8a3481e95375fc253e8f651756e653ecd0f2bb4a0be2110427d55fc13d588be9_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

8a3481e95375fc253e8f651756e653ecd0f2bb4a0be2110427d55fc13d588be9_NeikiAnalytics.exe
Size

40KB
MD5

334e94b21fb55aae41fcd548722a7870
SHA1

811253b0bc819b78b51c2d672e1cfcba977244a9
SHA256

8a3481e95375fc253e8f651756e653ecd0f2bb4a0be2110427d55fc13d588be9
SHA512

22a511e69d76abf487482d50bb9389e974ee0e2225e0a570b29b5c2ee9836404e83c6d1fb753dd30fd2ba1d44e67031d25d499ab35936978e722be0ff65c46d3
SSDEEP

768:Hz03NusawP+fXjdQgktcZyPMBpo84qcIh4zdvOYGx:HCRYXjO3cZgPFqcIGdvqx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8a3481e95375fc253e8f651756e653ecd0f2bb4a0be2110427d55fc13d588be9_NeikiAnalytics.exe

Files

8a3481e95375fc253e8f651756e653ecd0f2bb4a0be2110427d55fc13d588be9_NeikiAnalytics.exe
.exe windows:6 windows x64 arch:x64

3d4a7022b164476bc26a3c6db1f2d430

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

gdal

?AddString@CPLStringList@@QEAAAEAV1@PEBD@Z
?Count@CPLStringList@@QEBAHXZ
?Clear@CPLStringList@@QEAAAEAV1@XZ
??1CPLStringList@@QEAA@XZ
??0CPLStringList@@QEAA@PEAPEADH@Z
??0CPLStringList@@QEAA@XZ
?replaceAll@CPLString@@QEAAAEAV1@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@D@Z
CPLRecodeFromWChar
CPLSPrintf
CPLprintf
CPLGetValueType
CSLPartialFindString
?InsertStringDirectly@CPLStringList@@QEAAAEAV1@HPEAD@Z
CSLTokenizeString
GDALDestroyScaledProgress
CPLStrtod
?FetchNameValue@CPLStringList@@QEBAPEBDPEBD@Z
?SetNameValue@CPLStringList@@QEAAAEAV1@PEBD0@Z
?Assign@CPLStringList@@QEAAAEAV1@PEAPEADH@Z
??ACPLStringList@@QEAAPEADH@Z
??ACPLStringList@@QEBAPEBDH@Z
??8CSLIterator@cpl@@QEBA_NAEBU01@@Z
CPLAtof
CPLDestroyXMLNode
GDALVersionInfo
GDALAllRegister
CPLStrdup
CPLRealloc
CPLCalloc
GDALOpen
GDALDumpOpenDatasets
??0CPLErrorStateBackuper@@QEAA@P6AXW4CPLErr@@HPEBD@Z@Z
CPLPopErrorHandler
GDALDestroyDriverManager
GDALInitGCPs
GDALDeinitGCPs
GDALClose
GDALGeneralCmdLineProcessor
GDALCreateGenImgProjTransformer2
GDALDestroyGenImgProjTransformer
GDALGenImgProjTransform
GDALCreateGCPTransformer
GDALDestroyGCPTransformer
GDALGCPTransform
GDALCreateTPSTransformer
GDALDestroyTPSTransformer
GDALTPSTransform
OSRNewSpatialReference
CPLPushErrorHandlerEx
CPLPushErrorHandler
OSRDestroySpatialReference
CPLErrorReset
OSRSetFromUserInput
??0OGR_SRSNode@@QEAA@PEBD@Z
??0OGRSpatialReference@@QEAA@PEBD@Z
?Release@OGRSpatialReference@@QEAAXXZ
?GetLinearUnits@OGRSpatialReference@@QEBANPEAPEBD@Z
?GetTargetLinearUnits@OGRSpatialReference@@QEBANPEBDPEAPEBD@Z
?GetAngularUnits@OGRSpatialReference@@QEBANPEAPEBD@Z
?GetPrimeMeridian@OGRSpatialReference@@QEBANPEAPEBD@Z
?TransformWithErrorCodes@OGRCoordinateTransformation@@UEAAH_KPEAN111PEAH@Z
CPLError
CSLFindString
CSLDestroy
VSIFree

msvcp140

?_Xlength_error@std@@YAXPEBD@Z

kernel32

RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlLookupFunctionEntry

vcruntime140

_purecall
__std_exception_copy
__std_exception_destroy
_CxxThrowException
memcpy
memmove
memset
__current_exception
__current_exception_context
__C_specific_handler

