0305e703884b0555ab2b0fa5d81fb020_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

0305e703884b0555ab2b0fa5d81fb020_NeikiAnalytics.exe
Size

224KB
MD5

0305e703884b0555ab2b0fa5d81fb020
SHA1

4afa32788eb7d5955275ab9516761ba384108ea2
SHA256

f17be4546f14334b4e11d2a98de5a4fd1ab9b7f11e9303bb5211aa0acd005499
SHA512

853fc8368ea6fc9eeab159cc2fb592cb12f9cdc0b6d516521b95d272434f8a15812afadb70f471908f2c0080c4a37ad1598690b92ffa1f4ee7f61256c18e57b4
SSDEEP

1536:vynrmc1tgXE+Db8BJX6qJrnyHmQjpZtRFKg3HjKY07Lb8q9jKmN4v30ES72Wiy8g:bc1t8ngJKqZyjigghzmv30n72WM26M

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0305e703884b0555ab2b0fa5d81fb020_NeikiAnalytics.exe

Files

0305e703884b0555ab2b0fa5d81fb020_NeikiAnalytics.exe
.dll regsvr32 windows:4 windows x64 arch:x64

15ee0fd307270e2e73b059dad9b104c3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

advapi32

RegCloseKey
RegEnumKeyExW
RegGetValueW
RegOpenKeyA
RegOpenKeyExW
RegOpenKeyW
RegQueryInfoKeyW
RegQueryValueExA
RegQueryValueExW

dbghelp

ImageNtHeader
ImageRvaToVa

kernel32

CloseHandle
CreateFileMappingW
CreateFileW
CreateProcessW
DisableThreadLibraryCalls
DuplicateHandle
EnterCriticalSection
EnumResourceNamesW
ExitProcess
FindActCtxSectionGuid
FindResourceW
FreeLibrary
GetCommandLineW
GetEnvironmentVariableA
GetEnvironmentVariableW
GetFileAttributesW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetSystemDirectoryW
GetTickCount
GetWindowsDirectoryW
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
InitOnceExecuteOnce
InitializeCriticalSection
IsBadStringPtrA
IsBadStringPtrW
IsWow64Process
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LoadResource
LocalFree
MapViewOfFile
MultiByteToWideChar
QueryActCtxW
RaiseException
ReadFile
ReleaseActCtx
ResumeThread
SizeofResource
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnmapViewOfFile
WaitForSingleObject
WideCharToMultiByte

ntdll

_vsnprintf

ole32

CoCreateInstance
CoInitialize
CoInitializeEx
CoUninitialize
StringFromGUID2

shell32

CommandLineToArgvW

shlwapi

PathAppendW
PathRemoveFileSpecW

ucrtbase

__acrt_iob_func
__stdio_common_vsprintf
_assert
_strdup
_strnicmp
_wgetenv
atoi
free
fwrite
getenv
memchr
memcmp
memcpy
memmove
strchr
strcmp
strcpy
strcspn
strlen
strrchr
wcscat
wcschr
wcscmp
wcscpy
wcslen
wcsncmp
wcsrchr
wcstok_s

