81499f3733411fe3214586b9c9df03542c4002daa5b07237848f116412bed0e2_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

81499f3733411fe3214586b9c9df03542c4002daa5b07237848f116412bed0e2_NeikiAnalytics.exe
Size

314KB
MD5

446b8f9391af30e35bc6f9f9703185e0
SHA1

fc38411708ea1b9a245fd2af83bffd85266bbd24
SHA256

81499f3733411fe3214586b9c9df03542c4002daa5b07237848f116412bed0e2
SHA512

10b966d71d42f07cf510710587483a8b2ffe505ed386b4272bf787221cc3d2e44301ed8d5b1d20dc50422c1d57a90ffca97b2a4b6329455823fc0bd923a0b142
SSDEEP

6144:ZIdlzuENW3yoM3VzOzXzDPbvDjUr7EibEhY2cgY86VGjyErwFeCua:ydlzuENqyoM3VzUDDzvfIoibEDY81sQa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
81499f3733411fe3214586b9c9df03542c4002daa5b07237848f116412bed0e2_NeikiAnalytics.exe

Files

81499f3733411fe3214586b9c9df03542c4002daa5b07237848f116412bed0e2_NeikiAnalytics.exe
.dll windows:6 windows x86 arch:x86

1b3757bbb2105e81ab6b0836e34be493

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\Project\Software\Mobile\00.tags\79.iOSAssistant-3.2\build\Win32\Release\Model.iCloud.pdb

Imports

libbasic

?PushJsonArrayIntValue@AssJsonUtil@@SAXAAV?$GenericValue@U?$UTF8@D@rapidjson@@V?$MemoryPoolAllocator@VCrtAllocator@rapidjson@@@2@@rapidjson@@AAV?$MemoryPoolAllocator@VCrtAllocator@rapidjson@@@3@H@Z
?AddJsonDictIntValue@AssJsonUtil@@SAXAAV?$GenericValue@U?$UTF8@D@rapidjson@@V?$MemoryPoolAllocator@VCrtAllocator@rapidjson@@@2@@rapidjson@@AAV?$MemoryPoolAllocator@VCrtAllocator@rapidjson@@@3@PBDH@Z
?AddJsonDictStringValue@AssJsonUtil@@SAXAAV?$GenericValue@U?$UTF8@D@rapidjson@@V?$MemoryPoolAllocator@VCrtAllocator@rapidjson@@@2@@rapidjson@@AAV?$MemoryPoolAllocator@VCrtAllocator@rapidjson@@@3@PBD2@Z
?GetFilePathNewName@BASUtilityFile@@SAPA_WPB_W@Z
?Free@BASUtilityString@@SAXPAX@Z
?FindTask@DhTaskSchedular@@QAE?AV?$shared_ptr@VDhTask@@@std@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@3@@Z
?Get@DhTaskSchedular@@SAPAV1@XZ
?NotifySchedular@DhTask@@QAEXAAV?$shared_ptr@VDhTask@@@std@@W4DhTaskStatus1@@@Z
?GetDllModuleDir@BASUtilityApp@@SAPA_WPAUHINSTANCE__@@@Z
?UnicodeToAnsi@BASUtilityString@@SAPADPB_W@Z
?AddJsonDictBooleanValue@AssJsonUtil@@SAXAAV?$GenericValue@U?$UTF8@D@rapidjson@@V?$MemoryPoolAllocator@VCrtAllocator@rapidjson@@@2@@rapidjson@@AAV?$MemoryPoolAllocator@VCrtAllocator@rapidjson@@@3@PBD_N@Z
?PushJsonArrayStringValue@AssJsonUtil@@SAXAAV?$GenericValue@U?$UTF8@D@rapidjson@@V?$MemoryPoolAllocator@VCrtAllocator@rapidjson@@@2@@rapidjson@@AAV?$MemoryPoolAllocator@VCrtAllocator@rapidjson@@@3@PBD@Z
?AddJsonDictObjectValue@AssJsonUtil@@SAXAAV?$GenericValue@U?$UTF8@D@rapidjson@@V?$MemoryPoolAllocator@VCrtAllocator@rapidjson@@@2@@rapidjson@@AAV?$MemoryPoolAllocator@VCrtAllocator@rapidjson@@@3@PBD0@Z
?PushJsonArrayObjectValue@AssJsonUtil@@SAXAAV?$GenericValue@U?$UTF8@D@rapidjson@@V?$MemoryPoolAllocator@VCrtAllocator@rapidjson@@@2@@rapidjson@@AAV?$MemoryPoolAllocator@VCrtAllocator@rapidjson@@@3@0@Z
?AddJsonDictInt64Value@AssJsonUtil@@SAXAAV?$GenericValue@U?$UTF8@D@rapidjson@@V?$MemoryPoolAllocator@VCrtAllocator@rapidjson@@@2@@rapidjson@@AAV?$MemoryPoolAllocator@VCrtAllocator@rapidjson@@@3@PBD_J@Z
?AddJsonDictDoubleValue@AssJsonUtil@@SAXAAV?$GenericValue@U?$UTF8@D@rapidjson@@V?$MemoryPoolAllocator@VCrtAllocator@rapidjson@@@2@@rapidjson@@AAV?$MemoryPoolAllocator@VCrtAllocator@rapidjson@@@3@PBDN@Z
?GZDecompress@BASUtilityUnzip@@SAHPAEI0PAI@Z
?ToString@AssJsonUtil@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$GenericValue@U?$UTF8@D@rapidjson@@V?$MemoryPoolAllocator@VCrtAllocator@rapidjson@@@2@@rapidjson@@@Z
?GetProductBinDir@BASUtilityApp@@SAPA_WXZ

