ea777aab35d6cfb93d4082b28469cd90_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

ea777aab35d6cfb93d4082b28469cd90_NeikiAnalytics.exe
Size

1.3MB
MD5

ea777aab35d6cfb93d4082b28469cd90
SHA1

d37816dfbedac4bce951fc0c11d082f9e5209dba
SHA256

2e0d4d577a37bd33c143b58a86f13b1f7b5b878eae68ec84464f03779ba492c7
SHA512

7aae21e369873d0653ec80fcf510924b4aa5d791ec6e0bcd89744721ac0f2350a74378ddd5094ba1a5357e46e7272a9634d9c338f83c93566e04ccb992d70317
SSDEEP

24576:0kMq4f1MGRn8oSOv80qkL4GFhAdaTZGu9RPpXmYX4OVE:uMXoSA8TkSakYpXmYIOVE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ea777aab35d6cfb93d4082b28469cd90_NeikiAnalytics.exe

Files

ea777aab35d6cfb93d4082b28469cd90_NeikiAnalytics.exe
.dll windows:4 windows x86 arch:x86

1a0536db6790179e88372887edf15c4d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

wsock32

WSAStartup
ioctlsocket
gethostbyname
WSASetLastError
socket
htons
connect
shutdown
recv
select
send
WSAGetLastError
closesocket

kernel32

FileTimeToLocalFileTime
FindFirstFileA
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
GetFileTime
GetSystemDirectoryA
CompareFileTime
SystemTimeToFileTime
GetSystemTime
WritePrivateProfileStringA
GetPrivateProfileStringA
GetWindowsDirectoryA
MultiByteToWideChar
GetCurrentThreadId
FindClose
GetFileType
GetStdHandle
GetCurrentProcessId
GlobalMemoryStatus
QueryPerformanceCounter
FlushConsoleInputBuffer
SetLastError
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetEndOfFile
WriteConsoleW
CreateProcessA
GetExitCodeProcess
WaitForSingleObject
DeleteFileA
GetVersion
ReleaseMutex
CreateMutexA
UnmapViewOfFile
OpenFileMappingA
GetLastError
CreateFileA
CreateFileMappingA
MapViewOfFile
FreeLibrary
GetProcAddress
LoadLibraryA
GetVersionExA
CloseHandle
Sleep
GetTickCount
GetCurrentDirectoryA
SetCurrentDirectoryA
GetEnvironmentVariableA
RemoveDirectoryA
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoA
InitializeCriticalSection
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
HeapReAlloc
RtlUnwind
EnterCriticalSection
LeaveCriticalSection
GetCommandLineA
GetProcessHeap
FileTimeToSystemTime
GetDriveTypeA
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
ExitThread
ResumeThread
CreateThread
GetFileAttributesA
FindNextFileA
CreateDirectoryA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetConsoleCtrlHandler
TerminateProcess
GetCurrentProcess
IsDebuggerPresent
SetHandleCount
GetStartupInfoA
DeleteCriticalSection
VirtualFree
VirtualAlloc
HeapDestroy
HeapCreate
GetModuleHandleA
ExitProcess
WriteFile
GetModuleFileNameA
RaiseException
HeapSize
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
GetConsoleCP
GetTimeZoneInformation
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetFullPathNameA
ReadFile
SetFilePointer
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
FlushFileBuffers
SetStdHandle

user32

GetDesktopWindow
GetUserObjectInformationW
GetProcessWindowStation
MessageBoxA

advapi32

CryptReleaseContext
RegisterEventSourceA
ReportEventA
DeregisterEventSource
StartServiceA
QueryServiceStatus
OpenSCManagerA
OpenServiceA
CloseServiceHandle
CryptImportKey
CryptDecrypt
CryptCreateHash
CryptSetHashParam
CryptSignHashA
CryptDestroyHash
CryptSetProvParam
CryptDestroyKey
CryptAcquireContextA
CryptGetProvParam
CryptGetUserKey
CryptGetKeyParam
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
CryptEnumProvidersA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl

Exports

Exports

NcpPkiInit
RsuMgmChangePw
RsuMgmClose
RsuMgmConnect
RsuMgmConnectEx
RsuMgmDelUserConfig
RsuMgmDeleteEntry
RsuMgmDeleteEntryEx
RsuMgmDisconnect
RsuMgmGetActCode
RsuMgmGetDayLightSec
RsuMgmGetEntry
RsuMgmGetErrorMsg
RsuMgmGetErrorNr
RsuMgmGetList
RsuMgmGetListCB
RsuMgmGetListCancel
RsuMgmGetListCount
RsuMgmGetListEntry
RsuMgmGetPin
RsuMgmGetRights
RsuMgmGetServerInfo
RsuMgmGetSrvLicVer
RsuMgmGetSrvMgmVer
RsuMgmGetSrvType
RsuMgmInit
RsuMgmInsertEntry
RsuMgmIsConnected
RsuMgmLogin
RsuMgmLogout
RsuMgmMoveEntry
RsuMgmRequestInfo
RsuMgmRequestReloadConfig
RsuMgmSaveP12
RsuMgmSendP12Certificate
RsuMgmSetActCode
RsuMgmSetFunc
RsuMgmSslCheckPin
RsuMgmSslGetErrText
RsuMgmSslIsCardInserted
RsuMgmSslIsEnterPin
RsuMgmSslSetConfig
RsuMgmSslSetStateFunc
RsuMgmUpdConsolePlugins
RsuMgmUpdPackageStart
RsuMgmUpdPackageStartEx
RsuMgmUpdPluginFile
RsuMgmUpdPluginStart
RsuMgmUpdateConfig
RsuMgmUpdateEntry
RsuMgmUploadPackageArchive
RsuMgmUploadPackageFile
RsuMgmUseSsl
RsuMgmWriteLog

Sections

.text
Size: 1016KB - Virtual size: 1014KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 212KB - Virtual size: 210KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 72KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 52KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1a0536db6790179e88372887edf15c4d

Headers

File Characteristics

Imports

wsock32

kernel32

user32

advapi32

Exports

Exports

Sections

.text Size: 1016KB - Virtual size: 1014KB

.rdata Size: 212KB - Virtual size: 210KB

.data Size: 72KB - Virtual size: 87KB

.rsrc Size: 4KB - Virtual size: 176B

.reloc Size: 52KB - Virtual size: 50KB

.text
Size: 1016KB - Virtual size: 1014KB

.rdata
Size: 212KB - Virtual size: 210KB

.data
Size: 72KB - Virtual size: 87KB

.rsrc
Size: 4KB - Virtual size: 176B

.reloc
Size: 52KB - Virtual size: 50KB