Exports

Exports

CLRCreateInstance
CallFunctionShim
CloseCtrs
ClrCreateManagedInstance
CoEEShutDownCOM
CoInitializeCor
CoInitializeEE
CoUninitializeCor
CoUninitializeEE
CollectCtrs
CorBindToCurrentRuntime
CorBindToRuntime
CorBindToRuntimeByCfg
CorBindToRuntimeByPath
CorBindToRuntimeByPathEx
CorBindToRuntimeEx
CorBindToRuntimeHost
CorDllMainWorker
CorExitProcess
CorGetSvc
CorIsLatestSvc
CorMarkThreadInThreadPool
CorTickleSvc
CreateConfigStream
CreateDebuggingInterfaceFromVersion
CreateInterface
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
EEDllGetClassObjectFromClass
EEDllRegisterServer
EEDllUnregisterServer
GetAssemblyMDImport
GetCORRequiredVersion
GetCORRootDirectory
GetCORSystemDirectory
GetCORVersion
GetCompileInfo
GetFileVersion
GetHashFromAssemblyFile
GetHashFromAssemblyFileW
GetHashFromBlob
GetHashFromFile
GetHashFromFileW
GetHashFromHandle
GetHostConfigurationFile
GetMetaDataInternalInterface
GetMetaDataInternalInterfaceFromPublic
GetMetaDataPublicInterfaceFromInternal
GetPermissionRequests
GetPrivateContextsPerfCounters
GetProcessExecutableHeap
GetRealProcAddress
GetRequestedRuntimeInfo
GetRequestedRuntimeVersion
GetRequestedRuntimeVersionForCLSID
GetStartupFlags
GetTargetForVTableEntry
GetTokenForVTableEntry
GetVersionFromProcess
GetXMLElement
GetXMLElementAttribute
GetXMLObject
InitErrors
InitSSAutoEnterThread
LoadLibraryShim
LoadLibraryWithPolicyShim
LoadStringRC
LoadStringRCEx
LockClrVersion
MetaDataGetDispenser
ND_CopyObjDst
ND_CopyObjSrc
ND_RI2
ND_RI4
ND_RI8
ND_RU1
ND_WI2
ND_WI4
ND_WI8
ND_WU1
OpenCtrs
PostError
ReOpenMetaDataWithMemory
ReOpenMetaDataWithMemoryEx
RunDll@ShimW
RuntimeOSHandle
RuntimeOpenImage
RuntimeReleaseHandle
SetTargetForVTableEntry
StrongNameCompareAssemblies
StrongNameErrorInfo
StrongNameFreeBuffer
StrongNameGetBlob
StrongNameGetBlobFromImage
StrongNameGetPublicKey
StrongNameHashSize
StrongNameKeyDelete
StrongNameKeyGen
StrongNameKeyGenEx
StrongNameKeyInstall
StrongNameSignatureGeneration
StrongNameSignatureGenerationEx
StrongNameSignatureSize
StrongNameSignatureVerification
StrongNameSignatureVerificationEx
StrongNameSignatureVerificationFromImage
StrongNameTokenFromAssembly
StrongNameTokenFromAssemblyEx
StrongNameTokenFromPublicKey
TranslateSecurityAttributes
UpdateError
_CorDllMain
_CorExeMain
_CorExeMain2
_CorImageUnloading
_CorValidateImage
wine_install_mono

Sections

.text
Size: 80KB - Virtual size: 77KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 704B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 816B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 568B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

15ee0fd307270e2e73b059dad9b104c3

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

dbghelp

kernel32

ntdll

ole32

shell32

shlwapi

ucrtbase

Exports

Exports

Sections

.text Size: 80KB - Virtual size: 77KB

.data Size: 4KB - Virtual size: 704B

.rodata Size: 4KB - Virtual size: 2KB

.rdata Size: 48KB - Virtual size: 47KB

.pdata Size: 4KB - Virtual size: 3KB

.xdata Size: 4KB - Virtual size: 3KB

.bss Size: - Virtual size: 816B

.edata Size: 64KB - Virtual size: 63KB

.idata Size: 4KB - Virtual size: 3KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 4KB - Virtual size: 568B

.text
Size: 80KB - Virtual size: 77KB

.data
Size: 4KB - Virtual size: 704B

.rodata
Size: 4KB - Virtual size: 2KB

.rdata
Size: 48KB - Virtual size: 47KB

.pdata
Size: 4KB - Virtual size: 3KB

.xdata
Size: 4KB - Virtual size: 3KB

.bss
Size: - Virtual size: 816B

.edata
Size: 64KB - Virtual size: 63KB

.idata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 4KB - Virtual size: 568B