d22e9025595f91ca0d9cb1d7197ea640_NeikiAnalytics

Sharing

Copy URL Twitter E-mail

General

Target

d22e9025595f91ca0d9cb1d7197ea640_NeikiAnalytics
Size

2.8MB
MD5

d22e9025595f91ca0d9cb1d7197ea640
SHA1

d6452d0f0f0bd8cd502fbc8c8cccdc4e5f6dd20f
SHA256

86a7a64ef7697848564c199d9f422288955e462a28ad58878001720ae89079a2
SHA512

3b6036da237bcd5814a4f6b4dcbca184b53e6f9e86c876d65dea3493dec9485a50c2040771c4544a7adbef6855aaf940438ddf9bf8e12e5aa4eaa0a4b89e298b
SSDEEP

24576:nRGOsTihJfAzgRznLfcW14PFUo94RkKgmUSyOJj9ZpZ2FnP1KOLwW:RdqeA0RziNXKRU2tj9ZrW9KTW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d22e9025595f91ca0d9cb1d7197ea640_NeikiAnalytics

Files

d22e9025595f91ca0d9cb1d7197ea640_NeikiAnalytics
.dll windows:6 windows x64 arch:x64

5a750268a82ddf45b7b110485bf4b0a8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

iertutil.pdb

Imports

msvcrt

iswascii
iswalpha
iswcntrl
wcschr
??0exception@@QEAA@XZ
_wcsicmp
isalpha
iswalnum
iswxdigit
_snwprintf_s
wcstoul
wcsncpy_s
memmove_s
wcsncmp
iswdigit
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBD@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
strstr
wcsnlen
swprintf_s
strncmp
wcstok_s
wcsstr
_strlwr
memset
wcscspn
_vsnwprintf
iswpunct
wcstod
iswspace
wcsncat_s
memcmp
memcpy
__CxxFrameHandler3
_onexit
__dllonexit
_unlock
_lock
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
_itow_s
wcscpy_s
malloc
_wtoi
_wtoi64
isxdigit
realloc
isspace
strncat
free
wcsrchr
_wcslwr
memmove
memcpy_s
wcstol
_wcsnicmp
_CxxThrowException
bsearch
??1type_info@@UEAA@XZ
wcscmp

ntdll

RtlAllocateHeap
NtClose
NtCreateFile
RtlFreeHeap
NtDeviceIoControlFile
RtlIpv4StringToAddressExW
RtlIpv6StringToAddressExW
RtlIpv4AddressToStringExW
RtlIpv6AddressToStringExW
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
VerSetConditionMask

kernel32

FindClose
VirtualProtect
LoadLibraryExA
GetSystemInfo
GetLocaleInfoEx
VerifyScripts
GetUserDefaultLocaleName
LoadLibraryA
IsDBCSLeadByteEx
CompareStringOrdinal
LocalReAlloc
VirtualQuery
UnregisterWaitEx
ReleaseMutex
GetShortPathNameW
FindFirstFileExW
GetStringScripts
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
LoadLibraryExW
FreeLibrary
GetProcAddress
GetModuleHandleExW
VerifyVersionInfoW
CloseHandle
GetWindowsDirectoryW
GlobalMemoryStatusEx
GetCurrentProcessId
GetCurrentProcess
TlsGetValue
TlsSetValue
UnmapViewOfFile
MapViewOfFileEx
GetLastError
GetModuleHandleW
SetLastError
TlsAlloc
DisableThreadLibraryCalls
InitializeCriticalSectionAndSpinCount
ClosePrivateNamespace
TlsFree
HeapAlloc
GetProcessHeap
HeapFree
GetCurrentThreadId
GetTickCount
RaiseException
GetSystemTimeAsFileTime
LocalFree
HeapReAlloc
lstrlenW
lstrlenA
OpenProcess
CreateFileW
GetCurrentThread
GetModuleFileNameW
DeleteProcThreadAttributeList
CreateProcessW
UpdateProcThreadAttribute
LoadLibraryW
InitializeProcThreadAttributeList
GetVersionExA
OpenEventW
WaitForSingleObject
IsWow64Process
MapViewOfFile
CreateFileMappingW
OpenFileMappingW
CreateMutexW
OpenMutexW
DuplicateHandle
lstrcmpA
WideCharToMultiByte
CompareStringW
MultiByteToWideChar
GetEnvironmentVariableW
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
TerminateThread
RegisterWaitForSingleObject
AssignProcessToJobObject
FindNextFileW
GetSystemDirectoryW
lstrcmpW
ExpandEnvironmentStringsW
CompareFileTime
GetVersionExW
TrySubmitThreadpoolCallback
InitializeSRWLock
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
QueryPerformanceFrequency
GlobalAlloc
GetStringTypeExW
GlobalFree
GlobalReAlloc
EncodePointer
DecodePointer
CreateBoundaryDescriptorW
AddSIDToBoundaryDescriptor
OpenPrivateNamespaceW
CreatePrivateNamespaceW
DeleteBoundaryDescriptor
IsProcessInJob
CreateJobObjectW
SetInformationJobObject
CreateThread
CreateEventW
LocalAlloc
UnregisterWait
ResumeThread
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
SetEvent

