41c576d0c22e48e3e625d379df4c42a0_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

41c576d0c22e48e3e625d379df4c42a0_NeikiAnalytics.exe
Size

1.8MB
MD5

41c576d0c22e48e3e625d379df4c42a0
SHA1

3ad1bff519a0d6f4b80e211df6cb74fc6ff45c0f
SHA256

a6100c0b632771911272d6fb576dfef291d81c4d719a78228363c058b69fd197
SHA512

323259d4465d2c5713711e1f7bde6393663a3ab3aea256277fd81c37d1ea58c332f0713557dbb1af6adc44892ceb8547490134f146df60708f8eb244a10f668f
SSDEEP

12288:dfpFnFMFFKX7vqE1DMN4n2p7sz6MAj09IXuFsLBZs4f6UYfqyTilhGCQE2fO:BZX7vqE1DMh4ez/uqLrs4CNShGq2O

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
41c576d0c22e48e3e625d379df4c42a0_NeikiAnalytics.exe

Files

41c576d0c22e48e3e625d379df4c42a0_NeikiAnalytics.exe
.dll regsvr32 windows:4 windows x86 arch:x86

98ed0c717de2524d793ee04fd66e0cab

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

advapi32

RegCloseKey
RegDeleteKeyW
RegEnumKeyExW
RegEnumKeyW
RegQueryInfoKeyW
RegQueryValueA
RegQueryValueExW
RegQueryValueW
RegSetValueExW
RegSetValueW

combase

CLIPFORMAT_UserFree
CLIPFORMAT_UserMarshal
CLIPFORMAT_UserSize
CLIPFORMAT_UserUnmarshal
CLSIDFromProgID
CLSIDFromString
CoCreateFreeThreadedMarshaler
CoCreateInstance
CoFileTimeNow
CoGetClassObject
CoGetMarshalSizeMax
CoInitializeEx
CoLockObjectExternal
CoMarshalInterface
CoReleaseMarshalData
CoTaskMemAlloc
CoTaskMemFree
CoUninitialize
CoUnmarshalInterface
CoWaitForMultipleHandles
CreateStreamOnHGlobal
GetHGlobalFromStream
HACCEL_UserFree
HACCEL_UserMarshal
HACCEL_UserSize
HACCEL_UserUnmarshal
HBITMAP_UserFree
HBITMAP_UserMarshal
HBITMAP_UserSize
HBITMAP_UserUnmarshal
HDC_UserFree
HDC_UserMarshal
HDC_UserSize
HDC_UserUnmarshal
HGLOBAL_UserFree
HGLOBAL_UserMarshal
HGLOBAL_UserSize
HGLOBAL_UserUnmarshal
HICON_UserFree
HICON_UserMarshal
HICON_UserSize
HICON_UserUnmarshal
HMENU_UserFree
HMENU_UserMarshal
HMENU_UserSize
HMENU_UserUnmarshal
HWND_UserFree
HWND_UserMarshal
HWND_UserSize
HWND_UserUnmarshal
InternalCoStdMarshalObject
InternalIrotEnumRunning
InternalIrotGetObject
InternalIrotGetTimeOfLastChange
InternalIrotIsRunning
InternalIrotNoteChangeTime
InternalIrotRegister
InternalIrotRevoke
InternalIsProcessInitialized
InternalTlsAllocData
ProgIDFromCLSID
PropVariantClear
PropVariantCopy
StringFromGUID2
WdtpInterfacePointer_UserMarshal
WdtpInterfacePointer_UserSize
WdtpInterfacePointer_UserUnmarshal

coml2

CreateILockBytesOnHGlobal
FmtIdToPropStgName
GetConvertStg
GetHGlobalFromILockBytes
PropStgNameToFmtId
ReadClassStg
ReadClassStm
StgCreatePropSetStg
StgIsStorageFile
StgIsStorageILockBytes
WriteClassStg
WriteClassStm

