065641599a0a9a9a42fb9017e6466d20_NeikiAnalytics

General

Target

065641599a0a9a9a42fb9017e6466d20_NeikiAnalytics
Size

61KB
MD5

065641599a0a9a9a42fb9017e6466d20
SHA1

93542f28e69247ebbde06417a5921c80ec4c2dcc
SHA256

793a79eca18cc8c66710865373799dd0a7d2750ffa3ddbc5233977cd45c991bb
SHA512

680a9db33f5445b8c4538c242ad756a9957bebbdfe6aad16037577305a08bac9a6da510c24c027b3ab5828f16dcd4e3871ce996ea37124ebb69efdd809191d12
SSDEEP

1536:6vsHE+/EmjOgDjJpjyBW+WrpwjWhs+sWoR9lZxlUSBp9NhJ113kpNJTi0ofoFZRu:6vsHt8mjOgDjJpjyBW+Wrp+Whs+sWoRv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
065641599a0a9a9a42fb9017e6466d20_NeikiAnalytics

Files

065641599a0a9a9a42fb9017e6466d20_NeikiAnalytics
.dll windows:4 windows x86 arch:x86

c225a458f7b6509294a7fc0d5e4a4a1f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\dev\servermain\Steam\src\drm_rel_nov09\release\survey.pdb

Imports

rpcrt4

UuidCreate

kernel32

LoadResource
FindResourceW
GetLastError
HeapAlloc
GetProcessHeap
HeapFree
lstrcmpiA
GetProcAddress
GetModuleHandleA
CloseHandle
LocalFree
GetFileInformationByHandle
CreateFileW
FindClose
FindNextFileW
FindFirstFileW
lstrcpyW
lstrcmpiW
SizeofResource
lstrlenW
LockResource
GetSystemDirectoryW
GetWindowsDirectoryW
SetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
DeleteCriticalSection
DebugBreak
GetVolumePathNameW

version

VerQueryValueW

advapi32

RegOpenKeyExW
GetSecurityInfo
ConvertStringSidToSidA
GetAce
RegCreateKeyExW
RegSetValueW
RegCloseKey
RegQueryValueExW
GetAclInformation
EqualSid

ole32

StringFromGUID2

Exports

Exports

_runfunc@20

Sections

.text
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 240B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 732B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c225a458f7b6509294a7fc0d5e4a4a1f

Headers

File Characteristics

PDB Paths

Imports

rpcrt4

kernel32

version

advapi32

ole32

Exports

Exports

Sections

.text Size: 42KB - Virtual size: 41KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 512B - Virtual size: 240B

.rsrc Size: 1024B - Virtual size: 732B

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 42KB - Virtual size: 41KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 512B - Virtual size: 240B

.rsrc
Size: 1024B - Virtual size: 732B

.reloc
Size: 8KB - Virtual size: 8KB