1dd1d74555be459d512c9ebba379e1b0_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

1dd1d74555be459d512c9ebba379e1b0_NeikiAnalytics.exe
Size

942KB
MD5

1dd1d74555be459d512c9ebba379e1b0
SHA1

76705ddea7327198066b60f2c0a8b6ae26333197
SHA256

7eb96e05ecf6849290292ae0f396754b1faf8cbf39441867d3aea22c0a32de94
SHA512

99e2bb40adc24c9aaec62b36cb7321fcd5b12a7697bae4e72db229f750ece81d2bd29cd4f844586e3ab1cd647dd52f7c1e9ebc4bb066004d03938aae7c183eeb
SSDEEP

6144:FDTzzaKZDKxt05F20tdbL6efVw6TXpP6pZZwZ1LbTX52emqWBm29At0/QUiwOyqt:FDTzzaQPtdbLLfVwgrpcw9KOyo2hoWn8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1dd1d74555be459d512c9ebba379e1b0_NeikiAnalytics.exe

Files

1dd1d74555be459d512c9ebba379e1b0_NeikiAnalytics.exe
.dll regsvr32 windows:4 windows x64 arch:x64

e58b7356d13fe6b07b5441af2ff2ea89

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
CreateEventW
CreateThread
DisableThreadLibraryCalls
EnterCriticalSection
EnumResourceNamesW
FindResourceW
FreeLibrary
FreeLibraryAndExitThread
GetEnvironmentVariableW
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetProcAddress
GetTickCount
HeapAlloc
HeapFree
HeapReAlloc
InitOnceExecuteOnce
IsBadStringPtrA
IsBadStringPtrW
LeaveCriticalSection
LoadLibraryW
LoadResource
MultiByteToWideChar
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
SetEvent
SizeofResource
WaitForMultipleObjects

ntdll

_vsnprintf

ole32

CoCreateFreeThreadedMarshaler
CoCreateInstance
CoDecrementMTAUsage
CoIncrementMTAUsage
CoInitializeEx
CoTaskMemAlloc
CoTaskMemFree
CoUninitialize

oleacc

AccessibleObjectFromWindow
LresultFromObject
ObjectFromLresult
WindowFromAccessibleObject

oleaut32

SysAllocString
SysAllocStringLen
SysReAllocStringLen
SysFreeString
SysStringLen
VariantInit
VariantClear
VariantCopy
SafeArrayCreate
SafeArrayDestroy
SafeArrayGetDim
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElement
SafeArrayPutElement
SafeArrayCopy
SafeArrayGetVartype
SafeArrayCreateVector

ucrtbase

__acrt_iob_func
__stdio_common_vsprintf
_assert
_recalloc
_strdup
bsearch
calloc
free
fwrite
getenv
memcmp
memcpy
memmove
qsort
strchr
strcmp
strcspn
strlen
wcscmp

