69261933e35f8fe32ffaa495edbd8120_NeikiAnalytics[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

69261933e35f8fe32ffaa495edbd8120_NeikiAnalytics.exe
Size

1.9MB
MD5

69261933e35f8fe32ffaa495edbd8120
SHA1

cfe1aa1c33708a2b6d7775028c6a80ea842ad88b
SHA256

980f1c50b39ec12fed2ca3acd866b6d74cfaaddca4720c5af6c7ab2c62788132
SHA512

aa5edab7124365807c1571fe5dc9469a09897db54e24c304bb14478d2551b2880cc858a61b7010dda3eba958f62895541160f46e7b34943f7e70689c94ebfab5
SSDEEP

49152:9mFpKw/8l6VA9vsDforaOu/BBTyYH3sAR8Ud3idbYJO:obVMvsr1zdl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
69261933e35f8fe32ffaa495edbd8120_NeikiAnalytics.exe

Files

69261933e35f8fe32ffaa495edbd8120_NeikiAnalytics.exe
.dll windows:10 windows x64 arch:x64

a1d9b0ca0bff41938fff10b84fe75435

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

Windows.Media.Speech.pdb

Imports

msvcp110_win

?is@?$ctype@G@std@@QEBA_NFG@Z
?_Getcat@?$ctype@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Incref@facet@locale@std@@UEAAXXZ
_Wcscoll
_Wcsxfrm
?tolower@?$ctype@G@std@@QEBAPEBGPEAGPEBG@Z
??0facet@locale@std@@IEAA@_K@Z
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
??1_Container_base12@std@@QEAA@XZ
?_Xbad_function_call@std@@YAXXZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
?id@?$collate@G@std@@2V0locale@2@A
?tolower@?$ctype@G@std@@QEBAGG@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
??Bid@locale@std@@QEAA_KXZ
?id@?$ctype@G@std@@2V0locale@2@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
?_Xbad_alloc@std@@YAXXZ
??1_Locinfo@std@@QEAA@XZ
??1facet@locale@std@@MEAA@XZ
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Winerror_map@std@@YAPEBDH@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ

msvcrt

_wsplitpath_s
_wcsicmp
wcsncpy_s
wcstol
srand
_itow_s
wcstombs
??8type_info@@QEBAHAEBV0@@Z
wcscspn
calloc
_errno
memset
memmove
memcpy
memcmp
wcscpy_s
_wcstod_l
_vsnwprintf_l
_wtol_l
_free_locale
_create_locale
_wcsnicmp
mbstowcs_s
strnlen
?name@type_info@@QEBAPEBDXZ
swscanf_s
_wtof
_wtoi64
_i64tow_s
iswdigit
__ExceptionPtrCreate
__ExceptionPtrCurrentException
__ExceptionPtrRethrow
__ExceptionPtrDestroy
__ExceptionPtrCopy
strchr
??0bad_cast@@QEAA@PEBD@Z
??1bad_cast@@UEAA@XZ
??0bad_cast@@QEAA@AEBV0@@Z
wcstok_s
iswspace
wcschr
wprintf
swprintf_s
realloc
memmove_s
_ultow_s
_CxxThrowException
_vsnprintf
isspace
rand
wcsrchr
tolower
??3@YAXPEAX@Z
??1type_info@@UEAA@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
__CxxFrameHandler3
__C_specific_handler
_initterm
free
_amsg_exit
_XcptFilter
_callnewh
malloc
_vsnprintf_s
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
_purecall
memcpy_s
_vsnwprintf
??_V@YAXPEAX@Z
__CxxFrameHandler4
wcscmp

ntdll

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlNtStatusToDosError
RtlGetDeviceFamilyInfoEnum
RtlCaptureContext
WinSqmAddToStreamEx
RtlPublishWnfStateData
NtQueryWnfStateData

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
SizeofResource
GetModuleFileNameW
GetProcAddress
GetModuleHandleExA
FreeLibrary
GetModuleHandleExW
GetModuleHandleW
LoadStringW
FindResourceExW
GetModuleFileNameA
FreeResource
DisableThreadLibraryCalls
LoadResource

api-ms-win-core-synch-l1-2-0

WakeConditionVariable
SleepConditionVariableCS
Sleep
InitOnceBeginInitialize
InitOnceExecuteOnce
InitializeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
InitOnceComplete

api-ms-win-core-synch-l1-1-0

ReleaseSemaphore
WaitForMultipleObjectsEx
AcquireSRWLockExclusive
CreateMutexExW
CreateEventExW
DeleteCriticalSection
InitializeCriticalSection
ResetEvent
ReleaseSRWLockShared
TryEnterCriticalSection
OpenSemaphoreW
InitializeCriticalSectionEx
WaitForSingleObjectEx
InitializeSRWLock
CreateEventW
WaitForSingleObject
EnterCriticalSection
ReleaseSRWLockExclusive
AcquireSRWLockShared
SetEvent
LeaveCriticalSection
CreateSemaphoreExW
ReleaseMutex

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapSize
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
RaiseException
GetLastError
SetUnhandledExceptionFilter
SetLastError

api-ms-win-core-winrt-string-l1-1-0

WindowsDuplicateString
WindowsConcatString
WindowsIsStringEmpty
WindowsCreateString
WindowsDeleteString
WindowsGetStringRawBuffer
WindowsSubstringWithSpecifiedLength
WindowsCreateStringReference
WindowsGetStringLen
WindowsCompareStringOrdinal
WindowsStringHasEmbeddedNull

api-ms-win-core-com-l1-1-0

CoUninitialize
CoInitializeEx
GetHGlobalFromStream
CLSIDFromProgID
StringFromGUID2
CoCreateGuid
CoGetApartmentType
CoWaitForMultipleHandles
CreateStreamOnHGlobal
CoMarshalInterface
CoCreateInstance
CoCreateFreeThreadedMarshaler
CoTaskMemRealloc
CoTaskMemFree
CoReleaseMarshalData
CoTaskMemAlloc
StringFromCLSID
CoGetInterfaceAndReleaseStream
PropVariantClear
IIDFromString

api-ms-win-eventing-provider-l1-1-0

EventActivityIdControl
EventUnregister
EventWriteTransfer
EventRegister
EventSetInformation

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-processthreads-l1-1-0

OpenThreadToken
GetCurrentThreadId
GetCurrentProcessId
OpenProcessToken
GetCurrentProcess
GetCurrentThread
TerminateProcess

api-ms-win-core-winrt-error-l1-1-0

RoTransformError
RoOriginateError
RoOriginateErrorW
GetRestrictedErrorInfo
SetRestrictedErrorInfo

api-ms-win-core-localization-l1-2-0

LocaleNameToLCID
ResolveLocaleName
FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringA
DebugBreak
IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

oleaut32

SysStringLen
VariantClear
VarUI4FromStr
LoadTypeLi
LoadRegTypeLi
VariantInit
SysFreeString
SysAllocString

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetSystemWindowsDirectoryW
GetTickCount64
GetTickCount
GetSystemTime

api-ms-win-core-winrt-error-l1-1-1

IsErrorPropagationEnabled
RoReportFailedDelegate
RoGetMatchingRestrictedErrorInfo

api-ms-win-core-psm-app-l1-1-0

PsmUnregisterAppStateChangeNotification
PsmRegisterAppStateChangeNotification

api-ms-win-core-winrt-l1-1-0

RoUninitialize
RoActivateInstance
RoGetActivationFactory
RoInitialize

api-ms-win-core-com-l1-1-1

RoGetAgileReference

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-security-base-l1-1-0

GetTokenInformation
CreateWellKnownSid

api-ms-win-appmodel-runtime-l1-1-0

GetCurrentApplicationUserModelId
GetCurrentPackageFullName

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolWorkCallbacks
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolWork
CloseThreadpoolWork
FreeLibraryWhenCallbackReturns
CreateThreadpoolTimer
CloseThreadpoolTimer
SubmitThreadpoolWork

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
CompareStringOrdinal
CompareStringEx

api-ms-win-core-heap-obsolete-l1-1-0

GlobalUnlock
GlobalLock

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegGetValueW
RegSetValueExW
RegNotifyChangeKeyValue
RegDeleteValueW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrChrW

api-ms-win-core-file-l1-1-0

WriteFile
LockFileEx
UnlockFileEx
FlushFileBuffers
CompareFileTime
ReadFile
SetEndOfFile
GetFileInformationByHandle
SetFilePointer
CreateFileW
GetFileAttributesW
FileTimeToLocalFileTime

api-ms-win-core-localization-obsolete-l1-2-0

GetUserDefaultUILanguage
GetSystemDefaultUILanguage

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-shcore-stream-winrt-l1-1-0

CreateStreamOverRandomAccessStream

api-ms-win-security-capability-l1-1-0

CapabilityCheck

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx

api-ms-win-core-kernel32-legacy-l1-1-0

RegisterWaitForSingleObject

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime
FileTimeToSystemTime
GetTimeZoneInformation

api-ms-win-core-localization-l1-2-2

LCIDToLocaleName

api-ms-win-shcore-thread-l1-1-0

SHGetThreadRef

api-ms-win-core-url-l1-1-0

UrlUnescapeW

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

api-ms-win-security-provider-l1-1-0

SetEntriesInAclW
GetNamedSecurityInfoW
SetNamedSecurityInfoW

api-ms-win-stateseparation-helpers-l1-1-0

GetPersistedRegistryLocationW

api-ms-win-core-psapi-l1-1-0

K32GetModuleFileNameExW

api-ms-win-security-lsalookup-l2-1-0

LookupAccountNameW

api-ms-win-core-wow64-l1-1-1

IsWow64Process2

api-ms-win-core-wow64-l1-1-0

Wow64RevertWow64FsRedirection
Wow64DisableWow64FsRedirection

api-ms-win-core-winrt-robuffer-l1-1-0

RoGetBufferMarshaler

api-ms-win-shcore-taskpool-l1-1-0

SHTaskPoolQueueTask
SHTaskPoolAllowThreadReuse

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

urlmon

CoInternetParseUrl

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-namedpipe-l1-1-0

ConnectNamedPipe
DisconnectNamedPipe
CreateNamedPipeW

api-ms-win-core-io-l1-1-0

CancelIoEx

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 396KB - Virtual size: 395KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 60KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a1d9b0ca0bff41938fff10b84fe75435

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcp110_win

msvcrt

ntdll

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

oleaut32

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-psm-app-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-com-l1-1-1

api-ms-win-core-processthreads-l1-1-1

api-ms-win-security-base-l1-1-0

api-ms-win-appmodel-runtime-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-shlwapi-obsolete-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-localization-obsolete-l1-2-0

api-ms-win-core-synch-l1-2-1

api-ms-win-shcore-stream-winrt-l1-1-0

api-ms-win-security-capability-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-localization-l1-2-2

api-ms-win-shcore-thread-l1-1-0

api-ms-win-core-url-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-security-provider-l1-1-0

api-ms-win-stateseparation-helpers-l1-1-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-core-wow64-l1-1-1

api-ms-win-core-wow64-l1-1-0

api-ms-win-core-winrt-robuffer-l1-1-0

api-ms-win-shcore-taskpool-l1-1-0

api-ms-win-core-apiquery-l1-1-0

urlmon

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

Exports

Exports

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 396KB - Virtual size: 395KB

.data Size: 12KB - Virtual size: 14KB

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 396KB - Virtual size: 395KB

.data
Size: 12KB - Virtual size: 14KB

.pdata
Size: 60KB - Virtual size: 57KB

.didat
Size: 4KB - Virtual size: 104B

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 32KB - Virtual size: 28KB