deb9921e0a17e71ab6a4596b181475a0_NeikiAnalytics

Sharing

Copy URL

Twitter E-mail

General

Target

deb9921e0a17e71ab6a4596b181475a0_NeikiAnalytics
Size

460KB
MD5

deb9921e0a17e71ab6a4596b181475a0
SHA1

09ba6b7ce3490de5cf4b47fb2549c181d631f9df
SHA256

dd84e640d5cd6a178103fd29e64fe66b3dde0e2f93f6969ab4d22482a092a4f7
SHA512

2a268afd0f96374065a49abbd9aa7cd7c8152e03a9103cf29a78bee8c4bab9d68bd82bc7dbf806a730a9d0e9d0531dc82e9f2b391989210a1e8d079bb763f875
SSDEEP

6144:1riBMQkzOQnmUGSB0C6Qrcx/7WEuqNMmMBUGwMzuPO5sGU:1riBMQk/ndGSyC6L7WEuqsLzuPOY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
deb9921e0a17e71ab6a4596b181475a0_NeikiAnalytics

Files

deb9921e0a17e71ab6a4596b181475a0_NeikiAnalytics
.dll windows:4 windows x86 arch:x86

bf2cae1cbac5ca0f909e44476f12fc2b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

HeapAlloc
HeapFree
ExitProcess
GetStartupInfoA
TerminateProcess
GetACP
HeapReAlloc
HeapSize
SetUnhandledExceptionFilter
Sleep
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
SetStdHandle
VirtualAlloc
IsBadWritePtr
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetCommandLineA
GetFullPathNameA
GetVolumeInformationA
IsBadCodePtr
GetLocalTime
LockFile
UnlockFile
GetStdHandle
GetFileType
SetEnvironmentVariableA
LocalFree
WideCharToMultiByte
LeaveCriticalSection
EnterCriticalSection
GetSystemTime
GetTimeZoneInformation
RaiseException
RtlUnwind
WinExec
OpenProcess
ReadProcessMemory
GetCurrentProcessId
GetProcessHeap
ReleaseSemaphore
ReleaseMutex
CreateSemaphoreA
CreateMutexA
GetSystemDefaultLCID
lstrlenW
GetFileTime
GetFileSize
GetFileAttributesA
GetOEMCP
GetCPInfo
SetHandleCount
CompareStringA
CompareStringW
SetEndOfFile
IsBadReadPtr
FlushFileBuffers
DeleteCriticalSection
InitializeCriticalSection
lstrcmpA
InterlockedIncrement
InterlockedDecrement
MultiByteToWideChar
lstrlenA
GetCurrentThreadId
OutputDebugStringA
LoadLibraryA
GetProcAddress
InterlockedExchange
SetFilePointer
WriteFile
ReadFile
CreateFileA
GetCurrentProcess
DuplicateHandle
GetProcessVersion
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GetVersion
SetErrorMode
GetModuleHandleA
GetCurrentDirectoryA
lstrcatA
WritePrivateProfileStringA
GlobalFlags
FileTimeToLocalFileTime
FileTimeToSystemTime
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
GlobalUnlock
GlobalFree
TlsAlloc
LocalAlloc
lstrcpynA
WaitForSingleObject
CloseHandle
GetModuleFileNameA
GlobalLock
GlobalAlloc
GlobalDeleteAtom
lstrcmpiA
GetCurrentThread
FindNextFileA
lstrcpyA
FindFirstFileA
GetLastError
SetLastError
FindClose
FormatMessageA
GetDriveTypeA
FreeLibrary

