182399f1c77ff3052f8fbfa6c4e4c350_NeikiAnalytics

Sharing

Copy URL Twitter E-mail

General

Target

182399f1c77ff3052f8fbfa6c4e4c350_NeikiAnalytics
Size

123KB
MD5

182399f1c77ff3052f8fbfa6c4e4c350
SHA1

cb3558975e23a207882493ac083dfd44ffd36b0c
SHA256

227d138c39763fdf76a63933356fe01a42179f7f010bfeed1285bcabe6684bcc
SHA512

e96748c429be1fb08da855974400790eacfd6f95b01c5d91daafd44b3c4c38d48b2d9964423f9c5f31e262725a9226be01a1ed1157ff60fb9b1fd4da6925b39a
SSDEEP

3072:LnfvLcvJe4phO5qiHDBykiLUhfk6f1/F:7jjWgT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
182399f1c77ff3052f8fbfa6c4e4c350_NeikiAnalytics

Files

182399f1c77ff3052f8fbfa6c4e4c350_NeikiAnalytics
.dll windows:6 windows x64 arch:x64

ac06c1e5807120ee867cbb681363996e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

zlib

inflateInit_
deflateInit_
inflateEnd
inflate
deflateEnd
deflate

libexpat

ord18
ord21
ord16
ord52
ord25
ord31

wsock32

ntohl
htonl

advapi32

RegisterEventSourceA
DeregisterEventSource
ReportEventA

kernel32

GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
InitializeSListHead
UnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry
GetLastError
RemoveDirectoryA
LoadLibraryA
IsDebuggerPresent
SetUnhandledExceptionFilter
FreeLibrary
GetProcAddress

vcruntime140

__std_type_info_destroy_list
memcpy
strchr
strstr
memset
__C_specific_handler

api-ms-win-crt-heap-l1-1-0

malloc
realloc
free
calloc

api-ms-win-crt-string-l1-1-0

strspn
strcspn
isspace
strncpy
_stricmp
_strnicmp
_strdup
strcat
strcpy
strcmp
strncat
strncmp
isxdigit
isdigit
strlen

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-stdio-l1-1-0

feof
__stdio_common_vfprintf
fclose
fgets
fopen
__stdio_common_vsprintf
_getcwd
__acrt_iob_func

api-ms-win-crt-filesystem-l1-1-0

_findnext64i32
_findfirst64i32
_stat64i32
_unlink
_chdir
_findclose

api-ms-win-crt-math-l1-1-0

acos
fabs
atan
sin
sqrt
tan
cos
fmod

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-convert-l1-1-0

atof
strtoul

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment
_cexit
_execute_onexit_table
_initialize_onexit_table
_initterm_e
_configure_narrow_argv
_seh_filter_dll
exit
_initterm

Exports

Exports

cln_BlockOGDI
cln_BroadCloseLayers
cln_CheckExtension
cln_CreateClient
cln_DestroyClient
cln_GetAttributesFormat
cln_GetClientIdFromURL
cln_GetDictionary
cln_GetGlobalBound
cln_GetLayerCapabilities
cln_GetNextObject
cln_GetObject
cln_GetObjectIdFromCoord
cln_GetRasterInfo
cln_GetServerProjection
cln_GetTclProc
cln_GetURLList
cln_GetVersion
cln_LoadCache
cln_LoadCapabilities
cln_ReleaseCache
cln_ReleaseLayer
cln_SelectLayer
cln_SelectMask
cln_SelectRegion
cln_SetCompression
cln_SetRegionCaches
cln_SetServerLanguage
cln_SetTclProc
cln_UnBlockOGDI
cln_UnSelectMask
cln_UpdateDictionary
ecs_AddAttributeFormat
ecs_AddRasterInfoCategory
ecs_AddText
ecs_AdjustResult
ecs_Backslash
ecs_CalcObjectMBR
ecs_CalculateCentroid
ecs_CleanUp
ecs_CleanUpObject
ecs_CopyAndCollapse
ecs_CopyObject
ecs_CopyResult
ecs_DistanceMBR
ecs_DistanceObject
ecs_DistanceObjectWithTolerance
ecs_DistanceSegment
ecs_FindElement
ecs_FreeLayer
ecs_FreeObject
ecs_GetDefaultInfo
ecs_GetLayer
ecs_GetPixelFromRGB
ecs_GetRGBFromPixel
ecs_RemoveDir
ecs_ResultInit
ecs_SetError
ecs_SetErrorShouldStop
ecs_SetGeoRegion
ecs_SetGeomArea
ecs_SetGeomAreaRing
ecs_SetGeomImage
ecs_SetGeomImageWithArray
ecs_SetGeomLine
ecs_SetGeomMatrix
ecs_SetGeomMatrixWithArray
ecs_SetGeomPoint
ecs_SetGeomText
ecs_SetLayer
ecs_SetObjAttributeFormat
ecs_SetObjectAttr
ecs_SetObjectId
ecs_SetRasterInfo
ecs_SetReportErrorFunction
ecs_SetSuccess
ecs_SetText
ecs_SetTolerance
ecs_ShouldStopOnError
ecs_SplitList
ecs_SplitURL
ecs_TileClearBuffer
ecs_TileDeleteAllLines
ecs_TileGetLine
ecs_TileInitialize
ecs_begin_ellipsoid_polygon_area
ecs_ellipsoid_polygon_area
ecs_freeSplitURL
ecs_geodesic_distance
ecs_planimetric_polygon_area
svr_BroadCloseLayers
svr_CloseLayer
svr_CreateServer
svr_DestroyServer
svr_GetAttributesFormat
svr_GetDictionary
svr_GetGlobalBound
svr_GetNextObject
svr_GetObject
svr_GetObjectIdFromCoord
svr_GetRasterInfo
svr_GetServerProjection
svr_ReleaseLayer
svr_SelectLayer
svr_SelectRegion
svr_SetRasterConversion
svr_SetServerLanguage
svr_UpdateDictionary
xdr_ecs_Area
xdr_ecs_AreaPrim
xdr_ecs_AttributeFormat
xdr_ecs_Category
xdr_ecs_Compression
xdr_ecs_Coordinate
xdr_ecs_Edge
xdr_ecs_Face
xdr_ecs_Family
xdr_ecs_FeatureRing
xdr_ecs_Geometry
xdr_ecs_Image
xdr_ecs_LayerSelection
xdr_ecs_Line
xdr_ecs_Matrix
xdr_ecs_Node
xdr_ecs_ObjAttribute
xdr_ecs_ObjAttributeFormat
xdr_ecs_Object
xdr_ecs_Point
xdr_ecs_ProxyCreateServer
xdr_ecs_RasterConversion
xdr_ecs_RasterInfo
xdr_ecs_Region
xdr_ecs_Result
xdr_ecs_ResultType
xdr_ecs_ResultUnion
xdr_ecs_Text
xdr_ecs_TopoLevel

Sections

.text
Size: 101KB - Virtual size: 101KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ac06c1e5807120ee867cbb681363996e

Headers

DLL Characteristics

File Characteristics

Imports

zlib

libexpat

wsock32

advapi32

kernel32

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

Exports

Exports

Sections

.text Size: 101KB - Virtual size: 101KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 6KB - Virtual size: 7KB

.pdata Size: 3KB - Virtual size: 3KB

.reloc Size: 512B - Virtual size: 176B

.text
Size: 101KB - Virtual size: 101KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 6KB - Virtual size: 7KB

.pdata
Size: 3KB - Virtual size: 3KB

.reloc
Size: 512B - Virtual size: 176B