3f4b4dbd0a189228c74cbece317eaad0_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

3f4b4dbd0a189228c74cbece317eaad0_NeikiAnalytics.exe
Size

312KB
MD5

3f4b4dbd0a189228c74cbece317eaad0
SHA1

02bf4a150f4df9e67876f76c04658a2d5b0467aa
SHA256

71a79bd8ca4836f006a618f5721128b1774d383e56be55079926c6e0826c3aba
SHA512

04aaef22ec523d06a593556493d7a893246f2f62b03ed0ea5d607033a3860d0ba41a2ecb601c658909af4dfaa2e6dfb05efe68b7a1cb500803ec58621cf2ef8c
SSDEEP

3072:Pyen/Qk2470ZAr9H6c8XO55apewZDy8wEL:PB4kBhH6rXt1w

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3f4b4dbd0a189228c74cbece317eaad0_NeikiAnalytics.exe

Files

3f4b4dbd0a189228c74cbece317eaad0_NeikiAnalytics.exe
.dll windows:10 windows x64 arch:x64

4b4464c7677b6f07342800f4cf0ba273

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

api-ms-win-core-crt-l1-1-0

__C_specific_handler
_vsnwprintf_s
_wcsnicmp
_wtoi
wcstoul
_wcsicmp
memmove
memcpy
toupper
wcsrchr
wcschr
memset

api-ms-win-core-crt-l2-1-0

_purecall
_initterm
_initterm_e

ntdll

NtCreateKey
NtOpenKey
NtClose
RtlFreeUnicodeString
RtlFormatCurrentUserKeyPath
_vsnwprintf
RtlUnicodeToMultiByteSize
RtlInitUnicodeStringEx
RtlMultiByteToUnicodeSize
RtlGetVersion
NtQueryValueKey
NtSetValueKey
RtlMultiByteToUnicodeN
RtlGUIDFromString
RtlGetSaclSecurityDescriptor
RtlHashUnicodeString
RtlGetOwnerSecurityDescriptor
RtlUnicodeToMultiByteN
RtlGetDaclSecurityDescriptor
RtlNtStatusToDosErrorNoTeb
_vsnprintf
RtlIsTextUnicode
RtlNtStatusToDosError
RtlEqualUnicodeString
RtlGetGroupSecurityDescriptor
RtlUpcaseUnicodeString
EtwTraceMessage
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlVirtualUnwind
RtlUnsubscribeWnfStateChangeNotification
RtlLookupFunctionEntry
RtlCaptureContext
RtlDllShutdownInProgress
RtlSubscribeWnfStateChangeNotification
NtCreateFile
RtlUnicodeStringToInteger
RtlIoDecodeMemIoResource
RtlCmDecodeMemIoResource
RtlIoEncodeMemIoResource
RtlInitUnicodeString
RtlCmEncodeMemIoResource

api-ms-win-core-libraryloader-l1-2-0

LoadStringW
LoadLibraryExW
DisableThreadLibraryCalls
GetModuleFileNameA
FreeLibrary
GetModuleHandleW
GetModuleHandleExW
GetProcAddress
GetModuleFileNameW

api-ms-win-core-heap-l1-1-0

HeapFree
HeapReAlloc
GetProcessHeap
HeapAlloc

api-ms-win-core-synch-l1-1-0

CreateMutexW
ReleaseMutex
SetEvent
WaitForSingleObject
InitializeSRWLock
InitializeCriticalSection
SleepEx
WaitForSingleObjectEx
ReleaseSRWLockShared
AcquireSRWLockExclusive
CreateEventW
AcquireSRWLockShared
WaitForMultipleObjectsEx
LeaveCriticalSection
DeleteCriticalSection
EnterCriticalSection
OpenEventW
ReleaseSRWLockExclusive

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetErrorMode
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
SetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-2-0

InitializeConditionVariable
Sleep
WakeConditionVariable
SleepConditionVariableSRW
InitOnceExecuteOnce
InitOnceInitialize

api-ms-win-core-io-l1-1-0

GetOverlappedResult
CancelIoEx
DeviceIoControl

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolWaitCallbacks
DisassociateCurrentThreadFromCallback
StartThreadpoolIo
CreateThreadpoolWork
WaitForThreadpoolWorkCallbacks
CloseThreadpoolWork
CloseThreadpoolWait
CancelThreadpoolIo
CallbackMayRunLong
WaitForThreadpoolIoCallbacks
CreateThreadpoolWait
CloseThreadpoolIo
CreateThreadpoolIo
FreeLibraryWhenCallbackReturns
SubmitThreadpoolWork
SetThreadpoolWait

