cd8cdbeeb14d90f90296c47376b9e9d0_NeikiAnalytics

Sharing

Copy URL Twitter E-mail

General

Target

cd8cdbeeb14d90f90296c47376b9e9d0_NeikiAnalytics
Size

1.5MB
MD5

cd8cdbeeb14d90f90296c47376b9e9d0
SHA1

a440a33d8e643a584e353c82239bf52819195b6d
SHA256

ca014df90e3c70b55de49024b19b481c1de041e3a800b53ee5d0b002c6225e13
SHA512

6f4bafdce0095e0129cc5accd2fe1b710c46b8857ce0a3c8964c9a844e89074f39c4fc99e9d35348b99de5d48a23f1d076538733ded2e4c4a143bb48347a45bc
SSDEEP

12288:aYXJkWHSEbEC/Mo4lhli2lkp9CC02/Ugtag5dRsojEa69ZJ4Rvp+hCmgp:a02WHp/ElDKp9CdgtLq1NWvp+cNp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cd8cdbeeb14d90f90296c47376b9e9d0_NeikiAnalytics

Files

cd8cdbeeb14d90f90296c47376b9e9d0_NeikiAnalytics
.exe windows:10 windows x64 arch:x64

c29a8b4e64755be19f08b918f93a11c7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

TieringEngineService.pdb

Imports

msvcrt

wcscat_s
__CxxFrameHandler3
_snwprintf_s
wcsncmp
_vsnwprintf
realloc
swprintf_s
_onexit
__dllonexit
_unlock
_lock
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_commode
_fmode
_wcmdln
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
wcscpy_s
memset
_callnewh
malloc
free
_purecall
__C_specific_handler
_CxxThrowException

ntdll

RtlSetBits
RtlInitializeBitMap
RtlCreateSystemVolumeInformationFolder
NtQueryInformationFile
NtSetInformationFile
RtlCopyUnicodeString
NtFsControlFile
NtWaitForSingleObject
NtOpenFile
RtlGetThreadErrorMode
RtlSetThreadErrorMode
RtlNumberOfClearBits
RtlStringFromGUID
WinSqmEndSession
WinSqmStartSession
NtClose
RtlNtStatusToDosError
RtlGUIDFromString
RtlCompareUnicodeString
RtlInitUnicodeString
RtlCompareMemory
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WinSqmAddToStreamEx

oleaut32

VariantInit
SysAllocString
SysFreeString
VariantClear

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableLevel
GetTraceLoggerHandle
UnregisterTraceGuids
GetTraceEnableFlags
RegisterTraceGuidsW
TraceMessage

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
RaiseException
SetUnhandledExceptionFilter

api-ms-win-core-com-l1-1-0

CoUninitialize
CoTaskMemFree
CoMarshalInterface
CoInitializeEx
CoRevokeClassObject
CreateStreamOnHGlobal
CoCreateInstance
CoSuspendClassObjects
CoUnmarshalInterface
CoTaskMemAlloc
CoResumeClassObjects
CoReleaseMarshalData
CoCreateGuid
CoRegisterClassObject

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
ReleaseSRWLockShared
AcquireSRWLockExclusive
InitializeSRWLock
WaitForSingleObject
ReleaseSRWLockExclusive
AcquireSRWLockShared
SetEvent
CreateEventW
ResetEvent
InitializeCriticalSection

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventWrite
EventSetInformation
EventWriteTransfer
EventUnregister

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
GetModuleHandleExW
LoadStringW

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
CreateThread
GetCurrentThreadId
GetStartupInfoW
GetCurrentProcess
TerminateProcess
OpenProcessToken

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-service-core-l1-1-0

StartServiceCtrlDispatcherW
SetServiceStatus

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-service-winsvc-l1-1-0

RegisterServiceCtrlHandlerW

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolWork
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolCleanupGroup
WaitForThreadpoolWorkCallbacks
CloseThreadpoolCleanupGroupMembers
FreeLibraryWhenCallbackReturns
CloseThreadpoolWait
CloseThreadpool
SetThreadpoolWait
CreateThreadpoolWait
SubmitThreadpoolWork
CreateThreadpoolWork
SetThreadpoolThreadMinimum
WaitForThreadpoolTimerCallbacks
SetThreadpoolThreadMaximum
WaitForThreadpoolWaitCallbacks
CreateThreadpoolCleanupGroup
CreateThreadpool

api-ms-win-core-string-l1-1-0

CompareStringW

api-ms-win-core-processenvironment-l1-1-0

SetCurrentDirectoryW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount
GetSystemWindowsDirectoryW

api-ms-win-core-synch-l1-2-1

CreateSemaphoreW

api-ms-win-core-file-l1-1-0

FindClose
CreateDirectoryW
DeleteFileW
FindNextFileW
FindNextVolumeW
GetFileAttributesW
FindVolumeClose
FindFirstVolumeW
FindFirstFileW

api-ms-win-core-registry-l1-1-0

RegGetValueW
RegCreateKeyExW
RegNotifyChangeKeyValue

api-ms-win-eventing-controller-l1-1-0

ControlTraceW
EnableTraceEx2
StartTraceW

api-ms-win-eventing-consumer-l1-1-0

OpenTraceW
CloseTrace
ProcessTrace

api-ms-win-core-file-l1-2-0

GetVolumeNameForVolumeMountPointW

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW

api-ms-win-security-base-l1-1-0

AdjustTokenPrivileges
PrivilegeCheck

api-ms-win-core-localization-l1-2-0

GetLocaleInfoW

api-ms-win-devices-config-l1-1-1

CM_Register_Notification
CM_Unregister_Notification

api-ms-win-core-file-l2-1-1

OpenFileById

api-ms-win-core-realtime-l1-1-0

QueryUnbiasedInterruptTime

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-kernel32-legacy-l1-1-0

MoveFileW

esent

JetOpenTableW
JetDeleteTableW
JetSetCurrentIndexW
JetCreateDatabase2W
JetOpenDatabaseW
JetAttachDatabase2W
JetBeginSessionW
JetEndSession
JetCloseDatabase
JetCloseTable
JetInit3W
JetTerm2
JetSetSystemParameterW
JetCreateInstance2W
JetCreateTableColumnIndex2W
JetResetSessionContext
JetSetSessionContext
JetOpenTempTable
JetRetrieveColumns
JetSetColumns
JetPrepareUpdate
JetUpdate
JetMove
JetMakeKey
JetSeek
JetBeginTransaction
JetRetrieveColumn
JetDelete
JetCommitTransaction
JetRollback
JetGetColumnInfoW
JetComputeStats
JetEnableMultiInstanceW
JetGetObjectInfoW

clusapi

GetClusterInformation
OpenCluster
CloseCluster

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Sections

.text
Size: 239KB - Virtual size: 239KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.2MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

c29a8b4e64755be19f08b918f93a11c7

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

oleaut32

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-service-core-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-file-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-eventing-controller-l1-1-0

api-ms-win-eventing-consumer-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-io-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-devices-config-l1-1-1

api-ms-win-core-file-l2-1-1

api-ms-win-core-realtime-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-file-l2-1-2

api-ms-win-core-kernel32-legacy-l1-1-0

esent

clusapi

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Sections

.text Size: 239KB - Virtual size: 239KB

.rdata Size: 40KB - Virtual size: 40KB

.data Size: 1024B - Virtual size: 3KB

.pdata Size: 6KB - Virtual size: 5KB

.didat Size: 512B - Virtual size: 16B

.rsrc Size: 7KB - Virtual size: 7KB

.reloc Size: 1.2MB - Virtual size: 1.8MB

.text
Size: 239KB - Virtual size: 239KB

.rdata
Size: 40KB - Virtual size: 40KB

.data
Size: 1024B - Virtual size: 3KB

.pdata
Size: 6KB - Virtual size: 5KB

.didat
Size: 512B - Virtual size: 16B

.rsrc
Size: 7KB - Virtual size: 7KB

.reloc
Size: 1.2MB - Virtual size: 1.8MB