General

Malware Config

Signatures

Files

• e5264505016723c2871b4cac2b4e4ad0_NeikiAnalytics.exe

  .exe windows:6 windows x86 arch:x86

  97dd52f58782275b1df4da4355367e64

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  D:\a\_work\1\s\\binaries\x86ret\bin\i386\nmake.pdb

  Imports

  kernel32

  FindResourceExW

  LoadResource

  WaitForSingleObject

  GetExitCodeProcess

  Sleep

  CloseHandle

  GetTempFileNameW

  GetModuleHandleW

  GetProcAddress

  GetSystemTimeAsFileTime

  CreateFileW

  SetFileTime

  FindFirstFileW

  FindClose

  FindNextFileW

  GetFileTime

  WideCharToMultiByte

  LoadLibraryExW

  GetLastError

  GetEnvironmentVariableW

  EncodePointer

  DecodePointer

  HeapAlloc

  GetProcessHeap

  HeapFree

  GetUserDefaultUILanguage

  SetErrorMode

  VirtualQuery

  GetModuleFileNameW

  GetFileSizeEx

  GetFileType

  GetConsoleMode

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  GetDateFormatW

  GetTimeFormatW

  SetUnhandledExceptionFilter

  GetCurrentProcess

  TerminateProcess

  IsProcessorFeaturePresent

  QueryPerformanceCounter

  GetCurrentProcessId

  GetCurrentThreadId

  InitializeSListHead

  IsDebuggerPresent

  UnhandledExceptionFilter

  vcruntime140

  __current_exception

  memset

  wcsstr

  wcsrchr

  wcschr

  _except_handler4_common

  __current_exception_context

  memcpy

  memmove

  api-ms-win-crt-heap-l1-1-0

  free

  malloc

  _set_new_mode

  realloc

  api-ms-win-crt-string-l1-1-0

  wcsncat_s

  wcsncpy_s

  towupper

  wcsncmp

  iswalpha

  wcscat_s

  wcscpy_s

  _wcsnicmp

  wcstok_s

  iswdigit

  iswspace

  wcspbrk

  _wcsicmp

  wcsspn

  _wcsupr_s

  api-ms-win-crt-environment-l1-1-0

  _wgetenv_s

  _wputenv_s

  _wdupenv_s

  _wputenv

  _wgetcwd

  __p__wenviron

  _wsearchenv

  api-ms-win-crt-stdio-l1-1-0

  _set_fmode

  _wsopen_s

  __stdio_common_vfwprintf

  _dup2

  _fileno

  fputwc

  __acrt_iob_func

  __p__commode

  _close

  fflush

  _fcloseall

  _lseek

  _dup

  _wfopen_s

  ungetwc

  setvbuf

  _get_osfhandle

  fclose

  __stdio_common_vswscanf

  feof

  getwc

  fgetws

  __stdio_common_vswprintf_s

  _wfsopen

  fwrite

  api-ms-win-crt-runtime-l1-1-0

  _wcserror_s

  _errno

  _set_invalid_parameter_handler

  signal

  exit

  _controlfp_s

  __p__wpgmptr

  _crt_atexit

  _register_onexit_function

  _initialize_onexit_table

  terminate

  _register_thread_local_exe_atexit_callback

  _c_exit

  _cexit

  __doserrno

  __p___argc

  _exit

  _seh_filter_exe

  _set_app_type

  __p___wargv

  _configure_wide_argv

  _initialize_wide_environment

  _get_initial_wide_environment

  _initterm

  _initterm_e

  api-ms-win-crt-convert-l1-1-0

  wcstoul

  _itow_s

  wcstol

  api-ms-win-crt-process-l1-1-0

  _wspawnvp

  api-ms-win-crt-filesystem-l1-1-0

  _wsplitpath_s

  _wremove

  _chdrive

  _waccess_s

  _wunlink

  _waccess

  _wchdir

  _wmakepath_s

  api-ms-win-crt-locale-l1-1-0

  setlocale

  _configthreadlocale

  api-ms-win-crt-conio-l1-1-0

  _putwch

  __conio_common_vcwprintf

  api-ms-win-crt-math-l1-1-0

  __setusermatherr

  Sections

  .text

  Size: 64KB - Virtual size: 63KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 147KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 12KB - Virtual size: 11KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 572KB - Virtual size: 576KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE