886c73f201939d5fdae3d3ea5f557ca17c72c48d1f3bfabc7fe54761d80d0dfe_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

886c73f201939d5fdae3d3ea5f557ca17c72c48d1f3bfabc7fe54761d80d0dfe_NeikiAnalytics.exe
Size

74KB
MD5

f5308d61d1436d274f0def7041bc7170
SHA1

4cfd435786e85760866c50987d825523dbbb2e2d
SHA256

886c73f201939d5fdae3d3ea5f557ca17c72c48d1f3bfabc7fe54761d80d0dfe
SHA512

b94e61e49f01f95f82542eb618b2e13a23470a2e28d3967160f313da286ad6e1e31c81997f0908193ca1f9afc6a3a872edcc47d398f782642adfa59505cc3219
SSDEEP

1536:vfAxk/w/jG4MoAIOdVEtNDibG/SPBeaf7LR19WsEOXxaDOo5OrX:iDibG/SpeMosEOXxaDOowrX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
886c73f201939d5fdae3d3ea5f557ca17c72c48d1f3bfabc7fe54761d80d0dfe_NeikiAnalytics.exe

Files

886c73f201939d5fdae3d3ea5f557ca17c72c48d1f3bfabc7fe54761d80d0dfe_NeikiAnalytics.exe
.exe windows:5 windows x86 arch:x86

1284f16416de48c39572d881c288f50f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\factory\CPP\apptest\bin\Release\apptest.pdb

Imports

srvcore

SRV_GetErrorMessage
SRV_GetErrorSpecific
SRV_GetError
SRV_SetException
SRV_CloseHandle

dttmrtl

ord29
ord5

crmrtl

CrmGetReply
MT_CrmBeginApp
MT_CrmBeginTask
MT_CrmBeginReq
CrmGetRequest
CrmProcess
CrmPerform
CrmLogMessage

logical

LogicalEvaluate

srvrtl

SrvDestroyBuffer
MT_SrvSelectMessage
MT_SrvCreateRequestType
SrvReCreateInstance
MT_SrvCreateInputBuffer
SrvReadInstance
SrvCopy
SrvFirstField
SrvGetType
SrvGetStringLen
SrvSetString
SrvGetStringPtr
SrvSetLong
SrvGetLong
SrvSetDouble
SrvGetDouble
SrvSetFloat
SrvGetFloat
SrvSetULong
SrvGetULong
SrvSetShort
SrvGetShort
SrvSetDate
SrvGetDate
SrvGetItemCount
SrvAddItem
SrvGetItem
SrvGetStruct
SrvGetPointer
SrvNextField
MT_SrvCreateOutputBuffer
SrvWriteInstance
SrvGetBufferSize
SrvGetBufferPtr

kernel32

IsProcessorFeaturePresent
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
HeapSetInformation
InterlockedCompareExchange
InterlockedExchange
DecodePointer
EncodePointer
GetComputerNameA
GetProcAddress
LoadLibraryA
Sleep
InterlockedIncrement
InterlockedDecrement

msvcp100

?_Xlength_error@std@@YAXPBD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
?_Xout_of_range@std@@YAXPBD@Z
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAJ@Z
?ignore@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@M@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@F@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z

msvcr100

_onexit
_amsg_exit
_controlfp_s
_invoke_watson
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
_crt_debugger_hook
__set_app_type
_fmode
_commode
__setusermatherr
_configthreadlocale
_initterm_e
__getmainargs
_cexit
_exit
_XcptFilter
__initenv
_initterm
strlen
??3@YAXPAX@Z
??2@YAPAXI@Z
__CxxFrameHandler3
_purecall
_fstat64i32
strcmp
fgets
__iob_func
fclose
fwrite
fopen
_snprintf
??_V@YAXPAX@Z
fread
strncat
strchr
memchr
strcpy
strncpy
memset
isupper
memcpy
atoi
atol
atof
memcmp
sprintf
abort
setlocale
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
_fileno
exit
_cputs
_getch
toupper
printf
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
puts
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
memmove
_unlock
__dllonexit
_lock
_isatty

srvdata

MT_SRV_CreateStruct

srvinterface

SRV_QueryInterface

srvframe

MT_SRV_LookupInterface
MT_SRV_CreateInterfaceProxy
SRV_QueryInterfaceProxy
SRV_ResolveInterfaceDirectory
SRV_Invoke
SRV_InvokeEx
MT_SRV_OpenInterfaceDirectory

secrtl

SecGetDomainName
SecLoginExt
SecChangePassword
SecLogout
SecRegAuthentCallback
SecLogin

Sections

.text
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1284f16416de48c39572d881c288f50f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

srvcore

dttmrtl

crmrtl

logical

srvrtl

kernel32

msvcp100

msvcr100

srvdata

srvinterface

srvframe

secrtl

Sections

.text Size: 40KB - Virtual size: 40KB

.rdata Size: 18KB - Virtual size: 17KB

.data Size: 1024B - Virtual size: 1KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 13KB - Virtual size: 13KB

.text
Size: 40KB - Virtual size: 40KB

.rdata
Size: 18KB - Virtual size: 17KB

.data
Size: 1024B - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 13KB - Virtual size: 13KB