226ae221745ca064a752c13307bea9c3998b24116377fe974ceaf289d842c58c_NeikiAnalytics[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

226ae221745ca064a752c13307bea9c3998b24116377fe974ceaf289d842c58c_NeikiAnalytics.exe
Size

241KB
MD5

f80de043e595e0b01c1d15a876cd4760
SHA1

cbaa96e092c4dbea5bb7bae0cf0ac03eb4502b16
SHA256

226ae221745ca064a752c13307bea9c3998b24116377fe974ceaf289d842c58c
SHA512

9074122c53cf0f691dc6de1ab9fb93cca0a0b09afb974caa11993f51579ead39a6ffdfa5741d7f7dfd773e0ccbedc126f32a414e99e8ac0387d028bbbacc5ba4
SSDEEP

3072:tBGn4WfCHenodoxxJRc6dWikg/IuTTYp7iG6rbtOLeylRO9caMFHt1BWg9RkkBz:tIn0HenDnC+t0eERZUmR/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
226ae221745ca064a752c13307bea9c3998b24116377fe974ceaf289d842c58c_NeikiAnalytics.exe

Files

226ae221745ca064a752c13307bea9c3998b24116377fe974ceaf289d842c58c_NeikiAnalytics.exe
.dll windows:6 windows x64 arch:x64

eee3d4b9b9f5a6d532020d14a2aa9a84

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

FactoryServer-ControlFlows.pdb

Imports

factoryserver-core

??0FName@@QEAA@PEB_WW4EFindName@@@Z
??0FLogCategoryBase@@QEAA@AEBVFName@@W4Type@ELogVerbosity@@1@Z
??1FLogCategoryBase@@QEAA@XZ
?GCoreObjectArrayForDebugVisualizers@@3PEAVFChunkedFixedUObjectArray@@EA
?GCoreComplexObjectPathDebug@@3PEAUFStoredObjectPathDebug@Private@CoreUObject@UE@@EA
?GCoreObjectHandlePackageDebug@@3PEAUFObjectHandlePackageDebugData@Private@CoreUObject@UE@@EA
?CheckVerifyFailedImpl@FDebug@@SA_NPEBD0HPEAXPEB_WZZ
?CheckVerifyImpl@@YA_NAEA_N_NPEBDHPEAX2PEB_WZZ
?Malloc@FMemory@@SAPEAX_KI@Z
?Realloc@FMemory@@SAPEAXPEAX_KI@Z
?Free@FMemory@@SAXPEAX@Z
?QuantizeSize@FMemory@@SA_K_KI@Z
?OnInvalidArrayNum@Private@Core@UE@@YAX_K@Z
?ResizeAllocation@ForAnyElementType@?$TSizedHeapAllocator@$0CA@UFMemory@@@@QEAAXHH_K@Z
?ResizeAllocation@ForAnyElementType@?$TSizedHeapAllocator@$0CA@UFMemory@@@@QEAAXHH_KI@Z
??0FString@@QEAA@PEBD@Z
??0FString@@QEAA@PEB_W@Z
?AppendChars@FString@@QEAAXPEB_WH@Z
?Format@FString@@SA?AV1@PEB_WAEBV?$TArray@UFStringFormatArg@@V?$TSizedDefaultAllocator@$0CA@@@@@@Z
?FormatAsNumber@FString@@SA?AV1@H@Z
?AppendInt@FString@@QEAAXH@Z
??0FStringFormatArg@@QEAA@H@Z
??0FStringFormatArg@@QEAA@VFString@@@Z
??4FStringFormatArg@@QEAAAEAU0@AEBU0@@Z
?FromValidEName@FNameEntryId@@CA?AU1@W4EName@@@Z
?GetBlocks@FNameDebugVisualizer@@SAPEAPEAEXZ
?BasicLog@Private@Logging@UE@@YAXAEBUFLogCategoryBase@@PEBUFStaticBasicLogRecord@123@ZZ
?GenerateNewID@FDelegateHandle@@CA_KXZ
?StackWalkAndDump@FWindowsPlatformStackWalk@@SAXPEAD_KHPEAX@Z
?ThreadStackWalkAndDump@FWindowsPlatformStackWalk@@SAXPEAD_KHI@Z
?GetDestructionSentinelStackTls@FMRSWRecursiveAccessDetector@@CAAEAV?$TArray@PEAUFDestructionSentinel@FMRSWRecursiveAccessDetector@@V?$TSizedInlineAllocator@$03$0CA@V?$TSizedDefaultAllocator@$0CA@@@@@@@XZ
?GetReadersTls@FMRSWRecursiveAccessDetector@@CAAEAV?$TArray@UFReaderNum@FMRSWRecursiveAccessDetector@@V?$TSizedInlineAllocator@$03$0CA@V?$TSizedDefaultAllocator@$0CA@@@@@@@XZ
?GetCoreTicker@FTSTicker@@SAAEAV1@XZ
?AddTicker@FTSTicker@@QEAA?AV?$TWeakPtr@UFElement@FTSTicker@@$00@@AEBV?$TDelegate@$$A6A_NM@ZUFDefaultDelegateUserPolicy@@@@M@Z
?RemoveTicker@FTSTicker@@SAXV?$TWeakPtr@UFElement@FTSTicker@@$00@@@Z
??0FTrackedActivity@@QEAA@PEB_W0W4ETrackedActivityLight@@W4EType@0@H@Z
??1FTrackedActivity@@QEAA@XZ
?Update@FTrackedActivity@@QEAAXPEB_WI@Z

kernel32

EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
DisableThreadLibraryCalls
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
GetModuleHandleW
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive

vcruntime140

memset
__C_specific_handler
memmove
_purecall
__current_exception
__current_exception_context
__std_type_info_destroy_list
memcpy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_seh_filter_dll
_initialize_narrow_environment
_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
_initialize_onexit_table
_register_onexit_function
terminate
_initterm_e
_initterm
_configure_narrow_argv
_cexit

Exports

Exports

??0FConditionalLoop@@QEAA@XZ
??0FControlFlow@@QEAA@AEBVFString@@@Z
??_FFControlFlow@@QEAAXXZ
?AddOrGetFlow@FConcurrentControlFlows@@QEAAAEAVFControlFlow@@HAEBVFString@@@Z
?AddOrGetProng@FConcurrentControlFlows@@QEAAAEAVFControlFlow@@HAEBVFString@@@Z
?CancelFlow@FControlFlow@@QEAAXXZ
?CancelFlow@FControlFlowNode@@UEAAXXZ
?CancelFlow@FControlFlowNode_Task@@UEAAXXZ
?CheckConditionFirst@FConditionalLoop@@QEAAAEAVFControlFlow@@XZ
?CheckForInvalidFlows@FControlFlowStatics@@CAXXZ
?CheckNewlyCreatedFlows@FControlFlowStatics@@CAXXZ
?ContinueFlow@FControlFlowNode@@QEAAXXZ
?ExecuteAtLeastOnce@FConditionalLoop@@QEAAAEAVFControlFlow@@XZ
?ExecuteFlow@FControlFlow@@QEAAXXZ
?FormatOrGetNewNodeDebugName@FControlFlow@@AEAA?AVFString@@AEBV2@@Z
?GetCurrentStepDebugName@FControlFlow@@QEBA?AU?$TOptional@VFString@@@@XZ
?GetExecutingFlows@FControlFlowStatics@@CAAEAV?$TArray@V?$TSharedRef@VFControlFlowContainerBase@@$00@@V?$TSizedDefaultAllocator@$0CA@@@@@XZ
?GetFinishedFlows@FControlFlowStatics@@CAAEAV?$TArray@V?$TSharedRef@VFControlFlowContainerBase@@$00@@V?$TSizedDefaultAllocator@$0CA@@@@@XZ
?GetNewlyCreatedFlows@FControlFlowStatics@@CAAEAV?$TArray@V?$TSharedRef@VFControlFlowContainerBase@@$00@@V?$TSizedDefaultAllocator@$0CA@@@@@XZ
?GetPersistentFlows@FControlFlowStatics@@CAAEAV?$TArray@V?$TSharedRef@VFControlFlowContainerBase@@$00@@V?$TSizedDefaultAllocator@$0CA@@@@@XZ
?GetTrackedActivity@FControlFlow@@QEBA?AV?$TSharedPtr@VFTrackedActivity@@$00@@XZ
?GetTrackedActivity@FControlFlowNode@@QEBA?AV?$TSharedPtr@VFTrackedActivity@@$00@@XZ
?QueueBranch@FControlFlow@@QEAA?AV?$TSharedRef@VFControlFlowTask_BranchLegacy@@$00@@AEAV?$TDelegate@$$A6AHXZUFDefaultDelegateUserPolicy@@@@AEBVFString@@1@Z
?QueueConcurrentFlows@FControlFlow@@QEAAAEAV?$TDelegate@$$A6AXV?$TSharedRef@VFConcurrentControlFlows@@$00@@@ZUFDefaultDelegateUserPolicy@@@@AEBVFString@@0@Z
?QueueConditionalLoop@FControlFlow@@QEAAAEAV?$TDelegate@$$A6A?AW4EConditionalLoopResult@@V?$TSharedRef@VFConditionalLoop@@$00@@@ZUFDefaultDelegateUserPolicy@@@@AEBVFString@@0@Z
?QueueControlFlow@FControlFlow@@QEAAAEAV?$TDelegate@$$A6AXV?$TSharedRef@VFControlFlow@@$00@@@ZUFDefaultDelegateUserPolicy@@@@AEBVFString@@0@Z
?QueueControlFlowBranch@FControlFlow@@QEAAAEAV?$TDelegate@$$A6AHV?$TSharedRef@VFControlFlowBranch@@$00@@@ZUFDefaultDelegateUserPolicy@@@@AEBVFString@@0@Z
?QueueDelay@FControlFlow@@QEAAAEAV1@MAEBVFString@@@Z
?QueueFunction@FControlFlow@@QEAAAEAV?$TDelegate@$$A6AXXZUFDefaultDelegateUserPolicy@@@@AEBVFString@@@Z
?QueueLoop@FControlFlow@@QEAAAEAV?$TDelegate@$$A6AXV?$TSharedRef@VFControlFlow@@$00@@@ZUFDefaultDelegateUserPolicy@@@@AEAV?$TDelegate@$$A6A_NXZUFDefaultDelegateUserPolicy@@@@AEBVFString@@1@Z
?QueueWait@FControlFlow@@QEAAAEAV?$TDelegate@$$A6AXV?$TSharedRef@VFControlFlowNode@@$00@@@ZUFDefaultDelegateUserPolicy@@@@AEBVFString@@@Z
?Reset@FControlFlow@@QEAAXXZ
?RunLoopFirst@FConditionalLoop@@QEAAAEAVFControlFlow@@XZ
?SetCancelledNodeAsComplete@FControlFlow@@QEAAAEAV1@_N@Z
?SetCheckConditionFirst@FConditionalLoop@@QEAAAEAVFControlFlow@@_N@Z
?TrackActivities@FControlFlow@@QEAAAEAV1@V?$TSharedPtr@VFTrackedActivity@@$00@@@Z
InitializeModule

Sections

.text
Size: 119KB - Virtual size: 119KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.uedbg
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

eee3d4b9b9f5a6d532020d14a2aa9a84

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

factoryserver-core

kernel32

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

Exports

Exports

Sections

.text Size: 119KB - Virtual size: 119KB

.uedbg Size: 7KB - Virtual size: 6KB

.rdata Size: 44KB - Virtual size: 43KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 9KB - Virtual size: 8KB

.rsrc Size: 59KB - Virtual size: 58KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 119KB - Virtual size: 119KB

.uedbg
Size: 7KB - Virtual size: 6KB

.rdata
Size: 44KB - Virtual size: 43KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 9KB - Virtual size: 8KB

.rsrc
Size: 59KB - Virtual size: 58KB

.reloc
Size: 1KB - Virtual size: 1KB