434be44c8d3d99bb0839f4204b3e6cb0_NeikiAnalytics[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

434be44c8d3d99bb0839f4204b3e6cb0_NeikiAnalytics.exe
Size

864KB
MD5

434be44c8d3d99bb0839f4204b3e6cb0
SHA1

968288d04139256652a0042891db83c08acfdb61
SHA256

d7fffd7546e94ffe779e9280ed06d4a391bf80bd73e46d175af6e151f1a1f262
SHA512

17ad9742572e41bd65d3c728fbac4942cf00348ba5ae14806611b35f28efddcc4f373ebf28a57f669eb3e1ab877db11cd81fe4d0f04e60a0f724fd38581c7526
SSDEEP

24576:w02WHpxRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:w5WHpxm+brLC2hTR9quLB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
434be44c8d3d99bb0839f4204b3e6cb0_NeikiAnalytics.exe

Files

434be44c8d3d99bb0839f4204b3e6cb0_NeikiAnalytics.exe
.exe windows:10 windows x64 arch:x64

c29a8b4e64755be19f08b918f93a11c7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

TieringEngineService.pdb

Imports

msvcrt

wcscat_s
__CxxFrameHandler3
_snwprintf_s
wcsncmp
_vsnwprintf
realloc
swprintf_s
_onexit
__dllonexit
_unlock
_lock
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_commode
_fmode
_wcmdln
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
wcscpy_s
memset
_callnewh
malloc
free
_purecall
__C_specific_handler
_CxxThrowException

ntdll

RtlSetBits
RtlInitializeBitMap
RtlCreateSystemVolumeInformationFolder
NtQueryInformationFile
NtSetInformationFile
RtlCopyUnicodeString
NtFsControlFile
NtWaitForSingleObject
NtOpenFile
RtlGetThreadErrorMode
RtlSetThreadErrorMode
RtlNumberOfClearBits
RtlStringFromGUID
WinSqmEndSession
WinSqmStartSession
NtClose
RtlNtStatusToDosError
RtlGUIDFromString
RtlCompareUnicodeString
RtlInitUnicodeString
RtlCompareMemory
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WinSqmAddToStreamEx

oleaut32

VariantInit
SysAllocString
SysFreeString
VariantClear

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableLevel
GetTraceLoggerHandle
UnregisterTraceGuids
GetTraceEnableFlags
RegisterTraceGuidsW
TraceMessage

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
RaiseException
SetUnhandledExceptionFilter

api-ms-win-core-com-l1-1-0

CoUninitialize
CoTaskMemFree
CoMarshalInterface
CoInitializeEx
CoRevokeClassObject
CreateStreamOnHGlobal
CoCreateInstance
CoSuspendClassObjects
CoUnmarshalInterface
CoTaskMemAlloc
CoResumeClassObjects
CoReleaseMarshalData
CoCreateGuid
CoRegisterClassObject

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
ReleaseSRWLockShared
AcquireSRWLockExclusive
InitializeSRWLock
WaitForSingleObject
ReleaseSRWLockExclusive
AcquireSRWLockShared
SetEvent
CreateEventW
ResetEvent
InitializeCriticalSection

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventWrite
EventSetInformation
EventWriteTransfer
EventUnregister

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
GetModuleHandleExW
LoadStringW

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
CreateThread
GetCurrentThreadId
GetStartupInfoW
GetCurrentProcess
TerminateProcess
OpenProcessToken

