05faec9dc48b6ce23f19a15f14fa40c0_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

05faec9dc48b6ce23f19a15f14fa40c0_NeikiAnalytics.exe
Size

949KB
MD5

05faec9dc48b6ce23f19a15f14fa40c0
SHA1

615e3ae949c5c04835b378aebf83f519611b585c
SHA256

dc2c97cf39b53c04cfb0ce87c4e5f8116fe62a07acd75e186a7561f41134c404
SHA512

59a8754abe9956d8cf931e16c1ebd253e18b47a31d2e64adb2ff57f6c5680b5ae785c359393354920f338a09d09754d41962771c9c116ad4257a03c3e993e6f0
SSDEEP

24576:lqB5tUnPkmxmR0mYjlkPJHNCHtClUNF+j6sG6rEH72:jKTmtqUT+2/E

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
05faec9dc48b6ce23f19a15f14fa40c0_NeikiAnalytics.exe

Files

05faec9dc48b6ce23f19a15f14fa40c0_NeikiAnalytics.exe
.dll windows:5 windows x86 arch:x86

f28894e7f003ac05fd78a936b74a38cd

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetFullPathNameA
GetTempFileNameW
CreateFileA
SearchPathW
FindFirstFileW
VirtualQuery
FreeLibrary
CreateProcessW
LoadLibraryExW
ReadConsoleA
CreateDirectoryW
GetComputerNameW
ReadConsoleW
GetVolumeInformationA
CopyFileW
GetFileAttributesA
GetFileAttributesW
CreateProcessA
WriteConsoleW
GetModuleFileNameW
CreateFileW
GetTempPathW
GetShortPathNameA
CreateDirectoryA
SetCurrentDirectoryA
FindFirstFileA
GetCurrentDirectoryW
GetProcAddress
MoveFileW
RemoveDirectoryA
CopyFileA
SearchPathA
SetFileAttributesA
DisableThreadLibraryCalls
BuildCommDCBW
GetTempFileNameA
LoadLibraryA
WriteConsoleA
MoveFileA
SetCurrentDirectoryW
RemoveDirectoryW
GetSystemInfo
GetModuleFileNameA
FindNextFileA
LoadLibraryExA
FindNextFileW
BuildCommDCBA
GetCurrentDirectoryA
GetShortPathNameW
GetVersionExA
DeleteFileW
GetTempPathA
lstrcpyW
SetFileAttributesW
DeleteFileA
GetVolumeInformationW
lstrcpyA
SetFilePointer
SetEndOfFile
GetCommState
GetCurrentProcess
GetComputerNameA
GetConsoleMode
ReadFile
FlushFileBuffers
GetStdHandle
GetLastError
GetFileType
DuplicateHandle
CloseHandle
WaitForSingleObject
SetEvent
GetConsoleCP
TerminateThread
CreateEventA
SetConsoleMode
SetThreadPriority
ResetEvent
GetExitCodeThread
WaitForMultipleObjects
PeekConsoleInputA
CreateThread
SetupComm
GetCommModemStatus
ClearCommError
EscapeCommFunction
SetCommState
SetCommTimeouts
InitializeCriticalSection
LeaveCriticalSection
GetOverlappedResult
EnterCriticalSection
PurgeComm
DeleteCriticalSection
GetLogicalDriveStringsA
FindClose
GetCurrentThread
SetFileTime
GetWindowsDirectoryA
WideCharToMultiByte
MultiByteToWideChar
lstrlenW
GetPrivateProfileStringA
DeviceIoControl
GetWindowsDirectoryW
GetFileInformationByHandle
GetEnvironmentVariableW
SetErrorMode
GetEnvironmentVariableA
GetACP
lstrcmpiA
Sleep
GetCurrentThreadId
PeekNamedPipe
GetExitCodeProcess
CreatePipe
SetHandleInformation
QueryPerformanceCounter
WaitForSingleObjectEx
GetSystemTimeAsFileTime
GetTimeZoneInformation
QueryPerformanceFrequency
GetFullPathNameW
GetProcessHeap
HeapFree
WriteFile
InterlockedExchange
InterlockedCompareExchange
GetCurrentProcessId
GetTickCount
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
HeapAlloc

user32

GetMessageA
CharLowerW
wsprintfA
RegisterClassA
DispatchMessageA
PostMessageA
MsgWaitForMultipleObjectsEx
DefWindowProcA
PeekMessageA
CreateWindowExA
UnregisterClassA
TranslateMessage
KillTimer
PostQuitMessage
SetTimer
DestroyWindow
WaitForInputIdle
GetWindowLongA
SetWindowLongA
SendMessageA
CharLowerA

ws2_32

getsockopt
WSAAsyncSelect
send
accept
ntohs
gethostbyname
gethostbyaddr
closesocket
getservbyname
socket
bind
recv
WSACleanup
setsockopt
getsockname
htons
WSAGetLastError
select
inet_addr
WSAStartup
inet_ntoa
connect
gethostname
ioctlsocket
getpeername
listen

msvcr90

_isatty
memset
_getpid
_timezone
memcpy
_putenv
_tzset
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
toupper
_gmtime32
strspn
_ftime32
wcsncmp
_wcsicmp
_stricmp
_strnicmp
tolower
sprintf
strncmp
__iob_func
fflush
fprintf
atoi
strncpy
free
malloc
realloc
atan2
sqrt
cos
ceil
modf
pow
log
strstr
tanh
_errno
sinh
tan
fmod
cosh
acos
floor
_isnan
log10
atan
_hypot
exp
_finite
getenv
asin
sin
isdigit
strtoul
isxdigit
fabs
_localtime32
_mktime32
strcmp
strpbrk
memcmp
strchr
isalnum
isalpha
memmove
strlen
strtol
_environ
exit
strrchr
islower
qsort
abort
strerror
ldexp
frexp
_HUGE

advapi32

GetUserNameW
GetSecurityDescriptorOwner
GetSidIdentifierAuthority
GetUserNameA

Exports

Exports

TclAddLiteralObj
TclAllocateFreeObjects
TclBN_epoch
TclBN_fast_s_mp_mul_digs
TclBN_fast_s_mp_sqr
TclBN_mp_add
TclBN_mp_add_d
TclBN_mp_and
TclBN_mp_clamp
TclBN_mp_clear
TclBN_mp_clear_multi
TclBN_mp_cmp
TclBN_mp_cmp_d
TclBN_mp_cmp_mag
TclBN_mp_cnt_lsb
TclBN_mp_copy
TclBN_mp_count_bits
TclBN_mp_div
TclBN_mp_div_2
TclBN_mp_div_2d
TclBN_mp_div_3
TclBN_mp_div_d
TclBN_mp_exch
TclBN_mp_expt_d
TclBN_mp_grow
TclBN_mp_init
TclBN_mp_init_copy
TclBN_mp_init_multi
TclBN_mp_init_set
TclBN_mp_init_set_int
TclBN_mp_init_size
TclBN_mp_karatsuba_mul
TclBN_mp_karatsuba_sqr
TclBN_mp_lshd
TclBN_mp_mod
TclBN_mp_mod_2d
TclBN_mp_mul
TclBN_mp_mul_2
TclBN_mp_mul_2d
TclBN_mp_mul_d
TclBN_mp_neg
TclBN_mp_or
TclBN_mp_radix_size
TclBN_mp_read_radix
TclBN_mp_rshd
TclBN_mp_set
TclBN_mp_set_int
TclBN_mp_shrink
TclBN_mp_sqr
TclBN_mp_sqrt
TclBN_mp_sub
TclBN_mp_sub_d
TclBN_mp_to_unsigned_bin
TclBN_mp_to_unsigned_bin_n
TclBN_mp_toom_mul
TclBN_mp_toom_sqr
TclBN_mp_toradix_n
TclBN_mp_unsigned_bin_size
TclBN_mp_xor
TclBN_mp_zero
TclBN_reverse
TclBN_revision
TclBN_s_mp_add
TclBN_s_mp_mul_digs
TclBN_s_mp_sqr
TclBN_s_mp_sub
TclBackgroundException
TclCallVarTraces
TclChannelEventScriptInvoker
TclChannelTransform
TclCheckExecutionTraces
TclCheckInterpTraces
TclCleanupChildren
TclCleanupCommand
TclCleanupVar
TclCopyAndCollapse
TclCopyChannel
TclCreatePipeline
TclCreateProc
TclDbDumpActiveObjects
TclDeleteCompiledLocalVars
TclDeleteVars
TclDoubleDigits
TclDumpMemoryInfo
TclEvalObjEx
TclExpandCodeArray
TclExprFloatError
TclFindElement
TclFindProc
TclFormatInt
TclFreeObj
TclFreePackageInfo
TclGetAndDetachPids
TclGetAuxDataType
TclGetEnv
TclGetExtension
TclGetFrame
TclGetInstructionTable
TclGetIntForIndex
TclGetLibraryPath
TclGetLoadedPackages
TclGetLong
