General

Malware Config

Signatures

Files

• 704fd1218fa3791ccbe6e21124d39050_NeikiAnalytics.exe

  .exe windows:10 windows x64 arch:x64

  e3af3d69733a79b41c2a91e430bf90f2

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  PDB Paths

  gamesaveutil.pdb

  Imports

  msvcrt

  _fmode

  ?terminate@@YAXXZ

  ??1type_info@@UEAA@XZ

  exit

  _exit

  _unlock

  __dllonexit

  __set_app_type

  _onexit

  __C_specific_handler

  ??3@YAXPEAX@Z

  __setusermatherr

  _lock

  _initterm

  memmove

  _commode

  ??0exception@@QEAA@AEBV0@@Z

  ?what@exception@@UEBAPEBDXZ

  ??1exception@@UEAA@XZ

  ??0exception@@QEAA@AEBQEBD@Z

  _wcsicmp

  _vsnprintf

  ??_V@YAXPEAX@Z

  _vsnwprintf

  _wtoi

  ??0bad_cast@@QEAA@AEBV0@@Z

  ??1bad_cast@@UEAA@XZ

  ??0bad_cast@@QEAA@PEBD@Z

  free

  strchr

  realloc

  wprintf

  ??0exception@@QEAA@XZ

  _purecall

  ??0exception@@QEAA@AEBQEBDH@Z

  wcsncpy_s

  wcscpy_s

  wcscat_s

  wcsncmp

  _wtoi64

  malloc

  memmove_s

  _callnewh

  _CxxThrowException

  setlocale

  memcpy

  ___mb_cur_max_func

  _errno

  ___lc_handle_func

  ___lc_codepage_func

  __pctype_func

  calloc

  __crtLCMapStringW

  ___lc_collate_cp_func

  memcmp

  __crtCompareStringW

  abort

  __wgetmainargs

  _amsg_exit

  _XcptFilter

  printf

  __CxxFrameHandler3

  _cexit

  memset

  api-ms-win-core-synch-l1-2-0

  SleepConditionVariableSRW

  WakeAllConditionVariable

  Sleep

  api-ms-win-core-errorhandling-l1-1-0

  UnhandledExceptionFilter

  SetLastError

  SetUnhandledExceptionFilter

  GetLastError

  RaiseException

  api-ms-win-core-libraryloader-l1-2-0

  GetModuleHandleW

  api-ms-win-core-profile-l1-1-0

  QueryPerformanceCounter

  api-ms-win-core-processthreads-l1-1-0

  GetCurrentProcessId

  GetCurrentThreadId

  TerminateProcess

  OpenProcessToken

  GetCurrentProcess

  api-ms-win-core-sysinfo-l1-1-0

  GetSystemTime

  GetTickCount64

  GetSystemTimeAsFileTime

  GetTickCount

  api-ms-win-core-rtlsupport-l1-1-0

  RtlLookupFunctionEntry

  RtlVirtualUnwind

  RtlCaptureContext

  ntdll

  NtFlushBuffersFileEx

  NtQueryInformationToken

  crypt32

  CryptBinaryToStringW

  CryptStringToBinaryW

  api-ms-win-shcore-stream-l1-1-0

  SHCreateStreamOnFileW

  api-ms-win-core-heap-l2-1-0

  LocalFree

  api-ms-win-core-localization-l1-2-0

  FormatMessageW

  xmllite

  CreateXmlWriter

  CreateXmlReader

  api-ms-win-eventing-provider-l1-1-0

  EventWriteTransfer

  api-ms-win-core-winrt-string-l1-1-0

  WindowsCreateStringReference

  WindowsCreateString

  WindowsGetStringRawBuffer

  WindowsGetStringLen

  WindowsDeleteString

  WindowsIsStringEmpty

  WindowsDuplicateString

  WindowsCompareStringOrdinal

  api-ms-win-core-synch-l1-1-0

  AcquireSRWLockShared

  AcquireSRWLockExclusive

  InitializeCriticalSection

  DeleteCriticalSection

  ReleaseSRWLockExclusive

  ReleaseSRWLockShared

  EnterCriticalSection

  LeaveCriticalSection

  SetEvent

  CreateEventW

  WaitForSingleObject

  InitializeSRWLock

  api-ms-win-core-com-l1-1-0

  CoCreateInstance

  CoImpersonateClient

  CoRevertToSelf

  CoSetProxyBlanket

  StringFromGUID2

  CoTaskMemFree

  CoCreateGuid

  CoCreateFreeThreadedMarshaler

  CoEnableCallCancellation

  CoCancelCall

  CoDisableCallCancellation

  CoInitializeEx

  CoInitializeSecurity

  CoUninitialize

  CoTaskMemAlloc

  api-ms-win-core-winrt-l1-1-0

  RoGetActivationFactory

  RoActivateInstance

  api-ms-win-appmodel-state-l1-2-0

  GetSystemAppDataFolder

  CloseState

  OpenStateExplicit

  api-ms-win-core-handle-l1-1-0

  CloseHandle

  api-ms-win-core-threadpool-legacy-l1-1-0

  CreateTimerQueueTimer

  DeleteTimerQueueTimer

  api-ms-win-core-winrt-error-l1-1-0

  RoTransformError

  RoOriginateError

  api-ms-win-core-file-l1-1-0

  DeleteFileW

  RemoveDirectoryW

  GetFileAttributesW

  CreateDirectoryW

  ReadFile

  WriteFile

  FindClose

  FindFirstFileW

  FindNextFileW

  CreateFileW

  api-ms-win-core-registry-l1-1-0

  RegQueryInfoKeyW

  RegCloseKey

  RegFlushKey

  RegSetValueExW

  RegOpenKeyExW

  RegCreateKeyExW

  RegDeleteValueW

  RegDeleteKeyExW

  api-ms-win-core-threadpool-l1-2-0

  CloseThreadpoolWork

  WaitForThreadpoolWorkCallbacks

  CreateThreadpoolWork

  SubmitThreadpoolWork

  api-ms-win-core-file-l2-1-0

  MoveFileExW

  rpcrt4

  UuidFromStringW

  api-ms-win-security-base-l1-1-0

  RevertToSelf

  ImpersonateLoggedOnUser

  api-ms-win-security-sddl-l1-1-0

  ConvertSidToStringSidW

  api-ms-win-core-timezone-l1-1-0

  SystemTimeToFileTime

  api-ms-win-service-management-l1-1-0

  OpenSCManagerW

  OpenServiceW

  CloseServiceHandle

  api-ms-win-service-management-l2-1-0

  ChangeServiceConfigW

  oleaut32

  VariantInit

  ext-ms-win-session-usermgr-l1-1-0

  UMgrQueryUserContext

  ext-ms-win-gaming-xblgamesave-l1-1-0

  XblGameSave_GetUserStorageRoot

  api-ms-win-core-string-l1-1-0

  GetStringTypeW

  WideCharToMultiByte

  MultiByteToWideChar

  api-ms-win-core-util-l1-1-0

  EncodePointer

  DecodePointer

  Sections

  .text

  Size: 253KB - Virtual size: 252KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  RT_CODE

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 111KB - Virtual size: 110KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 3KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 12KB - Virtual size: 11KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 1016B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 568KB - Virtual size: 572KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE