e34e34536fb0c218a423c73d19882820_NeikiAnalytics

Sharing

Copy URL Twitter E-mail

General

Target

e34e34536fb0c218a423c73d19882820_NeikiAnalytics
Size

705KB
MD5

e34e34536fb0c218a423c73d19882820
SHA1

6b80c1186eee7d38c1694fc4f3f4e30bc6155f30
SHA256

c2f8e5edd93805e319a00a69d97e5439753af1a9ee385b8fbda9ede66a5f9af0
SHA512

410599e00d47a06334b1cbe930505c49c4703b2302fefdd18b7ca0dc24ba460bb85331329072867a9dad44594d5b96aedaf831a9605c3c710f63f5e0e42763bd
SSDEEP

12288:ikyXMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:ly8SkQ/7Gb8NLEbeZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e34e34536fb0c218a423c73d19882820_NeikiAnalytics

Files

e34e34536fb0c218a423c73d19882820_NeikiAnalytics
.exe windows:6 windows x64 arch:x64

364ce282a93e03a146321d365523e1d1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

msdtcexe.pdb

Imports

kernel32

GetCommandLineW
TlsGetValue
UnregisterWait
TlsFree
TlsAlloc
LocalAlloc
ExpandEnvironmentStringsW
SetFileAttributesW
LocalFree
DeleteFileW
DeleteCriticalSection
FindNextFileW
IsDebuggerPresent
LockResource
FindClose
GetModuleFileNameW
GetExitCodeProcess
FormatMessageW
GetCurrentThread
CreateDirectoryW
LoadLibraryExW
CreateProcessW
LoadResource
FindResourceW
FindFirstFileW
GetThreadContext
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
Sleep
GetStartupInfoW
SetUnhandledExceptionFilter
GetModuleHandleW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetFullPathNameW
FreeLibrary
SetEvent
WaitForSingleObjectEx
OutputDebugStringW
QueryFullProcessImageNameW
CreateEventA
CreateFileW
GetLastError
GetProcAddress
ResetEvent
GetLocalTime
LoadLibraryA
QueueUserWorkItem
CloseHandle
DebugBreak
GetSystemWindowsDirectoryA

ole32

CoCreateInstance
StringFromGUID2
CoGetObjectContext
CoInitializeEx
CoUninitialize

msvcrt

__CxxFrameHandler3
??1type_info@@UEAA@XZ
_wfopen
memcpy
_CxxThrowException
memset
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
__set_app_type
_fmode
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
_purecall
_commode
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_cexit
_exit
_XcptFilter
__C_specific_handler
__wgetmainargs
free
_callnewh
malloc
wcschr
_wstrdate
_waccess
_wstrtime
_wcsicmp
_vsnwprintf
fwprintf
fflush
fopen
fprintf
fclose
wcsrchr
_local_unwind

msdtctm

ord4

ntdll

RtlReportException
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

version

VerQueryValueW

user32

GetWindowRect
GetThreadDesktop
CloseWindowStation
DialogBoxParamW
GetProcessWindowStation
OpenDesktopW
GetClientRect
SetProcessWindowStation
EndDialog
GetDesktopWindow
SetWindowPos
SetThreadDesktop
SetDlgItemTextW
OpenWindowStationW
MapWindowPoints
LoadStringW
CloseDesktop

advapi32

RegOpenKeyExW
GetTokenInformation
OpenProcessToken
RegSetValueExW
RegCloseKey
ReportEventW
RegisterEventSourceW
RegOpenKeyExA
DeregisterEventSource
RegQueryValueExW
RegQueryValueExA

Sections

.text
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 94KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 568KB - Virtual size: 572KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

364ce282a93e03a146321d365523e1d1

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

ole32

msvcrt

msdtctm

ntdll

version

user32

advapi32

Sections

.text Size: 39KB - Virtual size: 38KB

.data Size: 1KB - Virtual size: 10KB

.pdata Size: 1KB - Virtual size: 1KB

.rsrc Size: 94KB - Virtual size: 94KB

.reloc Size: 568KB - Virtual size: 572KB

.text
Size: 39KB - Virtual size: 38KB

.data
Size: 1KB - Virtual size: 10KB

.pdata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 94KB - Virtual size: 94KB

.reloc
Size: 568KB - Virtual size: 572KB