04e88e43a689126d6eb4beaac6347a655e138f3596aa04e334db1cb812267df4_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

04e88e43a689126d6eb4beaac6347a655e138f3596aa04e334db1cb812267df4_NeikiAnalytics.exe
Size

1.9MB
MD5

9d6f92ab1911eeeb649df9493bea71f0
SHA1

3e88995de1218642c651e0e679cbe255a8379bfb
SHA256

04e88e43a689126d6eb4beaac6347a655e138f3596aa04e334db1cb812267df4
SHA512

038a73d8f5632a1458923cd036f27b538c9559cc3869d426b3d7f51ff78b025d6a7711bae48a0e9fa34ff95c7e698d6562bee08862c7c3f062867097b247a72d
SSDEEP

49152:6mskMtXov6c4sNYRv5e5V7yJYgci9Kks0ndSobsq9EQdkKirBjv:ef7OGKks+VA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
04e88e43a689126d6eb4beaac6347a655e138f3596aa04e334db1cb812267df4_NeikiAnalytics.exe

Files

04e88e43a689126d6eb4beaac6347a655e138f3596aa04e334db1cb812267df4_NeikiAnalytics.exe
.dll windows:10 windows x64 arch:x64

66d563d93e687ceac52892c629c028f9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

AudioSrv.pdb

Imports

audiosrvpolicymanager

PbmReportHostedAppStateChange_2
HHOSTEDAPPMANAGERCONTEXTRundown
ActivatePolicyManager
PbmReportAppInteractivityChange
PbmReportAppClosing
PbmAllowMediaPlaybackForApp
PbmRegisterPlaybackManagerNotifications
PbmUnregisterPlaybackManagerNotifications
PbmSetSmtcSubscriptionState
PbmGetSoundLevel
PbmIsPlaying
PbmRegisterAppManagerNotification
PbmUnregisterAppManagerNotification
PbmRegisterAppClosureNotification
PbmUnregisterAppClosureNotification
PbmPlayToStreamStateChanged
PbmCastingAppStateChanged
PbmSetScreenReaderState
PbmReportHostedAppStateChange
PbmSwitchSoftNonInteractiveAppsToHardNonInteractive
PbmReportApplicationState
PbmLaunchBackgroundTask
TS_SessionChanged
TS_SessionGetAudioProtocol
TS_RegisterAudioProtocolNotification
TS_UnregisterAudioProtocolNotification
TS_AudioProtocolNotifyRundown

msvcp_win

_Mtx_unlock
?_Throw_Cpp_error@std@@YAXH@Z
_Mtx_lock
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?_Xbad_function_call@std@@YAXXZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ
?sbumpc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGXZ
?sgetc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGXZ
?snextc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGXZ
?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QEAA_N_N@Z
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
?_Xlength_error@std@@YAXPEBD@Z
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
?_Xout_of_range@std@@YAXPEBD@Z
_Mtx_init_in_situ
_Mtx_destroy_in_situ
?_Xbad_alloc@std@@YAXXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
??7ios_base@std@@QEBA_NXZ
?_Xinvalid_argument@std@@YAXPEBD@Z

api-ms-win-crt-string-l1-1-0

wcsnlen
wcscspn
wcsspn
memset
wcscmp
wcsncmp

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__resetstkoflw
_o__seh_filter_dll
_o__wcsicmp
_o__wcsupr_s
_o__wtof
_o_calloc
_o_ceilf
_o_floorf
_o_free
_o_log10
_o_malloc
_o_pow
_o_roundf
_o_sinf
_o_terminate
_o_towlower
_o_wcscpy_s
_o_wcstoul
_o_wmemcpy_s
__current_exception
__current_exception_context
__CxxFrameHandler3
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___stdio_common_vsnprintf_s
_o__execute_onexit_table
_o___std_type_info_destroy_list
_o__errno
_o___std_exception_destroy
_o___std_exception_copy
_o__crt_atexit
wcsstr
wcsrchr
__C_specific_handler
__std_terminate
_o__configure_narrow_argv
__CxxFrameHandler4
_o__cexit
memcmp
memcpy
_o__aligned_malloc
_o__aligned_free
_CxxThrowException
_o__wcsnicmp
__C_specific_handler_noexcept
memmove

ntdll

EtwGetTraceEnableLevel
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlQueryWnfStateData
RtlDllShutdownInProgress
RtlGetActiveConsoleId
RtlGetCurrentServiceSessionId
EtwUnregisterTraceGuids
EtwGetTraceEnableFlags
EtwEventUnregister
EtwEventWriteTransfer
EtwEventSetInformation
EtwEventRegister
EtwEventActivityIdControl
RtlPublishWnfStateData
RtlGetDeviceFamilyInfoEnum
NtQueryInformationProcess
NtDeleteWnfStateName
NtCreateWnfStateName
EtwTraceMessage
RtlUnsubscribeWnfStateChangeNotification
NtQueryWnfStateData
RtlSubscribeWnfStateChangeNotification
RtlFreeSid
RtlInitializeResource
RtlDeleteResource
RtlAcquireResourceExclusive
RtlReleaseResource
RtlAcquireResourceShared
RtlInitUnicodeString
NtCreateIRTimer
NtCancelTimer2
NtSetTimer2
RtlNtStatusToDosError
EtwRegisterTraceGuidsW
EtwGetTraceLoggerHandle

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
SizeofResource
GetModuleHandleExW
LockResource
LoadResource
FreeLibrary
GetModuleHandleExA
GetProcAddress
LoadStringW
GetModuleFileNameW
FindResourceExW
GetModuleHandleW
DisableThreadLibraryCalls

api-ms-win-core-synch-l1-1-0

ReleaseMutex
OpenEventW
OpenSemaphoreW
ReleaseSemaphore
CreateSemaphoreExW
DeleteCriticalSection
ReleaseSRWLockExclusive
ResetEvent
WaitForMultipleObjectsEx
InitializeCriticalSection
TryEnterCriticalSection
InitializeCriticalSectionEx
CreateEventW
AcquireSRWLockExclusive
ReleaseSRWLockShared
SetEvent
LeaveCriticalSection
WaitForSingleObjectEx
CreateEventExW
AcquireSRWLockShared
WaitForSingleObject
EnterCriticalSection
CreateMutexW
CreateMutexExW
InitializeCriticalSectionAndSpinCount

api-ms-win-core-heap-l1-1-0

HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

SetLastError
RaiseException
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolThreadMinimum
CloseThreadpoolCleanupGroupMembers
SetThreadpoolThreadMaximum
CreateThreadpoolWait
WaitForThreadpoolWaitCallbacks
SetThreadpoolWait
CreateThreadpool
CloseThreadpool
CreateThreadpoolTimer
SubmitThreadpoolWork
CloseThreadpoolWork
WaitForThreadpoolWorkCallbacks
SetEventWhenCallbackReturns
IsThreadpoolTimerSet
CreateThreadpoolWork
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolCleanupGroup
CloseThreadpoolWait
CreateThreadpoolCleanupGroup

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
ProcessIdToSessionId
GetCurrentProcess
GetCurrentThreadId
CreateThread
GetExitCodeProcess
CreateProcessW
GetProcessTimes
GetProcessId
TerminateProcess
OpenThreadToken
GetCurrentThread

api-ms-win-core-localization-l1-2-0

FormatMessageW
LCMapStringEx

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-string-l1-1-0

CompareStringW
MultiByteToWideChar
CompareStringOrdinal
WideCharToMultiByte

rpcrt4

NdrServerCallAll
NdrClientCall3
RpcStringFreeW
RpcStringBindingComposeW
RpcBindingFromStringBindingW
I_RpcExceptionFilter
RpcBindingFree
RpcImpersonateClient
RpcRevertToSelf
I_RpcBindingInqLocalClientPID
UuidCreate
I_RpcBindingInqTransportType
RpcServerInqBindings
RpcBindingToStringBindingW
RpcStringBindingParseW
RpcBindingVectorFree
RpcServerUseProtseqEpW
RpcServerRegisterIf3
RpcServerUnregisterIfEx
UuidEqual
NdrServerCall2
RpcServerInqCallAttributesW

api-ms-win-core-sysinfo-l1-1-0

GetTickCount64
GetSystemTimeAsFileTime
GetSystemDirectoryW
GetTickCount

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce
Sleep
InitOnceBeginInitialize
WaitOnAddress
WakeByAddressAll
InitOnceComplete

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegOpenKeyExW
RegDeleteKeyExW
RegQueryInfoKeyW
RegEnumValueW
RegQueryValueExW
RegCreateKeyExW
RegDeleteTreeW
RegEnumKeyExW
RegSetValueExW
RegOpenCurrentUser
RegNotifyChangeKeyValue
RegGetValueW

api-ms-win-core-file-l1-2-4

GetTempPath2W

api-ms-win-core-windowserrorreporting-l1-1-0

WerRegisterFile

api-ms-win-core-file-l1-1-0

CompareFileTime
FileTimeToLocalFileTime
CreateFileW
DeleteFileW

api-ms-win-core-sysinfo-l1-2-0

GetSystemTimePreciseAsFileTime

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToFileTime

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoUninitialize
RoRevokeActivationFactories
RoRegisterActivationFactories

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-io-l1-1-0

DeviceIoControl
PostQueuedCompletionStatus
GetQueuedCompletionStatus
CreateIoCompletionPort

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent
OpenProcess
GetProcessMitigationPolicy

api-ms-win-core-memory-l1-1-0

UnmapViewOfFile
MapViewOfFile
CreateFileMappingW

api-ms-win-core-kernel32-legacy-l1-1-0

GetSystemPowerStatus
RegisterWaitForSingleObject

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventSetInformation
EventUnregister
EventRegister

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW
lstrcmpW

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-marshal-l1-1-0

HWND_UserMarshal
HWND_UserSize64
HWND_UserMarshal64
HWND_UserFree
HWND_UserUnmarshal
HWND_UserSize
HWND_UserFree64
HWND_UserUnmarshal64

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

combase

ord168
ord68
ord66
ord167
ord67
ord69

api-ms-win-core-memory-l1-1-1

VirtualUnlock
SetProcessWorkingSetSizeEx
GetProcessWorkingSetSizeEx
VirtualLock

Exports

Exports

ServiceMain
SvchostPushServiceGlobals

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

fothk
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

RT_BSS
Size: - Virtual size: 40B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 368KB - Virtual size: 365KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

RT_DATA
Size: 4KB - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 80KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

66d563d93e687ceac52892c629c028f9

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

audiosrvpolicymanager

msvcp_win

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

ntdll

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-string-l1-1-0

rpcrt4

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-file-l1-2-4

api-ms-win-core-windowserrorreporting-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-util-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-memory-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-marshal-l1-1-0

api-ms-win-core-apiquery-l1-1-0

combase

api-ms-win-core-memory-l1-1-1

Exports

Exports

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

fothk Size: 4KB - Virtual size: 4KB

RT_BSS Size: - Virtual size: 40B

.rdata Size: 368KB - Virtual size: 365KB

.data Size: 12KB - Virtual size: 17KB

.pdata Size: 60KB - Virtual size: 59KB

.didat Size: 4KB - Virtual size: 2KB

RT_DATA Size: 4KB - Virtual size: 16B

.rsrc Size: 80KB - Virtual size: 77KB

.reloc Size: 16KB - Virtual size: 14KB

.text
Size: 1.3MB - Virtual size: 1.3MB

fothk
Size: 4KB - Virtual size: 4KB

RT_BSS
Size: - Virtual size: 40B

.rdata
Size: 368KB - Virtual size: 365KB

.data
Size: 12KB - Virtual size: 17KB

.pdata
Size: 60KB - Virtual size: 59KB

.didat
Size: 4KB - Virtual size: 2KB

RT_DATA
Size: 4KB - Virtual size: 16B

.rsrc
Size: 80KB - Virtual size: 77KB

.reloc
Size: 16KB - Virtual size: 14KB