0ca05a239ea44d406583cf8466f5138f53fb0434f3bccf32416356565ba2ff35_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

0ca05a239ea44d406583cf8466f5138f53fb0434f3bccf32416356565ba2ff35_NeikiAnalytics.exe
Size

353KB
MD5

0067a5f50c542d5edad1354b68e16e80
SHA1

0ab085f56db34b2013cebf59895a065689f284ff
SHA256

0ca05a239ea44d406583cf8466f5138f53fb0434f3bccf32416356565ba2ff35
SHA512

b6ad9358f2909c2dafd46a08f45485169981ceaa574c78218d74cb8a7b7755f2bea299c45a24e0dcdfccc52b605118a7d75ea601c0aa9b75dd45018b2085fa7b
SSDEEP

6144:HEGKSgiIhvQY9ccZLZQL12Xm5FRHO8eVw/Vvj:K1Li5UUXje

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0ca05a239ea44d406583cf8466f5138f53fb0434f3bccf32416356565ba2ff35_NeikiAnalytics.exe

Files

0ca05a239ea44d406583cf8466f5138f53fb0434f3bccf32416356565ba2ff35_NeikiAnalytics.exe
.exe windows:6 windows x64 arch:x64

40d108c292874cd6ded0043d4e483104

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

E:\rust项目研究\rust图片马\rust_image_shellcode_loader-master\rust_image_shellcode_loader-master\target\release\deps\stealth_loader.pdb

Imports

ntdll

RtlPcToFileHeader
RtlUnwindEx
RtlVirtualUnwind
NtWriteVirtualMemory
NtWriteFile
RtlNtStatusToDosError
RtlLookupFunctionEntry
RtlCaptureContext
NtTestAlert
NtQueueApcThread
NtProtectVirtualMemory
NtAllocateVirtualMemory

advapi32

SystemFunction036

kernel32

LCMapStringW
CompareStringW
HeapSize
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetConsoleOutputCP
CloseHandle
ReleaseSRWLockExclusive
FreeEnvironmentStringsW
ReleaseMutex
FindClose
DeleteProcThreadAttributeList
ReleaseSRWLockShared
CompareStringOrdinal
GetLastError
AddVectoredExceptionHandler
SetThreadStackGuarantee
QueryPerformanceCounter
AcquireSRWLockExclusive
GetCurrentProcess
GetCurrentThread
GetProcAddress
SetLastError
GetCurrentDirectoryW
GetEnvironmentStringsW
GetEnvironmentVariableW
SetEnvironmentVariableW
GetCommandLineW
FlushFileBuffers
DuplicateHandle
SetFilePointerEx
GetStdHandle
GetCurrentProcessId
WriteFileEx
SleepEx
ReadFileEx
WaitForSingleObject
TerminateProcess
TryAcquireSRWLockExclusive
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
AcquireSRWLockShared
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetModuleHandleA
FindNextFileW
CreateFileW
GetConsoleMode
GetFileType
GetModuleHandleW
FormatMessageW
GetModuleFileNameW
ExitProcess
GetFullPathNameW
CreateNamedPipeW
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
MultiByteToWideChar
WriteConsoleW
WideCharToMultiByte
CreateThread
GetSystemTimeAsFileTime
GetStringTypeW
SetStdHandle
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetCommandLineA
GetModuleHandleExW
WriteFile
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
EncodePointer
RaiseException
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
GetCurrentThreadId

bcrypt

BCryptGenRandom

Sections

.text
Size: 235KB - Virtual size: 235KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 98KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

40d108c292874cd6ded0043d4e483104

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntdll

advapi32

kernel32

bcrypt

Sections

.text Size: 235KB - Virtual size: 235KB

.rdata Size: 98KB - Virtual size: 97KB

.data Size: 3KB - Virtual size: 7KB

.pdata Size: 12KB - Virtual size: 11KB

_RDATA Size: 512B - Virtual size: 348B

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 235KB - Virtual size: 235KB

.rdata
Size: 98KB - Virtual size: 97KB

.data
Size: 3KB - Virtual size: 7KB

.pdata
Size: 12KB - Virtual size: 11KB

_RDATA
Size: 512B - Virtual size: 348B

.reloc
Size: 3KB - Virtual size: 2KB