActiveObject

msvcp140

?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z

vcruntime140

strstr
strchr
longjmp
_setjmp3
memcpy
memchr
memset
memmove
wcschr
__std_exception_copy
__std_exception_destroy
_CxxThrowException
__current_exception
__current_exception_context
_except_handler4_common
strrchr

api-ms-win-crt-runtime-l1-1-0

_c_exit
_register_onexit_function
_crt_atexit
strerror
_initialize_narrow_environment
_cexit
_configure_narrow_argv
_invalid_parameter_noinfo_noreturn
abort
_seh_filter_exe
_set_app_type
_register_thread_local_exe_atexit_callback
_get_initial_narrow_environment
_initterm
_initterm_e
system
_errno
_exit
terminate
__p___argv
exit
__p___argc
_initialize_onexit_table
_controlfp_s

api-ms-win-crt-stdio-l1-1-0

__p__commode
_kbhit
freopen_s
_get_osfhandle
clearerr
_fseeki64
_ftelli64
_pclose
_popen
setvbuf
tmpfile
__acrt_iob_func
__stdio_common_vswprintf
fputs
puts
__stdio_common_vsprintf
_set_fmode
fclose
feof
ferror
tmpnam
_wfopen
fputc
fflush
ungetc
fopen
_wfsopen
fread
_telli64
_chsize_s
__stdio_common_vsprintf_s
fputwc
fgetws
fputws
_setmode
freopen
fseek
__stdio_common_vsscanf
getc
__stdio_common_vfprintf
fgets
fwrite
_fileno

api-ms-win-crt-math-l1-1-0

ldexp
floor
frexp
__setusermatherr
_libm_sse2_pow_precise
_CIfmod
ceil
_libm_sse2_tan_precise
_libm_sse2_sqrt_precise
_libm_sse2_sin_precise
_libm_sse2_log_precise
_libm_sse2_log10_precise
_libm_sse2_exp_precise
_CIatan2
_CIcosh
_CIsinh
_CItanh
_libm_sse2_cos_precise
_libm_sse2_asin_precise
_libm_sse2_acos_precise

api-ms-win-crt-locale-l1-1-0

setlocale
_configthreadlocale
localeconv

api-ms-win-crt-convert-l1-1-0

strtod

api-ms-win-crt-string-l1-1-0

isdigit
strncmp
iswctype
isalpha
isalnum
islower
_strdup
strncpy
isxdigit
isspace
isupper
strcoll
ispunct
strspn
strpbrk
isgraph
iscntrl
tolower
wcsncpy
_wcsdup
toupper

api-ms-win-crt-time-l1-1-0

strftime
_mktime64
_localtime64
_gmtime64
_localtime64_s
_wutime64
_time64
_difftime64
clock

