4c22227bc3b5a4784a70b95abf1192224ef4e969ac1833d72ac0e766960e5421_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

4c22227bc3b5a4784a70b95abf1192224ef4e969ac1833d72ac0e766960e5421_NeikiAnalytics.exe
Size

1.3MB
MD5

1c819090d426926105e065b5d1384e00
SHA1

4b5e0b66d72e24d3660e4ddd00b93478b69228b1
SHA256

4c22227bc3b5a4784a70b95abf1192224ef4e969ac1833d72ac0e766960e5421
SHA512

59bcc6f61434ed6e8deb6a1765389301d964835d78620cfa4226a578715fa00438e5fee8909caa89900603a4b411f8c7b5af59481a931162692f7dd6631bc50f
SSDEEP

24576:icPaA8c4hal5R3HacIvDVb3MBS9SHfiGy+/hejW9aHzvnQk1Ya:/SA+2KhrJMBS9AaTLd1J

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4c22227bc3b5a4784a70b95abf1192224ef4e969ac1833d72ac0e766960e5421_NeikiAnalytics.exe

Files

4c22227bc3b5a4784a70b95abf1192224ef4e969ac1833d72ac0e766960e5421_NeikiAnalytics.exe
.dll windows:10 windows x64 arch:x64

c33fa8c757af71d36d7a979638dbbce3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

win32spl.pdb

Imports

msvcrt

wcstok_s
wcschr
wcsrchr
_get_errno
_purecall
_wcsnicmp
wcsncmp
_wtol
wcsnlen
wcstol
wcscpy_s
__dllonexit
wcstoul
_unlock
wcsstr
_wcsicmp
memmove_s
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
??0exception@@QEAA@XZ
memcpy_s
_itow_s
qsort
_lock
malloc
_callnewh
_CxxThrowException
__CxxFrameHandler3
memcpy
memmove
??0exception@@QEAA@AEBQEBD@Z
_wcsdup
_open
_errno
_read
_write
_close
_lseek
_wopen
_stricmp
swprintf_s
wcsncpy_s
sprintf_s
_wtof
isdigit
isupper
_set_errno
??1bad_cast@@UEAA@XZ
??0bad_cast@@QEAA@PEBD@Z
localeconv
strcspn
__uncaught_exception
setlocale
___mb_cur_max_func
___lc_handle_func
___lc_codepage_func
_ismbblead
__pctype_func
calloc
islower
??8type_info@@QEBAHAEBV0@@Z
__crtLCMapStringW
__crtLCMapStringA
_wsetlocale
abort
memset
memchr
memcmp
sqrt
_vsnwprintf
??0exception@@QEAA@AEBQEBDH@Z
?what@exception@@UEBAPEBDXZ
_XcptFilter
_amsg_exit
free
_initterm
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
wcscmp
_onexit
??0bad_cast@@QEAA@AEBV0@@Z
_wcstoi64
wcscat_s
strcpy_s
_wcslwr
strchr
iswspace
tolower
??_V@YAXPEAX@Z
??3@YAXPEAX@Z
__C_specific_handler
__CxxFrameHandler4

ntdll

RtlFreeHeap
NtSetInformationToken
RtlAllocateHeap
WinSqmIncrementDWORD
WinSqmAddToStreamEx
WinSqmSetDWORD
WinSqmIsOptedIn
EtwEventWrite
EtwEventEnabled
EtwEventUnregister
EtwEventRegister
RtlValidRelativeSecurityDescriptor
RtlIsThreadWithinLoaderCallout
NtQuerySystemInformation
NtFsControlFile
RtlInitializeSRWLock
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockExclusive
RtlReleaseSRWLockShared
RtlAcquireSRWLockShared
TpAllocPool
TpSetPoolMinThreads
TpSetPoolMaxThreads
TpReleaseAlpcCompletion
TpWaitForAlpcCompletion
TpReleaseIoCompletion
TpWaitForIoCompletion
TpReleaseTimer
TpWaitForTimer
RtlInitAnsiString
RtlOemStringToUnicodeString
RtlUnicodeToOemN
RtlxUnicodeStringToOemSize
NtOpenThreadToken
NtImpersonateAnonymousToken
NtCreateFile
NtClose
TpReleaseWait
TpWaitForWait
TpReleaseWork
TpWaitForWork
TpAllocAlpcCompletion
TpStartAsyncIoOperation
TpAllocIoCompletion
TpSetTimer
TpAllocTimer
TpAllocWait
TpPostWork
TpAllocWork
RtlNtStatusToDosError
TpSimpleTryPost
TpSetWait
TpCallbackMayRunLong
RtlInitUnicodeString
NtSetInformationThread
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
VerSetConditionMask
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwTraceMessage
TpReleasePool

api-ms-win-core-errorhandling-l1-1-0

SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException
GetLastError

api-ms-win-core-file-l1-1-0

CompareFileTime
GetFullPathNameW
GetFileSize
RemoveDirectoryW
SetFileAttributesW
SetFileTime
SetEndOfFile
ReadFile
LocalFileTimeToFileTime
FindClose
FindNextFileW
FindFirstFileW
CreateFileW
WriteFile
SetFilePointerEx
DeleteFileW
CreateDirectoryW
GetFileAttributesW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
GetModuleHandleW
LoadStringW
LoadLibraryExW
FreeLibrary
GetModuleFileNameA
GetProcAddress
DisableThreadLibraryCalls

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-localization-l1-2-0

FormatMessageW
GetSystemPreferredUILanguages

rpcrt4

NdrClientCall3
RpcBindingFree
RpcAsyncCompleteCall
RpcSmDestroyClientContext
Ndr64AsyncClientCall
RpcBindingSetObject
RpcEpResolveBinding
RpcAsyncInitializeHandle
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcBindingSetAuthInfoExW
RpcStringFreeW
MesDecodeIncrementalHandleCreate
MesHandleFree
I_RpcExceptionFilter
RpcBindingSetOption
MesEncodeIncrementalHandleCreate
NdrMesProcEncodeDecode3

api-ms-win-core-registry-l1-1-0

RegEnumKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegGetValueW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW
RegDeleteValueW
RegDeleteKeyExW
RegOpenCurrentUser

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
OpenProcessToken
TerminateProcess
GetCurrentProcess
SetThreadToken
GetCurrentThread
OpenThreadToken
ExitProcess
GetCurrentProcessId

api-ms-win-security-base-l1-1-0

FreeSid
AllocateAndInitializeSid
SetSecurityDescriptorDacl
RevertToSelf
MakeSelfRelativeSD
SetSecurityDescriptorOwner
IsWellKnownSid
IsValidSecurityDescriptor
IsTokenRestricted
GetSecurityDescriptorLength
GetLengthSid
InitializeAcl
AddAccessDeniedAceEx
AddAccessAllowedAceEx
SetTokenInformation
DuplicateTokenEx
CreateWellKnownSid
InitializeSecurityDescriptor
CopySid
SetSecurityDescriptorGroup
CheckTokenMembership
GetTokenInformation

api-ms-win-core-synch-l1-1-0

WaitForSingleObject
CreateEventW
SetEvent
CreateMutexExW
ReleaseMutex
CreateSemaphoreExW
LeaveCriticalSection
OpenSemaphoreW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
InitializeCriticalSectionEx
ReleaseSRWLockShared
ReleaseSemaphore
InitializeCriticalSection
EnterCriticalSection
WaitForSingleObjectEx
CreateEventExW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount

oleaut32

LoadRegTypeLi
SetErrorInfo
VariantCopyInd
LoadTypeLi
GetRecordInfoFromTypeInfo
SysAllocStringLen
BSTR_UserSize
BSTR_UserFree
LPSAFEARRAY_UserSize
BSTR_UserUnmarshal64
LPSAFEARRAY_UserFree
LPSAFEARRAY_UserUnmarshal
LPSAFEARRAY_UserFree64
LPSAFEARRAY_UserMarshal64
BSTR_UserUnmarshal
BSTR_UserMarshal
LPSAFEARRAY_UserUnmarshal64
VariantClear
LPSAFEARRAY_UserMarshal
BSTR_UserFree64
BSTR_UserSize64
SafeArrayGetElement
SysStringLen
SafeArrayPutElement
LPSAFEARRAY_UserSize64
SafeArrayGetUBound
BSTR_UserMarshal64
SafeArrayDestroy
SafeArrayCreateVector
SafeArrayPtrOfIndex
VariantInit
VariantChangeType
VariantCopy
SafeArrayCopyData
SysAllocString
SysFreeString

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolWorkCallbacks
SubmitThreadpoolWork
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
IsThreadpoolTimerSet
CreateThreadpoolWork
SetThreadpoolTimer
CloseThreadpoolTimer
CloseThreadpoolWork

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-sysinfo-l1-1-0

GetSystemDirectoryW
GetTickCount
GetVersionExW
GetSystemInfo
GetSystemTimeAsFileTime

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventRegister
EventSetInformation
EventWriteTransfer

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable
SleepConditionVariableSRW
Sleep
InitOnceBeginInitialize
InitOnceComplete

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference
WindowsDeleteString
WindowsGetStringRawBuffer

api-ms-win-core-winrt-l1-1-0

RoUninitialize
RoGetActivationFactory
RoInitialize

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processtopology-obsolete-l1-1-0

GetActiveProcessorCount

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

spoolss

CacheIsNameInNodeList
IsNamedPipeRpcCall
CallRouterFindFirstPrinterChangeNotification
AllocSplStr
EnumPrintersW
SplRegisterForSessionEvents
GetPrinterW
GetPrinterDriverW
GetServerPolicy
GetJobNamedPropertyValue
SplUnregisterForSessionEvents
ReplyPrinterChangeNotification
DllAllocSplMem
DllFreeSplMem
ClosePrinter
OpenPrinterW
ImpersonatePrinterClient
RevertToPrinterSelf
DeletePrinterConnectionW
IsNameTheLocalMachineOrAClusterSpooler
MIDL_user_free1
MIDL_user_allocate1
PartialReplyPrinterChangeNotification
SpoolerRefreshPrinterChangeNotification
SpoolerFindClosePrinterChangeNotification
SpoolerFindFirstPrinterChangeNotification
GetJobW
OpenPrinter2W
AppendPrinterNotifyInfoData
RouterAllocPrinterNotifyInfo
RouterFreePrinterNotifyInfo
RouterCreatePrintAsyncNotificationChannel
SetJobW
DllFreeSplStr
SetPortW
GetPrinterDataW
CallDrvDevModeConversion
AllowRemoteCalls
SetPrinterDataW
FreePrintPropertyValue
GetPrinterDriverDirectoryW
ReplyPrinterChangeNotificationEx

localspl

SplSetJobExtra
SplSetJob
SplSetJobError
SplDeleteForm
SplAddForm
SplSetForm
SplEnumJobs
SplAddPrinterDriverEx
SplIsLocalDriverAvailable
SplGetDriverUpdateStatus
SplSetDriverUpdateStatus
SplAddPrinter
SplAddMonitor
SplCopyNumberOfFiles
SplEnumPrinterDrivers
SplIsCompatibleDriver
SplEnumPrinters
SplEnumPorts
SplDeletePrinterWithJobs
SplIsDriverInstalled
SplOpenPrinter
SplSetJobNamedProperty
SplDeleteJobNamedProperty
SplSetCSRPrinterDevnode
SplDoesCSRPrinterDevnodeExist
SplGetUserPropertyBag
SplPrintSupportOperation
SplIppCreateJobOnPrinter
SplIppGetJobAttributes
SplIppSetJobAttributes
SplCloseSpooler
SplDeleteSpooler
SplCreateSpooler
SplNotifyServerStatus
SplGetPrintClassObject_4CSR
SplGetPrinter
SplGetJobExtra
SplSetPrinter
SplXcvData
SplCopyFileEvent
SplLoadLibraryTheCopyFileModule
LocalAddForm
LocalDeleteForm
LocalEnumForms
SplEnumForms
SplGetForm
SplMonitorIsInstalled
SplGetPrintClassObject
SplDeletePrinterKey
SplDeletePrintProcCacheData
SplEnumPrintProcCacheData
SplGetLocalDevMode
SplSetPrintProcCacheData
SplGetPrintProcCacheData
SplEnumPrinterKey
SplEnumPrinterDataEx
SplEnumPrinterData
SplGetDriverDir
SplDeletePrinterDataEx
SplDeletePrinterData
SplSetPrinterDataEx
SplSetPrinterData
SplGetPrinterDataEx
SplGetPrinterData
SplGetPrinterDriver
SplGetPrinterDriverEx
SplResetPrinter
SplDeletePrinterIC
SplPlayGdiScriptOnPrinterIC
SplCreatePrinterIC
SplEnumJobNamedProperties
SplGetJobNamedPropertyValue
SplReportJobProcessingProgress
SplGetJob
SplScheduleJob
SplAddJob
SplAbortPrinter
LocalReadPrinter
SplWritePrinter
SplEndDocPrinter
SplEndPagePrinter
SplStartPagePrinter
SplStartDocPrinter
SplClosePrinter
SplAddCSRPrinter
SplEnableCSRPrinterDeviceInterface
SplDriverEvent

api-ms-win-core-kernel32-legacy-l1-1-0

DosDateTimeToFileTime
GetComputerNameW

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

kernelbase

LocalAlloc
LocalReAlloc
GetIsEdpEnabled

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
GetTimeZoneInformation

api-ms-win-core-registry-l1-1-1

RegDeleteKeyValueW
RegSetKeyValueW

api-ms-win-core-file-l2-1-0

MoveFileExW

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-privateprofile-l1-1-0

GetPrivateProfileStringW
GetPrivateProfileSectionW

combase

ord148

Exports

Exports

DllMain
InitializePrintMonitor2
InitializePrintProvidor

Sections

.text
Size: 948KB - Virtual size: 946KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

fothk
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 292KB - Virtual size: 289KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 52KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c33fa8c757af71d36d7a979638dbbce3

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-localization-l1-2-0

rpcrt4

api-ms-win-core-registry-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-synch-l1-1-0

oleaut32

api-ms-win-core-debug-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processtopology-obsolete-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

spoolss

localspl

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-1

kernelbase

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-registry-l1-1-1

api-ms-win-core-file-l2-1-0

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-privateprofile-l1-1-0

combase

Exports

Exports

Sections

.text Size: 948KB - Virtual size: 946KB

fothk Size: 4KB - Virtual size: 4KB

.rdata Size: 292KB - Virtual size: 289KB

.data Size: 12KB - Virtual size: 23KB

.pdata Size: 52KB - Virtual size: 49KB

.didat Size: 4KB - Virtual size: 888B

.rsrc Size: 12KB - Virtual size: 9KB

.reloc Size: 12KB - Virtual size: 9KB

.text
Size: 948KB - Virtual size: 946KB

fothk
Size: 4KB - Virtual size: 4KB

.rdata
Size: 292KB - Virtual size: 289KB

.data
Size: 12KB - Virtual size: 23KB

.pdata
Size: 52KB - Virtual size: 49KB

.didat
Size: 4KB - Virtual size: 888B

.rsrc
Size: 12KB - Virtual size: 9KB

.reloc
Size: 12KB - Virtual size: 9KB