40fc7c27a1363a988a757ef5ccf80630_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

40fc7c27a1363a988a757ef5ccf80630_NeikiAnalytics.exe
Size

1.9MB
MD5

40fc7c27a1363a988a757ef5ccf80630
SHA1

246ef5674a02e1cdad8c08d8708b2c16f25870b4
SHA256

178380b52dc48c27e393a73527b61801eaadb5dd0da0c4f9196669a3b68a613c
SHA512

5a4f7ef24e676b01d7260ea01c46b605849b4128ab14d1f3c177b5b2bd537425e351d6b8431d7bb7f7f7c0ef2f9b5c37fcbb9f01b47f0a50ddb0138e6c153466
SSDEEP

12288:67keN08JUSorOapYZ1LCC+/3H7DbmmrR3rcmZuBZB8GmCDbe5lHxArWgr8CwT9lP:4bNfJUSoXuv7QAr5r3LBVzJixPX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
40fc7c27a1363a988a757ef5ccf80630_NeikiAnalytics.exe

Files

40fc7c27a1363a988a757ef5ccf80630_NeikiAnalytics.exe
.dll windows:4 windows x86 arch:x86

1867081cb51901efac98dade4543a39d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

AddVectoredExceptionHandler
Beep
CloseHandle
ConvertToGlobalHandle
CreateDirectoryA
CreateDirectoryW
CreateEventW
CreateFileA
CreateFileMappingA
CreateFileMappingW
CreateFileW
CreateThread
CreateWaitableTimerA
DeleteFileA
DeleteFileW
DeviceIoControl
DosDateTimeToFileTime
DuplicateHandle
ExitProcess
ExitThread
FileTimeToDosDateTime
FindClose
FindFirstFileA
FindFirstFileW
FindNextFileA
FindNextFileW
FindResourceA
FlushFileBuffers
FlushViewOfFile
FreeEnvironmentStringsA
FreeLibrary
GetCommandLineA
GetCompressedFileSizeW
GetComputerNameW
GetCurrentDirectoryA
GetCurrentDirectoryW
GetDiskFreeSpaceA
GetDiskFreeSpaceW
GetDriveTypeA
GetDriveTypeW
GetEnvironmentStringsA
GetEnvironmentVariableA
GetEnvironmentVariableW
GetExitCodeThread
GetFileAttributesA
GetFileAttributesW
GetFileInformationByHandle
GetFileTime
GetFileType
GetFullPathNameA
GetFullPathNameW
GetLocalTime
GetLongPathNameW
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetOEMCP
GetPrivateProfileIntA
GetPrivateProfileSectionA
GetPrivateProfileSectionNamesA
GetPrivateProfileStringA
GetPrivateProfileStructA
GetProcAddress
GetProcessFlags
GetProcessId
GetProfileIntA
GetShortPathNameA
GetShortPathNameW
GetStartupInfoA
GetStartupInfoW
GetStdHandle
GetSystemDefaultLangID
GetSystemInfo
GetTempFileNameA
GetTempPathA
GetTempPathW
GetThreadSelectorEntry
GetTickCount
GetVersion
GetVersionExA
GetVolumeInformationW
GetWindowsDirectoryA
GlobalAlloc
GlobalFree
GlobalGetAtomNameA
GlobalLock
GlobalMemoryStatus
GlobalUnlock
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapLock
HeapReAlloc
HeapSize
HeapUnlock
HeapWalk
IsBadStringPtrA
IsBadStringPtrW
IsDBCSLeadByte
LoadLibraryA
LoadLibraryExA
LoadLibraryW
LoadResource
LockFile
LockResource
MapViewOfFile
MapViewOfFileEx
MoveFileW
MultiByteToWideChar
OpenFile
OpenFileMappingA
OutputDebugStringA
QueryPerformanceCounter
RaiseException
ReadFile
RemoveDirectoryA
RemoveDirectoryW
RemoveVectoredExceptionHandler
ResetEvent
RtlCaptureContext
RtlUnwind
SearchPathA
SetCurrentDirectoryA
SetCurrentDirectoryW
SetEnvironmentVariableA
SetEnvironmentVariableW
SetErrorMode
SetEvent
SetFileAttributesA
SetFileAttributesW
SetFilePointer
SetFileTime
SetHandleCount
SetWaitableTimer
SizeofResource
Sleep
SleepEx
TerminateProcess
UnlockFile
UnmapViewOfFile
VerifyConsoleIoHandle
VirtualAlloc
VirtualFree
VirtualLock
VirtualProtect
VirtualQuery
VirtualUnlock
WaitForMultipleObjectsEx
WaitForSingleObject
WideCharToMultiByte
WriteFile
WritePrivateProfileSectionA
WritePrivateProfileSectionW
WritePrivateProfileStringA
WritePrivateProfileStructA
_hwrite
_lclose
_lcreat
_llseek
_lopen
_lread
_lwrite
lstrcpyA
lstrcpynA
lstrlenA

