d96c6bc03e7be454cbb5e1f4c214c390_NeikiAnalytics

Sharing

Copy URL Twitter E-mail

General

Target

d96c6bc03e7be454cbb5e1f4c214c390_NeikiAnalytics
Size

1.5MB
MD5

d96c6bc03e7be454cbb5e1f4c214c390
SHA1

e9525c80d89c6bf3216524fd6adc1b22d60ece06
SHA256

03e13a68a05caad1622d1cfc4507ae2f3c6ca8eeba000d403496a2d2d8f59055
SHA512

e0e5df1e25b1070817371d5c22781cc660a034bb58204e8d4dc3ced015521a4253dac72c5f595a274443266f67f29186805f795809402727b628acb692e98864
SSDEEP

12288:qQVnwTmYChBB2VsgKi5MueVzmYXK4+S3Nr10FvBSDh0lO+ahzR/XELaGjjW9s4d:qQq+hj2uCM11K4+S3YFvBvnyXcC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d96c6bc03e7be454cbb5e1f4c214c390_NeikiAnalytics

Files

d96c6bc03e7be454cbb5e1f4c214c390_NeikiAnalytics
.exe windows:6 windows x64 arch:x64

322f1c1ff4870ee88af8af80b98138a2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

aspnet_state.pdb

Imports

mswsock

GetAcceptExSockaddrs
AcceptEx

ole32

CoUninitialize
CoInitializeEx

ws2_32

ntohs
bind
WSAGetOverlappedResult
WSAStartup
closesocket
WSARecv
WSASend
WSAAddressToStringA
htons
listen
htonl
WSACleanup
select
recv
WSASocketW
WSAGetLastError
inet_ntoa
setsockopt

mscoree

ClrCreateManagedInstance

webengine4

GetXSPHeap
LoadLibraryUsingFullPath
AttachHandleToThreadPool
XspLogEvent
InitializeLibrary
PrintResourceString
PerfCounterInitialize
AspnetLoadResourceDLL

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerW

kernel32

InitializeSListHead
GetCurrentProcessId
QueryPerformanceCounter
GetProcessAffinityMask
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
RtlCaptureContext
GetVersionExW
GetSystemDirectoryW
HeapReAlloc
WideCharToMultiByte
FileTimeToSystemTime
lstrlenW
GetSystemTimeAsFileTime
FileTimeToLocalFileTime
LoadLibraryW
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetModuleHandleW
MultiByteToWideChar
HeapCreate
HeapDestroy
HeapAlloc
HeapFree
FreeLibrary
GetProcAddress
SetEvent
WaitForSingleObject
GetSystemInfo
CloseHandle
CreateEventW
SetWaitableTimer
Sleep
CreateThread
FormatMessageW
CreateWaitableTimerW
SetConsoleCtrlHandler
GetLastError
SwitchToThread

vcruntime140_clr0400

strchr
_purecall
memset
__C_specific_handler
memcpy
strstr

ucrtbase_clr0400

_configure_wide_argv
_initialize_wide_environment
_get_initial_wide_environment
_initterm
_initterm_e
exit
_exit
_set_fmode
__p___argc
__p___wargv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_configthreadlocale
_set_new_mode
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
_set_app_type
_itoa_s
wcsncpy_s
wcscpy_s
__stdio_common_vswprintf
strtol
_seh_filter_exe
strncmp
__p__commode
__setusermatherr

Exports

Exports

STWNDCloseConnection
STWNDDeleteStateItem
STWNDEndOfRequest
STWNDGetLocalAddress
STWNDGetLocalPort
STWNDGetRemoteAddress
STWNDGetRemotePort
STWNDIsClientConnected
STWNDSendResponse

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.4MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

322f1c1ff4870ee88af8af80b98138a2

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mswsock

ole32

ws2_32

mscoree

webengine4

advapi32

kernel32

vcruntime140_clr0400

ucrtbase_clr0400

Exports

Exports

Sections

.text Size: 23KB - Virtual size: 22KB

.rdata Size: 9KB - Virtual size: 8KB

.data Size: 512B - Virtual size: 6KB

.pdata Size: 2KB - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 1.4MB - Virtual size: 2.3MB

.text
Size: 23KB - Virtual size: 22KB

.rdata
Size: 9KB - Virtual size: 8KB

.data
Size: 512B - Virtual size: 6KB

.pdata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 1.4MB - Virtual size: 2.3MB