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW
RegDeleteValueW
RegSetValueExW
RegQueryValueExW
RegGetValueW
RegQueryInfoKeyW
RegEnumKeyExW
RegCloseKey
RegOpenKeyExW

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetLocalTime
GetSystemDirectoryW
GetSystemWindowsDirectoryW
GetTickCount
GetComputerNameExW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
GetStringTypeExW
CompareStringW
MultiByteToWideChar
CompareStringOrdinal

api-ms-win-core-wow64-l1-1-0

IsWow64Process

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
OpenThreadToken
OpenProcessToken
SetThreadToken
GetCurrentThreadId
TerminateProcess
GetCurrentThread
GetCurrentProcessId

api-ms-win-security-base-l1-1-0

DuplicateTokenEx
GetKernelObjectSecurity
AdjustTokenPrivileges
GetSecurityDescriptorLength
GetTokenInformation

api-ms-win-core-localization-l1-2-0

FormatMessageW
GetThreadPreferredUILanguages
LCMapStringW
GetThreadLocale

api-ms-win-eventing-provider-l1-1-0

EventProviderEnabled
EventActivityIdControl
EventSetInformation
EventUnregister
EventRegister
EventWriteTransfer

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-crt-runtime-l1-1-0

_resetstkoflw

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableW
ExpandEnvironmentStringsW

api-ms-win-core-file-l1-1-0

GetFileAttributesW
SetFilePointer
CreateFileW
SetEndOfFile
FindFirstFileW
FindClose
GetFullPathNameW
CreateDirectoryW
WriteFile
FlushFileBuffers
CompareFileTime
DeleteFileW
GetFileSize

api-ms-win-core-memory-l1-1-0

UnmapViewOfFile
MapViewOfFile
CreateFileMappingW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

