General

Malware Config

Signatures

Files

• dd487124d0350a64d4437e4c5cd67630_NeikiAnalytics.exe

  .dll .vbs windows:4 windows x86 arch:x86 polyglot

  62a7616cac5efe94334afe90464544ad

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  Imports

  kernel32

  GetCurrentProcessId

  GetDiskFreeSpaceExA

  GetDriveTypeA

  GetFileAttributesA

  GetFileSize

  GetFileTime

  GetLastError

  GetLocalTime

  GetLocaleInfoA

  GetLogicalDriveStringsA

  GetLogicalDrives

  GetModuleFileNameA

  GetModuleHandleA

  GetProcAddress

  GetSystemDirectoryA

  GetSystemInfo

  GetSystemTimeAsFileTime

  GetTempFileNameA

  GetTempPathA

  GetTickCount

  GetVersionExA

  GetVolumeInformationA

  GetWindowsDirectoryA

  GlobalAlloc

  GlobalFree

  GlobalReAlloc

  HeapAlloc

  HeapCreate

  HeapDestroy

  HeapFree

  HeapReAlloc

  GetCurrentProcess

  LeaveCriticalSection

  LoadLibraryA

  MapViewOfFile

  MoveFileA

  MultiByteToWideChar

  OpenFileMappingA

  OpenMutexA

  ReadFile

  ReleaseMutex

  RemoveDirectoryA

  ResumeThread

  RtlMoveMemory

  SetEndOfFile

  SetErrorMode

  SetFileAttributesA

  SetFilePointer

  SetFileTime

  SetThreadPriority

  Sleep

  TryEnterCriticalSection

  UnmapViewOfFile

  WideCharToMultiByte

  WriteFile

  lstrcatA

  lstrcmpA

  lstrcmpiA

  lstrcpyA

  lstrcpynA

  lstrlenA

  lstrlenW

  FindNextFileA

  FindFirstFileA

  FindClose

  FileTimeToSystemTime

  FileTimeToLocalFileTime

  ExpandEnvironmentStringsA

  ExitProcess

  EnterCriticalSection

  DeleteCriticalSection

  DeleteFileA

  CreateThread

  CreateProcessA

  CreateMutexA

  CreateFileMappingA

  CreateFileA

  CreateDirectoryA

  CopyFileA

  CompareStringA

  InitializeCriticalSection

  CloseHandle

  ws2_32

  recv

  listen

  ioctlsocket

  inet_addr

  select

  getsockname

  send

  socket

  getpeername

  gethostbyname

  connect

  closesocket

  bind

  accept

  __WSAFDIsSet

  WSAStartup

  WSAGetLastError

  WSACleanup

  htons

  user32

  GetDC

  ExitWindowsEx

  CharUpperBuffW

  MessageBoxA

  GetDesktopWindow

  wsprintfA

  advapi32

  AdjustTokenPrivileges

  OpenProcessToken

  RegCloseKey

  RegDeleteKeyA

  RegEnumKeyExA

  RegOpenKeyExA

  RegQueryInfoKeyA

  RegQueryValueExA

  LookupPrivilegeValueA

  shell32

  ShellExecuteA

  gdi32

  CreateCompatibleDC

  DeleteDC

  DeleteObject

  GdiFlush

  GetDeviceCaps

  SelectObject

  SetStretchBltMode

  StretchBlt

  CreateDIBSection

  ole32

  CreateStreamOnHGlobal

  Sections

  .text

  Size: 50KB - Virtual size: 50KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 3KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 11KB - Virtual size: 13KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