243d94ce15daf01322b919338d50d9d54f7a51c7a35ca36e829d39b5b91e33f7_NeikiAnalytics

Sharing

Copy URL Twitter E-mail

General

Target

243d94ce15daf01322b919338d50d9d54f7a51c7a35ca36e829d39b5b91e33f7_NeikiAnalytics
Size

1.3MB
MD5

36e097dccf2ff9475e5f9da3232471e0
SHA1

393d874019ee9213c4bd1d43f7a5966121f1846d
SHA256

243d94ce15daf01322b919338d50d9d54f7a51c7a35ca36e829d39b5b91e33f7
SHA512

d73aa872ce787d419ce208861ef1eeaee939f2804822fd7d8ccd43aa9e1673158b8a58d6724c500026531b6afc838e320a7e9ece9697a13c98657d801d3ebf90
SSDEEP

12288:5XQ3ZN2kRCU+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:VQ3L2kRC1MdIuwe3zfIe7xmvH/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
243d94ce15daf01322b919338d50d9d54f7a51c7a35ca36e829d39b5b91e33f7_NeikiAnalytics

Files

243d94ce15daf01322b919338d50d9d54f7a51c7a35ca36e829d39b5b91e33f7_NeikiAnalytics
.exe windows:6 windows x64 arch:x64

290ed5ed5e77a4ad2a79bf3733c18d20

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\mspdbsrv.pdb

Imports

advapi32

GetTokenInformation
OpenThreadToken
EqualSid
OpenProcessToken

kernel32

InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetCurrentProcessId
GetLastError
CloseHandle
GetCurrentProcess
GetCommandLineW
GetCurrentThread
CreateEventW
CreateWaitableTimerW
SetPriorityClass
CreateMutexW
WaitForSingleObject
ReleaseMutex
WaitForMultipleObjectsEx
OpenEventW
SetEvent
CancelWaitableTimer
SetWaitableTimer
VirtualQuery
GetModuleFileNameW
RaiseFailFastException
SetErrorMode
OpenProcess
DuplicateHandle
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetModuleHandleW
TerminateProcess
QueryPerformanceCounter

vcruntime140

_CxxThrowException
__std_exception_destroy
__std_exception_copy
memset
__current_exception_context
__current_exception
memcpy
wcschr
memmove
__C_specific_handler

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

strncpy_s
wcsncpy_s
_wcsdup
_wcsicmp
iswspace

api-ms-win-crt-stdio-l1-1-0

fflush
_set_fmode
__acrt_iob_func
__stdio_common_vsnwprintf_s
fclose
__stdio_common_vfwprintf
_wfopen_s
__p__commode

api-ms-win-crt-time-l1-1-0

_wctime64
_time64

api-ms-win-crt-heap-l1-1-0

malloc
free
_set_new_mode
_callnewh

api-ms-win-crt-convert-l1-1-0

wcstoul

api-ms-win-crt-environment-l1-1-0

_wdupenv_s

api-ms-win-crt-runtime-l1-1-0

_crt_atexit
terminate
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
__p___wargv
__p___argc
_initialize_onexit_table
_exit
_register_onexit_function
_seh_filter_exe
_set_app_type
exit
_configure_wide_argv
_initialize_wide_environment
_initterm
_get_initial_wide_environment
_initterm_e

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

mspdbcore

?CloseAllTimeoutPDB@PDB@@SAHXZ
?SetErrorHandlerAPI@PDB@@SAHP6APEAUIPDBError@@PEAU1@@Z@Z
?OpenEx2W@PDB@@SAHPEBGPEBDJPEAJPEAG_KPEAPEAU1@@Z
?RPC@PDB@@SAHXZ
?OpenValidate4@PDB@@SAHPEBGPEBDPEBU_GUID@@KKPEAJPEAG_KPEAPEAU1@@Z
?open@NameMap@@SAHPEAUPDB@@HPEAPEAU1@@Z
?FOpenW@MREngine@@SAHPEAPEAU1@PEBGAEAJPEAG_KHH@Z
?FOpen@MREngine@@SAHPEAPEAU1@PEAUMreToPdb@@HH@Z
?SetPDBCloseTimeout@PDB@@SAH_K@Z
?FOpen@MREngine@@SAHPEAPEAU1@PEAUPDB@@PEAUNameMap@@HH@Z
?ShutDownTimeoutManager@PDB@@SAHXZ
?OpenNgenPdb@PDB@@SAHPEBG0PEAJPEAG_KPEAPEAU1@@Z

rpcrt4

RpcMgmtStopServerListening
RpcServerListen
RpcServerRegisterIf2
RpcServerUseProtseqEpW
RpcServerUnregisterIf
RpcRevertToSelf
RpcImpersonateClient
NdrClientCall2
NdrServerCall2
RpcBindingInqAuthClientW
RpcMgmtInqStats
RpcMgmtStatsVectorFree

Sections

.text
Size: 81KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 65KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.2MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

290ed5ed5e77a4ad2a79bf3733c18d20

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

vcruntime140

vcruntime140_1

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

mspdbcore

rpcrt4

Sections

.text Size: 81KB - Virtual size: 81KB

.rdata Size: 65KB - Virtual size: 64KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 14KB - Virtual size: 13KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 1.2MB - Virtual size: 1.8MB

.text
Size: 81KB - Virtual size: 81KB

.rdata
Size: 65KB - Virtual size: 64KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 14KB - Virtual size: 13KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 1.2MB - Virtual size: 1.8MB