d0f81834ae071ebbc693cb605fc65ec0_NeikiAnalytics

Sharing

Copy URL Twitter E-mail

General

Target

d0f81834ae071ebbc693cb605fc65ec0_NeikiAnalytics
Size

529KB
MD5

d0f81834ae071ebbc693cb605fc65ec0
SHA1

b79c5f2715b0c0740629c7c84e4e3819318c3756
SHA256

798b5fee1f50b94161dced53125e98fcfac9a9395d4eca48a1b79dddcda347a1
SHA512

0576632688edaee38d8c34251cfce55f86d709224eb53adb1b8c1ab690fd28609980a1899ec43c6e4daad0773dd0457dd017feafe48d367dc17d78d4c8815f8c
SSDEEP

12288:0M9XbSN6NRZqYztEBZmRpGBuIuSbZbGoCJ:v9XON2TphugzuuIuSbZyoCJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d0f81834ae071ebbc693cb605fc65ec0_NeikiAnalytics

Files

d0f81834ae071ebbc693cb605fc65ec0_NeikiAnalytics
.dll windows:6 windows x64 arch:x64

98b13fd42b209f159f7f9de884d8ca74

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

ws2_32

freeaddrinfo
getaddrinfo
accept
WSAIoctl
socket
setsockopt
recv
ntohs
htons
getsockopt
getsockname
getpeername
connect
bind
WSAGetLastError
WSASetLastError
send
closesocket
gethostname
listen
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAResetEvent
WSASetEvent
WSAWaitForMultipleEvents
ioctlsocket
htonl
__WSAFDIsSet
select
WSAStartup
WSACleanup
recvfrom
sendto
inet_ntop
inet_pton

bcrypt

BCryptGenRandom

libssl-3-x64

SSL_CTX_set_cert_store
SSL_get_current_cipher
SSL_CIPHER_get_name
SSL_pending
SSL_set0_rbio
SSL_set0_wbio
SSL_CTX_set_ciphersuites
SSL_CTX_use_PrivateKey_file
SSL_CTX_use_certificate_file
SSL_CTX_use_certificate_chain_file
SSL_SESSION_free
SSL_set_session
SSL_get1_peer_certificate
SSL_get_peer_cert_chain
SSL_CTX_set_verify
SSL_CTX_use_PrivateKey
SSL_CTX_use_certificate
SSL_CTX_set_default_passwd_cb
SSL_CTX_set_default_passwd_cb_userdata
SSL_CTX_check_private_key
SSL_new
SSL_CTX_set_srp_username
SSL_CTX_get_cert_store
SSL_free
SSL_connect
SSL_read
SSL_write
SSL_ctrl
SSL_CTX_ctrl
SSL_get_error
SSL_get_version
TLS_client_method
SSL_shutdown
SSL_CTX_set_post_handshake_auth
SSL_alert_desc_string_long
SSL_CTX_add_client_CA
SSL_set_connect_state
SSL_get_certificate
SSL_get_privatekey
SSL_get_shutdown
SSL_get_verify_result
SSL_get0_verified_chain
SSL_set_ex_data
SSL_get_ex_data
OPENSSL_init_ssl
SSL_CTX_set_srp_password
SSL_CTX_set_options
SSL_CTX_set_msg_callback
SSL_CTX_sess_set_new_cb
SSL_CTX_set_alpn_protos
SSL_CTX_new
SSL_CTX_set_cipher_list
SSL_get0_group_name
SSL_get_peer_signature_type_nid
SSL_CTX_set_keylog_callback
SSL_get0_alpn_selected
SSL_CTX_free