gdi32

BitBlt
CloseMetaFile
CopyEnhMetaFileW
CopyMetaFileW
CreateBitmapIndirect
CreateCompatibleBitmap
CreateCompatibleDC
CreateDIBitmap
CreateFontIndirectW
CreateMetaFileW
CreatePalette
DeleteDC
DeleteEnhMetaFile
DeleteMetaFile
DeleteObject
ExtEscape
GetBitmapBits
GetDIBits
GetDeviceCaps
GetEnhMetaFileBits
GetMetaFileBitsEx
GetObjectW
GetPaletteEntries
GetTextExtentPoint32W
GetWinMetaFileBits
PlayMetaFile
SelectObject
SetEnhMetaFileBits
SetMapMode
SetMetaFileBitsEx
SetViewportExtEx
SetViewportOrgEx
SetWinMetaFileBits
SetWindowExtEx
SetWindowOrgEx
StretchDIBits
TextOutW

kernel32

DelayLoadFailureHook
EnumResourceNamesW
FindResourceW
GetEnvironmentVariableW
GetModuleFileNameW
GetProcAddress
GlobalLock
GlobalSize
GlobalUnlock
IsBadCodePtr
IsBadReadPtr
IsBadStringPtrA
IsBadStringPtrW
LoadLibraryW
LoadResource
QueryPerformanceCounter
QueryPerformanceFrequency
ResolveDelayLoadedAPI
RtlUnwind
SizeofResource

kernelbase

CloseHandle
CreateEventW
CreateFileMappingW
CreateFileW
DeleteCriticalSection
DeleteFileW
DisableThreadLibraryCalls
DuplicateHandle
EnterCriticalSection
ExpandEnvironmentStringsW
FindActCtxSectionGuid
FreeLibrary
GetACP
GetFileAttributesExW
GetFileAttributesW
GetFileSize
GetFullPathNameW
GetModuleHandleW
GetTempFileNameW
GetTempPathW
GetThreadLocale
GetTickCount
GetVersion
GlobalAlloc
GlobalFree
HeapAlloc
HeapFree
HeapReAlloc
InitOnceExecuteOnce
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryExW
LockFileEx
MapViewOfFile
MulDiv
MultiByteToWideChar
OpenProcess
PathCchFindExtension
RaiseException
ReadFile
ResetEvent
SetEndOfFile
SetEvent
SetFilePointerEx
Sleep
UnlockFileEx
UnmapViewOfFile
VirtualQuery
WideCharToMultiByte
WriteFile
lstrcmpA
lstrcmpiA
lstrcmpiW

ntdll

NtClose
NtCreateKey
NtOpenKey
RtlInitUnicodeString
RtlNtStatusToDosError
_vsnprintf

rpcrt4

CStdStubBuffer_AddRef
CStdStubBuffer_Connect
CStdStubBuffer_CountRefs
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
CStdStubBuffer_Invoke
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_QueryInterface
IUnknown_AddRef_Proxy
IUnknown_QueryInterface_Proxy
IUnknown_Release_Proxy
NdrAllocate
NdrCStdStubBuffer_Release
NdrClearOutParameters
NdrComplexArrayBufferSize
NdrComplexArrayMarshall
NdrComplexArrayUnmarshall
NdrComplexStructBufferSize
NdrComplexStructMarshall
NdrComplexStructUnmarshall
NdrConformantArrayBufferSize
NdrConformantArrayFree
NdrConformantArrayMarshall
NdrConformantArrayUnmarshall
NdrConformantStringBufferSize
NdrConformantStringMarshall
NdrConformantStringUnmarshall
NdrConformantStructBufferSize
NdrConformantStructMarshall
NdrConformantStructUnmarshall
NdrConformantVaryingArrayBufferSize
NdrConformantVaryingArrayMarshall
NdrConformantVaryingArrayUnmarshall
NdrConvert
NdrDllCanUnloadNow
NdrDllGetClassObject
NdrInterfacePointerBufferSize
NdrInterfacePointerFree
NdrInterfacePointerMarshall
NdrInterfacePointerUnmarshall
NdrOleAllocate
NdrOleFree
NdrPointerBufferSize
NdrPointerFree
NdrPointerMarshall
NdrPointerUnmarshall
NdrProxyErrorHandler
NdrProxyFreeBuffer
NdrProxyGetBuffer
NdrProxyInitialize
NdrProxySendReceive
NdrSimpleStructBufferSize
NdrSimpleStructMarshall
NdrSimpleStructUnmarshall
NdrStubGetBuffer
NdrStubInitialize
NdrUserMarshalBufferSize
NdrUserMarshalFree
NdrUserMarshalMarshall
NdrUserMarshalUnmarshall
RpcRaiseException
UuidFromStringW

