0917ca761558b1cc12dc673ded78d4233c6d4588248f71ef47e7db12f34adf26_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

0917ca761558b1cc12dc673ded78d4233c6d4588248f71ef47e7db12f34adf26_NeikiAnalytics.exe
Size

453KB
MD5

a8da290b3b2907ca9b670ca9333621c0
SHA1

c784ec970e82083559f1f6eb93838815371e4d80
SHA256

0917ca761558b1cc12dc673ded78d4233c6d4588248f71ef47e7db12f34adf26
SHA512

ebc202f4ba5ad89061f93836a32664e5168f0960f2e5490e60f80c3b0ed9ceba7b2a2a16e0a244a804f900979d6fc5dbd74913622e3cf0b24f9a83c86553f580
SSDEEP

6144:tWUu2OjjSq4m+FqvVt5tXB9Nd0Bp2ppDiCUvKq9Io9HfU2VOGvHDy+hjIb2DwnJ5:M2ojShOtH0B43i3JJ1m+lbwn2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0917ca761558b1cc12dc673ded78d4233c6d4588248f71ef47e7db12f34adf26_NeikiAnalytics.exe

Files

0917ca761558b1cc12dc673ded78d4233c6d4588248f71ef47e7db12f34adf26_NeikiAnalytics.exe
.dll windows:6 windows x64 arch:x64

f1164dfb4b7ca293a087d503d2524dc0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

ws2_32

inet_addr
inet_ntoa
recvfrom
sendto
__WSAFDIsSet
select
ntohl
getaddrinfo
ntohs
freeaddrinfo
WSACleanup
accept
getsockname
closesocket
listen
WSAIoctl
send
connect
WSASocketA
recv
getsockopt
htonl
htons
ioctlsocket
getnameinfo
setsockopt
WSAGetLastError
bind
WSAStartup
getpeername

advapi32

SetSecurityDescriptorDacl
CryptAcquireContextA
CryptGenRandom
InitializeSecurityDescriptor

iphlpapi

GetAdaptersAddresses
if_indextoname

libpypy3-c

PyPyModule_Create2

msvcp140

?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?_Xout_of_range@std@@YAXPEBD@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?uncaught_exception@std@@YA_NXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Xlength_error@std@@YAXPEBD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ

kernel32

WaitForSingleObject
SetHandleInformation
FormatMessageA
RaiseException
GetTickCount
QueryPerformanceCounter
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
IsDebuggerPresent
GetCurrentThreadId
Sleep
WideCharToMultiByte
SleepConditionVariableCS
WakeAllConditionVariable
GetModuleHandleW
GetCurrentProcessId
TryEnterCriticalSection
FreeLibrary
QueryPerformanceFrequency
LoadLibraryA
SetFileCompletionNotificationModes
CreateIoCompletionPort
DeleteCriticalSection
AcquireSRWLockShared
GetProcAddress
GetQueuedCompletionStatusEx
CancelIoEx
ReleaseSRWLockShared
CloseHandle
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetLastError
GetTickCount64
InitializeCriticalSection
LeaveCriticalSection
GetHandleInformation
EnterCriticalSection
SetLastError
InitOnceExecuteOnce
InitializeConditionVariable
InitializeSRWLock

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy
__std_exception_copy
__std_terminate
_purecall
strrchr
__C_specific_handler
_CxxThrowException
memset
__std_type_info_destroy_list
memchr
memcmp
memcpy
memmove

api-ms-win-crt-runtime-l1-1-0

_errno
_initterm_e
_initterm
_cexit
strerror
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
abort
_beginthreadex
_invalid_parameter_noinfo_noreturn
_seh_filter_dll
_configure_narrow_argv

api-ms-win-crt-heap-l1-1-0

malloc
_callnewh
realloc
free

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf
tmpnam_s
__acrt_iob_func
fflush
puts
__stdio_common_vfprintf

api-ms-win-crt-convert-l1-1-0

strtol
atoi

api-ms-win-crt-filesystem-l1-1-0

_rmdir
_unlink
_mkdir

api-ms-win-crt-string-l1-1-0

isdigit
isxdigit
strncpy
isalnum
isalpha

api-ms-win-crt-utility-l1-1-0

rand

Exports

Exports

PyInit_libzmq
zmq_atomic_counter_dec
zmq_atomic_counter_destroy
zmq_atomic_counter_inc
zmq_atomic_counter_new
zmq_atomic_counter_set
zmq_atomic_counter_value
zmq_bind
zmq_close
zmq_connect
zmq_ctx_destroy
zmq_ctx_get
zmq_ctx_new
zmq_ctx_set
zmq_ctx_shutdown
zmq_ctx_term
zmq_curve_keypair
zmq_curve_public
zmq_device
zmq_disconnect
zmq_errno
zmq_getsockopt
zmq_has
zmq_init
zmq_msg_close
zmq_msg_copy
zmq_msg_data
zmq_msg_get
zmq_msg_gets
zmq_msg_init
zmq_msg_init_data
zmq_msg_init_size
zmq_msg_more
zmq_msg_move
zmq_msg_recv
zmq_msg_send
zmq_msg_set
zmq_msg_size
zmq_poll
zmq_proxy
zmq_proxy_steerable
zmq_recv
zmq_recviov
zmq_recvmsg
zmq_send
zmq_send_const
zmq_sendiov
zmq_sendmsg
zmq_setsockopt
zmq_sleep
zmq_socket
zmq_socket_monitor
zmq_stopwatch_intermediate
zmq_stopwatch_start
zmq_stopwatch_stop
zmq_strerror
zmq_term
zmq_threadclose
zmq_threadstart
zmq_timers_add
zmq_timers_cancel
zmq_timers_destroy
zmq_timers_execute
zmq_timers_new
zmq_timers_reset
zmq_timers_set_interval
zmq_timers_timeout
zmq_unbind
zmq_version
zmq_z85_decode
zmq_z85_encode

Sections

.text
Size: 337KB - Virtual size: 337KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 86KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f1164dfb4b7ca293a087d503d2524dc0

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

advapi32

iphlpapi

libpypy3-c

msvcp140

kernel32

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

Exports

Exports

Sections

.text Size: 337KB - Virtual size: 337KB

.rdata Size: 86KB - Virtual size: 86KB

.data Size: 5KB - Virtual size: 6KB

.pdata Size: 17KB - Virtual size: 17KB

.rsrc Size: 512B - Virtual size: 248B

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 337KB - Virtual size: 337KB

.rdata
Size: 86KB - Virtual size: 86KB

.data
Size: 5KB - Virtual size: 6KB

.pdata
Size: 17KB - Virtual size: 17KB

.rsrc
Size: 512B - Virtual size: 248B

.reloc
Size: 4KB - Virtual size: 4KB