9b92e91a6d37b5547dc88dd0867c6d80_NeikiAnalytics

Sharing

Copy URL Twitter E-mail

General

Target

9b92e91a6d37b5547dc88dd0867c6d80_NeikiAnalytics
Size

3.4MB
MD5

9b92e91a6d37b5547dc88dd0867c6d80
SHA1

75b3133e5fa02a8eabef6d330a2a62e45c2f7e3f
SHA256

e67d510467914f10c867c6bfe910dc922ca87b7f922131137d0e0707dbf6513c
SHA512

a3eba4024fea1b30d8c00bed5fad2e1c7330a43be006a546d614015395a3245a6d19a5f8e636ceeabd0c028817acb220eb2470575e1f2d8cfdb1b36193d50517
SSDEEP

49152:j24Hu2HI3jCiSzpTJMoJeww01uxTd93dR8NazQvkrx2HHf/sz4MSZK76x3EYc:0CiYYxXI0qH/w4zZWKNc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9b92e91a6d37b5547dc88dd0867c6d80_NeikiAnalytics

Files

9b92e91a6d37b5547dc88dd0867c6d80_NeikiAnalytics
.exe windows:6 windows x64 arch:x64

38af56dd242d80f4c38749cdaf4a0226

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\whowho\Desktop\code\track_titles\target\x86_64-pc-windows-msvc\release\deps\track_titles.pdb

Imports

secur32

FreeCredentialsHandle
AcquireCredentialsHandleA
QueryContextAttributesW
DeleteSecurityContext
EncryptMessage
DecryptMessage
InitializeSecurityContextW
AcceptSecurityContext
FreeContextBuffer
ApplyControlToken

kernel32

InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
RtlUnwindEx
RtlPcToFileHeader
RaiseException
CloseHandle
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetComputerNameExW
LoadLibraryExW
GetProcAddress
FreeLibrary
GetProcessHeap
HeapAlloc
HeapFree
LoadLibraryExA
GetLastError
FormatMessageW
WaitForSingleObject
TryAcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
GetCurrentProcess
GetSystemInfo
SetHandleInformation
CreateIoCompletionPort
GetQueuedCompletionStatusEx
PostQueuedCompletionStatus
WriteFile
SetFileCompletionNotificationModes
Sleep
GetModuleHandleA
FreeEnvironmentStringsW
AddVectoredExceptionHandler
SetThreadStackGuarantee
SwitchToThread
QueryPerformanceCounter
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
SetLastError
GetCurrentDirectoryW
GetEnvironmentStringsW
GetEnvironmentVariableW
SetEnvironmentVariableW
GetCommandLineW
FlushFileBuffers
SetFilePointerEx
GetStdHandle
GetCurrentProcessId
TerminateProcess
QueryPerformanceFrequency
HeapReAlloc
ReleaseMutex
FindNextFileW
FindClose
CreateFileW
GetFinalPathNameByHandleW
GetConsoleMode
GetFileType
GetModuleHandleW
GetModuleFileNameW
ExitProcess
MultiByteToWideChar
WriteConsoleW
WideCharToMultiByte
CreateThread
GetCurrentThread
GetSystemTimeAsFileTime
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetConsoleOutputCP
HeapSize
LCMapStringW
CompareStringW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetStringTypeW
SetStdHandle
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetCommandLineA
GetModuleHandleExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
EncodePointer
GetCurrentThreadId

advapi32

SystemFunction036
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
GetUserNameW

user32

GetMonitorInfoW
GetWindowTextLengthW
EnumDisplayMonitors
GetWindowTextW
IsWindowVisible
EnumDisplaySettingsExW
EnumWindows

gdi32

DeleteObject
GetObjectW
DeleteDC
GetDeviceCaps
GetDIBits
SelectObject
CreateDCW
CreateCompatibleDC
CreateCompatibleBitmap
StretchBlt
SetStretchBltMode

oleaut32

SysStringLen
SysFreeString
GetErrorInfo

ws2_32

ioctlsocket
connect
bind
WSASocketW
getpeername
getsockname
closesocket
getsockopt
send
WSASend
setsockopt
WSAIoctl
WSAStartup
shutdown
WSAGetLastError
getaddrinfo
freeaddrinfo
WSACleanup
recv

crypt32

CertFreeCertificateChain
CertDuplicateCertificateChain
CertGetCertificateChain
CertVerifyCertificateChainPolicy
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertFreeCertificateContext
CertDuplicateCertificateContext
CertDuplicateStore
CertCloseStore
CertOpenStore

ntdll

RtlNtStatusToDosError
NtDeviceIoControlFile
NtWriteFile
NtCreateFile
NtCancelIoFileEx

bcrypt

BCryptGenRandom

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 111KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

38af56dd242d80f4c38749cdaf4a0226

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

secur32

kernel32

advapi32

user32

gdi32

oleaut32

ws2_32

crypt32

ntdll

bcrypt

Sections

.text Size: 2.0MB - Virtual size: 2.0MB

.rdata Size: 1.2MB - Virtual size: 1.2MB

.data Size: 15KB - Virtual size: 19KB

.pdata Size: 111KB - Virtual size: 111KB

_RDATA Size: 512B - Virtual size: 500B

.reloc Size: 23KB - Virtual size: 22KB

.text
Size: 2.0MB - Virtual size: 2.0MB

.rdata
Size: 1.2MB - Virtual size: 1.2MB

.data
Size: 15KB - Virtual size: 19KB

.pdata
Size: 111KB - Virtual size: 111KB

_RDATA
Size: 512B - Virtual size: 500B

.reloc
Size: 23KB - Virtual size: 22KB