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

terminate
_seh_filter_exe
_crt_atexit
_register_onexit_function
_initialize_onexit_table
exit
_set_app_type
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
__p___wargv
__p___argc
_exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_invalid_parameter_noinfo_noreturn

api-ms-win-crt-stdio-l1-1-0

_isatty
__acrt_iob_func
_fileno
__p__commode
feof
_set_fmode
fgets
__stdio_common_vfprintf

api-ms-win-crt-convert-l1-1-0

atoi
strtold
strtof

api-ms-win-crt-string-l1-1-0

_stricmp
isspace

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-heap-l1-1-0

malloc
_callnewh
_set_new_mode
free

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Exports

Exports

??0CPLErrorHandlerPusher@@QEAA@P6AXW4CPLErr@@HPEBD@Z@Z
??0CPLErrorHandlerPusher@@QEAA@P6AXW4CPLErr@@HPEBD@ZPEAX@Z
??0CPLXMLTreeCloser@@QEAA@$$QEAV0@@Z
??0CPLXMLTreeCloser@@QEAA@PEAUCPLXMLNode@@@Z
??0CSLIterator@cpl@@QEAA@XZ
??0CSLIteratorWrapper@cpl@@QEAA@PEBQEBD@Z
??0CSLNameValueIterator@cpl@@QEAA@$$QEAU01@@Z
??0CSLNameValueIterator@cpl@@QEAA@AEBU01@@Z
??0CSLNameValueIterator@cpl@@QEAA@XZ
??0CSLNameValueIteratorWrapper@cpl@@QEAA@PEBQEBD_N@Z
??0OGRCoordinateTransformation@@QEAA@AEBV0@@Z
??0OGRCoordinateTransformation@@QEAA@XZ
??0OGREnvelope3D@@QEAA@AEBV0@@Z
??0OGREnvelope3D@@QEAA@XZ
??0OGREnvelope@@QEAA@AEBV0@@Z
??0OGREnvelope@@QEAA@XZ
??1?$unique_ptr@UCPLXMLNode@@UCPLXMLTreeCloserDeleter@@@std@@QEAA@XZ
??1CPLErrorHandlerPusher@@QEAA@XZ
??1CPLXMLTreeCloser@@QEAA@XZ
??1CSLNameValueIterator@cpl@@QEAA@XZ
??1OGRCoordinateTransformation@@UEAA@XZ
??4?$unique_ptr@UCPLXMLNode@@UCPLXMLTreeCloserDeleter@@@std@@QEAAAEAV01@$$T@Z
??4CPLErrorHandlerPusher@@QEAAAEAV0@AEBV0@@Z
??4CPLStringList@@QEAAAEAV0@PEAPEAD@Z
??4CPLXMLTreeCloser@@QEAAAEAV0@$$QEAV0@@Z
??4CPLXMLTreeCloserDeleter@@QEAAAEAU0@$$QEAU0@@Z
??4CPLXMLTreeCloserDeleter@@QEAAAEAU0@AEBU0@@Z
??4CSLDestroyReleaser@@QEAAAEAU0@$$QEAU0@@Z
??4CSLDestroyReleaser@@QEAAAEAU0@AEBU0@@Z
??4CSLIterator@cpl@@QEAAAEAU01@$$QEAU01@@Z
??4CSLIterator@cpl@@QEAAAEAU01@AEBU01@@Z
??4CSLIteratorWrapper@cpl@@QEAAAEAU01@$$QEAU01@@Z
??4CSLIteratorWrapper@cpl@@QEAAAEAU01@AEBU01@@Z
??4CSLNameValueIterator@cpl@@QEAAAEAU01@$$QEAU01@@Z
??4CSLNameValueIterator@cpl@@QEAAAEAU01@AEBU01@@Z
??4GDALScaledProgressReleaser@@QEAAAEAU0@$$QEAU0@@Z
??4GDALScaledProgressReleaser@@QEAAAEAU0@AEBU0@@Z