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-service-core-l1-1-0

StartServiceCtrlDispatcherW
SetServiceStatus

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-service-winsvc-l1-1-0

RegisterServiceCtrlHandlerW

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolWork
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolCleanupGroup
WaitForThreadpoolWorkCallbacks
CloseThreadpoolCleanupGroupMembers
FreeLibraryWhenCallbackReturns
CloseThreadpoolWait
CloseThreadpool
SetThreadpoolWait
CreateThreadpoolWait
SubmitThreadpoolWork
CreateThreadpoolWork
SetThreadpoolThreadMinimum
WaitForThreadpoolTimerCallbacks
SetThreadpoolThreadMaximum
WaitForThreadpoolWaitCallbacks
CreateThreadpoolCleanupGroup
CreateThreadpool

api-ms-win-core-string-l1-1-0

CompareStringW

api-ms-win-core-processenvironment-l1-1-0

SetCurrentDirectoryW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount
GetSystemWindowsDirectoryW

api-ms-win-core-synch-l1-2-1

CreateSemaphoreW

api-ms-win-core-file-l1-1-0

FindClose
CreateDirectoryW
DeleteFileW
FindNextFileW
FindNextVolumeW
GetFileAttributesW
FindVolumeClose
FindFirstVolumeW
FindFirstFileW

api-ms-win-core-registry-l1-1-0

RegGetValueW
RegCreateKeyExW
RegNotifyChangeKeyValue

api-ms-win-eventing-controller-l1-1-0

ControlTraceW
EnableTraceEx2
StartTraceW

api-ms-win-eventing-consumer-l1-1-0

OpenTraceW
CloseTrace
ProcessTrace

api-ms-win-core-file-l1-2-0

GetVolumeNameForVolumeMountPointW

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW

api-ms-win-security-base-l1-1-0

AdjustTokenPrivileges
PrivilegeCheck

api-ms-win-core-localization-l1-2-0

GetLocaleInfoW

api-ms-win-devices-config-l1-1-1

CM_Register_Notification
CM_Unregister_Notification

api-ms-win-core-file-l2-1-1

OpenFileById

api-ms-win-core-realtime-l1-1-0

QueryUnbiasedInterruptTime

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-kernel32-legacy-l1-1-0

MoveFileW

esent

JetOpenTableW
JetDeleteTableW
JetSetCurrentIndexW
JetCreateDatabase2W
JetOpenDatabaseW
JetAttachDatabase2W
JetBeginSessionW
JetEndSession
JetCloseDatabase
JetCloseTable
JetInit3W
JetTerm2
JetSetSystemParameterW
JetCreateInstance2W
JetCreateTableColumnIndex2W
JetResetSessionContext
JetSetSessionContext
JetOpenTempTable
JetRetrieveColumns
JetSetColumns
JetPrepareUpdate
JetUpdate
JetMove
JetMakeKey
JetSeek
JetBeginTransaction
JetRetrieveColumn
JetDelete
JetCommitTransaction
JetRollback
JetGetColumnInfoW
JetComputeStats
JetEnableMultiInstanceW
JetGetObjectInfoW

clusapi

GetClusterInformation
OpenCluster
CloseCluster

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Sections

.text
Size: 239KB - Virtual size: 239KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 568KB - Virtual size: 572KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

c29a8b4e64755be19f08b918f93a11c7

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

oleaut32

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-service-core-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-file-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-eventing-controller-l1-1-0

api-ms-win-eventing-consumer-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-io-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-devices-config-l1-1-1

api-ms-win-core-file-l2-1-1

api-ms-win-core-realtime-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-file-l2-1-2

api-ms-win-core-kernel32-legacy-l1-1-0

esent

clusapi

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Sections

.text Size: 239KB - Virtual size: 239KB

.rdata Size: 40KB - Virtual size: 40KB

.data Size: 1024B - Virtual size: 3KB

.pdata Size: 6KB - Virtual size: 5KB

.didat Size: 512B - Virtual size: 16B

.rsrc Size: 7KB - Virtual size: 7KB

.reloc Size: 568KB - Virtual size: 572KB

.text
Size: 239KB - Virtual size: 239KB

.rdata
Size: 40KB - Virtual size: 40KB

.data
Size: 1024B - Virtual size: 3KB

.pdata
Size: 6KB - Virtual size: 5KB

.didat
Size: 512B - Virtual size: 16B

.rsrc
Size: 7KB - Virtual size: 7KB

.reloc
Size: 568KB - Virtual size: 572KB