1ce4ff525b3479d40426dd93a0441a65c0e3a722bae34d31d710a0bf91c2509b_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

1ce4ff525b3479d40426dd93a0441a65c0e3a722bae34d31d710a0bf91c2509b_NeikiAnalytics.exe
Size

340KB
MD5

c758d3678a714468e9467417e521a4a0
SHA1

9e4115875fc82f9081deabedad4ad8ad42387e01
SHA256

1ce4ff525b3479d40426dd93a0441a65c0e3a722bae34d31d710a0bf91c2509b
SHA512

e6ca84cc85d5360e412c1e97f22cbb8215e711b663fb772966960386b2ea548f383ede5a54000ab731aa17d9dcf9473dbf75d257455fe48aa7901611bf9cd7dd
SSDEEP

6144:fdujigXkO1ohapdsAgnzgBECzUJaPysAAmsUkyIibNyL9tOSwkLd:fAjigXkwohydZgkBlz3jSUL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1ce4ff525b3479d40426dd93a0441a65c0e3a722bae34d31d710a0bf91c2509b_NeikiAnalytics.exe

Files

1ce4ff525b3479d40426dd93a0441a65c0e3a722bae34d31d710a0bf91c2509b_NeikiAnalytics.exe
.dll regsvr32 windows:10 windows x64 arch:x64

ba48c592b7724f8a6bb24c5fb354d026

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

TpmTasks.pdb

Imports

msvcp_win

?_Xlength_error@std@@YAXPEBD@Z
_Xtime_get_ticks
?_Xout_of_range@std@@YAXPEBD@Z

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e

api-ms-win-crt-private-l1-1-0

_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__wcsdup
_o__wcsicmp
_o__wcsnicmp
_o__wcsupr
_o__wfopen_s
memmove
_o_fclose
_o_fflush
_o_free
_o_malloc
_o_terminate
_o_wcscat_s
_o_wcscpy_s
__C_specific_handler
__current_exception
__current_exception_context
_CxxThrowException
__CxxFrameHandler3
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o__execute_onexit_table
_o__errno
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
_o___stdio_common_vfwprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
wcsstr
wcsrchr
wcschr
_o___acrt_iob_func
__std_terminate
__CxxFrameHandler4
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

wcscmp
memset
wcsncmp

ntdll

RtlNtStatusToDosError
RtlCaptureContext
NtQueryWnfStateData
RtlGetPersistedStateLocation
RtlLookupFunctionEntry
RtlPublishWnfStateData
NtQuerySystemInformation
RtlInitUnicodeString
NtSetSystemEnvironmentValueEx
RtlCheckPortableOperatingSystem
NtDeviceIoControlFile
NtClose
NtCreateEvent
ZwQueryWnfStateData
RtlComputeCrc32
NtCreateFile
NtWaitForSingleObject
RtlReleasePrivilege
RtlAcquirePrivilege
NtWriteFile
NtQueryInformationProcess
NtOpenProcess
NtReadFile
NtSetInformationThread
RtlImageNtHeader
NtQueryInformationFile
NtQueryInformationThread
NtOpenFile
RtlFreeUnicodeString
NtSetInformationFile
RtlStringFromGUID
RtlFreeHeap
LdrFindResource_U
LdrAccessResource
RtlAllocateHeap
RtlVirtualUnwind
NtQuerySystemEnvironmentValueEx

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetModuleHandleW
GetModuleFileNameA
GetProcAddress
FindResourceExW
DisableThreadLibraryCalls
LoadLibraryExW
FreeLibraryAndExitThread
GetModuleHandleExW
LoadResource

oleaut32

VariantClear
SysAllocString
SysFreeString
VariantInit

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceComplete
InitOnceBeginInitialize

api-ms-win-core-file-l1-1-0

GetLongPathNameW
SetFileInformationByHandle
FlushFileBuffers
DeleteFileW
CreateFileW
CreateDirectoryW
FindClose
GetFileSizeEx
ReadFile
FindNextFileW
GetFileInformationByHandle
FindFirstFileW
SetFileAttributesW
GetFullPathNameW
GetVolumeInformationW
QueryDosDeviceW
WriteFile
GetFileAttributesW
GetVolumePathNameW

api-ms-win-core-synch-l1-1-0

CreateMutexW
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
ReleaseSRWLockShared
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
ReleaseMutex
WaitForSingleObject
InitializeCriticalSectionEx
LeaveCriticalSection
TryAcquireSRWLockExclusive
ReleaseSemaphore
EnterCriticalSection
CreateSemaphoreExW
OpenMutexW

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
SetLastError
UnhandledExceptionFilter

api-ms-win-core-com-l1-1-0

CoInitializeSecurity
CoInitializeEx
CoCreateInstance
CoUninitialize
CoSetProxyBlanket

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventWriteTransfer
EventSetInformation
EventUnregister

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegQueryValueExW
RegSetValueExW
RegGetValueW