??4OGRCoordinateTransformation@@QEAAAEAV0@AEBV0@@Z
??4OGREnvelope3D@@QEAAAEAV0@AEBV0@@Z
??4OGREnvelope@@QEAAAEAV0@AEBV0@@Z
??4OGRSpatialReferenceReleaser@@QEAAAEAU0@$$QEAU0@@Z
??4OGRSpatialReferenceReleaser@@QEAAAEAU0@AEBU0@@Z
??4VSIFreeReleaser@@QEAAAEAU0@$$QEAU0@@Z
??4VSIFreeReleaser@@QEAAAEAU0@AEBU0@@Z
??8CSLNameValueIterator@cpl@@QEBA_NAEBU01@@Z
??8OGREnvelope@@QEBA_NAEBV0@@Z
??9CSLIterator@cpl@@QEBA_NAEBU01@@Z
??9CSLNameValueIterator@cpl@@QEBA_NAEBU01@@Z
??9OGREnvelope@@QEBA_NAEBV0@@Z
??ACPLStringList@@QEAAPEAD_K@Z
??ACPLStringList@@QEBAPEBDPEBD@Z
??ACPLStringList@@QEBAPEBD_K@Z
??B?$unique_ptr@UCPLXMLNode@@UCPLXMLTreeCloserDeleter@@@std@@QEBA_NXZ
??BCPLStringList@@QEAAPEAPEADXZ
??BCPLStringList@@QEBA?AV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@XZ
??BCPLStringList@@QEBAPEBQEBDXZ
??C?$unique_ptr@UCPLXMLNode@@UCPLXMLTreeCloserDeleter@@@std@@QEBAPEAUCPLXMLNode@@XZ
??D?$unique_ptr@UCPLXMLNode@@UCPLXMLTreeCloserDeleter@@@std@@QEBAAEAUCPLXMLNode@@XZ
??DCSLIterator@cpl@@QEBAPEBDXZ
??ECSLIterator@cpl@@QEAAAEAU01@XZ
??ECSLNameValueIterator@cpl@@QEAAAEAU01@XZ
??RCPLXMLTreeCloserDeleter@@QEBAXPEAUCPLXMLNode@@@Z
??RCSLDestroyReleaser@@QEBAXPEAPEAD@Z
??RGDALScaledProgressReleaser@@QEBAXPEAX@Z
??ROGRSpatialReferenceReleaser@@QEBAXPEAVOGRSpatialReference@@@Z
??RVSIFreeReleaser@@QEBAXPEAX@Z
??_7OGRCoordinateTransformation@@6B@
??_FCPLErrorStateBackuper@@QEAAXXZ
??_FOGRSpatialReference@@QEAAXXZ
??_FOGR_SRSNode@@QEAAXXZ
?Contains@OGREnvelope3D@@QEBAHAEBV1@@Z
?Contains@OGREnvelope@@QEBAHAEBV1@@Z
?FindString@CPLStringList@@QEBAHPEBD@Z
?FromHandle@OGRCoordinateTransformation@@SAPEAV1@PEAX@Z
?FromHandle@OGRSpatialReference@@SAPEAV1@PEAX@Z
?GetAngularUnits@OGRSpatialReference@@QEBAN$$T@Z
?GetChildCount@OGR_SRSNode@@QEBAHXZ
?GetEmitErrors@OGRCoordinateTransformation@@UEBA_NXZ
?GetLinearUnits@OGRSpatialReference@@QEBAN$$T@Z
?GetPrimeMeridian@OGRSpatialReference@@QEBAN$$T@Z
?GetTargetLinearUnits@OGRSpatialReference@@QEBANPEBD$$T@Z
?GetValue@OGR_SRSNode@@QEBAPEBDXZ
?InsertString@CPLStringList@@QEAAAEAV1@HPEBD@Z
?Intersect@OGREnvelope3D@@QEAAXAEBV1@@Z
?Intersect@OGREnvelope@@QEAAXAEBV1@@Z
?Intersects@OGREnvelope3D@@QEBAHAEBV1@@Z
?Intersects@OGREnvelope@@QEBAHAEBV1@@Z
?Is3D@OGREnvelope3D@@QEBA_NXZ
?IsInit@OGREnvelope3D@@QEBAHXZ
?IsInit@OGREnvelope@@QEBAHXZ
?IsLeafNode@OGR_SRSNode@@QEBAHXZ