TclGetNamespaceForQualName
TclGetNamespaceFromObj
TclGetObjInterpProc
TclGetObjNameOfExecutable
TclGetOpenMode
TclGetOriginalCommand
TclGetPlatform
TclGetSrcInfoForPc
TclGetStartupScriptFileName
TclGetStartupScriptPath
TclGuessPackageName
TclHandleCreate
TclHandleFree
TclHandlePreserve
TclHandleRelease
TclHideLiteral
TclHideUnsafeCommands
TclInExit
TclInThreadExit
TclInitCompiledLocals
TclInitVarHashTable
TclInterpInit
TclInvokeObjectCommand
TclInvokeStringCommand
TclIsProc
TclListObjSetElement
TclLookupVar
TclNeedSpace
TclNewProcBodyObj
TclObjBeingDeleted
TclObjCommandComplete
TclObjGetFrame
TclObjInterpProc
TclObjInterpProcCore
TclObjInvoke
TclObjLookupVar
TclPopStackFrame
TclPrecTraceProc
TclPreventAliasLoop
TclProcCleanupProc
TclProcCompileProc
TclProcDeleteProc
TclPtrMakeUpvar
TclPushStackFrame
TclRegAbout
TclRegError
TclRegExpRangeUniChar
TclRenameCommand
TclResetShadowedCmdRefs
TclServiceIdle
TclSetByteCodeFromAny
TclSetLibraryPath
TclSetNsPath
TclSetObjNameOfExecutable
TclSetPreInitScript
TclSetStartupScriptFileName
TclSetStartupScriptPath
TclSetupEnv
TclSockGetPort
TclSockMinimumBuffers
TclSockMinimumBuffersOld
TclStackAlloc
TclStackFree
TclTeardownNamespace
TclTraceDictPath
TclUniCharMatch
TclUpdateReturnInfo
TclVarErrMsg
TclVarHashCreateVar
TclVarTraceExists
TclWinAddProcess
TclWinCPUID
TclWinConvertError
TclWinConvertWSAError
TclWinFlushDirtyChannels
TclWinGetPlatformId
TclWinGetServByName
TclWinGetSockOpt
TclWinGetTclInstance
TclWinNToHS
TclWinNoBackslash
TclWinResetInterfaces
TclWinSetInterfaces
TclWinSetSockOpt
Tcl_Access
Tcl_AddErrorInfo
Tcl_AddInterpResolvers
Tcl_AddObjErrorInfo
Tcl_AlertNotifier
Tcl_Alloc
Tcl_AllocStatBuf
Tcl_AllowExceptions
Tcl_AppendAllObjTypes
Tcl_AppendElement
Tcl_AppendExportList
Tcl_AppendFormatToObj
Tcl_AppendLimitedToObj
Tcl_AppendObjToErrorInfo
Tcl_AppendObjToObj
Tcl_AppendPrintfToObj
Tcl_AppendResult
Tcl_AppendResultVA
Tcl_AppendStringsToObj
Tcl_AppendStringsToObjVA
Tcl_AppendToObj
Tcl_AppendUnicodeToObj
Tcl_AsyncCreate
Tcl_AsyncDelete
Tcl_AsyncInvoke
Tcl_AsyncMark
Tcl_AsyncReady
Tcl_AttemptAlloc
Tcl_AttemptDbCkalloc
Tcl_AttemptDbCkrealloc
Tcl_AttemptRealloc
Tcl_AttemptSetObjLength
Tcl_BackgroundError
Tcl_Backslash
Tcl_BadChannelOption
Tcl_CallWhenDeleted
Tcl_CancelIdleCall
Tcl_ChannelBlockModeProc
Tcl_ChannelBuffered
Tcl_ChannelClose2Proc
Tcl_ChannelCloseProc
Tcl_ChannelFlushProc
Tcl_ChannelGetHandleProc
Tcl_ChannelGetOptionProc
Tcl_ChannelHandlerProc
Tcl_ChannelInputProc
Tcl_ChannelName
Tcl_ChannelOutputProc
Tcl_ChannelSeekProc
Tcl_ChannelSetOptionProc
Tcl_ChannelThreadActionProc
Tcl_ChannelTruncateProc
Tcl_ChannelVersion
Tcl_ChannelWatchProc
Tcl_ChannelWideSeekProc
Tcl_Chdir
Tcl_ClearChannelHandlers
Tcl_Close
Tcl_CommandComplete