user32

CreateWindowExW
DefWindowProcW
DestroyWindow
DispatchMessageW
EnumWindows
GetAncestor
GetClassNameW
GetClientRect
GetDesktopWindow
GetGUIThreadInfo
GetMessageW
GetWindow
GetWindowLongPtrW
GetWindowRect
GetWindowThreadProcessId
IntersectRect
IsIconic
IsWindow
IsWindowVisible
MapWindowPoints
PostMessageW
SendMessageTimeoutW
SendMessageW
SetWinEventHook
SetWindowLongPtrW
TranslateMessage
UnhookWinEvent
wsprintfW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
DockPattern_SetDockPosition
ExpandCollapsePattern_Collapse
ExpandCollapsePattern_Expand
GridPattern_GetItem
InvokePattern_Invoke
ItemContainerPattern_FindItemByProperty
LegacyIAccessiblePattern_DoDefaultAction
LegacyIAccessiblePattern_GetIAccessible
LegacyIAccessiblePattern_Select
LegacyIAccessiblePattern_SetValue
MultipleViewPattern_GetViewName
MultipleViewPattern_SetCurrentView
RangeValuePattern_SetValue
ScrollItemPattern_ScrollIntoView
ScrollPattern_Scroll
ScrollPattern_SetScrollPercent
SelectionItemPattern_AddToSelection
SelectionItemPattern_RemoveFromSelection
SelectionItemPattern_Select
SynchronizedInputPattern_Cancel
SynchronizedInputPattern_StartListening
TextPattern_GetSelection
TextPattern_GetVisibleRanges
TextPattern_RangeFromChild
TextPattern_RangeFromPoint
TextPattern_get_DocumentRange
TextPattern_get_SupportedTextSelection
TextRange_AddToSelection
TextRange_Clone
TextRange_Compare
TextRange_CompareEndpoints
TextRange_ExpandToEnclosingUnit
TextRange_FindAttribute
TextRange_FindText
TextRange_GetAttributeValue
TextRange_GetBoundingRectangles
TextRange_GetChildren
TextRange_GetEnclosingElement
TextRange_GetText
TextRange_Move
TextRange_MoveEndpointByRange
TextRange_MoveEndpointByUnit
TextRange_RemoveFromSelection
TextRange_ScrollIntoView
TextRange_Select
TogglePattern_Toggle
TransformPattern_Move
TransformPattern_Resize
TransformPattern_Rotate
UiaAddEvent
UiaClientsAreListening
UiaDisconnectProvider
UiaEventAddWindow
UiaEventRemoveWindow
UiaFind
UiaGetErrorDescription
UiaGetPatternProvider
UiaGetPropertyValue
UiaGetReservedMixedAttributeValue
UiaGetReservedNotSupportedValue
UiaGetRootNode
UiaGetRuntimeId
UiaGetUpdatedCache
UiaHPatternObjectFromVariant
UiaHTextRangeFromVariant
UiaHUiaNodeFromVariant
UiaHasServerSideProvider
UiaHostProviderFromHwnd
UiaLookupId
UiaNavigate
UiaNodeFromFocus
UiaNodeFromHandle
UiaNodeFromPoint
UiaNodeFromProvider
UiaNodeRelease
UiaPatternRelease
UiaProviderFromIAccessible
UiaRaiseAsyncContentLoadedEvent
UiaRaiseAutomationEvent
UiaRaiseAutomationPropertyChangedEvent
UiaRaiseChangesEvent
UiaRaiseNotificationEvent
UiaRaiseStructureChangedEvent
UiaRaiseTextEditTextChangedEvent
UiaRegisterProviderCallback
UiaRemoveEvent
UiaReturnRawElementProvider
UiaSetFocus
UiaTextRangeRelease
ValuePattern_SetValue
VirtualizedItemPattern_Realize
WindowPattern_Close
WindowPattern_SetWindowVisualState
WindowPattern_WaitForInputIdle

Sections

.text
Size: 132KB - Virtual size: 131KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 96KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 148KB - Virtual size: 145KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e58b7356d13fe6b07b5441af2ff2ea89

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ntdll

ole32

oleacc

oleaut32

ucrtbase

user32

Exports

Exports

Sections

.text Size: 132KB - Virtual size: 131KB

.data Size: 4KB - Virtual size: 1KB

.rodata Size: 4KB - Virtual size: 2KB

.rdata Size: 96KB - Virtual size: 93KB

/4 Size: 4KB - Virtual size: 1KB

.pdata Size: 12KB - Virtual size: 8KB

.xdata Size: 12KB - Virtual size: 9KB

.edata Size: 4KB - Virtual size: 3KB

.idata Size: 8KB - Virtual size: 4KB

.rsrc Size: 148KB - Virtual size: 145KB

.reloc Size: 4KB - Virtual size: 2KB

.text
Size: 132KB - Virtual size: 131KB

.data
Size: 4KB - Virtual size: 1KB

.rodata
Size: 4KB - Virtual size: 2KB

.rdata
Size: 96KB - Virtual size: 93KB

/4
Size: 4KB - Virtual size: 1KB

.pdata
Size: 12KB - Virtual size: 8KB

.xdata
Size: 12KB - Virtual size: 9KB

.edata
Size: 4KB - Virtual size: 3KB

.idata
Size: 8KB - Virtual size: 4KB

.rsrc
Size: 148KB - Virtual size: 145KB

.reloc
Size: 4KB - Virtual size: 2KB