General

Malware Config

Signatures

Files

• 7a00d66136d3cef6abcc8d8406cda6f0_NeikiAnalytics.exe

  .dll regsvr32 windows:5 windows x86 arch:x86

  7e3ba57b003bfccb1c006adcb8af447a

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  PDB Paths

  PDFPrevHndlr.pdb

  Imports

  version

  GetFileVersionInfoW

  VerQueryValueW

  GetFileVersionInfoSizeW

  kernel32

  CreateMutexW

  DisconnectNamedPipe

  ReadFile

  ConnectNamedPipe

  WaitForSingleObject

  WriteFile

  GetProcAddress

  GetModuleHandleW

  InitializeCriticalSection

  CreateEventW

  CreateThread

  ResetEvent

  LocalFree

  CreateNamedPipeW

  CloseHandle

  GetCurrentProcessId

  SetEvent

  DeleteCriticalSection

  OpenMutexW

  Sleep

  SetNamedPipeHandleState

  lstrlenW

  GetVolumeInformationW

  GetTickCount

  GetModuleHandleA

  GetFileAttributesW

  GetVersion

  RaiseException

  InitializeCriticalSectionAndSpinCount

  lstrcmpiW

  LoadLibraryW

  SetLastError

  GetModuleFileNameW

  CallNamedPipeW

  LoadLibraryExW

  InterlockedIncrement

  InterlockedDecrement

  FreeLibrary

  MultiByteToWideChar

  SizeofResource

  LoadResource

  FindResourceW

  UnmapViewOfFile

  MapViewOfFile

  CreateFileMappingW

  ReleaseMutex

  SetThreadLocale

  GetThreadLocale

  TerminateProcess

  GlobalUnlock

  GlobalLock

  GlobalSize

  FindClose

  FindFirstFileW

  FormatMessageW

  CreateProcessW

  SetCurrentDirectoryW

  GetSystemDirectoryW

  GetCurrentDirectoryW

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  GetCurrentProcess

  InterlockedCompareExchange

  InterlockedExchange

  DecodePointer

  EncodePointer

  GetLastError

  WaitNamedPipeW

  CreateFileW

  GetVersionExW

  LeaveCriticalSection

  EnterCriticalSection

  IsDebuggerPresent

  QueryPerformanceCounter

  GetCurrentThreadId

  OutputDebugStringA

  GetSystemTimeAsFileTime

  user32

  SetFocus

  GetKeyState

  GetFocus

  SetParent

  PostMessageW

  GetParent

  MsgWaitForMultipleObjects

  DispatchMessageW

  TranslateMessage

  PeekMessageW

  WaitForInputIdle

  CopyRect

  IsWindow

  EqualRect

  SetWindowPos

  CharNextW

  IsRectEmpty

  advapi32

  ConvertStringSecurityDescriptorToSecurityDescriptorW

  RegCreateKeyExW

  RegDeleteKeyW

  RegDeleteValueW

  RegCloseKey

  RegSetValueExW

  RegQueryInfoKeyW

  RegEnumKeyExW

  RegQueryValueExW

  RegOpenKeyExW

  ole32

  CoTaskMemAlloc

  CoTaskMemRealloc

  CoTaskMemFree

  StringFromGUID2

  CoCreateInstance

  GetHGlobalFromStream

  CoMarshalInterface

  CreateStreamOnHGlobal

  oleaut32

  RegisterTypeLi

  UnRegisterTypeLi

  LoadTypeLi

  SysAllocString

  SysFreeString

  SysStringLen

  VarUI4FromStr

  msvcp100

  ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@H@Z

  ??0?$basic_ios@GU?$char_traits@G@std@@@std@@IAE@XZ

  ??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z

  ??1?$basic_ios@GU?$char_traits@G@std@@@std@@UAE@XZ

  ??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAE@XZ

  ??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UAE@XZ

  ?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ

  ?_BADOFF@std@@3_JB

  ?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXH@Z

  ?pbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXH@Z

  ?gptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ

  ?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEXABVlocale@2@@Z

  ?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEHXZ

  ?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEPAV12@PAG_J@Z

  ?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPBG_J@Z

  ?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPAG_J@Z

  ?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGXZ

  ?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JXZ

  ?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ

  ?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ

  ??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAE@XZ

  ?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ

  ?_Xlength_error@std@@YAXPBD@Z

  ?_Xout_of_range@std@@YAXPBD@Z

  ?clear@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXH_N@Z

  msvcr100

  srand

  _time64

  wcsrchr

  _vsnwprintf

  wcstok_s

  _wtof

  towlower

  memmove_s

  _wcsicmp

  _wmakepath_s

  _wsplitpath_s

  _except_handler4_common

  _unlock

  __dllonexit

  _lock

  _onexit

  __clean_type_info_names_internal

  _crt_debugger_hook

  ?_type_info_dtor_internal_method@type_info@@QAEXXZ

  __CppXcptFilter

  _amsg_exit

  _initterm_e

  _initterm

  _encoded_null

  _malloc_crt

  rand

  ?terminate@@YAXXZ

  ??0exception@std@@QAE@ABQBD@Z

  ?what@exception@std@@UBEPBDXZ

  ??1exception@std@@UAE@XZ

  ??3@YAXPAX@Z

  memcpy

  memmove

  wcslen

  memset

  memcpy_s

  ??2@YAPAXI@Z

  _CxxThrowException

  ??0exception@std@@QAE@ABV01@@Z

  __CxxFrameHandler3

  ??_V@YAXPAX@Z

  memcmp

  wcsstr

  malloc

  free

  wcsncpy_s

  _recalloc

  _snwprintf_s

  wcscpy_s

  wcscat_s

  swprintf_s

  _wtol

  rpcrt4

  CStdStubBuffer_AddRef

  RpcStringFreeW

  UuidCreate

  UuidToStringW

  NdrDllUnregisterProxy

  NdrDllRegisterProxy

  NdrCStdStubBuffer_Release

  NdrDllCanUnloadNow

  NdrDllGetClassObject

  IUnknown_QueryInterface_Proxy

  IUnknown_AddRef_Proxy

  IUnknown_Release_Proxy

  NdrOleAllocate

  NdrOleFree

  CStdStubBuffer_QueryInterface

  CStdStubBuffer_Connect

  CStdStubBuffer_Disconnect

  CStdStubBuffer_Invoke

  CStdStubBuffer_IsIIDSupported

  CStdStubBuffer_DebugServerRelease

  CStdStubBuffer_DebugServerQueryInterface

  CStdStubBuffer_CountRefs

  Exports

  Exports

  ??0_Mutex@std@@QAE@W4_Uninitialized@1@@Z

  ??4_Init_locks@std@@QAEAAV01@ABV01@@Z

  DllCanUnloadNow

  DllGetClassObject

  DllRegisterServer

  DllUnregisterServer

  Sections

  .text

  Size: 48KB - Virtual size: 48KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .orpc

  Size: 512B - Virtual size: 45B

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 20KB - Virtual size: 20KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 2KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 11KB - Virtual size: 11KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 241KB - Virtual size: 244KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