6c2a79b7659d42863f3b75c256e4f360_NeikiAnalytics

Sharing

Copy URL Twitter E-mail

General

Target

6c2a79b7659d42863f3b75c256e4f360_NeikiAnalytics
Size

191KB
MD5

6c2a79b7659d42863f3b75c256e4f360
SHA1

2cb5321286bd174647c6b3589898f9e23381ec4b
SHA256

3741323be4dfc148e7d32049e5a20b04a6beb049c48f8a490b10325ff45e7140
SHA512

798f80008f5dca90f2f88533850a0364a34026c2f49da0ca9e7399e4f63df62014322d42178e78e54782afb9f984529cace83eec31818e9f78c41782fac88961
SSDEEP

3072:2AKEsYqqjfipJWYpWJZfGXFxUYyaJC6sOMD5Qjj9jRMKSlJ8subptbbG+X:NKE+qjfipJWYpWJZfGXFRJJRsOM9+j5L

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6c2a79b7659d42863f3b75c256e4f360_NeikiAnalytics

Files

6c2a79b7659d42863f3b75c256e4f360_NeikiAnalytics
.exe windows:5 windows x86 arch:x86

59b7c12b805e8f464a99915a7933b0f8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetComputerNameA
SetEvent
CreateEventA
GlobalLock
GlobalUnlock
LoadLibraryA
GetLogicalDrives
GetDiskFreeSpaceExA
CreateFileW
CompareStringW
GetStringTypeW
HeapSize
GetTimeZoneInformation
GetProcessHeap
SetEndOfFile
FlushFileBuffers
WriteConsoleW
IsProcessorFeaturePresent
SetStdHandle
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
CreatePipe
GetFileAttributesA
LCMapStringW
IsValidCodePage
GetOEMCP
GetFileTime
GetDriveTypeA
SetFileTime
GetTickCount
OpenFile
GetCurrentProcessId
IsDebuggerPresent
GetSystemTime
GetLocalTime
LocalFree
GetVersionExA
GetModuleHandleA
GlobalMemoryStatusEx
GlobalFree
GetProcAddress
GlobalAlloc
GetCurrentProcess
CreateThread
CreateToolhelp32Snapshot
GetModuleFileNameA
Process32Next
TerminateProcess
CreateProcessA
TerminateThread
OpenProcess
WaitForSingleObject
Process32First
SetErrorMode
EndUpdateResourceA
EnumResourceNamesA
LoadLibraryExA
BeginUpdateResourceA
LockResource
GetBinaryTypeA
UpdateResourceA
LoadResource
FreeLibrary
FreeResource
FindResourceA
OpenFileMappingA
CloseHandle
CreateFileMappingA
SetLastError
GetLastError
UnmapViewOfFile
GetACP
GetCPInfo
LoadLibraryW
InterlockedDecrement
GetCurrentThreadId
RaiseException
InterlockedIncrement
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetModuleFileNameW
HeapCreate
GetCurrentDirectoryW
CreateFileA
PeekNamedPipe
GetFileInformationByHandle
SetFilePointer
DeleteCriticalSection
GetFileType
GetStdHandle
SetHandleCount
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
WriteFile
ReadFile
MapViewOfFile
SetFileAttributesA
RtlUnwind
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
EncodePointer
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
HeapSetInformation
GetCommandLineA
DuplicateHandle
GetFullPathNameA
GetDriveTypeW
SetCurrentDirectoryA
GetCurrentDirectoryA
SetEnvironmentVariableA
CreateDirectoryA
FindNextFileA
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
FindFirstFileExA
HeapFree
HeapAlloc
HeapReAlloc
DeleteFileA
GetModuleHandleW
ExitProcess
DecodePointer
Sleep
GetSystemTimeAsFileTime
MultiByteToWideChar

user32

CloseClipboard
GetWindowThreadProcessId
GetKeyboardLayout
GetForegroundWindow
CallNextHookEx
GetKeyState
UnhookWindowsHookEx
DispatchMessageA
SetWindowsHookExA
TranslateMessage
GetClipboardData
ReleaseDC
GetDC
MessageBoxA
EmptyClipboard
OpenClipboard
GetWindowRect
EnumWindows
GetWindowTextA
GetDesktopWindow
IsWindowVisible
SetClipboardData
GetMessageA

gdi32

SelectObject
CreateCompatibleBitmap
CreateDIBSection
BitBlt
DeleteDC
DeleteObject
CreateCompatibleDC

advapi32

CheckTokenMembership
SetSecurityDescriptorDacl
RegEnumKeyA
RegOpenKeyA
LookupAccountSidW
ConvertStringSidToSidA
OpenSCManagerA
StartServiceA
CreateServiceA
ChangeServiceConfig2A
DeleteService
CloseServiceHandle
OpenServiceA
SetServiceStatus
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
CryptHashData
CryptDestroyHash
CryptCreateHash
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
SetKernelObjectSecurity
FreeSid
AllocateAndInitializeSid
GetTokenInformation
ConvertSidToStringSidA
OpenProcessToken
RegCloseKey
RegDeleteValueA
RegOpenKeyExA
RegCreateKeyExA
RegQueryValueExA
RegSetValueExA
ConvertStringSecurityDescriptorToSecurityDescriptorA
InitializeSecurityDescriptor

shell32

ShellExecuteA

ole32

CoCreateInstance
CoUninitialize
CoTaskMemFree
CoInitializeEx
CreateStreamOnHGlobal

oleaut32

VariantClear
VariantInit

shlwapi

SHDeleteKeyA

wininet

InternetConnectA
InternetReadFile
InternetSetOptionA
InternetQueryOptionA
InternetCloseHandle
HttpOpenRequestA
InternetGetConnectedState
HttpSendRequestA
InternetOpenA

winmm

mciSendStringA

wsock32

connect
WSAStartup
send
gethostbyname
closesocket
socket
recv
htons

iphlpapi

GetAdaptersInfo

gdiplus

GdipGetImageEncoders
GdiplusStartup
GdiplusShutdown
GdipSaveImageToStream
GdipFree
GdipAlloc
GdipGetImageEncodersSize
GdipDisposeImage
GdipCreateBitmapFromHBITMAP
GdipCloneImage

mpr

WNetEnumResourceA
WNetOpenEnumA
WNetCloseEnum

netapi32

NetUserAdd
NetLocalGroupAddMembers

Sections

.text
Size: 143KB - Virtual size: 142KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

59b7c12b805e8f464a99915a7933b0f8

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

wininet

winmm

wsock32

iphlpapi

gdiplus

mpr

netapi32

Sections

.text Size: 143KB - Virtual size: 142KB

.rdata Size: 31KB - Virtual size: 30KB

.data Size: 4KB - Virtual size: 14KB

.reloc Size: 11KB - Virtual size: 11KB

.text
Size: 143KB - Virtual size: 142KB

.rdata
Size: 31KB - Virtual size: 30KB

.data
Size: 4KB - Virtual size: 14KB

.reloc
Size: 11KB - Virtual size: 11KB