3ff3b05dfdd94bc3c4f82c3610846580_NeikiAnalytics

Sharing

Copy URL Twitter E-mail

General

Target

3ff3b05dfdd94bc3c4f82c3610846580_NeikiAnalytics
Size

440KB
MD5

3ff3b05dfdd94bc3c4f82c3610846580
SHA1

b27d2098460434479894f740e5465ad4ae193af2
SHA256

a5b357f5a5895b2aa718af3f173b3c1e02b9bf42af3a8a1ac59cb02e9b0d05cc
SHA512

ac80abe28aa1c12aa8e148663ce91684c7ddb577f12a0daad876d754a3fdb83b0c7edb379486b12c85994d88049a907b440c37e1eddfe5c3d6af8f776eb7c769
SSDEEP

6144:wYRmVZj2OnWZMk8BkrIf+f6RQmrEhutq7hoJ7Aj4n1XeWfqaU:wYQXon3IWf1mrEhTSAj4El

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3ff3b05dfdd94bc3c4f82c3610846580_NeikiAnalytics

Files

3ff3b05dfdd94bc3c4f82c3610846580_NeikiAnalytics
.dll windows:4 windows x86 arch:x86

64fa4dd3e5128fe8c7b4c428466e6545

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

xp_h265

ord3
ord4
ord1

kernel32

GetSystemTimeAsFileTime
Sleep
GetCurrentProcessId
GetCurrentThreadId
GetLastError
CreateDirectoryA
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
InterlockedIncrement
InterlockedDecrement
CreateFileA
ReadFile
WriteFile
CloseHandle
FreeLibrary
GetProcAddress
LoadLibraryA
GetModuleHandleA
MoveFileExA
QueryPerformanceCounter
QueryPerformanceFrequency
TerminateThread
WaitForSingleObject
FindFirstFileA
OutputDebugStringA
GetDiskFreeSpaceExA
GetLocalTime
GetTickCount
GetModuleFileNameA
SetEvent
CreateEventW
LoadLibraryExA
HeapFree
HeapAlloc
SetThreadPriority
HeapDestroy
CreateThread
HeapCreate
ResetEvent
HeapReAlloc

user32

GetClientRect
IntersectRect
ClientToScreen
InvalidateRect
MonitorFromWindow
GetMonitorInfoA
IsWindowVisible

msvcrt

fopen
ftell
remove
rename
getenv
_errno
fwrite
fread
fseek
malloc
free
memcmp
memcpy
memmove
_strnicmp
strncat
strncmp
strcmp
strncpy
strtok
_stat
time
mktime
atoi
rand
_beginthreadex
printf
cos
sin
pow
floor
abs
ceil
fabs
sqrt
_fcvt
toupper
strspn
strcspn
_itoa
strcpy
log
__dllonexit
_onexit
??1type_info@@UAE@XZ
_except_handler3
?terminate@@YAXXZ
_initterm
_adjust_fdiv
_strdate
_vsnprintf
fprintf
fflush
fclose
memset
_snprintf
_ftol
_purecall
__RTDynamicCast
??2@YAPAXI@Z
??3@YAXPAX@Z
__CxxFrameHandler
strlen
_mkdir
_putenv
_strtime
realloc

ws2_32

bind
socket
ioctlsocket
WSAGetLastError
WSAStartup
getsockname
getsockopt
ntohs
htons
ntohl
htonl
connect
__WSAFDIsSet
select
inet_ntoa
inet_addr
getpeername
setsockopt
closesocket
sendto
recvfrom
send
recv
accept
listen

