8248f8aecf458628f133729d428b9810_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

8248f8aecf458628f133729d428b9810_NeikiAnalytics.exe
Size

2.0MB
MD5

8248f8aecf458628f133729d428b9810
SHA1

144bd8ed985976b9258c19e4e10f8ae9aa1ff308
SHA256

fb8c0c8b2e9bda3c79ac108da89e83c539e6b5a7f2af2753d6729526f12fe73e
SHA512

b902a90e2b6d61ac209da44fa940e848eee62dda0c20a9f0b386ed9368c497f3b48d696edf84df616f6e2647d0d215f709aea3e717d2a68c5786409f513d596c
SSDEEP

49152:aA1GfGEIydT2oQJZi6OmXQYDmg27RnWGj:a8D527BWG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8248f8aecf458628f133729d428b9810_NeikiAnalytics.exe

Files

8248f8aecf458628f133729d428b9810_NeikiAnalytics.exe
.exe windows:10 windows x64 arch:x64

a9f114e27bba5123dd7af9b225b159d9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

vssvc.pdb

Imports

msvcrt

_callnewh
_onexit
??0exception@@QEAA@AEBQEBDH@Z
__dllonexit
?what@exception@@UEBAPEBDXZ
_unlock
_lock
_CxxThrowException
__CxxFrameHandler3
memmove_s
??0exception@@QEAA@AEBQEBD@Z
_XcptFilter
wcsstr
qsort
??1type_info@@UEAA@XZ
_amsg_exit
_vscwprintf
_errno
_beginthreadex
wcsncmp
memmove
_wcsicmp
towupper
_wcsnicmp
__wgetmainargs
?terminate@@YAXXZ
iswspace
wcsrchr
wcstoul
iswdigit
memcmp
_vsnprintf
_purecall
wcscat_s
_vsnprintf_s
malloc
realloc
free
??0exception@@QEAA@XZ
memcpy_s
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
_vsnwprintf
__C_specific_handler
_commode
__set_app_type
exit
memset
_exit
_cexit
__setusermatherr
_initterm
_wcmdln
_fmode
wcstok
memcpy
wcscmp

oleaut32

GetErrorInfo
SysAllocString
LoadRegTypeLi
VariantClear
VariantCopy
VariantChangeType
VarUI4FromStr
SysAllocStringLen
VariantInit
SysStringLen
SysFreeString

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-synch-l1-1-0

ReleaseMutex
SetEvent
CancelWaitableTimer
WaitForSingleObjectEx
CreateWaitableTimerExW
CreateMutexExW
CreateSemaphoreExW
OpenSemaphoreW
InitializeCriticalSection
SetWaitableTimer
WaitForMultipleObjectsEx
ResetEvent
EnterCriticalSection
CreateEventW
ReleaseSemaphore
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
LeaveCriticalSection

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
SetErrorMode
RaiseException
SetLastError
UnhandledExceptionFilter

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
Sleep
InitOnceComplete

api-ms-win-core-processthreads-l1-1-0

ResumeThread
OpenThreadToken
SetThreadPriority
CreateThread
GetStartupInfoW
GetCurrentThread
OpenProcessToken
GetCurrentProcessId
GetCurrentProcess
TerminateProcess
OpenThread
GetCurrentThreadId

api-ms-win-core-com-l1-1-0

CoTaskMemRealloc
CoCreateGuid
CoGetClassObject
CoImpersonateClient
CoTaskMemFree
CoDisconnectContext
CoRegisterClassObject
CLSIDFromString
CoFreeUnusedLibraries
CoTaskMemAlloc
CoRevertToSelf
CoGetObjectContext
CoSetProxyBlanket
CoUninitialize
CoInitializeEx
CoInitializeSecurity
CoCreateInstance
StringFromCLSID
CoRevokeClassObject

api-ms-win-core-string-l1-1-0

CompareStringW
MultiByteToWideChar

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-memory-l1-1-0

VirtualAlloc
VirtualQuery
VirtualProtect

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetVersionExW
GetSystemDirectoryW
GetSystemWindowsDirectoryW
GetTickCount64
GetTickCount
GetSystemInfo
GetComputerNameExW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetModuleHandleExW
GetModuleHandleW
GetProcAddress
LoadStringW
GetModuleFileNameA
FindResourceExW
LoadLibraryExW
GetModuleFileNameW
LoadResource
SizeofResource

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap
HeapSetInformation

api-ms-win-core-string-l2-1-0

CharPrevW
CharNextW

api-ms-win-core-registry-l1-1-0

RegEnumKeyExW
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegCloseKey
RegEnumValueW
RegDeleteValueW
RegQueryInfoKeyW
RegQueryValueExW
RegDeleteTreeW

api-ms-win-core-string-obsolete-l1-1-0

lstrcpynW
lstrcmpiW

ntdll

RtlNtStatusToDosError
RtlAdjustPrivilege
EtwTraceMessage
NtThawRegistry
NtFreezeRegistry
NtClose
NtCreateSymbolicLinkObject
RtlInitUnicodeString
NtThawTransactions
NtFreezeTransactions
NtQuerySystemInformation
RtlNtStatusToDosErrorNoTeb
NtQueryVolumeInformationFile
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle

api-ms-win-service-core-l1-1-0

StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerExW
SetServiceStatus

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableW
GetCommandLineW
ExpandEnvironmentStringsW

