222ab97920bd5c8e7d034a4546e7fe6bfdbcf734fae6d4ce2d559b4b2092f6e6_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

222ab97920bd5c8e7d034a4546e7fe6bfdbcf734fae6d4ce2d559b4b2092f6e6_NeikiAnalytics.exe
Size

748KB
MD5

9e520bce88c4a2ad866b5cb02e463a00
SHA1

3ecb81f59a62e08a34b07ec18793f2a2e7603f49
SHA256

222ab97920bd5c8e7d034a4546e7fe6bfdbcf734fae6d4ce2d559b4b2092f6e6
SHA512

4274c2773172cb239abbe90b5b3539b28230264f49bc070ef3301f2a52c666bbb461f16125b4624c087e6550be9db01962f461434efc4ebe697fdf0af5f58c82
SSDEEP

12288:w+r1ozkuB65RV/U43rpEAcoxDxBPZFscyyPn3oD6pKKj+:L1ozXBqzlxbBPZylyP3Nj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
222ab97920bd5c8e7d034a4546e7fe6bfdbcf734fae6d4ce2d559b4b2092f6e6_NeikiAnalytics.exe

Files

222ab97920bd5c8e7d034a4546e7fe6bfdbcf734fae6d4ce2d559b4b2092f6e6_NeikiAnalytics.exe
.dll regsvr32 windows:10 windows x64 arch:x64

b9c3d2db847d7d575ed6ee2d3461046b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wiaservc.pdb

Imports

msvcrt

__RTDynamicCast
memcpy
memmove
_wsplitpath_s
_vsnwprintf
memcmp
__CxxFrameHandler3
memset
??1type_info@@UEAA@XZ
_onexit
__dllonexit
_unlock
_lock
_initterm
_amsg_exit
_XcptFilter
_callnewh
_splitpath_s
wcschr
_vscwprintf
_wcsicmp
__C_specific_handler
malloc
memmove_s
free
_purecall
_vsnprintf
memcpy_s
wcsstr
wcscmp

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW
RegQueryValueW
LookupAccountSidW
GetTokenInformation
GetSecurityDescriptorDacl
GetAclInformation
AccessCheck
SetSecurityDescriptorOwner
GetAce
GetSidSubAuthorityCount
GetSidSubAuthority
DestroyPrivateObjectSecurity
GetSidLengthRequired
CreatePrivateObjectSecurity
CopySid
InitializeSid
SetSecurityDescriptorSacl
AddAce
OpenProcessToken
GetKernelObjectSecurity
SetKernelObjectSecurity
OpenServiceW
EventUnregister
StartServiceW
EventSetInformation
OpenSCManagerW
EventRegister
CloseServiceHandle
QueryServiceStatus
EventWriteTransfer
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
RegDeleteKeyW
RegQueryInfoKeyW
RegCloseKey
OpenThreadToken
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
AllocateAndInitializeSid
FreeSid
InitializeSecurityDescriptor
InitializeAcl
GetLengthSid
AddAccessAllowedAce
RegGetValueW
RegisterServiceCtrlHandlerExW
SetServiceStatus
RegDeleteKeyExW
RegDeleteValueW
RegQueryValueExA
RegOpenKeyW
RegOpenKeyExA
RegCreateKeyExA

kernel32

ReleaseSRWLockExclusive
OutputDebugStringW
CloseThreadpoolTimer
DisableThreadLibraryCalls
AcquireSRWLockExclusive
WaitForSingleObjectEx
OpenSemaphoreW
CloseHandle
SetThreadpoolTimer
ReleaseSRWLockShared
CreateThreadpoolTimer
HeapAlloc
GetProcAddress
CreateMutexExW
AcquireSRWLockShared
DeleteCriticalSection
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
DebugBreak
GetTickCount
IsDebuggerPresent
GetSystemDirectoryW
FreeLibrary
LoadLibraryExW
lstrlenW
LocalAlloc
LocalFree
GetSystemTime
lstrcmpiW
lstrcmpW
WriteFile
lstrlenA
MultiByteToWideChar
GetLocalTime
MulDiv
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
UnmapViewOfFile
OpenProcess
GetCurrentThread
ResetEvent
CreateDirectoryW
PowerClearRequest
PowerCreateRequest
DuplicateHandle
PowerSetRequest
InitOnceComplete
VirtualQuery
GetSystemInfo
InitOnceBeginInitialize
GetThreadId
CreateFileW
CreateThread
FreeLibraryAndExitThread
WaitForMultipleObjects
ExpandEnvironmentStringsW
SetEvent
FormatMessageW
Sleep
CreateEventW
SetProcessMitigationPolicy
RaiseException
VirtualProtect
FormatMessageA
GetSystemDirectoryA
GetModuleHandleA
ReleaseMutex
lstrcmpA
CreateMutexW
LoadLibraryExA
GetCurrentThreadId
WaitForSingleObject
WaitForThreadpoolTimerCallbacks
InitializeCriticalSectionEx
InitializeCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetModuleHandleExW
ReleaseSemaphore
RemoveDirectoryW
EnterCriticalSection
SetLastError
HeapFree
CreateSemaphoreExW
CompareStringW
GetModuleFileNameA
GetLastError
DeleteFileW
GetTempFileNameW
GetTempPath2W
CreateFileMappingW
MapViewOfFileEx
SetFilePointer
GetFileType
SetEndOfFile
GetFileSize
ReadFile
WideCharToMultiByte
GetModuleFileNameW
GetFileInformationByHandle
GetDateFormatW
FlushFileBuffers
PurgeComm
EscapeCommFunction
ClearCommError
SetCommMask
SystemTimeToFileTime

user32

CharUpperA
CharNextA
CharNextW
PostMessageW
IsWindow
UnregisterPowerSettingNotification
RegisterPowerSettingNotification
RegisterDeviceNotificationW
UnregisterDeviceNotification

oleaut32

BSTR_UserSize64
SysAllocString
BSTR_UserMarshal64
BSTR_UserFree64
BSTR_UserMarshal
BSTR_UserUnmarshal
BSTR_UserUnmarshal64
SysFreeString
SysStringLen
BSTR_UserFree
BSTR_UserSize

ole32

CoGetCallContext
CreateStreamOnHGlobal
StgCreatePropStg
StgOpenPropStg
CoRevertToSelf
CoRevokeClassObject
CoRegisterClassObject
FreePropVariantArray
CoImpersonateClient
CoSuspendClassObjects
CoDisconnectObject
PropVariantCopy
CoTaskMemAlloc
PropVariantClear
CLSIDFromString
CoTaskMemFree
StringFromGUID2
StringFromCLSID
CoInitializeSecurity
CoCreateInstance
CoInitializeEx
CoUninitialize
CoResumeClassObjects

rpcrt4

UuidToStringW
RpcRevertToSelf
RpcServerTestCancel
RpcAsyncCompleteCall
UuidCreate
RpcStringFreeA
UuidToStringA
UuidCreateNil
RpcServerUnsubscribeForNotification
RpcServerSubscribeForNotification
NdrServerCall2
Ndr64AsyncServerCallAll
NdrServerCallAll
NdrAsyncServerCall
RpcImpersonateClient
RpcServerRegisterAuthInfoW
RpcServerListen
RpcServerRegisterIfEx
RpcStringBindingParseW
RpcBindingInqAuthClientW
RpcAsyncAbortCall
RpcServerUseProtseqEpW
RpcBindingToStringBindingW
RpcServerInqDefaultPrincNameW
RpcStringFreeW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

Exports

Exports

DllRegisterServer
DllUnregisterServer
ServiceMain
wiasCreateChildAppItem
wiasCreateDrvItem
wiasCreateLogInstance
wiasCreatePropContext
wiasDebugError
wiasDebugTrace
wiasDownSampleBuffer
wiasFormatArgs
wiasFreePropContext
wiasGetChangedValueFloat
wiasGetChangedValueGuid
wiasGetChangedValueLong
wiasGetChangedValueStr
wiasGetChildrenContexts
wiasGetContextFromName
wiasGetDrvItem
wiasGetImageInformation
wiasGetItemType
wiasGetPropertyAttributes
wiasGetRootItem
wiasIsPropChanged
wiasParseEndorserString
wiasPrintDebugHResult
wiasQueueEvent
wiasReadMultiple
wiasReadPropBin
wiasReadPropFloat
wiasReadPropGuid
wiasReadPropLong
wiasReadPropStr
wiasSendEndOfPage
wiasSetItemPropAttribs
wiasSetItemPropNames
wiasSetPropChanged
wiasSetPropertyAttributes
wiasSetValidFlag
wiasSetValidListFloat
wiasSetValidListGuid
wiasSetValidListLong
wiasSetValidListStr
wiasSetValidRangeFloat
wiasSetValidRangeLong
wiasUpdateScanRect
wiasUpdateValidFormat
wiasValidateItemProperties
wiasWriteBufToFile
wiasWriteMultiple
wiasWritePageBufToFile
wiasWritePageBufToStream
wiasWritePropBin
wiasWritePropFloat
wiasWritePropGuid
wiasWritePropLong
wiasWritePropStr

Sections

.text
Size: 484KB - Virtual size: 480KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

fothk
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 208KB - Virtual size: 207KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b9c3d2db847d7d575ed6ee2d3461046b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

advapi32

kernel32

user32

oleaut32

ole32

rpcrt4

version

Exports

Exports

Sections

.text Size: 484KB - Virtual size: 480KB

fothk Size: 4KB - Virtual size: 4KB

.rdata Size: 208KB - Virtual size: 207KB

.data Size: 16KB - Virtual size: 15KB

.pdata Size: 16KB - Virtual size: 15KB

.didat Size: 4KB - Virtual size: 216B

.rsrc Size: 8KB - Virtual size: 5KB

.reloc Size: 4KB - Virtual size: 2KB

.text
Size: 484KB - Virtual size: 480KB

fothk
Size: 4KB - Virtual size: 4KB

.rdata
Size: 208KB - Virtual size: 207KB

.data
Size: 16KB - Virtual size: 15KB

.pdata
Size: 16KB - Virtual size: 15KB

.didat
Size: 4KB - Virtual size: 216B

.rsrc
Size: 8KB - Virtual size: 5KB

.reloc
Size: 4KB - Virtual size: 2KB