e238cfb63321efabf7cf97c7c8fb80b0_NeikiAnalytics

Sharing

Copy URL

Twitter E-mail

General

Target

e238cfb63321efabf7cf97c7c8fb80b0_NeikiAnalytics
Size

153KB
MD5

e238cfb63321efabf7cf97c7c8fb80b0
SHA1

1eabd7096109e4773aa3c2ffba26b5e5564aa2f4
SHA256

1e5c7ab55eaf61233e2677b6db0de23828cf825f4d89dd38281e3c2f8fa8115e
SHA512

81361dd36b24dad8990535d4cdb6c39dd7431cb1fd7e3ac8498930c5c6db2fa437fede7062334e3ef993ab788f5e6748d7023139da62f972551d97c79bf7fa21
SSDEEP

1536:J8ckVIzWjMOJ5QJe8KsZY3cL/qMLQF4gJ5E1V6sU7ulo3U/6hSiEOWDRvnR0j+VD:J8VD/5P3s7nLQ+gryV6SVlk0o8j7Eq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e238cfb63321efabf7cf97c7c8fb80b0_NeikiAnalytics

Files

e238cfb63321efabf7cf97c7c8fb80b0_NeikiAnalytics
.dll windows:6 windows

885edd830ee44a02f30770e251b1316f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_APPCONTAINER
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\BA\54\b\Ship.Inbox\ARM\LivingImagesProcessing.Windows\LivingImagesProcessing.Windows.pdb

Imports

ipp_uwp

ctbitmap_destroy
ctbitmap_convertBitmap
ctbitmap_createFromDataPlanar
ctbitmap_createFromData

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError

ole32

CoGetContextToken
CoCreateInstanceFromApp
CoCreateFreeThreadedMarshaler
CoTaskMemAlloc

api-ms-win-shcore-stream-winrt-l1-1-0

CreateStreamOverRandomAccessStream

d3d11

D3D11CreateDevice

mfplat

MFCreateSample
MFCreateMemoryBuffer
MFCreateMediaType
MFStartup
MFShutdown
MFCreateAttributes
MFCreateDXGIDeviceManager
MFCreateMFByteStreamOnStreamEx

mfreadwrite

MFCreateSinkWriterFromURL
MFCreateSourceReaderFromByteStream

vccorlib140_app

?__abi_WinRTraiseFailureException@@YAXXZ
?__abi_WinRTraiseOperationCanceledException@@YAXXZ
?__abi_WinRTraiseInvalidArgumentException@@YAXXZ
?__abi_WinRTraiseNullReferenceException@@YAXXZ
?__abi_WinRTraiseClassNotRegisteredException@@YAXXZ
?__abi_WinRTraiseInvalidCastException@@YAXXZ
?__abi_WinRTraiseNotImplementedException@@YAXXZ
??0Object@Platform@@Q$AAA@XZ
?__abi_WinRTraiseWrongThreadException@@YAXXZ
?__abi_WinRTraiseOutOfBoundsException@@YAXXZ
?__abi_WinRTraiseAccessDeniedException@@YAXXZ
?Free@Heap@Details@Platform@@SAXPAX@Z
?AlignedFree@Heap@Details@Platform@@SAXPAX@Z
?ReleaseTarget@ControlBlock@Details@Platform@@AAAXXZ
?CreateException@Exception@Platform@@SAP$AAV12@H@Z
?Allocate@Heap@Details@Platform@@SAPAXII@Z
?__abi_translateCurrentException@@YAJ_N@Z
?ReleaseInContextImpl@Details@Platform@@YAJPAUIUnknown@@0@Z
?GetProxyImpl@Details@Platform@@YAJPAUIUnknown@@ABU_GUID@@0PAPAU3@@Z
?GetObjectContext@Details@Platform@@YAPAUIUnknown@@XZ
?__abi_WinRTraiseCOMException@@YAXJ@Z
?__abi_WinRTraiseObjectDisposedException@@YAXXZ
?__abi_WinRTraiseOutOfMemoryException@@YAXXZ
?__abi_WinRTraiseDisconnectedException@@YAXXZ
?ReCreateException@Exception@Platform@@SAP$AAV12@H@Z
??0Delegate@Platform@@Q$AAA@XZ
?__abi_WinRTraiseChangedStateException@@YAXXZ
?InitializeData@Details@Platform@@YAJH@Z
?UninitializeData@Details@Platform@@YAXH@Z
?GetIidsFn@@YAJHPAKPBU__s_GUID@@PAPAVGuid@Platform@@@Z
?GetActivationFactoryByPCWSTR@@YAJPAXAAVGuid@Platform@@PAPAX@Z
?GetActivationFactory@Details@Platform@@YAJPAVModuleBase@1WRL@Microsoft@@PAUHSTRING__@@PAPAUIActivationFactory@@@Z
?TerminateModule@Details@Platform@@YA_NPAVModuleBase@1WRL@Microsoft@@@Z