CMP_GetBlockedDriverInfo
CMP_GetServerSideDeviceInstallFlags
CMP_Init_Detection
CMP_RegisterServiceNotification
CMP_Register_Notification
CMP_Report_LogOn
CMP_WaitNoPendingInstallEvents
CMP_WaitServicesAvailable
CM_Add_Driver_PackageW
CM_Add_Driver_Package_ExW
CM_Add_Empty_Log_Conf
CM_Add_Empty_Log_Conf_Ex
CM_Add_IDA
CM_Add_IDW
CM_Add_ID_ExA
CM_Add_ID_ExW
CM_Add_Range
CM_Add_Res_Des
CM_Add_Res_Des_Ex
CM_Apply_PowerScheme
CM_Connect_MachineA
CM_Connect_MachineW
CM_Create_DevNodeA
CM_Create_DevNodeW
CM_Create_DevNode_ExA
CM_Create_DevNode_ExW
CM_Create_Range_List
CM_Delete_Class_Key
CM_Delete_Class_Key_Ex
CM_Delete_DevNode_Key
CM_Delete_DevNode_Key_Ex
CM_Delete_Device_Interface_KeyA
CM_Delete_Device_Interface_KeyW
CM_Delete_Device_Interface_Key_ExA
CM_Delete_Device_Interface_Key_ExW
CM_Delete_Driver_PackageW
CM_Delete_Driver_Package_ExW
CM_Delete_PowerScheme
CM_Delete_Range
CM_Detect_Resource_Conflict
CM_Detect_Resource_Conflict_Ex
CM_Disable_DevNode
CM_Disable_DevNode_Ex
CM_Disconnect_Machine
CM_Dup_Range_List
CM_Duplicate_PowerScheme
CM_Enable_DevNode
CM_Enable_DevNode_Ex
CM_Enumerate_Classes
CM_Enumerate_Classes_Ex
CM_Enumerate_EnumeratorsA
CM_Enumerate_EnumeratorsW
CM_Enumerate_Enumerators_ExA
CM_Enumerate_Enumerators_ExW
CM_Find_Range
CM_First_Range
CM_Free_Log_Conf
CM_Free_Log_Conf_Ex
CM_Free_Log_Conf_Handle
CM_Free_Range_List
CM_Free_Res_Des
CM_Free_Res_Des_Ex
CM_Free_Res_Des_Handle
CM_Free_Resource_Conflict_Handle
CM_Get_Child
CM_Get_Child_Ex
CM_Get_Class_Key_NameA
CM_Get_Class_Key_NameW
CM_Get_Class_Key_Name_ExA
CM_Get_Class_Key_Name_ExW
CM_Get_Class_NameA
CM_Get_Class_NameW
CM_Get_Class_Name_ExA
CM_Get_Class_Name_ExW
CM_Get_Class_PropertyW
CM_Get_Class_Property_ExW
CM_Get_Class_Property_Keys
CM_Get_Class_Property_Keys_Ex
CM_Get_Class_Registry_PropertyA
CM_Get_Class_Registry_PropertyW
CM_Get_Depth
CM_Get_Depth_Ex
CM_Get_DevNode_Custom_PropertyA
CM_Get_DevNode_Custom_PropertyW
CM_Get_DevNode_Custom_Property_ExA
CM_Get_DevNode_Custom_Property_ExW
CM_Get_DevNode_PropertyW
CM_Get_DevNode_Property_ExW
CM_Get_DevNode_Property_Keys
CM_Get_DevNode_Property_Keys_Ex
CM_Get_DevNode_Registry_PropertyA
CM_Get_DevNode_Registry_PropertyW
CM_Get_DevNode_Registry_Property_ExA
CM_Get_DevNode_Registry_Property_ExW
CM_Get_DevNode_Status
CM_Get_DevNode_Status_Ex
CM_Get_Device_IDA
CM_Get_Device_IDW
CM_Get_Device_ID_ExA
CM_Get_Device_ID_ExW
CM_Get_Device_ID_ListA
CM_Get_Device_ID_ListW
CM_Get_Device_ID_List_ExA
CM_Get_Device_ID_List_ExW
CM_Get_Device_ID_List_SizeA
CM_Get_Device_ID_List_SizeW
CM_Get_Device_ID_List_Size_ExA
CM_Get_Device_ID_List_Size_ExW
CM_Get_Device_ID_Size
CM_Get_Device_ID_Size_Ex
CM_Get_Device_Interface_AliasA
CM_Get_Device_Interface_AliasW
CM_Get_Device_Interface_Alias_ExA
CM_Get_Device_Interface_Alias_ExW
CM_Get_Device_Interface_ListA
CM_Get_Device_Interface_ListW
CM_Get_Device_Interface_List_ExA
CM_Get_Device_Interface_List_ExW
CM_Get_Device_Interface_List_SizeA
CM_Get_Device_Interface_List_SizeW
CM_Get_Device_Interface_List_Size_ExA
CM_Get_Device_Interface_List_Size_ExW
CM_Get_Device_Interface_PropertyW
CM_Get_Device_Interface_Property_ExW
CM_Get_Device_Interface_Property_KeysW
CM_Get_Device_Interface_Property_Keys_ExW
CM_Get_First_Log_Conf
CM_Get_First_Log_Conf_Ex
CM_Get_Global_State
CM_Get_Global_State_Ex
CM_Get_HW_Prof_FlagsA
CM_Get_HW_Prof_FlagsW
CM_Get_HW_Prof_Flags_ExA
CM_Get_HW_Prof_Flags_ExW
CM_Get_Hardware_Profile_InfoA
CM_Get_Hardware_Profile_InfoW
CM_Get_Hardware_Profile_Info_ExA
CM_Get_Hardware_Profile_Info_ExW
CM_Get_Log_Conf_Priority
CM_Get_Log_Conf_Priority_Ex
CM_Get_Next_Log_Conf
CM_Get_Next_Log_Conf_Ex
CM_Get_Next_Res_Des
CM_Get_Next_Res_Des_Ex
CM_Get_Parent
CM_Get_Parent_Ex
CM_Get_Res_Des_Data
CM_Get_Res_Des_Data_Ex
CM_Get_Res_Des_Data_Size
CM_Get_Res_Des_Data_Size_Ex
CM_Get_Resource_Conflict_Count
CM_Get_Resource_Conflict_DetailsA
CM_Get_Resource_Conflict_DetailsW
CM_Get_Sibling
CM_Get_Sibling_Ex
CM_Get_Version