ntdll

DbgBreakPoint
LdrFindEntryForAddress
NtAllocateVirtualMemory
NtClose
NtContinue
NtCreateEvent
NtOpenKey
NtQueryInformationFile
NtQueryInformationProcess
NtQuerySystemInformation
NtQueryValueKey
NtRaiseException
NtResetEvent
NtSetEvent
NtSetLdtEntries
RtlAcquirePebLock
RtlAddVectoredExceptionHandler
RtlAllocateHeap
RtlAreBitsClear
RtlAreBitsSet
RtlClearBits
RtlCreateHeap
RtlCreateUnicodeString
RtlEnterCriticalSection
RtlFindClearBitsAndSet
RtlFreeUnicodeString
RtlGetVersion
RtlImageNtHeader
RtlInitializeCriticalSection
RtlLeaveCriticalSection
RtlNtStatusToDosError
RtlOpenCurrentUser
RtlReleasePebLock
RtlSecondsSince1970ToTime
RtlSetBits
RtlUpperChar
_vsnprintf

ucrtbase

__acrt_iob_func
__stdio_common_vsprintf
_strdup
_stricmp
_strnicmp
_wcsicmp
_wcslwr
_wcsupr
atoi
free
fwrite
getenv
memchr
memcmp
memcpy
memmove
memset
strcat
strchr
strcmp
strcpy
strcspn
strlen
strncmp
strrchr
tolower
toupper
wcscat
wcschr
wcscpy
wcsrchr

Exports

Exports

AllocMappedBuffer
AllocSLCallback
AllocSelectorArray16
Common32ThkLS
CommonUnimpStub
DisposeLZ32Handle
DosFileHandleToWin32Handle
FT_Exit0
FT_Exit12
FT_Exit16
FT_Exit20
FT_Exit24
FT_Exit28
FT_Exit32
FT_Exit36
FT_Exit4
FT_Exit40
FT_Exit44
FT_Exit48
FT_Exit52
FT_Exit56
FT_Exit8
FT_Prolog
FT_PrologPrime
FT_Thunk
FarGetOwner16
FarSetOwner16
FindResource16
FreeLibrary16
FreeMappedBuffer
FreeResource16
FreeSLCallback
FreeSelector16
Get16DLLAddress
GetCurrentPDB16
GetCurrentTask
GetDOSEnvironment16
GetExePtr
GetExeVersion16
GetExpWinVer16
GetModuleHandle16
GetPK16SysVar
GetProcAddress16
GetProcessDword
GetSelectorBase
GetSelectorLimit16
GetThunkBuff
GetThunkStuff
GetWin16DOSEnv
GetpWin16Lock
GlobalAlloc16
GlobalFix16
GlobalFree16
GlobalLock16
GlobalReAlloc16
GlobalSize16
GlobalUnWire16
GlobalUnfix16
GlobalUnlock16
GlobalWire16
HouseCleanLogicallyDeadHandles
InitTask16
IsBadReadPtr16
IsTask16
K32Thk1632Epilog
K32Thk1632Prolog
K32WOWCallback16
K32WOWCallback16Ex
K32WOWDirectedYield16
K32WOWGetDescriptor
K32WOWGetVDMPointer
K32WOWGetVDMPointerFix
K32WOWGetVDMPointerUnfix
K32WOWGlobalAlloc16
K32WOWGlobalAllocLock16
K32WOWGlobalFree16
K32WOWGlobalLock16
K32WOWGlobalLockSize16
K32WOWGlobalUnlock16
K32WOWGlobalUnlockFree16
K32WOWHandle16
K32WOWHandle32
K32WOWYield16
LoadLibrary16
LoadModule16
LoadResource16
LocalAlloc16
LocalCompact16
LocalCountFree16
LocalFree16
LocalHeapSize16
LocalInit16
LocalLock16
LocalReAlloc16
LocalSize16
LocalUnlock16
LockResource16
LogApiThkLSF
LogApiThkSL
LogCBThkSL
MapHInstLS
MapHInstLS_PN
MapHInstSL
MapHInstSL_PN
MapHModuleLS
MapHModuleSL
MapLS
MapSL
MapSLFix
OT_32ThkLSF
PK16FNF
PrestoChangoSelector16
PrivateFreeLibrary
PrivateLoadLibrary
QT_Thunk
QT_ThunkPrime
ReleaseThunkLock
RestoreThunkLock
SMapLS
SMapLS_IP_EBP_12
SMapLS_IP_EBP_16
SMapLS_IP_EBP_20
SMapLS_IP_EBP_24
SMapLS_IP_EBP_28
SMapLS_IP_EBP_32
SMapLS_IP_EBP_36
SMapLS_IP_EBP_40
SMapLS_IP_EBP_8
SSCall
SSOnBigStack
SUnMapLS
SUnMapLS_IP_EBP_12
SUnMapLS_IP_EBP_16
SUnMapLS_IP_EBP_20
SUnMapLS_IP_EBP_24
SUnMapLS_IP_EBP_28
SUnMapLS_IP_EBP_32
SUnMapLS_IP_EBP_36
SUnMapLS_IP_EBP_40
SUnMapLS_IP_EBP_8
SetSelectorBase
SetSelectorLimit16
SizeofResource16
ThunkConnect32
ThunkInitLS
ThunkInitLSF
ThunkInitSL
UTRegister
UTUnRegister
UnMapLS
UnMapSLFixArray
VxDCall0
VxDCall1
VxDCall2
VxDCall3
VxDCall4
VxDCall5
VxDCall6
VxDCall7
VxDCall8
W32S_BackTo32
Win32HandleToDosFileHandle
WinExec16
_CheckNotSysLevel
_ConfirmSysLevel
_ConfirmWin16Lock
_EnterSysLevel
_KERNEL32_100
_KERNEL32_86
_KERNEL32_99
_LeaveSysLevel
__wine_call_int_handler16
__wine_spec_dos_header
__wine_vxd_get_proc
__wine_vxd_open
_lclose16
k32CharToOemA
k32CharToOemBuffA
k32LoadStringA
k32OemToCharA
k32OemToCharBuffA
k32wsprintfA
k32wvsprintfA