msvcp140_app

?__ExceptionPtrCopyException@@YAXPAXPBX1@Z
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QAAXXZ
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QAAXXZ
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QAAXXZ
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QAAXXZ
_Cnd_init_in_situ
_Mtx_init_in_situ
?_Xlength_error@std@@YAXPBD@Z
_Cnd_destroy_in_situ
_Mtx_destroy_in_situ
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QAAXXZ
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QAAX_N@Z
?_Xbad_function_call@std@@YAXXZ
?_Schedule_chore@details@Concurrency@@YAHPAU_Threadpool_chore@12@@Z
?_Release_chore@details@Concurrency@@YAXPAU_Threadpool_chore@12@@Z
?_IsNonBlockingThread@_Task_impl_base@details@Concurrency@@SA_NXZ
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AAAXXZ
?_ReportUnobservedException@details@Concurrency@@YAXXZ
?__ExceptionPtrCreate@@YAXPAX@Z
?__ExceptionPtrCurrentException@@YAXPAX@Z
_Cnd_wait
?__ExceptionPtrRethrow@@YAXPBX@Z
?__ExceptionPtrCopy@@YAXPAXPBX@Z
?_Reset@_ContextCallback@details@Concurrency@@AAAXXZ
?_Assign@_ContextCallback@details@Concurrency@@AAAXPAX@Z
?_Capture@_ContextCallback@details@Concurrency@@AAAXXZ
?_IsCurrentOriginSTA@_ContextCallback@details@Concurrency@@CA_NXZ
_Cnd_broadcast
?_Throw_C_error@std@@YAXH@Z
_Mtx_unlock
_Mtx_lock
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
?GetNextAsyncId@platform@details@Concurrency@@YAIXZ
?_CallInContext@_ContextCallback@details@Concurrency@@QBAXV?$function@$$A6AXXZ@std@@_N@Z
?__ExceptionPtrDestroy@@YAXPAX@Z

concrt140_app

??0critical_section@Concurrency@@QAA@XZ
??1critical_section@Concurrency@@QAA@XZ

vcruntime140_app

__C_specific_handler
memcpy
__std_exception_copy
_purecall
memset
__std_exception_destroy
__std_terminate
__CxxFrameHandler3
_CxxThrowException
__std_type_info_destroy_list
memmove

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e
abort
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_cexit

api-ms-win-crt-heap-l1-1-0

malloc
free
_callnewh

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf
__stdio_common_vsnprintf_s

api-ms-win-crt-string-l1-1-0

wcscmp
strcpy_s

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString
WindowsDuplicateString
WindowsDeleteString
WindowsCreateStringReference
WindowsConcatString
WindowsCompareStringOrdinal

kernel32

GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
SleepConditionVariableSRW
WakeAllConditionVariable
InitOnceBeginInitialize
AcquireSRWLockExclusive
InitOnceComplete
InitializeSListHead
ReleaseSRWLockExclusive
DecodePointer
DisableThreadLibraryCalls

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory

Sections

.text
Size: 77KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

885edd830ee44a02f30770e251b1316f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ipp_uwp

api-ms-win-core-winrt-error-l1-1-0

ole32

api-ms-win-shcore-stream-winrt-l1-1-0

d3d11

mfplat

mfreadwrite

vccorlib140_app

msvcp140_app

concrt140_app

vcruntime140_app

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

kernel32

Exports

Exports

Sections

.text Size: 77KB - Virtual size: 76KB

.rdata Size: 57KB - Virtual size: 57KB

.data Size: 6KB - Virtual size: 6KB

.pdata Size: 5KB - Virtual size: 5KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 77KB - Virtual size: 76KB

.rdata
Size: 57KB - Virtual size: 57KB

.data
Size: 6KB - Virtual size: 6KB

.pdata
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 5KB - Virtual size: 4KB