dsp_audio_g711

G711Encoder
G711Decoder

dsp_video_h264

h264_global_init
dec_h264_main
dec_h264_destroy
dec_h264_init
h264_global_free

dsp_video_mjpeg

DSP_JpegEncode
DSP_JpegEncInit
DSP_JpegEncDestroy

winmm

waveOutClose
waveOutReset
timeEndPeriod
timeBeginPeriod
timeGetDevCaps
timeGetTime
waveOutOpen
waveOutUnprepareHeader
waveOutPrepareHeader
waveOutWrite
waveInStop
waveInReset
waveInClose
waveOutGetNumDevs
waveInGetNumDevs
waveOutSetVolume
waveOutGetVolume
mixerClose
mixerGetLineControlsA
mixerGetLineInfoA
mixerGetDevCapsA
mixerOpen
mixerSetControlDetails
mixerGetControlDetailsA
waveInUnprepareHeader
waveInStart
waveInAddBuffer
waveInPrepareHeader
waveInOpen

ddraw

DirectDrawCreateEx
DirectDrawEnumerateExA

msvcp60

??9std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??8std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??Mstd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z

Exports

Exports

UWARE_XP_AdjustPktSeq
UWARE_XP_CleanPlayPorts
UWARE_XP_Cleanup
UWARE_XP_CloseNetStream
UWARE_XP_CloseVoiceSvc
UWARE_XP_FreeChannelPort
UWARE_XP_GetBitRate
UWARE_XP_GetChannelPort
UWARE_XP_GetDigitalZoomStatus
UWARE_XP_GetInitCount
UWARE_XP_GetLocalIP
UWARE_XP_GetLocalNetPort
UWARE_XP_GetLostPacketRate
UWARE_XP_GetMicVolume
UWARE_XP_GetPlayedTime
UWARE_XP_GetQuietStatus
UWARE_XP_GetRecordStatus
UWARE_XP_GetRenderScale
UWARE_XP_GetVideoAdjust
UWARE_XP_GetVolume
UWARE_XP_Init
UWARE_XP_OpenNetStream
UWARE_XP_OpenVoiceSvc
UWARE_XP_PausePlay
UWARE_XP_PlaySound
UWARE_XP_ResetLostPacketRate
UWARE_XP_ResumePlay
UWARE_XP_SendVoiceData
UWARE_XP_SetDigitalZoom
UWARE_XP_SetDisplayDataCB
UWARE_XP_SetMaxRecordSize
UWARE_XP_SetMicVolume
UWARE_XP_SetNatParam
UWARE_XP_SetPayloadType
UWARE_XP_SetPictureFluency
UWARE_XP_SetPlayWnd
UWARE_XP_SetPlayedTime
UWARE_XP_SetPlayerRunMsgCB
UWARE_XP_SetRenderScale
UWARE_XP_SetVideoAdjust
UWARE_XP_SetVoiceEncodeType
UWARE_XP_SetVolume
UWARE_XP_SetWriteLogCB
UWARE_XP_SnatchOnce
UWARE_XP_StartIndependTimer
UWARE_XP_StartPlay
UWARE_XP_StartRecord
UWARE_XP_StartVoiceSvc
UWARE_XP_StopIndependTimer
UWARE_XP_StopPlay
UWARE_XP_StopRecord
UWARE_XP_StopSound
UWARE_XP_StopVoiceSvc
_UWARE_XP_GetFrameRate@8
_UWARE_XP_GetPicSize@12
_UWARE_XP_ReleaseLocalNetPort@4

Sections

.text
Size: 292KB - Virtual size: 290KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 64KB - Virtual size: 144KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

64fa4dd3e5128fe8c7b4c428466e6545

Headers

File Characteristics

Imports

xp_h265

kernel32

user32

msvcrt

ws2_32

dsp_audio_g711

dsp_video_h264

dsp_video_mjpeg

winmm

ddraw

msvcp60

Exports

Exports

Sections

.text Size: 292KB - Virtual size: 290KB

.rdata Size: 52KB - Virtual size: 51KB

.data Size: 64KB - Virtual size: 144KB

.reloc Size: 28KB - Virtual size: 24KB

.text
Size: 292KB - Virtual size: 290KB

.rdata
Size: 52KB - Virtual size: 51KB

.data
Size: 64KB - Virtual size: 144KB

.reloc
Size: 28KB - Virtual size: 24KB