Sections

.text
Size: 248KB - Virtual size: 246KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 44KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/14
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/29
Size: 836KB - Virtual size: 835KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/41
Size: 56KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/55
Size: 176KB - Virtual size: 175KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/67
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/80
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/91
Size: 256KB - Virtual size: 252KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/102
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1867081cb51901efac98dade4543a39d

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ntdll

ucrtbase

Exports

Exports

Sections

.text Size: 248KB - Virtual size: 246KB

.data Size: 20KB - Virtual size: 18KB

.rodata Size: 4KB - Virtual size: 1KB

.rdata Size: 44KB - Virtual size: 42KB

/4 Size: 8KB - Virtual size: 7KB

.bss Size: - Virtual size: 7KB

.edata Size: 8KB - Virtual size: 4KB

.idata Size: 8KB - Virtual size: 7KB

.reloc Size: 20KB - Virtual size: 16KB

/14 Size: 4KB - Virtual size: 1KB

/29 Size: 836KB - Virtual size: 835KB

/41 Size: 56KB - Virtual size: 52KB

/55 Size: 176KB - Virtual size: 175KB

/67 Size: 36KB - Virtual size: 33KB

/80 Size: 20KB - Virtual size: 16KB

/91 Size: 256KB - Virtual size: 252KB

/102 Size: 36KB - Virtual size: 32KB

.text
Size: 248KB - Virtual size: 246KB

.data
Size: 20KB - Virtual size: 18KB

.rodata
Size: 4KB - Virtual size: 1KB

.rdata
Size: 44KB - Virtual size: 42KB

/4
Size: 8KB - Virtual size: 7KB

.bss
Size: - Virtual size: 7KB

.edata
Size: 8KB - Virtual size: 4KB

.idata
Size: 8KB - Virtual size: 7KB

.reloc
Size: 20KB - Virtual size: 16KB

/14
Size: 4KB - Virtual size: 1KB

/29
Size: 836KB - Virtual size: 835KB

/41
Size: 56KB - Virtual size: 52KB

/55
Size: 176KB - Virtual size: 175KB

/67
Size: 36KB - Virtual size: 33KB

/80
Size: 20KB - Virtual size: 16KB

/91
Size: 256KB - Virtual size: 252KB

/102
Size: 36KB - Virtual size: 32KB