4a448fff2b784963a671508424fa2fb0_NeikiAnalytics

Sharing

Copy URL Twitter E-mail

General

Target

4a448fff2b784963a671508424fa2fb0_NeikiAnalytics
Size

317KB
MD5

4a448fff2b784963a671508424fa2fb0
SHA1

86c984de04f6f56f19414a909f553f50a774cec6
SHA256

0fdb890d22fda3863c2436883193ee79cb81d1b1aead28c4d3fecc89e1b259d1
SHA512

e641f4c16ffeece2179034545a226b1754018cc72962f81e88bb04fac29faeee65565d14508472613aa954f2a343a4ca7123e6a68398062d314cbd9235992164
SSDEEP

6144:ItXbsJEZK+vYzI270o53JGnNlxqx6Z3Pc:wXbsJ+YUO0oFJWnWZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4a448fff2b784963a671508424fa2fb0_NeikiAnalytics

Files

4a448fff2b784963a671508424fa2fb0_NeikiAnalytics
.exe windows:4 windows x86 arch:x86

16f79b4dc07b112ac07e2a6b3c7f6555

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

oran9

ztvulp
ztvulc
ztcrseed3
ztcrnumber
ztcrfini
ztucbtx
ztvovg
ztucxtb
ztchi
ztchn
ztchf
ztch

orannzsbb9

nzos_Read
SSLServiceWriteQueue
nzos_Initialize
nzos_Create_Ctx
nzos_Configure
nzos_OToolkitContext
nzos_OpenWallet
nzos_RetrievePersonaCopy
nzosSetCredential
nzos_Handshake
nzosGetPeerCredential
nzosDestroyCredential
nztwCloseWallet
nzos_Close
nzos_Destroy_Ctx
nzos_Deinitialize
nzos_Write

oranl9

nluicrt
nlstdgg

oranls9

lxlterm
lxlinit
lxinitc
lmsaicmt
lmsacin
lmsacbn
lxgcnv
lxhlinfo
lxhlmod
lxhLangEnv
lxhLaToId
lxhclrsave
lxmxdix
lxoCnvNumStrToInt
lxmbteqx
lxoCpChar
lxmspax
lmsatrm
lxmgrax
lxmalpx
lxmdigx
lmsagbf
lxmctex
lxoSchPat
lxsCmpStr
lxsCatStr
lxscat
lxsCnvCase
lxsCpStr
lxscop
lxmfwdx
lxmopen
lxmcpen
lxoCpStr
lxoWriChar
lxsulen
lxoCpToOp
lxmalnx
lxoCvChar
lxmpunx

oracore9

lfiabt
ldxsto
lfifex
lsfp
lfipthad
lfimkpth
slzgetevar
lmmmalloc
lmmcalloc
lmmrealloc
lmmfree
sldxgd
lmtrand
slmaacb
lstprintf
lpmsavecompctx
lsfini
lpmloadpkg
lrmini
sltsini
ldxbegin
sltsmxi
lmmtophp
lpmmkpri
sltsimr
lfifpo
lpminit
sltsima
sltsmxd
lrmtrm
ldxend
lsfdl
lsfcln
sltmgcs
slzsetevar
sltstspawn
lstclo
sltspcdestroy
sltspcinit
sltspcwait
sltspcbroadcast
sltspcsignal
sltstcl
sltstkill
sltstgh
sltsthndinit
lstmup
lstmclo
ldxdts
ldxstd
ldxsti
lnxsni
lnxmul
lnxmin
ldxdyf
ldxdtd
ldxads
ldxftd
lnxdiv
lsfdi
lsfpd
sltsmna
lfiflu
sltsmnr
lfitell
lsfpv
lfiskb
lfiwr
lfird
lfimknam
lfilini
lfiopn
lficls
lfifno
lpmgetcompctx
lsfdrm
lpmdelete