api-ms-win-crt-heap-l1-1-0

_callnewh
free
_set_new_mode
realloc
malloc
calloc

api-ms-win-crt-environment-l1-1-0

getenv
_wputenv
_wgetenv

api-ms-win-crt-filesystem-l1-1-0

_wstat64
rename
remove
_waccess

Exports

Exports

File_close
File_open
LoadFont
TBuffer
TCOM
TDatetime
TDirectory
TFile
TPipe
TWidget
TZip
WIDGET_METHODS
WM_LUAMAX
console_finalize
detectBOM
fontsize_fromheight
luaL_addgsub
luaL_addlstring
luaL_addstring
luaL_addvalue
luaL_argerror
luaL_buffinit
luaL_buffinitsize
luaL_callmeta
luaL_checkFilename
luaL_checkany
luaL_checkinteger
luaL_checklstring
luaL_checknumber
luaL_checkoption
luaL_checkstack
luaL_checktype
luaL_checkudata
luaL_checkversion_
luaL_embedclose
luaL_embedopen
luaL_error
luaL_execresult
luaL_fileresult
luaL_getlasterror
luaL_getmetafield
luaL_getsubtable
luaL_gsub
luaL_len
luaL_loadbufferx
luaL_loadfilex
luaL_loadstring
luaL_newmetatable
luaL_newstate
luaL_openlibs
luaL_optinteger
luaL_optlstring
luaL_optnumber
luaL_prepbuffsize
luaL_pushresult
luaL_pushresultsize
luaL_ref
luaL_require
luaL_requiref
luaL_setfuncs
luaL_setmetatable
luaL_setrawfuncs
luaL_testudata
luaL_tolstring
luaL_traceback
luaL_typeerror
luaL_unref
luaL_where
lua_absindex
lua_arith
lua_atpanic
lua_callk
lua_checkcinstance
lua_checkinstance
lua_checkstack
lua_close
lua_closeslot
lua_closethread
lua_compare
lua_concat
lua_copy
lua_createcinstance
lua_createinstance
lua_createtable
lua_dump
lua_error
lua_gc
lua_getallocf
lua_getevent
lua_getfield
lua_getglobal
lua_gethook
lua_gethookcount
lua_gethookmask
lua_geti
lua_getinfo
lua_getiuservalue
lua_getlocal
lua_getmetatable
lua_getstack
lua_gettable
lua_gettask
lua_gettop
lua_getupvalue
lua_iscfunction
lua_iscinstance
lua_isinstance
lua_isinteger
lua_isnumber
lua_isobject
lua_isstring
lua_isuserdata
lua_isyieldable
lua_len
lua_load
lua_newstate
lua_newthread
lua_newuserdatauv
lua_next
lua_objectname
lua_optstring
lua_pcallk
lua_pushboolean
lua_pushcclosure
lua_pushfstring
lua_pushinteger
lua_pushlightuserdata
lua_pushlstring
lua_pushlwstring
lua_pushnewinstance
lua_pushnewinstancebyname
lua_pushnil
lua_pushnumber
lua_pushstring
lua_pushtask
lua_pushthread
lua_pushvalue
lua_pushvfstring
lua_rawequal
lua_rawget
lua_rawgeti
lua_rawgetp
lua_rawlen
lua_rawset
lua_rawseti
lua_rawsetp
lua_registerevent
lua_registermodule
lua_registerobject
lua_registerwidget
lua_resetthread
lua_resume
lua_rotate
lua_schedule
lua_setallocf
lua_setcstacklimit
lua_setfield
lua_setglobal
lua_sethook
lua_seti
lua_setiuservalue
lua_setlocal
lua_setmetatable
lua_settable
lua_settop
lua_setupvalue
lua_setwarnf
lua_sleep
lua_status
lua_stringtonumber
lua_super
lua_toBuffer
lua_toboolean
lua_tocfunction
lua_tocinstance
lua_toclose
lua_tointegerx
lua_tolstring
lua_tolwstring
lua_tonumberx
lua_topointer
lua_toself
lua_tothread
lua_touserdata
lua_type
lua_typename
lua_upvalueid
lua_upvaluejoin
lua_version
lua_warning
lua_widgetconstructor
lua_widgetdestructor
lua_widgetinitialize
lua_widgetproc
lua_xmove
lua_yieldk
luaopen_base
luaopen_compression
luaopen_console
luaopen_coroutine
luaopen_crypto
luaopen_debug
luaopen_embed
luaopen_io
luaopen_math
luaopen_net
luaopen_os
luaopen_package
luaopen_string
luaopen_sys
luaopen_table
luaopen_utf8
luart_tobuffer
search_task

Sections

.text
Size: 304KB - Virtual size: 304KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a1a395d3ca198fecf2bbd9d45f4d2434

Headers

DLL Characteristics

File Characteristics

Imports

ole32

comctl32

crypt32

wininet

ws2_32

secur32

dnsapi

iphlpapi

urlmon

sensapi

shlwapi

advapi32

gdi32

kernel32

user32

oleaut32

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

Exports

Exports

Sections

.text Size: 304KB - Virtual size: 304KB

.rdata Size: 46KB - Virtual size: 45KB

.data Size: 1024B - Virtual size: 3KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 13KB - Virtual size: 13KB

.text
Size: 304KB - Virtual size: 304KB

.rdata
Size: 46KB - Virtual size: 45KB

.data
Size: 1024B - Virtual size: 3KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 13KB - Virtual size: 13KB