8193ae96e17c5f78bbe9db6f518020f0_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

8193ae96e17c5f78bbe9db6f518020f0_NeikiAnalytics.exe
Size

1.5MB
MD5

8193ae96e17c5f78bbe9db6f518020f0
SHA1

74961bcec1be4f5d78a6382c42d3eac8f6e946d8
SHA256

7b0b4f199dc07c617602f054cd53497fb81ec828deb1ea46db3bcb4f477da8b7
SHA512

f3d0843b597039977a1944df451b60aaddd3327dde990b8ce9ee0d8628fa1d4c27d4c064e5db72612c2cfc35308767d0f3be17345a24c5f0d2cb2b256b32cb28
SSDEEP

24576:h02WHenVg9N9JMlDlfjRiVuVsWt5MJMs:h5WHeVgFIDRRAubt5M

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8193ae96e17c5f78bbe9db6f518020f0_NeikiAnalytics.exe

Files

8193ae96e17c5f78bbe9db6f518020f0_NeikiAnalytics.exe
.exe windows:10 windows x64 arch:x64

c29a8b4e64755be19f08b918f93a11c7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

TieringEngineService.pdb

Imports

msvcrt

wcscat_s
__CxxFrameHandler3
_snwprintf_s
wcsncmp
_vsnwprintf
realloc
swprintf_s
_onexit
__dllonexit
_unlock
_lock
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_commode
_fmode
_wcmdln
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
wcscpy_s
memset
_callnewh
malloc
free
_purecall
__C_specific_handler
_CxxThrowException

ntdll

RtlSetBits
RtlInitializeBitMap
RtlCreateSystemVolumeInformationFolder
NtQueryInformationFile
NtSetInformationFile
RtlCopyUnicodeString
NtFsControlFile
NtWaitForSingleObject
NtOpenFile
RtlGetThreadErrorMode
RtlSetThreadErrorMode
RtlNumberOfClearBits
RtlStringFromGUID
WinSqmEndSession
WinSqmStartSession
NtClose
RtlNtStatusToDosError
RtlGUIDFromString
RtlCompareUnicodeString
RtlInitUnicodeString
RtlCompareMemory
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WinSqmAddToStreamEx

oleaut32

VariantInit
SysAllocString
SysFreeString
VariantClear

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableLevel
GetTraceLoggerHandle
UnregisterTraceGuids
GetTraceEnableFlags
RegisterTraceGuidsW
TraceMessage

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
RaiseException
SetUnhandledExceptionFilter

api-ms-win-core-com-l1-1-0

CoUninitialize
CoTaskMemFree
CoMarshalInterface
CoInitializeEx
CoRevokeClassObject
CreateStreamOnHGlobal
CoCreateInstance
CoSuspendClassObjects
CoUnmarshalInterface
CoTaskMemAlloc
CoResumeClassObjects
CoReleaseMarshalData
CoCreateGuid
CoRegisterClassObject

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
ReleaseSRWLockShared
AcquireSRWLockExclusive
InitializeSRWLock
WaitForSingleObject
ReleaseSRWLockExclusive
AcquireSRWLockShared
SetEvent
CreateEventW
ResetEvent
InitializeCriticalSection

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventWrite
EventSetInformation
EventWriteTransfer
EventUnregister

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
GetModuleHandleExW
LoadStringW

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
CreateThread
GetCurrentThreadId
GetStartupInfoW
GetCurrentProcess
TerminateProcess
OpenProcessToken