ucrtbase

__acrt_iob_func
__stdio_common_vsprintf
__stdio_common_vswprintf
_assert
_strdup
_wcsicmp
_wcsnicmp
calloc
free
fwrite
getenv
malloc
memcmp
memcpy
memmove
memset
realloc
strchr
strcmp
strcpy
strcspn
strlen
towupper
wcschr
wcscmp
wcstol
wcstoul

user32

CallNextHookEx
CloseClipboard
CopyAcceleratorTableW
CreateWindowExW
DefWindowProcW
DestroyWindow
DispatchMessageW
DrawIcon
EmptyClipboard
EnumClipboardFormats
GetClipboardData
GetClipboardFormatNameA
GetClipboardFormatNameW
GetClipboardSequenceNumber
GetDC
GetKeyState
GetKeyboardState
GetMenuItemCount
GetMessageW
GetParent
GetPropW
GetSubMenu
GetSystemMetrics
GetWindowLongA
GetWindowThreadProcessId
IsClipboardFormatAvailable
IsWindow
KillTimer
LoadCursorW
OpenClipboard
PostQuitMessage
RegisterClassExW
RegisterClassW
RegisterClipboardFormatA
RegisterClipboardFormatW
ReleaseCapture
ReleaseDC
RemovePropW
SendMessageW
SetCapture
SetClipboardData
SetCursor
SetPropW
SetTimer
SetWindowLongW
SetWindowsHookExW
SystemParametersInfoW
UnhookWindowsHookEx
UnregisterClassW
WindowFromPoint
wsprintfW