Tcl_CommandTraceInfo
Tcl_Concat
Tcl_ConcatObj
Tcl_ConditionFinalize
Tcl_ConditionNotify
Tcl_ConditionWait
Tcl_ConvertCountedElement
Tcl_ConvertElement
Tcl_ConvertToType
Tcl_CreateAlias
Tcl_CreateAliasObj
Tcl_CreateChannel
Tcl_CreateChannelHandler
Tcl_CreateCloseHandler
Tcl_CreateCommand
Tcl_CreateEncoding
Tcl_CreateEnsemble
Tcl_CreateEventSource
Tcl_CreateExitHandler
Tcl_CreateHashEntry
Tcl_CreateInterp
Tcl_CreateMathFunc
Tcl_CreateNamespace
Tcl_CreateObjCommand
Tcl_CreateObjTrace
Tcl_CreateSlave
Tcl_CreateThread
Tcl_CreateThreadExitHandler
Tcl_CreateTimerHandler
Tcl_CreateTrace
Tcl_CutChannel
Tcl_DStringAppend
Tcl_DStringAppendElement
Tcl_DStringEndSublist
Tcl_DStringFree
Tcl_DStringGetResult
Tcl_DStringInit
Tcl_DStringResult
Tcl_DStringSetLength
Tcl_DStringStartSublist
Tcl_DbCkalloc
Tcl_DbCkfree
Tcl_DbCkrealloc
Tcl_DbDecrRefCount
Tcl_DbIncrRefCount
Tcl_DbIsShared
Tcl_DbNewBignumObj
Tcl_DbNewBooleanObj
Tcl_DbNewByteArrayObj
Tcl_DbNewDictObj
Tcl_DbNewDoubleObj
Tcl_DbNewListObj
Tcl_DbNewLongObj
Tcl_DbNewObj
Tcl_DbNewStringObj
Tcl_DbNewWideIntObj
Tcl_DeleteAssocData
Tcl_DeleteChannelHandler
Tcl_DeleteCloseHandler
Tcl_DeleteCommand
Tcl_DeleteCommandFromToken
Tcl_DeleteEventSource
Tcl_DeleteEvents
Tcl_DeleteExitHandler
Tcl_DeleteHashEntry
Tcl_DeleteHashTable
Tcl_DeleteInterp
Tcl_DeleteNamespace
Tcl_DeleteThreadExitHandler
Tcl_DeleteTimerHandler
Tcl_DeleteTrace
Tcl_DetachChannel
Tcl_DetachPids
Tcl_DictObjDone
Tcl_DictObjFirst
Tcl_DictObjGet
Tcl_DictObjNext
Tcl_DictObjPut
Tcl_DictObjPutKeyList
Tcl_DictObjRemove
Tcl_DictObjRemoveKeyList
Tcl_DictObjSize
Tcl_DiscardInterpState
Tcl_DiscardResult
Tcl_DoOneEvent
Tcl_DoWhenIdle
Tcl_DontCallWhenDeleted
Tcl_DumpActiveMemory
Tcl_DuplicateObj
Tcl_Eof
Tcl_ErrnoId
Tcl_ErrnoMsg
Tcl_Eval
Tcl_EvalEx
Tcl_EvalFile
Tcl_EvalObj
Tcl_EvalObjEx
Tcl_EvalObjv
Tcl_EvalTokens
Tcl_EvalTokensStandard
Tcl_EventuallyFree
Tcl_Exit
Tcl_ExitThread
Tcl_Export
Tcl_ExposeCommand
Tcl_ExprBoolean
Tcl_ExprBooleanObj
Tcl_ExprDouble
Tcl_ExprDoubleObj
Tcl_ExprLong
Tcl_ExprLongObj
Tcl_ExprObj
Tcl_ExprString
Tcl_ExternalToUtf
Tcl_ExternalToUtfDString
Tcl_FSAccess
Tcl_FSChdir
Tcl_FSConvertToPathType
Tcl_FSCopyDirectory
Tcl_FSCopyFile
Tcl_FSCreateDirectory
Tcl_FSData
Tcl_FSDeleteFile
Tcl_FSEqualPaths
Tcl_FSEvalFile
Tcl_FSEvalFileEx
Tcl_FSFileAttrStrings
Tcl_FSFileAttrsGet
Tcl_FSFileAttrsSet
Tcl_FSFileSystemInfo
Tcl_FSGetCwd
Tcl_FSGetFileSystemForPath
Tcl_FSGetInternalRep
Tcl_FSGetNativePath
Tcl_FSGetNormalizedPath
Tcl_FSGetPathType
Tcl_FSGetTranslatedPath
Tcl_FSGetTranslatedStringPath
Tcl_FSJoinPath
Tcl_FSJoinToPath
Tcl_FSLink
Tcl_FSListVolumes
Tcl_FSLoadFile
Tcl_FSLstat
Tcl_FSMatchInDirectory
Tcl_FSMountsChanged
Tcl_FSNewNativePath
Tcl_FSOpenFileChannel
Tcl_FSPathSeparator