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-service-core-l1-1-0

StartServiceCtrlDispatcherW
SetServiceStatus

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-service-winsvc-l1-1-0

RegisterServiceCtrlHandlerW

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolWork
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolCleanupGroup
WaitForThreadpoolWorkCallbacks
CloseThreadpoolCleanupGroupMembers
FreeLibraryWhenCallbackReturns
CloseThreadpoolWait
CloseThreadpool
SetThreadpoolWait
CreateThreadpoolWait
SubmitThreadpoolWork
CreateThreadpoolWork
SetThreadpoolThreadMinimum
WaitForThreadpoolTimerCallbacks
SetThreadpoolThreadMaximum
WaitForThreadpoolWaitCallbacks
CreateThreadpoolCleanupGroup
CreateThreadpool

api-ms-win-core-string-l1-1-0

CompareStringW

api-ms-win-core-processenvironment-l1-1-0

SetCurrentDirectoryW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount
GetSystemWindowsDirectoryW

api-ms-win-core-synch-l1-2-1

CreateSemaphoreW

api-ms-win-core-file-l1-1-0

FindClose
CreateDirectoryW
DeleteFileW
FindNextFileW
FindNextVolumeW
GetFileAttributesW
FindVolumeClose
FindFirstVolumeW
FindFirstFileW

api-ms-win-core-registry-l1-1-0

RegGetValueW
RegCreateKeyExW
RegNotifyChangeKeyValue

api-ms-win-eventing-controller-l1-1-0

ControlTraceW
EnableTraceEx2
StartTraceW

api-ms-win-eventing-consumer-l1-1-0

OpenTraceW
CloseTrace
ProcessTrace

api-ms-win-core-file-l1-2-0

GetVolumeNameForVolumeMountPointW

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW

api-ms-win-security-base-l1-1-0

AdjustTokenPrivileges
PrivilegeCheck

api-ms-win-core-localization-l1-2-0

GetLocaleInfoW

api-ms-win-devices-config-l1-1-1

CM_Register_Notification
CM_Unregister_Notification

api-ms-win-core-file-l2-1-1

OpenFileById

api-ms-win-core-realtime-l1-1-0

QueryUnbiasedInterruptTime

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-kernel32-legacy-l1-1-0

MoveFileW

esent

JetOpenTableW
JetDeleteTableW
JetSetCurrentIndexW
JetCreateDatabase2W
JetOpenDatabaseW
JetAttachDatabase2W
JetBeginSessionW
JetEndSession
JetCloseDatabase
JetCloseTable
JetInit3W
JetTerm2
JetSetSystemParameterW
JetCreateInstance2W
JetCreateTableColumnIndex2W
JetResetSessionContext
JetSetSessionContext
JetOpenTempTable
JetRetrieveColumns
JetSetColumns
JetPrepareUpdate
JetUpdate
JetMove
JetMakeKey
JetSeek
JetBeginTransaction
JetRetrieveColumn
JetDelete
JetCommitTransaction
JetRollback
JetGetColumnInfoW
JetComputeStats
JetEnableMultiInstanceW
JetGetObjectInfoW

clusapi

GetClusterInformation
OpenCluster
CloseCluster

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Sections

.text
Size: 239KB - Virtual size: 239KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

c29a8b4e64755be19f08b918f93a11c7

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

oleaut32

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-service-core-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-file-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-eventing-controller-l1-1-0

api-ms-win-eventing-consumer-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-io-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-devices-config-l1-1-1

api-ms-win-core-file-l2-1-1

api-ms-win-core-realtime-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-file-l2-1-2

api-ms-win-core-kernel32-legacy-l1-1-0

esent

clusapi

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Sections

.text Size: 239KB - Virtual size: 239KB

.rdata Size: 40KB - Virtual size: 40KB

.data Size: 1024B - Virtual size: 3KB

.pdata Size: 6KB - Virtual size: 5KB

.didat Size: 512B - Virtual size: 16B

.rsrc Size: 7KB - Virtual size: 7KB

.reloc Size: 1.2MB - Virtual size: 1.2MB

.text
Size: 239KB - Virtual size: 239KB

.rdata
Size: 40KB - Virtual size: 40KB

.data
Size: 1024B - Virtual size: 3KB

.pdata
Size: 6KB - Virtual size: 5KB

.didat
Size: 512B - Virtual size: 16B

.rsrc
Size: 7KB - Virtual size: 7KB

.reloc
Size: 1.2MB - Virtual size: 1.2MB