?IsSorted@CPLStringList@@QEBAHXZ
?List@CPLStringList@@QEAAPEAPEADXZ
?List@CPLStringList@@QEBAPEBQEBDXZ
?Merge@OGREnvelope3D@@QEAAXAEBV1@@Z
?Merge@OGREnvelope3D@@QEAAXAEBVOGREnvelope@@@Z
?Merge@OGREnvelope3D@@QEAAXNNN@Z
?Merge@OGREnvelope@@QEAAXAEBV1@@Z
?Merge@OGREnvelope@@QEAAXNN@Z
?PartialFindString@CPLStringList@@QEBAHPEBD@Z
?SetEmitErrors@OGRCoordinateTransformation@@UEAAX_N@Z
?ToHandle@OGRCoordinateTransformation@@SAPEAXPEAV1@@Z
?ToHandle@OGRSpatialReference@@SAPEAXPEAV1@@Z
?TransformBounds@OGRCoordinateTransformation@@UEAAHNNNNPEAN000H@Z
?back@CPLStringList@@QEBAPEBDXZ
?begin@CPLStringList@@QEBAPEBQEBDXZ
?begin@CSLIteratorWrapper@cpl@@QEBA?AUCSLIterator@2@XZ
?begin@CSLNameValueIteratorWrapper@cpl@@QEBA?AUCSLNameValueIterator@2@XZ
?clear@CPLStringList@@QEAAXXZ
?empty@CPLStringList@@QEBA_NXZ
?end@CPLStringList@@QEBAPEBQEBDXZ
?end@CSLIteratorWrapper@cpl@@QEBA?AUCSLIterator@2@XZ
?front@CPLStringList@@QEBAPEBDXZ
?get@?$unique_ptr@UCPLXMLNode@@UCPLXMLTreeCloserDeleter@@@std@@QEBAPEAUCPLXMLNode@@XZ
?get_deleter@?$unique_ptr@UCPLXMLNode@@UCPLXMLTreeCloserDeleter@@@std@@QEAAAEAUCPLXMLTreeCloserDeleter@@XZ
?get_deleter@?$unique_ptr@UCPLXMLNode@@UCPLXMLTreeCloserDeleter@@@std@@QEBAAEBUCPLXMLTreeCloserDeleter@@XZ
?release@?$unique_ptr@UCPLXMLNode@@UCPLXMLTreeCloserDeleter@@@std@@QEAAPEAUCPLXMLNode@@XZ
?reset@?$unique_ptr@UCPLXMLNode@@UCPLXMLTreeCloserDeleter@@@std@@QEAAXPEAUCPLXMLNode@@@Z
?size@CPLStringList@@QEBAHXZ
?swap@?$unique_ptr@UCPLXMLNode@@UCPLXMLTreeCloserDeleter@@@std@@QEAAXAEAV12@@Z

Sections

.text
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 720B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 116B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3d4a7022b164476bc26a3c6db1f2d430

Headers

DLL Characteristics

File Characteristics

Imports

gdal

msvcp140

kernel32

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

Exports

Exports

Sections

.text Size: 18KB - Virtual size: 17KB

.rdata Size: 18KB - Virtual size: 17KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 1KB - Virtual size: 1KB

.rsrc Size: 1024B - Virtual size: 720B

.reloc Size: 512B - Virtual size: 116B

.text
Size: 18KB - Virtual size: 17KB

.rdata
Size: 18KB - Virtual size: 17KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 1024B - Virtual size: 720B

.reloc
Size: 512B - Virtual size: 116B