ba8b95fd2a6ceb24d3c7fcd835747ae0_NeikiAnalytics

Sharing

Copy URL Twitter E-mail

General

Target

ba8b95fd2a6ceb24d3c7fcd835747ae0_NeikiAnalytics
Size

808KB
MD5

ba8b95fd2a6ceb24d3c7fcd835747ae0
SHA1

f0c382d4ad4ae3548841c8ce24a9b7849d72b0e8
SHA256

9aa5faf18e5f042bf2f3719454acef049ea05f206b60944a9e49839e3d4d2a6e
SHA512

55b5f67b2a85f11cce4a2512043595b93a0fa70e51427cced1fbb5c540abaad532f2f8763f63e060fd7eb653ab1e699f700cca2819c2f0ff80908393474d1e70
SSDEEP

24576:HrbtjwM/4pWf6Dijk2fkcDjCGpy/AWnbR:H1jf/4FiffkCCGo/5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ba8b95fd2a6ceb24d3c7fcd835747ae0_NeikiAnalytics

Files

ba8b95fd2a6ceb24d3c7fcd835747ae0_NeikiAnalytics
.exe windows:10 windows x86 arch:x86

9558560cbfdb419535f9680927a961eb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

vshadow.pdb

Imports

kernel32

GetLastError
GetVolumePathNamesForVolumeNameW
WriteFile
CloseHandle
CreateFileW
WideCharToMultiByte
QueryDosDeviceW
GetFileAttributesW
FindFirstFileW
FindClose
FindNextFileW
GetThreadLocale
GetTimeFormatW
GetDateFormatW
FileTimeToSystemTime
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
GetVolumePathNameW
ExpandEnvironmentStringsW
VerSetConditionMask
VerifyVersionInfoW
HeapSetInformation
GetExitCodeProcess
LocalFree
CreateProcessW
ReadFile
GetFileSize
GetCommandLineW
GetCurrentProcess
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
SetUnhandledExceptionFilter
Sleep
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
DecodePointer
EncodePointer
InitializeCriticalSectionEx
GetStringTypeW
MultiByteToWideChar
WaitForSingleObject
FormatMessageW
TerminateProcess

msvcrt

??0exception@@QAE@ABQBDH@Z
_CxxThrowException
memcpy
memmove
_errno
___mb_cur_max_func
___lc_handle_func
___lc_codepage_func
_ismbblead
memset
__uncaught_exception
setlocale
_lock
_unlock
_fsopen
fseek
__pctype_func
isupper
calloc
__iob_func
__mb_cur_max
islower
_wcsdup
__crtLCMapStringW
__crtLCMapStringA
_wsetlocale
abort
_wcsnicmp
_callnewh
memcmp
_XcptFilter
__p__commode
_amsg_exit
__wgetmainargs
__set_app_type
exit
_exit
_cexit
__p__fmode
__setusermatherr
_initterm
__dllonexit
_onexit
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_controlfp
_except_handler4_common
strcspn
fputwc
ungetwc
fclose
localeconv
??_V@YAXPAX@Z
__CxxFrameHandler3
??3@YAXPAX@Z
_purecall
_vsnwprintf
wprintf
??0exception@@QAE@ABV0@@Z
?what@exception@@UBEPBDXZ
malloc
getchar
_wcsicmp
free
??0bad_cast@@QAE@PBD@Z
??1bad_cast@@UAE@XZ
??0bad_cast@@QAE@ABV0@@Z
sprintf_s
fwrite
memcpy_s
ungetc
fgetc
fgetwc
fgetpos
_fseeki64
fsetpos
setvbuf
fflush
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
fputc

atl

ord30

oleaut32

SysFreeString
SysAllocString

ole32

CLSIDFromString
CoInitializeSecurity
CoInitialize
CoUninitialize
CoTaskMemFree
CoCreateInstance

vssapi

VssFreeSnapshotPropertiesInternal
CreateVssBackupComponentsInternal
ShouldBlockRevertInternal

resutils

ClusterPrepareSharedVolumeForBackup
ClusterIsPathOnSharedVolume
ClusterGetVolumePathName
ClusterGetVolumeNameForVolumeMountPoint

shlwapi

PathFileExistsW

Sections

.text
Size: 225KB - Virtual size: 225KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 576KB - Virtual size: 580KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

9558560cbfdb419535f9680927a961eb

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

msvcrt

atl

oleaut32

ole32

vssapi

resutils

shlwapi

Sections

.text Size: 225KB - Virtual size: 225KB

.data Size: 512B - Virtual size: 2KB

.idata Size: 4KB - Virtual size: 3KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 576KB - Virtual size: 580KB

.text
Size: 225KB - Virtual size: 225KB

.data
Size: 512B - Virtual size: 2KB

.idata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 576KB - Virtual size: 580KB