user32

SystemParametersInfoA
IsIconic
RegisterWindowMessageA
GetWindowPlacement
SetFocus
ShowWindow
SetWindowPos
SetWindowLongA
GetSystemMetrics
SetForegroundWindow
SetPropA
CallWindowProcA
GetDlgItem
GetMessageTime
GrayStringA
RemovePropA
GetForegroundWindow
GetMessagePos
GetPropA
TabbedTextOutA
ReleaseDC
GetDC
ScreenToClient
UnregisterClassA
GetMenuItemCount
GetDesktopWindow
GetWindowTextA
CreateWindowExA
DestroyWindow
DefWindowProcA
GetSubMenu
SetWindowTextA
ClientToScreen
GetWindow
GetDlgCtrlID
GetWindowRect
DrawTextA
RegisterClassA
wsprintfA
GetClassLongA
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetNextDlgTabItem
GetMessageA
TranslateMessage
DispatchMessageA
GetActiveWindow
GetKeyState
CallNextHookEx
ValidateRect
IsWindowVisible
PeekMessageA
GetCursorPos
SetWindowsHookExA
GetParent
GetLastActivePopup
IsWindowEnabled
MessageBoxA
SetLastErrorEx
DdeFreeStringHandle
DdeGetLastError
DdeCreateStringHandleA
DdePostAdvise
SetRectEmpty
LoadAcceleratorsA
TranslateAcceleratorA
ReleaseCapture
LoadMenuA
SetMenu
ReuseDDElParam
UnpackDDElParam
InvalidateRect
BringWindowToTop
RegisterClipboardFormatA
EnableWindow
SetCursor
ShowOwnedPopups
SendMessageA
PostMessageA
PostQuitMessage
GetMenu
UnhookWindowsHookEx
GetWindowLongA
LoadStringA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
EndDeferWindowPos
CopyRect
BeginDeferWindowPos
GetClientRect
EqualRect
AdjustWindowRectEx
IsWindow
SetActiveWindow
GetSysColor
MapWindowPoints
UpdateWindow
LoadIconA
DestroyMenu
CharUpperA
GetSysColorBrush
LoadCursorA
PtInRect
GetClassNameA
GetMenuItemID
DeferWindowPos

gdi32

SetBkColor
SetTextColor
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
GetStockObject
GetDeviceCaps
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
GetObjectA
SelectObject
RestoreDC
SaveDC
DeleteDC
CreateBitmap
DeleteObject

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

advapi32

RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA

shell32

DragFinish
DragQueryFileA

comctl32

ord17

ole32

CoTaskMemRealloc
CoTaskMemFree
CoCreateInstance

oleaut32

GetErrorInfo
VariantCopy
VariantInit
SafeArrayDestroy
VariantChangeType
SafeArrayCreate
SafeArrayGetDim
SafeArrayGetUBound
SafeArrayRedim
SafeArrayGetElement
SafeArrayPutElement
SafeArrayUnlock
SafeArrayPtrOfIndex
SafeArrayLock
VariantClear
SysAllocStringLen
SysAllocString
SysFreeString

odbc32

ord16
ord3

jrnallog

?ErrorReport@@YGHPAXPBD111KI1@Z
?JournalLog@@YGHPAX0PBD111I1@Z

imagehlp

SymFunctionTableAccess
SymSetOptions
SymInitialize
SymLoadModule
SymGetModuleBase
StackWalk
SymGetSymFromAddr
SymGetOptions
SymCleanup

mtxex

GetObjectContext

sig

HashString
DecryptString

Exports

Exports

HS_Init
HS_RemoteTransaction

Sections

.text
Size: 252KB - Virtual size: 249KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 104KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 48KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bf2cae1cbac5ca0f909e44476f12fc2b

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

ole32

oleaut32

odbc32

jrnallog

imagehlp

mtxex

sig

Exports

Exports

Sections

.text Size: 252KB - Virtual size: 249KB

.rdata Size: 52KB - Virtual size: 51KB

.data Size: 104KB - Virtual size: 140KB

.reloc Size: 48KB - Virtual size: 44KB

.text
Size: 252KB - Virtual size: 249KB

.rdata
Size: 52KB - Virtual size: 51KB

.data
Size: 104KB - Virtual size: 140KB

.reloc
Size: 48KB - Virtual size: 44KB