libcrypto-3-x64

X509V3_EXT_print
X509_check_issued
ERR_get_error
ERR_peek_error
ERR_peek_last_error
ERR_clear_error
ERR_error_string_n
PKCS12_free
BIO_meth_new
PKCS12_parse
d2i_PKCS12_bio
OCSP_cert_to_id
OCSP_response_status
OCSP_response_get1_basic
OCSP_resp_find_status
OCSP_check_validity
OCSP_BASICRESP_free
OCSP_RESPONSE_free
d2i_OCSP_RESPONSE
OCSP_CERTID_free
OCSP_response_status_str
OCSP_cert_status_str
OCSP_crl_reason_str
OCSP_basic_verify
UI_get0_user_data
GENERAL_NAMES_free
UI_create_method
UI_destroy_method
UI_method_set_opener
UI_method_set_writer
UI_method_set_reader
UI_method_set_closer
UI_method_get_opener
UI_method_get_writer
UI_method_get_reader
UI_method_get_closer
UI_get_string_type
UI_get_input_flags
UI_set_result
ENGINE_get_first
ENGINE_get_next
ENGINE_by_id
X509_get_pubkey
ENGINE_ctrl_cmd
ENGINE_free
ENGINE_get_id
ENGINE_init
ENGINE_finish
ENGINE_load_private_key
ENGINE_set_default
X509_get0_pubkey
RAND_status
UI_OpenSSL
X509_get0_extensions
X509_get_X509_PUBKEY
X509_get0_notAfter
X509_get0_notBefore
BIO_printf
BIO_new_mem_buf
BIO_s_mem
BIO_ctrl
BIO_puts
BIO_up_ref
BIO_get_shutdown
BIO_set_shutdown
BIO_set_init
BIO_get_data
PEM_read_bio_PrivateKey
BIO_free
BIO_new
BIO_s_file
BIO_clear_flags
BIO_set_flags
CRYPTO_free
CRYPTO_malloc
OpenSSL_version
OPENSSL_sk_pop
OPENSSL_sk_pop_free
OPENSSL_sk_value
OPENSSL_sk_num
EVP_sha256
MD5_Final
MD5_Update
MD5_Init
EVP_sha512_256
EVP_DigestFinal_ex
EVP_DigestUpdate
EVP_DigestInit_ex
EVP_MD_CTX_free
EVP_MD_CTX_new
DES_set_key_unchecked
DES_set_odd_parity
DES_ecb_encrypt
RAND_bytes
X509_get_subject_name
PEM_read_bio_X509_AUX
X509_get_issuer_name
PEM_write_bio_X509
PEM_read_bio_X509
X509_get_serialNumber
X509_get_version
X509_INFO_free
X509_get0_signature
d2i_X509
PEM_X509_INFO_read_bio
X509_free
i2d_X509_PUBKEY
X509_ALGOR_get0
d2i_PrivateKey_bio
d2i_X509_bio
X509_verify_cert_error_string
X509_STORE_load_path
X509_STORE_load_file
X509_load_crl_file
X509_STORE_add_crl
X509_STORE_add_cert
X509_LOOKUP_file
X509_STORE_add_lookup
X509_STORE_set_flags
X509_STORE_up_ref
X509_STORE_free
RSA_flags
RSA_free
EVP_PKEY_get_group_name
EVP_PKEY_get_bn_param
X509_PUBKEY_get0_param
EVP_PKEY_get0_type_name
X509_EXTENSION_get_data
EVP_PKEY_copy_parameters
EVP_PKEY_free
EVP_PKEY_get1_RSA
EVP_PKEY_get_security_bits
X509_EXTENSION_get_object
X509_get_ext_d2i
EVP_PKEY_get_bits
EVP_PKEY_get_id
EVP_sha1
EVP_DigestInit
OBJ_obj2txt
OBJ_nid2sn
ASN1_STRING_print
X509_NAME_ENTRY_get_data
ASN1_TIME_print
ASN1_STRING_to_UTF8
i2t_ASN1_OBJECT
i2a_ASN1_OBJECT
X509_NAME_get_entry
ASN1_STRING_get0_data
ASN1_STRING_type
X509_NAME_get_index_by_NID
BIO_set_data
ASN1_STRING_length
X509_NAME_print_ex
BN_print
BN_clear_free
BN_num_bits
BIO_meth_set_destroy
BIO_meth_set_create
BIO_meth_set_ctrl
BIO_meth_set_read
BIO_meth_set_write
ENGINE_ctrl
BIO_meth_free
PKCS12_PBE_add

zlib

inflateInit2_
inflate
zlibVersion
inflateInit_
inflateEnd

wldap32

ord217
ord46
ord211
ord60
ord50
ord41
ord22
ord26
ord27
ord32
ord33
ord35
ord79
ord30
ord200
ord301
ord143

advapi32

CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash

crypt32

CertOpenSystemStoreA
CertCloseStore
CertEnumCertificatesInStore
CertFreeCertificateContext
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage

kernel32

CloseHandle
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
SetEvent
WaitForSingleObject
CreateEventA
MultiByteToWideChar
SleepEx
WaitForSingleObjectEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetEnvironmentVariableA
Sleep
MoveFileExA
GetCurrentProcessId
GetLastError
SetLastError
FormatMessageW
QueryPerformanceFrequency
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetCurrentThreadId
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetSystemDirectoryA
FreeLibrary
GetModuleHandleA
GetProcAddress
LoadLibraryA
GetStdHandle
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
QueryPerformanceCounter
GetTickCount
VerSetConditionMask
VerifyVersionInfoW
GetSystemTimeAsFileTime
CompareFileTime

vcruntime140

memcpy
memset
strchr
memmove
strrchr
memchr
memcmp
strstr
__C_specific_handler
__std_type_info_destroy_list

api-ms-win-crt-string-l1-1-0

strncmp
_strdup
strspn
strcmp
strcspn
strpbrk

api-ms-win-crt-stdio-l1-1-0

setvbuf
__stdio_common_vsscanf
fputs
fclose
fflush
_lseeki64
__stdio_common_vsprintf
fputc
fseek
_open
_close
__stdio_common_vswprintf
_fileno
_read
_write
__acrt_iob_func
ftell
feof
fgets
_fseeki64
fread
fopen
fwrite

api-ms-win-crt-convert-l1-1-0

strtoll
wcstombs
atoi
strtol
strtoul

api-ms-win-crt-time-l1-1-0

_time64
strftime
_gmtime64

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment
_errno
_cexit
_execute_onexit_table
__sys_errlist
__sys_nerr
_initialize_onexit_table
_beginthreadex
_configure_narrow_argv
_seh_filter_dll
_initterm
_initterm_e

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-filesystem-l1-1-0

_unlink
_access
_fstat64
_stat64

api-ms-win-crt-heap-l1-1-0

calloc
realloc
malloc
free

api-ms-win-crt-multibyte-l1-1-0

_mbspbrk

api-ms-win-crt-math-l1-1-0

_fdopen

Exports

Exports

curl_easy_cleanup
curl_easy_duphandle
curl_easy_escape
curl_easy_getinfo
curl_easy_header
curl_easy_init
curl_easy_nextheader
curl_easy_option_by_id
curl_easy_option_by_name
curl_easy_option_next
curl_easy_pause
curl_easy_perform
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_easy_upkeep
curl_escape
curl_formadd
curl_formfree
curl_formget
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_global_init_mem
curl_global_sslset
curl_global_trace
curl_maprintf
curl_mfprintf
curl_mime_addpart
curl_mime_data
curl_mime_data_cb
curl_mime_encoder
curl_mime_filedata
curl_mime_filename
curl_mime_free
curl_mime_headers
curl_mime_init
curl_mime_name
curl_mime_subparts
curl_mime_type
curl_mprintf
curl_msnprintf
curl_msprintf
curl_multi_add_handle
curl_multi_assign
curl_multi_cleanup
curl_multi_fdset
curl_multi_get_handles
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_poll
curl_multi_remove_handle
curl_multi_setopt
curl_multi_socket
curl_multi_socket_action
curl_multi_socket_all
curl_multi_strerror
curl_multi_timeout
curl_multi_wait
curl_multi_wakeup
curl_mvaprintf
curl_mvfprintf
curl_mvprintf
curl_mvsnprintf
curl_mvsprintf
curl_pushheader_byname
curl_pushheader_bynum
curl_share_cleanup
curl_share_init
curl_share_setopt
curl_share_strerror
curl_slist_append
curl_slist_free_all
curl_strequal
curl_strnequal
curl_unescape
curl_url
curl_url_cleanup
curl_url_dup
curl_url_get
curl_url_set
curl_url_strerror
curl_version
curl_version_info
curl_ws_meta
curl_ws_recv
curl_ws_send

Sections

.text
Size: 389KB - Virtual size: 388KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 104KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

98b13fd42b209f159f7f9de884d8ca74

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

bcrypt

libssl-3-x64

libcrypto-3-x64

zlib

wldap32

advapi32

crypt32

kernel32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-math-l1-1-0

Exports

Exports

Sections

.text Size: 389KB - Virtual size: 388KB

.rdata Size: 104KB - Virtual size: 104KB

.data Size: 10KB - Virtual size: 11KB

.pdata Size: 21KB - Virtual size: 20KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 389KB - Virtual size: 388KB

.rdata
Size: 104KB - Virtual size: 104KB

.data
Size: 10KB - Virtual size: 11KB

.pdata
Size: 21KB - Virtual size: 20KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 2KB