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer

api-ms-win-core-processthreads-l1-1-0

ResumeThread
CreateThread
GetCurrentProcessId
GetCurrentThread
OpenProcessToken
OpenThreadToken
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
SetThreadToken

api-ms-win-core-localization-l1-2-0

GetLocaleInfoEx
FormatMessageW
LocaleNameToLCID
GetLocaleInfoW

ncrypt

NCryptGetProperty
NCryptFreeObject
NCryptCreateClaim
NCryptOpenStorageProvider

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-sysinfo-l1-1-0

GetWindowsDirectoryW
GetSystemInfo
GetSystemTimeAsFileTime
GetSystemDirectoryW
GetVersionExW

api-ms-win-core-registry-l1-1-1

RegDeleteKeyValueW
RegSetKeyValueW

crypt32

CertGetNameStringW
CertCreateCertificateContext
CryptMsgClose
CertFreeCertificateContext
CertGetCertificateContextProperty
CryptQueryObject
CertCloseStore
CryptMsgGetParam
CertFindCertificateInStore

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

tpmcoreprovisioning

TpmGetOrderlyShutdownInfo
TpmGatherTpmData
TpmIsReadyInformation
TpmRemoveRegisteredWindowsAIK
TpmVerifyDeviceHealth
TpmRetrieveHealthCertOrReschedule
TpmEKCertValidateAndCleanup
TpmGetTpmVersion
TpmEnrollWindowsAikCertificate
TpmGetNumberOfEkCertsInNV
TpmEnableAutoProvisioning
TpmGet_ManufacturerVersion
TpmCertInstallNvEkCerts
TpmCertGetWindowsAik
TpmGetCapLockoutInfo
TpmCertSetPreferredMaximumProtocolVersion
TpmSetToLegacyDictionaryAttackParameters
TpmCheckCreateWindowsAIK
TpmGet_IsTpmVersion20
TpmIsOwned
TpmCertDeleteHealthCert
TpmGetInstalledEkCertificateCount
TpmGet_ManufacturerId
TpmPrepForNgc
TpmRetrieveEkCertOrReschedule
TpmGet_IsTpmPresent
TpmCertSetEkAttestationOverride
TpmIsUseLegacyDictionaryAttackParametersPolicySet
TpmProvision

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrStrIW
StrCmpIW

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-security-base-l1-1-0

AdjustTokenPrivileges
GetTokenInformation
GetSecurityDescriptorSacl
GetSecurityDescriptorOwner
GetSecurityDescriptorControl
GetSecurityDescriptorGroup
GetSecurityDescriptorDacl
DuplicateTokenEx

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW

api-ms-win-core-firmware-l1-1-0

GetFirmwareEnvironmentVariableW
SetFirmwareEnvironmentVariableExW

api-ms-win-core-rtlsupport-l1-1-0

RtlCompareMemory

rpcrt4

UuidCreate

wintrust

WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
WinVerifyTrust

imagehlp

CheckSumMappedFile

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-file-l1-2-0

GetVolumeNameForVolumeMountPointW

api-ms-win-core-file-l2-1-0

CopyFileExW
GetFileInformationByHandleEx
MoveFileExW

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-memory-l1-1-0

CreateFileMappingW
UnmapViewOfFile
MapViewOfFile

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-processenvironment-l1-1-0

SearchPathW

api-ms-win-core-localization-l1-2-2

LCIDToLocaleName

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

kernel32

GetUserDefaultUILanguage
GetPrivateProfileSectionW
GetSystemDefaultUILanguage

shlwapi

PathRemoveBackslashW

advapi32

SetNamedSecurityInfoW

bcd

BcdCopyObjects
BcdCreateStore
BcdOpenStoreFromFile
BcdCloseObject
SyspartIsSpace
BcdDeleteObject
BcdCloseStore
BcdFlushStore
BcdSetElementData
BcdDeleteElement
BcdGetElementData
SyspartGetSystemPartition
BcdQueryObject
BcdForciblyUnloadStore
BcdSetElementDataWithFlags
SyspartGetPhysicalPartitions
BcdOpenStore
BcdOpenObject
BcdSetLogging
BcdCopyObjectEx
BcdMarkAsSystemStore
BcdGetSystemStorePath
BcdEnumerateObjects

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 196KB - Virtual size: 192KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 112KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 572B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ba48c592b7724f8a6bb24c5fb354d026

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcp_win

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-string-l1-1-0

ntdll

api-ms-win-core-libraryloader-l1-2-0

oleaut32

api-ms-win-core-synch-l1-2-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

ncrypt

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-registry-l1-1-1

crypt32

api-ms-win-core-heap-l2-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-interlocked-l1-1-0

tpmcoreprovisioning

api-ms-win-core-shlwapi-obsolete-l1-1-0

api-ms-win-core-file-l2-1-2

api-ms-win-security-base-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-core-firmware-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

rpcrt4

wintrust

imagehlp

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-file-l1-2-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-localization-l1-2-2

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

kernel32

shlwapi

advapi32

bcd

Exports

Exports

Sections

.text Size: 196KB - Virtual size: 192KB

.rdata Size: 112KB - Virtual size: 109KB

.data Size: 4KB - Virtual size: 5KB

.pdata Size: 12KB - Virtual size: 8KB

.didat Size: 4KB - Virtual size: 112B

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 572B

.text
Size: 196KB - Virtual size: 192KB

.rdata
Size: 112KB - Virtual size: 109KB

.data
Size: 4KB - Virtual size: 5KB

.pdata
Size: 12KB - Virtual size: 8KB

.didat
Size: 4KB - Virtual size: 112B

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 572B