Exports

Exports

BindMoniker
CLIPFORMAT_UserFree
CLIPFORMAT_UserMarshal
CLIPFORMAT_UserSize
CLIPFORMAT_UserUnmarshal
CLSIDFromProgID
CLSIDFromProgIDEx
CLSIDFromString
CoAddRefServerProcess
CoAllowSetForegroundWindow
CoBuildVersion
CoCopyProxy
CoCreateFreeThreadedMarshaler
CoCreateGuid
CoCreateInstance
CoCreateInstanceEx
CoCreateInstanceFromApp
CoDecrementMTAUsage
CoDisableCallCancellation
CoDisconnectObject
CoDosDateTimeToFileTime
CoEnableCallCancellation
CoFileTimeNow
CoFileTimeToDosDateTime
CoFreeAllLibraries
CoFreeLibrary
CoFreeUnusedLibraries
CoFreeUnusedLibrariesEx
CoGetActivationState
CoGetApartmentType
CoGetCallContext
CoGetCallState
CoGetCallerTID
CoGetClassObject
CoGetContextToken
CoGetCurrentLogicalThreadId
CoGetCurrentProcess
CoGetDefaultContext
CoGetInstanceFromFile
CoGetInstanceFromIStorage
CoGetInterfaceAndReleaseStream
CoGetMalloc
CoGetMarshalSizeMax
CoGetObject
CoGetObjectContext
CoGetPSClsid
CoGetStandardMarshal
CoGetState
CoGetTIDFromIPID
CoGetTreatAsClass
CoImpersonateClient
CoIncrementMTAUsage
CoInitialize
CoInitializeEx
CoInitializeSecurity
CoInitializeWOW
CoIsHandlerConnected
CoIsOle1Class
CoLoadLibrary
CoLockObjectExternal
CoMarshalHresult
CoMarshalInterThreadInterfaceInStream
CoMarshalInterface
CoQueryAuthenticationServices
CoQueryClientBlanket
CoQueryProxyBlanket
CoQueryReleaseObject
CoRegisterChannelHook
CoRegisterClassObject
CoRegisterInitializeSpy
CoRegisterMallocSpy
CoRegisterMessageFilter
CoRegisterPSClsid
CoRegisterSurrogate
CoRegisterSurrogateEx
CoReleaseMarshalData
CoReleaseServerProcess
CoResumeClassObjects
CoRevertToSelf
CoRevokeClassObject
CoRevokeInitializeSpy
CoRevokeMallocSpy
CoSetProxyBlanket
CoSetState
CoSuspendClassObjects
CoSwitchCallContext
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
CoTreatAsClass
CoUninitialize
CoUnloadingWOW
CoUnmarshalHresult
CoUnmarshalInterface
CoWaitForMultipleHandles
CreateAntiMoniker
CreateBindCtx
CreateClassMoniker
CreateDataAdviseHolder
CreateDataCache
CreateErrorInfo
CreateFileMoniker
CreateGenericComposite
CreateILockBytesOnHGlobal
CreateItemMoniker
CreateObjrefMoniker
CreateOleAdviseHolder
CreatePointerMoniker
CreateStreamOnHGlobal
DestroyRunningObjectTable
DllDebugObjectRPCHook
DllGetClassObject
DllGetClassObjectWOW
DllRegisterServer
DllUnregisterServer
DoDragDrop
EnableHookObject
FmtIdToPropStgName
FreePropVariantArray
GetClassFile
GetConvertStg
GetDocumentBitStg
GetErrorInfo
GetHGlobalFromILockBytes
GetHGlobalFromStream
GetHookInterface
GetRunningObjectTable
HACCEL_UserFree
HACCEL_UserMarshal
HACCEL_UserSize
HACCEL_UserUnmarshal
HBITMAP_UserFree
HBITMAP_UserMarshal
HBITMAP_UserSize
HBITMAP_UserUnmarshal
HBRUSH_UserFree
HBRUSH_UserMarshal
HBRUSH_UserSize
HBRUSH_UserUnmarshal
HDC_UserFree
HDC_UserMarshal
HDC_UserSize
HDC_UserUnmarshal
HENHMETAFILE_UserFree
HENHMETAFILE_UserMarshal
HENHMETAFILE_UserSize
HENHMETAFILE_UserUnmarshal
HGLOBAL_UserFree
HGLOBAL_UserMarshal
HGLOBAL_UserSize
HGLOBAL_UserUnmarshal
HICON_UserFree
HICON_UserMarshal
HICON_UserSize
HICON_UserUnmarshal
HMENU_UserFree
HMENU_UserMarshal
HMENU_UserSize
HMENU_UserUnmarshal
HMETAFILEPICT_UserFree
HMETAFILEPICT_UserMarshal
HMETAFILEPICT_UserSize
HMETAFILEPICT_UserUnmarshal
HMETAFILE_UserFree
HMETAFILE_UserMarshal
HMETAFILE_UserSize
HMETAFILE_UserUnmarshal
HPALETTE_UserFree
HPALETTE_UserMarshal
HPALETTE_UserSize
HPALETTE_UserUnmarshal
HWND_UserFree
HWND_UserMarshal
HWND_UserSize
HWND_UserUnmarshal
IIDFromString
I_RemoteMain
IsAccelerator
IsEqualGUID
IsValidIid
IsValidInterface
IsValidPtrIn
IsValidPtrOut
MkParseDisplayName
MonikerCommonPrefixWith
MonikerRelativePathTo
Ole32DllGetClassObject
OleBuildVersion
OleConvertIStorageToOLESTREAM
OleConvertIStorageToOLESTREAMEx
OleConvertOLESTREAMToIStorage
OleConvertOLESTREAMToIStorageEx
OleCreate
OleCreateDefaultHandler
OleCreateEmbeddingHelper
OleCreateEx
OleCreateFromData
OleCreateFromDataEx
OleCreateFromFile
OleCreateFromFileEx
OleCreateLink
OleCreateLinkEx
OleCreateLinkFromData
OleCreateLinkFromDataEx
OleCreateLinkToFile
OleCreateLinkToFileEx
OleCreateMenuDescriptor
OleCreateStaticFromData
OleDestroyMenuDescriptor
OleDoAutoConvert
OleDraw
OleDuplicateData
OleFlushClipboard
OleGetAutoConvert
OleGetClipboard
OleGetIconOfClass
OleGetIconOfFile
OleInitialize
OleInitializeWOW
OleIsCurrentClipboard
OleIsRunning
OleLoad
OleLoadFromStream
OleLockRunning
OleMetafilePictFromIconAndLabel
OleNoteObjectVisible
OleQueryCreateFromData
OleQueryLinkFromData
OleRegEnumFormatEtc
OleRegEnumVerbs
OleRegGetMiscStatus
OleRegGetUserType
OleRun
OleSave
OleSaveToStream
OleSetAutoConvert
OleSetClipboard
OleSetContainedObject
OleSetMenuDescriptor
OleTranslateAccelerator
OleUninitialize
OpenOrCreateStream
ProgIDFromCLSID
PropStgNameToFmtId
PropSysAllocString
PropSysFreeString
PropVariantClear
PropVariantCopy
ReadClassStg
ReadClassStm
ReadFmtUserTypeStg
ReadOleStg
ReadStringStream
RegisterDragDrop
ReleaseStgMedium
RevokeDragDrop
SNB_UserFree
SNB_UserMarshal
SNB_UserSize
SNB_UserUnmarshal
STGMEDIUM_UserFree
STGMEDIUM_UserMarshal
STGMEDIUM_UserSize
STGMEDIUM_UserUnmarshal
SetConvertStg
SetDocumentBitStg
SetErrorInfo
StgConvertPropertyToVariant
StgConvertVariantToProperty
StgCreateDocfile
StgCreateDocfileOnILockBytes
StgCreatePropSetStg
StgCreatePropStg
StgCreateStorageEx
StgGetIFillLockBytesOnFile
StgGetIFillLockBytesOnILockBytes
StgIsStorageFile
StgIsStorageILockBytes
StgOpenAsyncDocfileOnIFillLockBytes
StgOpenPropStg
StgOpenStorage
StgOpenStorageEx
StgOpenStorageOnILockBytes
StgSetTimes
StringFromCLSID
StringFromGUID2
StringFromIID
UpdateDCOMSettings
UtConvertDvtd16toDvtd32
UtConvertDvtd32toDvtd16
UtGetDvtd16Info
UtGetDvtd32Info
WdtpInterfacePointer_UserFree
WdtpInterfacePointer_UserMarshal
WdtpInterfacePointer_UserSize
WdtpInterfacePointer_UserUnmarshal
WriteClassStg
WriteClassStm
WriteFmtUserTypeStg
WriteOleStg
WriteStringStream

