a34f43102bf152ea937fd06177b4a6f0_NeikiAnalytics[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

a34f43102bf152ea937fd06177b4a6f0_NeikiAnalytics.exe
Size

149KB
MD5

a34f43102bf152ea937fd06177b4a6f0
SHA1

545d2d1f147ec9ef7c31e0b931c26c141dfbc5c7
SHA256

0dbbf161328b510cc7b9dabb73474fcb004b5d145847fae08eb65cfeb4a16a36
SHA512

14de6daf44c83448037dda267a6bfb3868281cb7307cf8a7df0972ef67aeb68d6026e664c65e8f1a3e7ef7f3ac41d47c1367963e3cd6976473a56fce5a08eb0c
SSDEEP

3072:01rHa0JIFW/tAKelLHxexrDXB2B2lQBV+UdE+rECWp7hKvc:6602WlAKe5YXABV+UdvrEFp7hKvc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a34f43102bf152ea937fd06177b4a6f0_NeikiAnalytics.exe

Files

a34f43102bf152ea937fd06177b4a6f0_NeikiAnalytics.exe
.dll windows:6 windows x86 arch:x86

df5f252a362d40ffdf4793338eb50343

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\waffle\branches\se_leo\3_develop\lm\src_b\objfre_wnet_x86\i386\OK600PLM.pdb

Imports

msvcrt

_amsg_exit
_initterm
free
malloc
_XcptFilter
_errno
mbtowc
__mb_cur_max
isleadbyte
_iob
_snprintf
_itoa
ferror
__badioinfo
__pioinfo
_fileno
_lseeki64
_write
swprintf
floor
ceil
wcsrchr
_isatty
wcsncpy
wcsncmp
_wcsicmp
memset
memcpy

kernel32

EnterCriticalSection
VerSetConditionMask
LeaveCriticalSection
GetVersionExW
GetTempPathW
InitializeCriticalSection
WaitForSingleObject
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
RtlUnwind
InterlockedCompareExchange
InterlockedExchange
WritePrivateProfileStringW
GetFileAttributesW
LocalFree
GetLocalTime
OutputDebugStringA
GetTempFileNameW
CreateFileW
WriteFile
GetSystemDirectoryW
lstrcmpiW
GetCurrentThread
GetExitCodeProcess
CreateThread
GetSystemTime
SetFilePointer
GetFileSize
ReadFile
DeleteFileW
Sleep
VerifyVersionInfoW
CloseHandle
DisableThreadLibraryCalls
GetLastError
GlobalAlloc
GlobalFree
SetLastError
GetTickCount

advapi32

CreateProcessAsUserW
DuplicateTokenEx
OpenThreadToken
GetUserNameW
ConvertStringSecurityDescriptorToSecurityDescriptorW

user32

MessageBoxW
wsprintfW
LoadStringW

spoolss

ClosePrinter
SetJobW
GetPrinterW
GetPrinterDataW
GetPrinterDataExW
SetPrinterDataW
GetJobW
OpenPrinterW

shell32

SHCreateDirectoryExW

wtsapi32

WTSEnumerateSessionsW
WTSSendMessageW
WTSFreeMemory

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

pfousup

RtouCloseServer
RtouCloseSession
RtouSendMessage
RtouCloseMessage
RtouResponseMessage
RtouOpenSessionByAddrW
RtouSetMessageCallback
RtouInitServerW

Exports

Exports

DllMain
InitializePrintMonitor2

Sections

.text
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

df5f252a362d40ffdf4793338eb50343

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

kernel32

advapi32

user32

spoolss

shell32

wtsapi32

userenv

pfousup

Exports

Exports

Sections

.text Size: 42KB - Virtual size: 41KB

.data Size: 6KB - Virtual size: 6KB

.rsrc Size: 21KB - Virtual size: 21KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 42KB - Virtual size: 41KB

.data
Size: 6KB - Virtual size: 6KB

.rsrc
Size: 21KB - Virtual size: 21KB

.reloc
Size: 2KB - Virtual size: 2KB