kernel32

CreateFileA
TlsGetValue
ReadFile
PeekNamedPipe
WriteFile
GetCurrentProcess
DuplicateHandle
GetOverlappedResult
SetEvent
SetNamedPipeHandleState
DisconnectNamedPipe
GetLastError
ConnectNamedPipe
CreateNamedPipeA
GetVersionExA
LoadLibraryA
GetProcAddress
FreeLibrary
TerminateProcess
Sleep
GlobalMemoryStatus
OpenProcess
VirtualQueryEx
CloseHandle
TlsAlloc
TlsFree
TlsSetValue
CreateEventA

msvcrt

exit
fprintf
_iob
_setjmp3
time
strftime
gmtime
localtime
mktime
atoi
_onexit
__dllonexit
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__p___initenv
_XcptFilter
_exit
raise
_getpid
perror
_errno
sprintf
longjmp
memchr
strncmp
calloc
qsort
memmove
free
strncpy

wsock32

gethostname
WSACleanup
WSAStartup
htonl
WSAGetLastError
recv
send
setsockopt
ntohl
connect
getpeername
gethostbyaddr
WSASetLastError
select
__WSAFDIsSet
inet_ntoa
ioctlsocket
gethostbyname
socket
htons
bind
listen
accept
inet_addr
closesocket

orancrypt9

ztceenc

Exports

Exports

ber_free
ldap_abandon
ldap_abandon_ext
ldap_add
ldap_add_ext
ldap_add_ext_s
ldap_add_s
ldap_bind
ldap_bind_s
ldap_compare
ldap_compare_ext
ldap_compare_ext_s
ldap_compare_s
ldap_control_free
ldap_controls_free
ldap_count_entries
ldap_count_messages
ldap_count_references
ldap_count_values
ldap_count_values_len
ldap_delete
ldap_delete_ext
ldap_delete_ext_s
ldap_delete_s
ldap_dn2ufn
ldap_err2string
ldap_explode_dn
ldap_explode_dns
ldap_explode_rdn
ldap_first_attribute
ldap_first_entry
ldap_first_message
ldap_first_reference
ldap_free_urldesc
ldap_get_dn
ldap_get_entry_controls
ldap_get_lderrno
ldap_get_option
ldap_get_values
ldap_get_values_len
ldap_getfilter_free
ldap_init
ldap_init_SSL
ldap_is_ldap_url
ldap_memfree
ldap_modify
ldap_modify_ext
ldap_modify_ext_s
ldap_modify_s
ldap_modrdn
ldap_modrdn2
ldap_modrdn2_s
ldap_modrdn_s
ldap_mods_free
ldap_msgdelete
ldap_msgfree
ldap_msgid
ldap_msgtype
ldap_native_bind_s
ldap_next_attribute
ldap_next_entry
ldap_next_message
ldap_next_reference
ldap_open
ldap_parse_sasl_bind_result
ldap_perror
ldap_rename
ldap_rename_s
ldap_replic_bind
ldap_replic_bind_s
ldap_result
ldap_result2error
ldap_sasl_bind
ldap_sasl_bind_s
ldap_search
ldap_search_ext
ldap_search_ext_s
ldap_search_s
ldap_search_st
ldap_set_lderrno
ldap_set_option
ldap_set_rebind_proc
ldap_simple_bind
ldap_simple_bind_s
ldap_sort_entries
ldap_unbind
ldap_unbind_s
ldap_url_parse
ldap_url_search
ldap_url_search_s
ldap_url_search_st
ldap_value_free
ldap_value_free_len
ora_ldap_initbr
ora_ldap_normalize_dn
ora_ldap_normalize_dn_with_case

Sections

.text
Size: 108KB - Virtual size: 105KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

16f79b4dc07b112ac07e2a6b3c7f6555

Headers

File Characteristics

Imports

oran9

orannzsbb9

oranl9

oranls9

oracore9

kernel32

msvcrt

wsock32

orancrypt9

Exports

Exports

Sections

.text Size: 108KB - Virtual size: 105KB

.rdata Size: 12KB - Virtual size: 10KB

.data Size: 20KB - Virtual size: 18KB

.text
Size: 108KB - Virtual size: 105KB

.rdata
Size: 12KB - Virtual size: 10KB

.data
Size: 20KB - Virtual size: 18KB