4acd3aa3217147c374c1bcef178254e0_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

4acd3aa3217147c374c1bcef178254e0_NeikiAnalytics.exe
Size

4.7MB
MD5

4acd3aa3217147c374c1bcef178254e0
SHA1

1e8f88029620f1cfd26354609320f7c62d119833
SHA256

4cfe4405e8d07078ee32acbe732c2b315a276a1b3f92bb44cf7bb46675708ada
SHA512

2b1ca1e4e19bf087d72707760c6fa4865be264dda54c7d29bbd53fe764e9223f9d6e9377c4bf471d33cb6cde59e3498fb97dcee823c2ff7560c0ae5d81845f30
SSDEEP

98304:kPlqaY+BiHS3K4SMv+toYSuUJpGcbDnpCgkFdPSzNBG+iBBIjmX00mK:uB2aKdMhNDpCrFBG3iBBIKk0x

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4acd3aa3217147c374c1bcef178254e0_NeikiAnalytics.exe

Files

4acd3aa3217147c374c1bcef178254e0_NeikiAnalytics.exe
.dll windows:6 windows x86 arch:x86

35d6b66c9b987882c644b05318edae22

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetProcAddress
GetModuleHandleA
GetCurrentProcess
DeviceIoControl
CloseHandle
GetTempPathA
WriteFile
DeleteFileA
CreateFileW
CreateFileA
DecodePointer
GetConsoleMode
GetConsoleCP
FlushFileBuffers
HeapReAlloc
HeapSize
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwind
RaiseException
InterlockedFlushSList
GetLastError
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
MultiByteToWideChar
HeapFree
HeapAlloc
GetStdHandle
GetFileType
LCMapStringW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetStringTypeW
SetFilePointerEx
SetStdHandle
WriteConsoleW
GetSystemTimeAsFileTime
CreateEventA
GetModuleHandleA
TerminateProcess
GetCurrentProcess
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
LoadLibraryA
FreeLibrary
GetTickCount
SystemTimeToFileTime
FileTimeToSystemTime
GlobalFree
HeapAlloc
HeapFree
GetProcAddress
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
MultiByteToWideChar
GetModuleHandleW
LoadResource
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
GetLastError
GetCommandLineA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
HeapReAlloc
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
WriteFile
RtlUnwind
SetFilePointer
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers
VirtualQuery

advapi32

RegOpenKeyA
RegDeleteKeyA
RegCreateKeyA
RegCloseKey
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
RegSetValueExA

ntdll

RtlAnsiStringToUnicodeString
RtlInitAnsiString

Exports

Exports

CopyPhysicalMemory
GetModuleBase_x64
GetModuleBase_x86
InjectDll_x64
Install
RemoveLoadDll
SetProcess
UnInstall

Sections

.text
Size: 78KB - Virtual size: 78KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 137KB - Virtual size: 139KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.h%2
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.:uu
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.dZm
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 469B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

35d6b66c9b987882c644b05318edae22

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

ntdll

Exports

Exports

Sections

.text Size: 78KB - Virtual size: 78KB

.rdata Size: 29KB - Virtual size: 28KB

.data Size: 137KB - Virtual size: 139KB

.h%2 Size: 2.5MB - Virtual size: 2.5MB

.:uu Size: 1KB - Virtual size: 1KB

.dZm Size: 2.0MB - Virtual size: 2.0MB

.reloc Size: 9KB - Virtual size: 9KB

.rsrc Size: 512B - Virtual size: 469B

.text
Size: 78KB - Virtual size: 78KB

.rdata
Size: 29KB - Virtual size: 28KB

.data
Size: 137KB - Virtual size: 139KB

.h%2
Size: 2.5MB - Virtual size: 2.5MB

.:uu
Size: 1KB - Virtual size: 1KB

.dZm
Size: 2.0MB - Virtual size: 2.0MB

.reloc
Size: 9KB - Virtual size: 9KB

.rsrc
Size: 512B - Virtual size: 469B