3fb092670b4ac1d29fb6be981cb8b710_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

3fb092670b4ac1d29fb6be981cb8b710_NeikiAnalytics.exe
Size

735KB
MD5

3fb092670b4ac1d29fb6be981cb8b710
SHA1

bf8156e89d476ff4842046f8c76fb7172d5033df
SHA256

f8c30187f7b988d5596111a693eb8ac5fa20b5827881f8c8116b3f722f74a64b
SHA512

7b7fdd5f6887b15dc47e31ab941f26ea86d1666556c17fcfc0fc8465910a583de499732e60c28d7dd8735d22a42121e1d27507744f3eb2963aa6bde05499b592
SSDEEP

12288:95h1UpQ5MmyVcXOQLIfHgMaS3eFs/RMl9N:9wueQLk7nRMl9N

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3fb092670b4ac1d29fb6be981cb8b710_NeikiAnalytics.exe

Files

3fb092670b4ac1d29fb6be981cb8b710_NeikiAnalytics.exe
.dll windows:4 windows x64 arch:x64

aafc047e381155a2581df70d84c85c7e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

advapi32

RegCloseKey
RegOpenKeyA
RegOpenKeyExA
RegQueryValueExA

dnsapi

DnsQueryConfig

kernel32

CloseHandle
CreateEventW
CreateFileW
DisableThreadLibraryCalls
GetComputerNameExA
GetModuleHandleW
GetProcAddress
GetTickCount
HeapAlloc
HeapFree
HeapReAlloc
IsBadStringPtrA
IsBadStringPtrW
MultiByteToWideChar
RaiseException
WaitForSingleObject
WideCharToMultiByte

nsi

NsiAllocateAndGetTable
NsiCancelChangeNotification
NsiEnumerateObjectsAllParameters
NsiFreeTable
NsiGetAllParameters
NsiGetParameter
NsiRequestChangeNotification

ntdll

NtDeviceIoControlFile
RtlGUIDFromString
RtlInitUnicodeString
RtlIpv4AddressToStringA
RtlIpv4StringToAddressA
RtlIpv4StringToAddressExW
RtlIpv6StringToAddressExW
RtlNtStatusToDosError
_vsnprintf

ucrtbase

__acrt_iob_func
__stdio_common_vsprintf
__stdio_common_vswprintf
_strdup
free
fwrite
getenv
memcmp
memcpy
memmove
memset
qsort
strchr
strcmp
strcspn
strlen
wcschr
wcscmp
wcscpy
wcslen
wcstol