Tcl_FSRegister
Tcl_FSRemoveDirectory
Tcl_FSRenameFile
Tcl_FSSplitPath
Tcl_FSStat
Tcl_FSUnregister
Tcl_FSUtime
Tcl_Finalize
Tcl_FinalizeNotifier
Tcl_FinalizeThread
Tcl_FindCommand
Tcl_FindEnsemble
Tcl_FindExecutable
Tcl_FindHashEntry
Tcl_FindNamespace
Tcl_FindNamespaceVar
Tcl_FirstHashEntry
Tcl_Flush
Tcl_ForgetImport
Tcl_Format
Tcl_Free
Tcl_FreeEncoding
Tcl_FreeParse
Tcl_FreeResult
Tcl_GetAlias
Tcl_GetAliasObj
Tcl_GetAllocMutex
Tcl_GetAssocData
Tcl_GetBignumFromObj
Tcl_GetBoolean
Tcl_GetBooleanFromObj
Tcl_GetByteArrayFromObj
Tcl_GetChannel
Tcl_GetChannelBufferSize
Tcl_GetChannelError
Tcl_GetChannelErrorInterp
Tcl_GetChannelHandle
Tcl_GetChannelInstanceData
Tcl_GetChannelMode
Tcl_GetChannelName
Tcl_GetChannelNames
Tcl_GetChannelNamesEx
Tcl_GetChannelOption
Tcl_GetChannelThread
Tcl_GetChannelType
Tcl_GetCharLength
Tcl_GetCommandFromObj
Tcl_GetCommandFullName
Tcl_GetCommandInfo
Tcl_GetCommandInfoFromToken
Tcl_GetCommandName
Tcl_GetCurrentNamespace
Tcl_GetCurrentThread
Tcl_GetCwd
Tcl_GetDefaultEncodingDir
Tcl_GetDouble
Tcl_GetDoubleFromObj
Tcl_GetEncoding
Tcl_GetEncodingFromObj
Tcl_GetEncodingName
Tcl_GetEncodingNameFromEnvironment
Tcl_GetEncodingNames
Tcl_GetEncodingSearchPath
Tcl_GetEnsembleFlags
Tcl_GetEnsembleMappingDict
Tcl_GetEnsembleNamespace
Tcl_GetEnsembleSubcommandList
Tcl_GetEnsembleUnknownHandler
Tcl_GetErrno
Tcl_GetGlobalNamespace
Tcl_GetHostName
Tcl_GetIndexFromObj
Tcl_GetIndexFromObjStruct
Tcl_GetInt
Tcl_GetIntFromObj
Tcl_GetInterpPath
Tcl_GetInterpResolvers
Tcl_GetLongFromObj
Tcl_GetMaster
Tcl_GetMathFuncInfo
Tcl_GetNameOfExecutable
Tcl_GetNamespaceResolvers
Tcl_GetNamespaceUnknownHandler
Tcl_GetObjResult
Tcl_GetObjType
Tcl_GetPathType
Tcl_GetRange
Tcl_GetRegExpFromObj
Tcl_GetReturnOptions
Tcl_GetServiceMode
Tcl_GetSlave
Tcl_GetStackedChannel
Tcl_GetStartupScript
Tcl_GetStdChannel
Tcl_GetString
Tcl_GetStringFromObj
Tcl_GetStringResult
Tcl_GetThreadData
Tcl_GetTime
Tcl_GetTopChannel
Tcl_GetUniChar
Tcl_GetUnicode
Tcl_GetUnicodeFromObj
Tcl_GetVar
Tcl_GetVar2
Tcl_GetVar2Ex

Sections

.text
Size: 710KB - Virtual size: 710KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 112KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f28894e7f003ac05fd78a936b74a38cd

Headers

File Characteristics

Imports

kernel32

user32

ws2_32

msvcr90

advapi32

Exports

Exports

Sections

.text Size: 710KB - Virtual size: 710KB

.rdata Size: 112KB - Virtual size: 112KB

.data Size: 11KB - Virtual size: 14KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 36KB - Virtual size: 35KB

.text
Size: 710KB - Virtual size: 710KB

.rdata
Size: 112KB - Virtual size: 112KB

.data
Size: 11KB - Virtual size: 14KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 36KB - Virtual size: 35KB