Sections

.text
Size: 656KB - Virtual size: 655KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 112KB - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 108KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 148KB - Virtual size: 146KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

98ed0c717de2524d793ee04fd66e0cab

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

combase

coml2

gdi32

kernel32

kernelbase

ntdll

rpcrt4

ucrtbase

user32

Exports

Exports

Sections

.text Size: 656KB - Virtual size: 655KB

.data Size: 4KB - Virtual size: 1KB

.rodata Size: 4KB - Virtual size: 1KB

.rdata Size: 112KB - Virtual size: 110KB

/4 Size: 108KB - Virtual size: 105KB

.edata Size: 16KB - Virtual size: 12KB

.idata Size: 12KB - Virtual size: 11KB

.rsrc Size: 148KB - Virtual size: 146KB

.reloc Size: 40KB - Virtual size: 38KB

.text
Size: 656KB - Virtual size: 655KB

.data
Size: 4KB - Virtual size: 1KB

.rodata
Size: 4KB - Virtual size: 1KB

.rdata
Size: 112KB - Virtual size: 110KB

/4
Size: 108KB - Virtual size: 105KB

.edata
Size: 16KB - Virtual size: 12KB

.idata
Size: 12KB - Virtual size: 11KB

.rsrc
Size: 148KB - Virtual size: 146KB

.reloc
Size: 40KB - Virtual size: 38KB