api-ms-win-downlevel-version-l1-1-0

VerQueryValueW
GetFileVersionInfoExW
GetFileVersionInfoSizeExW

api-ms-win-downlevel-advapi32-l1-1-0

RegDeleteValueW
AddAccessAllowedAceEx
DeleteAce
GetSidIdentifierAuthority
RegQueryInfoKeyW
AddAce
InitializeSid
GetSidLengthRequired
FreeSid
AddAccessAllowedAce
AllocateAndInitializeSid
GetSecurityDescriptorDacl
CheckTokenMembership
DuplicateTokenEx
SetTokenInformation
CreateProcessAsUserW
RegQueryValueExW
CreateRestrictedToken
GetAclInformation
OpenThreadToken
AddMandatoryAce
SetSecurityDescriptorSacl
GetLengthSid
GetSecurityDescriptorSacl
IsValidSid
InitializeAcl
SetKernelObjectSecurity
GetAce
InitializeSecurityDescriptor
EqualSid
CopySid
GetKernelObjectSecurity
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
OpenProcessToken
RegEnumKeyExW
RegOpenKeyExW
EventUnregister
EventRegister
RegSetValueExW
RegCloseKey
RegGetValueW
RegCreateKeyExW
EventWrite
DuplicateToken
CreateWellKnownSid
TraceMessageVa
RegOpenKeyExA
SetSecurityDescriptorDacl
RegEnumValueW

api-ms-win-downlevel-user32-l1-1-0

CharLowerW
CharLowerA

api-ms-win-downlevel-normaliz-l1-1-0

IdnToAscii

Exports

Exports

CreateIUriBuilder
CreateStringHashN
CreateUri
CreateUriFromMultiByteString
CreateUriPriv
CreateUriWithFragment
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
FastMimeGetFileExtension
FastMimeGetIsMimeFilterEnabled
FastMimeLookupKnownType
FastMimeSetIsMimeFilterEnabled
GetIDNSettingsForIE
GetIUriPriv
GetIUriPriv2
GetPortFromUrlScheme
GetPropertyFromName
GetPropertyName
IEDllLoader
IEGetFrameUtilExports
IEGetProcessModule
IEGetTabWindowExports
IERT_DelayLoadFailureHook
IUriBuilderInternalCreateDomain
ImpersonateUser
IntlPercentEncodeNormalize
IsDWORDProperty
IsStringProperty
LCIECalculatePackedStringSize
LCIEPackString
LCIEUnpackString
PrivateCoInternetCanonicalizeIUri
PrivateCoInternetCombineIUri
PrivateCoInternetParseIUri
ResetIDNLanguageData
ResetIEExtensibility
ResetIERegistrySettings
RevertImpersonate
UriFromHostAndScheme

Sections

.text
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.wpp_sf
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 53B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 135KB - Virtual size: 135KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5a750268a82ddf45b7b110485bf4b0a8

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

kernel32

api-ms-win-downlevel-version-l1-1-0

api-ms-win-downlevel-advapi32-l1-1-0

api-ms-win-downlevel-user32-l1-1-0

api-ms-win-downlevel-normaliz-l1-1-0

Exports

Exports

Sections

.text Size: 2.5MB - Virtual size: 2.5MB

.wpp_sf Size: 1KB - Virtual size: 1KB

.data Size: 22KB - Virtual size: 22KB

.pdata Size: 59KB - Virtual size: 59KB

.idata Size: 9KB - Virtual size: 9KB

.didat Size: 1024B - Virtual size: 1016B

.tls Size: - Virtual size: 53B

.rsrc Size: 62KB - Virtual size: 62KB

.reloc Size: 135KB - Virtual size: 135KB

.text
Size: 2.5MB - Virtual size: 2.5MB

.wpp_sf
Size: 1KB - Virtual size: 1KB

.data
Size: 22KB - Virtual size: 22KB

.pdata
Size: 59KB - Virtual size: 59KB

.idata
Size: 9KB - Virtual size: 9KB

.didat
Size: 1024B - Virtual size: 1016B

.tls
Size: - Virtual size: 53B

.rsrc
Size: 62KB - Virtual size: 62KB

.reloc
Size: 135KB - Virtual size: 135KB