libglog

??1LogMessage@google@@QAE@XZ
??0LogMessage@google@@QAE@PBDHH@Z
?stream@LogMessage@google@@QAEAAV?$basic_ostream@DU?$char_traits@D@std@@@std@@XZ
??0LogMessage@google@@QAE@PBDH@Z

helper.idevice

?ConvertUtcToLocalDate@Utils@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_J@Z
?Base64Decode@Utils@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PBDI@Z
?ColorHexToRGB@Utils@@SA?AV?$tuple@HHH@std@@PBD@Z
?MonthRange@Utils@@SA?AU?$pair@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@_J@Z
?WriteMemoryToFile@Utils@@SA_NPBD_KPB_W@Z
?ReadFileInMemory@Utils@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PB_W@Z
?GetTempDir@Utils@@SA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?GenerateLowerUuid@Utils@@SA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?ConvertUnicodeToUtf8@Utils@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PB_W@Z
?MkDir@Utils@@SAHPB_W@Z
?IsFileExist@Utils@@SA_NPB_W@Z
?GetParentDir@Utils@@SA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PB_W@Z
?ConvertUtf8ToUnicode@Utils@@SA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PBD@Z

libcurl

curl_easy_setopt
curl_slist_append
curl_easy_perform
curl_easy_getinfo
curl_slist_free_all
curl_free
curl_easy_cleanup
curl_escape
curl_easy_init

icuin51

?getID@TimeZone@icu_51@@QBEAAVUnicodeString@2@AAV32@@Z
?createDefault@TimeZone@icu_51@@SAPAV12@XZ

icuuc51

??3UMemory@icu_51@@SAXPAX@Z
??1UnicodeString@icu_51@@UAE@XZ
??1ByteSink@icu_51@@UAE@XZ
?toUTF8@UnicodeString@icu_51@@QBEXAAVByteSink@2@@Z
?GetAppendBuffer@ByteSink@icu_51@@UAEPADHHPADHPAH@Z
?Flush@ByteSink@icu_51@@UAEXXZ
??0UnicodeString@icu_51@@QAE@XZ

kernel32

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetProcAddress
GetModuleHandleW
CreateEventW
GetCurrentProcess
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
CloseHandle
InitializeCriticalSection
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
LocalAlloc
WaitForSingleObjectEx
Sleep
TlsFree
TlsAlloc
LocalFree
TlsGetValue
TlsSetValue
DeleteFileW

msvcp140

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z
??Bid@locale@std@@QAEIXZ
?always_noconv@codecvt_base@std@@QBE_NXZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Xbad_alloc@std@@YAXXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Xlength_error@std@@YAXPBD@Z
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Xout_of_range@std@@YAXPBD@Z
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?uncaught_exception@std@@YA_NXZ
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z

vcruntime140

__CxxFrameHandler3
__std_terminate
__std_exception_copy
__std_exception_destroy
longjmp
strchr
__std_type_info_compare
_purecall
memcpy
memmove
memset
_CxxThrowException
_except_handler4_common
__std_type_info_destroy_list
memchr
_setjmp3

api-ms-win-crt-runtime-l1-1-0

_seh_filter_dll
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_cexit
_initterm
_crt_atexit
_initterm_e
_invalid_parameter_noinfo_noreturn

api-ms-win-crt-heap-l1-1-0

_callnewh
malloc
free

api-ms-win-crt-stdio-l1-1-0

fclose
__stdio_common_vsprintf
setvbuf
__stdio_common_vfprintf
__acrt_iob_func
fgetc
fputc
ungetc
fread
fflush
fwrite
fsetpos
_fseeki64
fgetpos
_get_stream_buffer_pointers

api-ms-win-crt-filesystem-l1-1-0

_lock_file
_unlock_file

api-ms-win-crt-string-l1-1-0

tolower
isalnum

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-math-l1-1-0

_except1

Exports

Exports

RegisterModule

Sections

.text
Size: 234KB - Virtual size: 233KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1b3757bbb2105e81ab6b0836e34be493

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

libbasic

libglog

helper.idevice

libcurl

icuin51

icuuc51

kernel32

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

Exports

Exports

Sections

.text Size: 234KB - Virtual size: 233KB

.rdata Size: 58KB - Virtual size: 58KB

.data Size: 4KB - Virtual size: 5KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 14KB - Virtual size: 14KB

.text
Size: 234KB - Virtual size: 233KB

.rdata
Size: 58KB - Virtual size: 58KB

.data
Size: 4KB - Virtual size: 5KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 14KB - Virtual size: 14KB