7c32faa2434db4504a28c1e7bc808c1f746f09150e3e94d7ead8e3a622f58131_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

7c32faa2434db4504a28c1e7bc808c1f746f09150e3e94d7ead8e3a622f58131_NeikiAnalytics.exe
Size

230KB
MD5

3b125fd6e490f51650ece4551fbd1930
SHA1

f4db1d53a88e629dbf3ddc891b43a21f2fb2e5d8
SHA256

7c32faa2434db4504a28c1e7bc808c1f746f09150e3e94d7ead8e3a622f58131
SHA512

3a2d38cc8f37251f3f99a90cdf7f34b7da4f35591a93a5430b8f57410bd711b4deed50ad7a0483aae42199ab465c05fc32f025a7793f77bec022595617cef1c5
SSDEEP

6144:i1mQYnClWX86AG41grlWUOyJscEl8JVUx:i1mQYnB6OJscEl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7c32faa2434db4504a28c1e7bc808c1f746f09150e3e94d7ead8e3a622f58131_NeikiAnalytics.exe

Files

7c32faa2434db4504a28c1e7bc808c1f746f09150e3e94d7ead8e3a622f58131_NeikiAnalytics.exe
.dll windows:6 windows x64 arch:x64

12b1578f0c4975e1f9a37fffd517ccb0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\agent\_work\3\b\build\integrations\automate\TopazGigapixelAIApply.pdb

Imports

shlwapi

PathAppendA

kernel32

FindClose
FindFirstFileA
FindNextFileA
RemoveDirectoryA
CloseHandle
DuplicateHandle
GetLastError
QueryPerformanceCounter
QueryPerformanceFrequency
ReleaseSemaphore
ReleaseMutex
WaitForSingleObject
CreateMutexA
Sleep
GetProcessTimes
GetCurrentProcess
GetCurrentProcessId
SwitchToThread
GetCurrentThreadId
GetTickCount
MapViewOfFileEx
UnmapViewOfFile
GetModuleHandleA
GetProcAddress
LocalFree
FormatMessageA
CreateSemaphoreA
CreateFileMappingA
OutputDebugStringA
SetLastError
GetModuleFileNameW
GetModuleHandleExW
CreateFileA
CreateActCtxW
ActivateActCtx
DeactivateActCtx
FindActCtxSectionStringW
QueryActCtxW
RtlCaptureContext
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
RtlLookupFunctionEntry
RtlVirtualUnwind
WideCharToMultiByte
CreateWaitableTimerA
FormatMessageW
GetLogicalProcessorInformation
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
ResumeThread
SetWaitableTimer
OpenEventA
CreateEventA
WaitForMultipleObjectsEx
WaitForSingleObjectEx
ResetEvent
SetEvent
GetProcessHeap
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
TerminateProcess
CreateDirectoryA
GetVersionExA
GetSystemInfo
DeleteCriticalSection
LoadLibraryW
CreateEventW
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
InitializeSListHead

user32

GetParent
SendDlgItemMessageA
LoadStringA
ShowWindow
SetWindowPos
GetDesktopWindow
DialogBoxParamA
EndDialog
GetDlgItem
SetDlgItemInt
SetDlgItemTextA
GetDlgItemTextA
GetWindowLongA
IsDlgButtonChecked
CheckDlgButton
SetFocus
EnableWindow
GetSystemMetrics
GetClientRect
GetWindowRect
MessageBoxA
MessageBeep
ClientToScreen

shell32

SHGetFolderPathA

advapi32

RegOpenKeyExA
RegCloseKey
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegQueryValueExA

msvcp140

?uncaught_exceptions@std@@YAHXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@O@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
_Xtime_get_ticks
?_W_Getmonths@_Locinfo@std@@QEBAPEBGXZ
?_W_Getdays@_Locinfo@std@@QEBAPEBGXZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
_Mbrtowc
?_Xbad_alloc@std@@YAXXZ
_Mtx_init_in_situ
_Mtx_destroy_in_situ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Xlength_error@std@@YAXPEBD@Z

vcruntime140

__current_exception_context
_purecall
__C_specific_handler
memmove
__current_exception
__std_type_info_destroy_list
memcpy
__std_terminate
strrchr
__std_exception_copy
__std_exception_destroy
_CxxThrowException
memset
__std_type_info_name
memcmp

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-heap-l1-1-0

calloc
free
malloc
_callnewh

api-ms-win-crt-runtime-l1-1-0

_crt_at_quick_exit
_initterm
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_invalid_parameter_noinfo_noreturn
terminate
_beginthreadex
strerror
_cexit
_crt_atexit

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf
__stdio_common_vfprintf
fopen
fclose

api-ms-win-crt-time-l1-1-0

strftime
_localtime64

api-ms-win-crt-convert-l1-1-0

_itoa
_ltoa
atol

api-ms-win-crt-string-l1-1-0

strncpy
strcpy_s
strncmp

Exports

Exports

PluginMain

Sections

.text
Size: 159KB - Virtual size: 158KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 708B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

12b1578f0c4975e1f9a37fffd517ccb0

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shlwapi

kernel32

user32

shell32

advapi32

msvcp140

vcruntime140

vcruntime140_1

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

Exports

Exports

Sections

.text Size: 159KB - Virtual size: 158KB

.rdata Size: 50KB - Virtual size: 49KB

.data Size: 4KB - Virtual size: 6KB

.pdata Size: 12KB - Virtual size: 12KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 708B

.text
Size: 159KB - Virtual size: 158KB

.rdata
Size: 50KB - Virtual size: 49KB

.data
Size: 4KB - Virtual size: 6KB

.pdata
Size: 12KB - Virtual size: 12KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 708B