CM_Get_Version_Ex
CM_Import_PowerScheme
CM_Install_DevNodeW
CM_Install_DevNode_ExW
CM_Install_DriverW
CM_Intersect_Range_List
CM_Invert_Range_List
CM_Is_Dock_Station_Present
CM_Is_Dock_Station_Present_Ex
CM_Is_Version_Available
CM_Is_Version_Available_Ex
CM_Locate_DevNodeA
CM_Locate_DevNodeW
CM_Locate_DevNode_ExA
CM_Locate_DevNode_ExW
CM_MapCrToSpErr
CM_MapCrToWin32Err
CM_Merge_Range_List
CM_Modify_Res_Des
CM_Modify_Res_Des_Ex
CM_Move_DevNode
CM_Move_DevNode_Ex
CM_Next_Range
CM_Open_Class_KeyA
CM_Open_Class_KeyW
CM_Open_Class_Key_ExA
CM_Open_Class_Key_ExW
CM_Open_DevNode_Key
CM_Open_DevNode_Key_Ex
CM_Open_Device_Interface_KeyA
CM_Open_Device_Interface_KeyW
CM_Open_Device_Interface_Key_ExA
CM_Open_Device_Interface_Key_ExW
CM_Query_And_Remove_SubTreeA
CM_Query_And_Remove_SubTreeW
CM_Query_And_Remove_SubTree_ExA
CM_Query_And_Remove_SubTree_ExW
CM_Query_Arbitrator_Free_Data
CM_Query_Arbitrator_Free_Data_Ex
CM_Query_Arbitrator_Free_Size
CM_Query_Arbitrator_Free_Size_Ex
CM_Query_Remove_SubTree
CM_Query_Remove_SubTree_Ex
CM_Query_Resource_Conflict_List
CM_Reenumerate_DevNode
CM_Reenumerate_DevNode_Ex
CM_Register_Device_Driver
CM_Register_Device_Driver_Ex
CM_Register_Device_InterfaceA
CM_Register_Device_InterfaceW
CM_Register_Device_Interface_ExA
CM_Register_Device_Interface_ExW
CM_Register_Notification
CM_Remove_SubTree
CM_Remove_SubTree_Ex
CM_Request_Device_EjectA
CM_Request_Device_EjectW
CM_Request_Device_Eject_ExA
CM_Request_Device_Eject_ExW
CM_Request_Eject_PC
CM_Request_Eject_PC_Ex
CM_RestoreAll_DefaultPowerSchemes
CM_Restore_DefaultPowerScheme
CM_Run_Detection
CM_Run_Detection_Ex
CM_Set_ActiveScheme
CM_Set_Class_PropertyW
CM_Set_Class_Property_ExW
CM_Set_Class_Registry_PropertyA
CM_Set_Class_Registry_PropertyW
CM_Set_DevNode_Problem
CM_Set_DevNode_Problem_Ex
CM_Set_DevNode_PropertyW
CM_Set_DevNode_Property_ExW
CM_Set_DevNode_Registry_PropertyA
CM_Set_DevNode_Registry_PropertyW
CM_Set_DevNode_Registry_Property_ExA
CM_Set_DevNode_Registry_Property_ExW
CM_Set_Device_Interface_PropertyW
CM_Set_Device_Interface_Property_ExW
CM_Set_HW_Prof
CM_Set_HW_Prof_Ex
CM_Set_HW_Prof_FlagsA
CM_Set_HW_Prof_FlagsW
CM_Set_HW_Prof_Flags_ExA
CM_Set_HW_Prof_Flags_ExW
CM_Setup_DevNode
CM_Setup_DevNode_Ex
CM_Test_Range_Available
CM_Uninstall_DevNode
CM_Uninstall_DevNode_Ex
CM_Uninstall_DriverW
CM_Unregister_Device_InterfaceA
CM_Unregister_Device_InterfaceW
CM_Unregister_Device_Interface_ExA
CM_Unregister_Device_Interface_ExW
CM_Unregister_Notification
CM_Write_UserPowerKey
DevCloseObjectQuery
DevCreateObjectQuery
DevCreateObjectQueryEx
DevCreateObjectQueryFromId
DevCreateObjectQueryFromIdEx
DevCreateObjectQueryFromIds
DevCreateObjectQueryFromIdsEx
DevFindProperty
DevFreeObjectProperties
DevFreeObjects
DevGetObjectProperties
DevGetObjectPropertiesEx
DevGetObjects
DevGetObjectsEx
DevSetObjectProperties
SwDeviceClose
SwDeviceCreate
SwDeviceGetLifetime
SwDeviceInterfacePropertySet
SwDeviceInterfaceRegister
SwDeviceInterfaceSetState
SwDevicePropertySet
SwDeviceSetLifetime
SwMemFree

Sections

.text
Size: 216KB - Virtual size: 216KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4b4464c7677b6f07342800f4cf0ba273

Headers

DLL Characteristics

File Characteristics

Imports

api-ms-win-core-crt-l1-1-0

api-ms-win-core-crt-l2-1-0

ntdll

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-wow64-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 216KB - Virtual size: 216KB

.rdata Size: 60KB - Virtual size: 60KB

.data Size: 8KB - Virtual size: 8KB

.pdata Size: 12KB - Virtual size: 12KB

.didat Size: 4KB - Virtual size: 4KB

.rsrc Size: 4KB - Virtual size: 4KB

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 216KB - Virtual size: 216KB

.rdata
Size: 60KB - Virtual size: 60KB

.data
Size: 8KB - Virtual size: 8KB

.pdata
Size: 12KB - Virtual size: 12KB

.didat
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 4KB - Virtual size: 4KB

.reloc
Size: 4KB - Virtual size: 4KB