ws2_32

htonl
ntohs

Exports

Exports

AddIPAddress
AllocateAndGetArpEntTableFromStack
AllocateAndGetIfTableFromStack
AllocateAndGetIpAddrTableFromStack
AllocateAndGetIpForwardTableFromStack
AllocateAndGetIpNetTableFromStack
AllocateAndGetTcpExTableFromStack
AllocateAndGetTcpTableFromStack
AllocateAndGetUdpTableFromStack
CancelIPChangeNotify
CancelMibChangeNotify2
ConvertGuidToStringA
ConvertGuidToStringW
ConvertInterfaceAliasToLuid
ConvertInterfaceGuidToLuid
ConvertInterfaceIndexToLuid
ConvertInterfaceLuidToAlias
ConvertInterfaceLuidToGuid
ConvertInterfaceLuidToIndex
ConvertInterfaceLuidToNameA
ConvertInterfaceLuidToNameW
ConvertInterfaceNameToLuidA
ConvertInterfaceNameToLuidW
ConvertLengthToIpv4Mask
ConvertStringToGuidW
CreateIpForwardEntry
CreateIpNetEntry
CreateProxyArpEntry
CreateSortedAddressPairs
DeleteIPAddress
DeleteIpForwardEntry
DeleteIpNetEntry
DeleteProxyArpEntry
EnableRouter
FlushIpNetTable
FlushIpNetTableFromStack
FreeMibTable
GetAdapterIndex
GetAdapterOrderMap
GetAdaptersAddresses
GetAdaptersInfo
GetAnycastIpAddressTable
GetBestInterface
GetBestInterfaceEx
GetBestInterfaceFromStack
GetBestRoute
GetBestRoute2
GetBestRouteFromStack
GetCurrentThreadCompartmentId
GetExtendedTcpTable
GetExtendedUdpTable
GetFriendlyIfIndex
GetIcmpStatistics
GetIcmpStatisticsEx
GetIcmpStatsFromStack
GetIfEntry
GetIfEntry2
GetIfEntry2Ex
GetIfEntryFromStack
GetIfTable
GetIfTable2
GetIfTable2Ex
GetIfTableFromStack
GetIgmpList
GetInterfaceInfo
GetIpAddrTable
GetIpAddrTableFromStack
GetIpForwardTable
GetIpForwardTable2
GetIpForwardTableFromStack
GetIpInterfaceTable
GetIpNetTable
GetIpNetTable2
GetIpNetTableFromStack
GetIpStatistics
GetIpStatisticsEx
GetIpStatsFromStack
GetNetworkParams
GetNumberOfInterfaces
GetPerAdapterInfo
GetPerTcpConnectionEStats
GetRTTAndHopCount
GetTcp6Table
GetTcp6Table2
GetTcpStatistics
GetTcpStatisticsEx
GetTcpStatsFromStack
GetTcpTable
GetTcpTable2
GetTcpTableFromStack
GetUdp6Table
GetUdpStatistics
GetUdpStatisticsEx
GetUdpStatsFromStack
GetUdpTable
GetUdpTableFromStack
GetUniDirectionalAdapterInfo
GetUnicastIpAddressEntry
GetUnicastIpAddressTable
Icmp6CreateFile
Icmp6SendEcho2
IcmpCloseHandle
IcmpCreateFile
IcmpParseReplies
IcmpSendEcho
IcmpSendEcho2
IcmpSendEcho2Ex
InternalCreateIpForwardEntry
InternalCreateIpNetEntry
InternalDeleteIpForwardEntry
InternalDeleteIpNetEntry
InternalGetIfTable
InternalGetIpAddrTable
InternalGetIpForwardTable
InternalGetIpNetTable
InternalGetTcpTable
InternalGetUdpTable
InternalSetIfEntry
InternalSetIpForwardEntry
InternalSetIpNetEntry
InternalSetIpStats
InternalSetTcpEntry
IpReleaseAddress
IpRenewAddress
IsLocalAddress
NhGetGuidFromInterfaceName
NhGetInterfaceNameFromGuid
NhpAllocateAndGetInterfaceInfoFromStack
NhpGetInterfaceIndexFromStack
NotifyAddrChange
NotifyIpInterfaceChange
NotifyRouteChange
NotifyRouteChange2
NotifyRouteChangeEx
NotifyUnicastIpAddressChange
ParseNetworkString
SendARP
SetAdapterIpAddress
SetBlockRoutes
SetIfEntry
SetIfEntryToStack
SetIpForwardEntry
SetIpForwardEntryToStack
SetIpMultihopRouteEntryToStack
SetIpNetEntry
SetIpNetEntryToStack
SetIpRouteEntryToStack
SetIpStatistics
SetIpStatsToStack
SetIpTTL
SetPerTcpConnectionEStats
SetProxyArpEntryToStack
SetRouteWithRef
SetTcpEntry
SetTcpEntryToStack
UnenableRouter
_PfAddFiltersToInterface@24
_PfAddGlobalFilterToInterface@8
_PfBindInterfaceToIPAddress@12
_PfBindInterfaceToIndex@16
_PfCreateInterface@24
_PfDeleteInterface@4
_PfDeleteLog@0
_PfGetInterfaceStatistics@16
_PfMakeLog@4
_PfRebindFilters@8
_PfRemoveFilterHandles@12
_PfRemoveFiltersFromInterface@20
_PfRemoveGlobalFilterFromInterface@8
_PfSetLogBuffer@28
_PfTestPacket@20
_PfUnBindInterface@4
if_indextoname
if_nametoindex

Sections

.text
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 48KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 352B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/14
Size: 4KB - Virtual size: 272B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/29
Size: 232KB - Virtual size: 230KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/41
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/55
Size: 40KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/67
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/80
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/91
Size: 108KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/102
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

aafc047e381155a2581df70d84c85c7e

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

dnsapi

kernel32

nsi

ntdll

ucrtbase

ws2_32

Exports

Exports

Sections

.text Size: 56KB - Virtual size: 55KB

.data Size: 4KB - Virtual size: 112B

.rodata Size: 4KB - Virtual size: 2KB

.rdata Size: 48KB - Virtual size: 44KB

/4 Size: 4KB - Virtual size: 1KB

.pdata Size: 8KB - Virtual size: 4KB

.xdata Size: 4KB - Virtual size: 2KB

.bss Size: - Virtual size: 352B

.edata Size: 8KB - Virtual size: 5KB

.idata Size: 4KB - Virtual size: 2KB

.rsrc Size: 4KB - Virtual size: 944B

.reloc Size: 4KB - Virtual size: 64B

/14 Size: 4KB - Virtual size: 272B

/29 Size: 232KB - Virtual size: 230KB

/41 Size: 8KB - Virtual size: 4KB

/55 Size: 40KB - Virtual size: 38KB

/67 Size: 12KB - Virtual size: 10KB

/80 Size: 4KB - Virtual size: 2KB

/91 Size: 108KB - Virtual size: 107KB

/102 Size: 16KB - Virtual size: 12KB

.text
Size: 56KB - Virtual size: 55KB

.data
Size: 4KB - Virtual size: 112B

.rodata
Size: 4KB - Virtual size: 2KB

.rdata
Size: 48KB - Virtual size: 44KB

/4
Size: 4KB - Virtual size: 1KB

.pdata
Size: 8KB - Virtual size: 4KB

.xdata
Size: 4KB - Virtual size: 2KB

.bss
Size: - Virtual size: 352B

.edata
Size: 8KB - Virtual size: 5KB

.idata
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 4KB - Virtual size: 944B

.reloc
Size: 4KB - Virtual size: 64B

/14
Size: 4KB - Virtual size: 272B

/29
Size: 232KB - Virtual size: 230KB

/41
Size: 8KB - Virtual size: 4KB

/55
Size: 40KB - Virtual size: 38KB

/67
Size: 12KB - Virtual size: 10KB

/80
Size: 4KB - Virtual size: 2KB

/91
Size: 108KB - Virtual size: 107KB

/102
Size: 16KB - Virtual size: 12KB