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-file-l1-1-0

ReadFile
DeleteFileW
GetFileAttributesW
WriteFile
SetFileAttributesW
CreateDirectoryW
DefineDosDeviceW
GetVolumeInformationW
CreateFileW
GetDiskFreeSpaceW
FlushFileBuffers
FindVolumeClose
FindClose
DeleteVolumeMountPointW
FindNextFileW
FindFirstFileW
FindNextVolumeW
GetVolumePathNameW
QueryDosDeviceW
FindFirstVolumeW
GetDriveTypeW

api-ms-win-core-io-l1-1-0

GetOverlappedResult
DeviceIoControl

api-ms-win-core-file-l1-2-0

GetVolumePathNamesForVolumeNameW
GetVolumeNameForVolumeMountPointW

api-ms-win-security-base-l1-1-0

GetLengthSid
InitializeSecurityDescriptor
DuplicateToken
InitializeAcl
GetTokenInformation
AddAccessAllowedAce
PrivilegeCheck
AllocateAndInitializeSid
AdjustTokenPrivileges
CreateWellKnownSid
EqualSid
SetSecurityDescriptorOwner
CopySid
SetSecurityDescriptorGroup
GetAclInformation
GetAce
AddAce
AddAccessDeniedAceEx
AddAccessAllowedAceEx
IsValidSid
AccessCheck
GetSidSubAuthorityCount
EqualDomainSid
CheckTokenMembership
FreeSid
SetSecurityDescriptorDacl

api-ms-win-core-kernel32-legacy-l1-1-1

SetVolumeMountPointW

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventUnregister
EventSetInformation
EventWriteTransfer

rpcrt4

RpcStringFreeW
UuidToStringW
I_RpcBindingInqLocalClientPID

api-ms-win-core-file-l2-1-0

MoveFileExW

api-ms-win-service-private-l1-1-0

I_ScRegisterDeviceNotification
I_ScUnregisterDeviceNotification

api-ms-win-core-kernel32-legacy-l1-1-0

GetComputerNameW

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

vssapi

CreateVssSnapshotSetDescription
VssFreeSnapshotPropertiesInternal
LoadVssSnapshotSetDescription
CreateWriter
CreateWriterEx

devobj

DevObjCreateDeviceInfoList
DevObjEnumDeviceInterfaces
DevObjGetDeviceInterfaceDetail
DevObjEnumDeviceInfo
DevObjDestroyDeviceInfoList
DevObjGetDeviceRegistryProperty
DevObjUninstallDevice
DevObjGetClassDevs

vsstrace

ord5
ord7
ord9
ord1
ord2
ord8
ord4
ord6
ord11
ord10
ord3

api-ms-win-eventlog-legacy-l1-1-0

RegisterEventSourceW
DeregisterEventSource
ReportEventW

authz

AuthzUnregisterSecurityEventSource
AuthzRegisterSecurityEventSource
AuthzReportSecurityEventFromParams

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformation

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

virtdisk

GetStorageDependencyInformation

bcd

BcdCloseObject
BcdGetElementData
BcdCloseStore
BcdOpenObject
BcdOpenSystemStore
BcdForciblyUnloadStore

api-ms-win-core-util-l1-1-0

EncodePointer

Sections

.text
Size: 1004KB - Virtual size: 1004KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 459KB - Virtual size: 458KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 336B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 568KB - Virtual size: 572KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a9f114e27bba5123dd7af9b225b159d9

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

oleaut32

api-ms-win-core-localization-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

ntdll

api-ms-win-service-core-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-eventing-provider-l1-1-0

rpcrt4

api-ms-win-core-file-l2-1-0

api-ms-win-service-private-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-profile-l1-1-0

vssapi

devobj

vsstrace

api-ms-win-eventlog-legacy-l1-1-0

authz

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

virtdisk

bcd

api-ms-win-core-util-l1-1-0

Sections

.text Size: 1004KB - Virtual size: 1004KB

.rdata Size: 459KB - Virtual size: 458KB

.data Size: 1KB - Virtual size: 4KB

.pdata Size: 33KB - Virtual size: 33KB

.didat Size: 512B - Virtual size: 336B

.rsrc Size: 20KB - Virtual size: 19KB

.reloc Size: 568KB - Virtual size: 572KB

.text
Size: 1004KB - Virtual size: 1004KB

.rdata
Size: 459KB - Virtual size: 458KB

.data
Size: 1KB - Virtual size: 4KB

.pdata
Size: 33KB - Virtual size: 33KB

.didat
Size: 512B - Virtual size: 336B

.rsrc
Size: 20KB - Virtual size: 19KB

.reloc
Size: 568KB - Virtual size: 572KB