General

Malware Config

Signatures

Files

• 8a66b250f1382980ec69b32edb5ed160_NeikiAnalytics.exe

  .exe windows:5 windows x64 arch:x64

  5684ac498f33e673679c0e6eb97444cd

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  PDB Paths

  GoogleCrashHandler64_unsigned.pdb

  Imports

  kernel32

  SetNamedPipeHandleState

  TransactNamedPipe

  WaitNamedPipeW

  GetModuleHandleW

  GetProcessHeap

  DeleteCriticalSection

  CreateSemaphoreW

  IsDebuggerPresent

  OutputDebugStringW

  EnterCriticalSection

  LeaveCriticalSection

  RtlCaptureContext

  RtlLookupFunctionEntry

  RtlVirtualUnwind

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  TerminateProcess

  IsProcessorFeaturePresent

  GetStartupInfoW

  QueryPerformanceCounter

  GetCurrentProcessId

  GetCurrentThreadId

  GetSystemTimeAsFileTime

  InitializeSListHead

  RtlUnwindEx

  SetLastError

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  FreeLibrary

  LoadLibraryExW

  EncodePointer

  RtlPcToFileHeader

  ExitProcess

  GetModuleHandleExW

  GetModuleFileNameW

  GetStdHandle

  WriteFile

  FindClose

  FindFirstFileExW

  FindNextFileW

  IsValidCodePage

  GetACP

  GetOEMCP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  MultiByteToWideChar

  WideCharToMultiByte

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  FlsAlloc

  FlsGetValue

  FlsSetValue

  FlsFree

  LCMapStringW

  GetFileType

  SetStdHandle

  GetStringTypeW

  FlushFileBuffers

  GetProcAddress

  GetConsoleMode

  GetFileSizeEx

  SetFilePointerEx

  ReadFile

  CreateFileW

  CloseHandle

  WriteConsoleW

  CreateDirectoryW

  SizeofResource

  RemoveDirectoryW

  WaitForMultipleObjects

  GetEnvironmentVariableW

  WaitForSingleObject

  ReleaseMutex

  DuplicateHandle

  LockResource

  DeleteFileW

  LoadLibraryW

  FindResourceExW

  LoadResource

  FindResourceW

  LocalFree

  lstrcmpiW

  GetTickCount

  GetExitCodeProcess

  GetTempPathW

  GetSystemDirectoryW

  VirtualQuery

  OpenProcess

  Sleep

  ReadProcessMemory

  lstrlenW

  SetFilePointer

  GetFileAttributesExW

  MoveFileExW

  GetFileTime

  CreateProcessW

  SetProcessWorkingSetSize

  GetPrivateProfileIntW

  OutputDebugStringA

  GetFileInformationByHandle

  GetLocalTime

  lstrcmpW

  GetVersionExW

  VerSetConditionMask

  VerifyVersionInfoW

  TryEnterCriticalSection

  InitializeCriticalSection

  CreateMutexW

  CreateEventW

  SetEvent

  ResetEvent

  lstrcpynW

  GlobalAlloc

  GlobalFree

  GlobalLock

  GlobalUnlock

  WaitForDebugEvent

  GetProcessId

  DebugActiveProcessStop

  ContinueDebugEvent

  GetSystemInfo

  GetThreadContext

  DebugActiveProcess

  VirtualQueryEx

  ReleaseSemaphore

  CreateThread

  HeapDestroy

  DecodePointer

  HeapAlloc

  RaiseException

  HeapReAlloc

  GetLastError

  HeapSize

  GetSystemDefaultLangID

  GetUserDefaultLangID

  DeviceIoControl

  GetComputerNameExW

  ConnectNamedPipe

  GetOverlappedResult

  DisconnectNamedPipe

  CreateNamedPipeW

  GetProcessTimes

  UnregisterWait

  UnregisterWaitEx

  RegisterWaitForSingleObject

  VirtualProtect

  VirtualAlloc

  InitializeCriticalSectionAndSpinCount

  GetConsoleOutputCP

  HeapFree

  user32

  CloseWindowStation

  SetThreadDesktop

  GetThreadDesktop

  CloseDesktop

  CreateDesktopW

  SetProcessWindowStation

  GetProcessWindowStation

  CreateWindowStationW

  PostThreadMessageW

  OpenClipboard

  CloseClipboard

  EmptyClipboard

  SetClipboardData

  GetMessageW

  DispatchMessageW

  PeekMessageW

  MessageBoxW

  wvsprintfW

  wsprintfW

  GetWindowThreadProcessId

  IsWindowVisible

  EnumWindows

  CharUpperW

  CharLowerW

  advapi32

  SetTokenInformation

  TraceEvent

  GetTraceLoggerHandle

  GetTraceEnableFlags

  GetTraceEnableLevel

  RegisterTraceGuidsW

  UnregisterTraceGuids

  GetTokenInformation

  SetSecurityDescriptorGroup

  MakeAbsoluteSD

  MakeSelfRelativeSD

  GetSecurityDescriptorLength

  GetLengthSid

  InitializeAcl

  InitializeSecurityDescriptor

  OpenProcessToken

  AddAce

  IsValidSid

  GetSecurityDescriptorOwner

  InitializeSid

  ConvertStringSidToSidW

  CopySid

  GetSecurityDescriptorControl

  SetNamedSecurityInfoW

  GetSidLengthRequired

  GetSidSubAuthority

  GetSecurityDescriptorGroup

  EqualSid

  GetAce

  SetSecurityDescriptorOwner

  GetAclInformation

  GetSecurityDescriptorDacl

  SetSecurityDescriptorDacl

  GetSecurityDescriptorSacl

  ConvertSidToStringSidW

  RegQueryValueExW

  RegOpenKeyExW

  RegCloseKey

  RegEnumValueW

  RegDeleteValueW

  RegSetValueExW

  RegEnumKeyExW

  RegCreateKeyExW

  RegDeleteKeyW

  RegQueryInfoKeyW

  CheckTokenMembership

  FreeSid

  AllocateAndInitializeSid

  ole32

  IIDFromString

  StringFromGUID2

  CoCreateGuid

  shell32

  SHGetFolderPathW

  netapi32

  NetGetJoinInformation

  NetApiBufferFree

  NetWkstaGetInfo

  rpcrt4

  UuidCreate

  shlwapi

  PathCanonicalizeW

  PathAppendW

  SHQueryValueExW

  PathRemoveFileSpecW

  PathRemoveExtensionW

  PathStripPathW

  userenv

  UnloadUserProfile

  version

  GetFileVersionInfoSizeW

  GetFileVersionInfoW

  VerQueryValueW

  Sections

  .text

  Size: 241KB - Virtual size: 241KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 98KB - Virtual size: 98KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 4KB - Virtual size: 13KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 11KB - Virtual size: 11KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  _RDATA

  Size: 512B - Virtual size: 148B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .gxfg

  Size: 6KB - Virtual size: 6KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .gehcont

  Size: 512B - Virtual size: 16B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 13KB - Virtual size: 12KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 572KB - Virtual size: 576KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE