40af09252814145ff0f753f17392a2f4bc47f4379c769d2f30b541726ce5b1f3_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

40af09252814145ff0f753f17392a2f4bc47f4379c769d2f30b541726ce5b1f3_NeikiAnalytics.exe
Size

666KB
MD5

de4edcb4a1399dc466919e6fa94dd740
SHA1

eb7b33b36e6a9acb3951b65562668d05333e15fd
SHA256

40af09252814145ff0f753f17392a2f4bc47f4379c769d2f30b541726ce5b1f3
SHA512

6d30f68974a46da38065f68b7412a872f702568b0920111e6429e04842d21a21cb28ac13f7dd0e39507cd48607a037b4a89172fb2d93b7d20c768e595338ddee
SSDEEP

12288:tK4dJ/JWu4CeER2PvxKNKdpE5eJ96SNWSNafYfWt7mU8pVQ:tK2J/JWuAOspKj5eEHZpKpVQ

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
40af09252814145ff0f753f17392a2f4bc47f4379c769d2f30b541726ce5b1f3_NeikiAnalytics.exe

Files

40af09252814145ff0f753f17392a2f4bc47f4379c769d2f30b541726ce5b1f3_NeikiAnalytics.exe
.exe windows:5 windows x86 arch:x86

7b3b93fa92f8c46b17669e19d975b205

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\WorkCode\TPSP\Tpsp独立版本\Source\Bin\Release\TpspCln\TpspCln.pdb

Imports

kernel32

UnmapViewOfFile
VirtualFree
Sleep
GetEnvironmentVariableA
VirtualAlloc
CreateFileMappingA
OpenFileMappingA
SetFileTime
GetFileAttributesA
GetFileAttributesW
ReadFile
CreateFileW
lstrcatA
DeviceIoControl
lstrcpyW
SetLastError
FindResourceA
FreeResource
LoadResource
WaitForSingleObject
GetSystemWow64DirectoryA
SizeofResource
CreateEventA
CreateProcessA
GetSystemDirectoryA
ResetEvent
GetLocalTime
GetExitCodeThread
LockResource
GetSystemInfo
GetVersionExA
WinExec
FreeLibrary
GetProcessHeap
IsBadReadPtr
LoadLibraryA
VirtualProtect
GetModuleHandleW
GetSystemDirectoryW
LoadLibraryW
GetCurrentThreadId
InterlockedIncrement
ExpandEnvironmentStringsA
LocalAlloc
ResumeThread
SetFilePointer
SystemTimeToFileTime
CreateDirectoryA
GetCurrentDirectoryA
LocalFileTimeToFileTime
GetDriveTypeA
GetPrivateProfileStringA
GetModuleFileNameA
GetFileSize
WaitNamedPipeW
ReadProcessMemory
SetNamedPipeHandleState
VirtualFreeEx
VirtualAllocEx
SleepEx
lstrlenW
TerminateProcess
CreateProcessW
WriteProcessMemory
VirtualProtectEx
DuplicateHandle
MapViewOfFile
GetCurrentDirectoryW
GetModuleFileNameW
GetVersion
VirtualQueryEx
GetCurrentThread
CreateRemoteThread
GetWindowsDirectoryW
CreateFileMappingW
CreateMutexW
OpenMutexW
OpenFileMappingW
CreateEventW
OpenEventW
ExitThread
FlushInstructionCache
ReleaseMutex
GetThreadContext
InterlockedCompareExchange
SetEndOfFile
GetDriveTypeW
SetEnvironmentVariableA
CompareStringW
GetTimeZoneInformation
InterlockedExchange
GetStringTypeW
GetFullPathNameA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlushFileBuffers
FindClose
lstrcpyA
LocalFree
FormatMessageA
GetTickCount
lstrlenA
FileTimeToLocalFileTime
CreateToolhelp32Snapshot
Process32Next
lstrcmpiA
FileTimeToSystemTime
OpenProcess
GetProcessTimes
Process32First
WriteFile
WaitNamedPipeA
CreateFileA
GetSystemTime
GetCurrentProcessId
CloseHandle
CreateMutexA
GetModuleHandleA
GetProcAddress
GetLastError
MultiByteToWideChar
WideCharToMultiByte
ExitProcess
OutputDebugStringA
DeleteCriticalSection
AddVectoredExceptionHandler
EnterCriticalSection
HeapCreate
LeaveCriticalSection
InitializeCriticalSection
HeapFree
GetCurrentProcess
HeapAlloc
VirtualQuery
LCMapStringW
GetConsoleMode
GetConsoleCP
GetStartupInfoW
SetHandleCount
InitializeCriticalSectionAndSpinCount
SetStdHandle
HeapSize
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
RaiseException
InterlockedDecrement
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlUnwind
FindFirstFileExA
HeapSetInformation
GetCommandLineA
HeapReAlloc
GetStdHandle
WriteConsoleW
GetFileType
PeekNamedPipe
GetFileInformationByHandle
MoveFileA
CreateThread
DecodePointer
EncodePointer
GetSystemTimeAsFileTime
GetVersionExW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

GetUserObjectInformationA
CloseDesktop
LoadIconA
FindWindowExA
SendMessageA
FindWindowA
wsprintfA
CharNextA
SetTimer
KillTimer
GetParent
EnumWindows
PeekMessageA
GetDesktopWindow
GetSystemMetrics
GetThreadDesktop
GetWindowThreadProcessId
GetMessageA
TranslateMessage
DispatchMessageA
OpenInputDesktop

advapi32

OpenSCManagerA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetLengthSid
GetKernelObjectSecurity
AllocateAndInitializeSid
FreeSid
GetTokenInformation
LookupPrivilegeValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyW
RegDeleteKeyW
CreateServiceW
OpenSCManagerW
OpenServiceW
QueryServiceConfigW
QueryServiceStatus
ChangeServiceConfigW
StartServiceW
ControlService
OpenProcessToken
QueryServiceStatusEx
StartServiceA
CreateServiceA
EnumDependentServicesA
DeleteService
CloseServiceHandle
OpenServiceA
RegDeleteValueA
RegEnumKeyExA
RegDeleteKeyA
RegCloseKey
RegOpenKeyA
BuildExplicitAccessWithNameA
RegOpenKeyExA
RegCreateKeyExA
RegQueryValueExA
RegSetValueExA
SetNamedSecurityInfoA
SetEntriesInAclA
AdjustTokenPrivileges
LookupPrivilegeValueA

shell32

SHFileOperationA
Shell_NotifyIconA
ShellExecuteExA

shlwapi

PathIsRootA
PathFindFileNameA
PathStripToRootA
PathRemoveFileSpecA
PathIsDirectoryA
PathFileExistsA
PathAddBackslashA

psapi

GetMappedFileNameA

ws2_32

getsockname
htons
inet_addr
connect
gethostname
WSACleanup
WSAStartup
WSAGetLastError
socket
send
setsockopt
ntohs
bind
getsockopt
getpeername
WSASetLastError
freeaddrinfo
closesocket
recv
gethostbyname
getaddrinfo
__WSAFDIsSet
ioctlsocket
select

imagehlp

CheckSumMappedFile

iphlpapi

GetAdaptersInfo

Sections

.text
Size: - Virtual size: 987KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 145KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 663KB - Virtual size: 662KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 208B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7b3b93fa92f8c46b17669e19d975b205

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

shlwapi

psapi

ws2_32

imagehlp

iphlpapi

Sections

.text Size: - Virtual size: 987KB

.rdata Size: - Virtual size: 145KB

.data Size: - Virtual size: 37KB

.vmp0 Size: - Virtual size: 27KB

.vmp1 Size: 663KB - Virtual size: 662KB

.reloc Size: 512B - Virtual size: 208B

.rsrc Size: 1KB - Virtual size: 115KB

.text
Size: - Virtual size: 987KB

.rdata
Size: - Virtual size: 145KB

.data
Size: - Virtual size: 37KB

.vmp0
Size: - Virtual size: 27KB

.vmp1
Size: 663KB - Virtual size: 662KB

.reloc
Size: 512B - Virtual size: 208B

.rsrc
Size: 1KB - Virtual size: 115KB