cf074b7d7e9d7698bb680794abdb4070_NeikiAnalytics

Sharing

Copy URL Twitter E-mail

General

Target

cf074b7d7e9d7698bb680794abdb4070_NeikiAnalytics
Size

663KB
MD5

cf074b7d7e9d7698bb680794abdb4070
SHA1

a7fa49ce3eec2ea6a4d8d4c2893db306acb334dc
SHA256

56a7a2ec1aaadd795d6fc197eca60abc9ad3d9a716532ab91cdb94a0239aedfb
SHA512

1ec5b115764a78f25bff2cdd235679640cf21f37c803b9067b8ca1aa6af4256629dadbd1931aed75c3d4084ee06d970944cc118ce9de9f0e3bbe13e12b39bed7
SSDEEP

6144:H1IKPsU1HnPnLOyY5vRdpmhp5JD2CthSN6SZVMXeT0EI77zkIC:HoXWhpbDFhsXZM7zk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cf074b7d7e9d7698bb680794abdb4070_NeikiAnalytics

Files

cf074b7d7e9d7698bb680794abdb4070_NeikiAnalytics
.dll regsvr32 windows:4 windows x86 arch:x86

984fcc5018d595ab639db118c0a43058

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

t:\designer\x86\ship\0\modhelp.pdb

Imports

mso

ord6818
ord6816
ord7897
ord1284
ord866
ord6873
ord2520
ord3062
ord1916
ord322
ord6243
ord1290
ord3054
ord395
ord3090
ord6821
ord6872
ord864
ord2814
ord929
ord652
ord6888
ord1314
ord3057
ord3087
ord295
ord6877
ord1799
ord815

kernel32

GetTempPathA
HeapFree
HeapAlloc
LoadLibraryW
InterlockedExchange
Sleep
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetProcessHeap
GetLocaleInfoA
GetThreadLocale
GetVersionExA
GetTempFileNameA
MultiByteToWideChar
WideCharToMultiByte
CreateProcessA
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetLastError
lstrlenA
lstrcmpiA
DisableThreadLibraryCalls
GetModuleFileNameA
IsDBCSLeadByte
FreeLibrary
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
GetModuleHandleA
GetFileAttributesA
GetUserDefaultLCID
GetSystemDefaultLCID
FormatMessageA
CloseHandle
GetModuleHandleW
GetProcAddress
VirtualProtect
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
lstrlenW
GetACP

advapi32

RegOpenKeyExW
RegQueryValueExA
RegEnumKeyExA
RegQueryInfoKeyA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
RegQueryValueExW

user32

IsWindow
GetActiveWindow
LoadStringA
CharNextA
UnregisterClassA
MessageBoxA
GetDesktopWindow

oleaut32

LoadTypeLi
SysFreeString
SysAllocStringLen
LoadRegTypeLi
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
SysAllocString
SysStringLen

ole32

CoTaskMemRealloc
CoTaskMemFree
StringFromCLSID
StringFromGUID2
CoCreateInstance
CoTaskMemAlloc

shell32

ShellExecuteA

msvcr80

strncpy_s
strcat_s
_resetstkoflw
__CxxFrameHandler3
_recalloc
memset
strstr
wcsncpy_s
_splitpath_s
_strlwr_s
sprintf_s
wcsrchr
vswprintf_s
wcscpy_s
fclose
fwprintf_s
fopen_s
_encode_pointer
_malloc_crt
_encoded_null
_decode_pointer
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
?terminate@@YAXXZ
_except_handler4_common
_unlock
__dllonexit
_lock
_onexit
_crt_debugger_hook
__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QAEXXZ
strcpy_s
_CxxThrowException
memcpy_s
free
malloc
vsprintf_s

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
VSDllRegisterServer
VSDllUnregisterServer

Sections

.text
Size: 434KB - Virtual size: 433KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 224KB - Virtual size: 228KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

984fcc5018d595ab639db118c0a43058

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mso

kernel32

advapi32

user32

oleaut32

ole32

shell32

msvcr80

Exports

Exports

Sections

.text Size: 434KB - Virtual size: 433KB

.data Size: 2KB - Virtual size: 3KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 224KB - Virtual size: 228KB

.text
Size: 434KB - Virtual size: 433KB

.data
Size: 2KB - Virtual size: 3KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 224KB - Virtual size: 228KB