8cc4063ecd6d595bf6895f4ad2e3dd395ebde34c4111892bb554ed0a70981885_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

8cc4063ecd6d595bf6895f4ad2e3dd395ebde34c4111892bb554ed0a70981885_NeikiAnalytics.exe
Size

2.8MB
MD5

d5ca3827ba37e315439134b9d39e4d80
SHA1

1aa68bb30964566f47c54e51d7cea59a78677c8c
SHA256

8cc4063ecd6d595bf6895f4ad2e3dd395ebde34c4111892bb554ed0a70981885
SHA512

9119a4b7eb8ad4991aca296ac514068f3c99e15fb56a6d761168f27ef77f7f01fba37503ded4f9a896cfe12b9ab7e60826b855e73935ff45079c5f8d295536b3
SSDEEP

49152:cta7Kn6p5c+ghaeWmNtBcgSYEN8AT0Ti9Ev7aP4vkMCV:p2nc5J1JmJcRYEN8AT0Ti9Ev+P4FCV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8cc4063ecd6d595bf6895f4ad2e3dd395ebde34c4111892bb554ed0a70981885_NeikiAnalytics.exe

Files

8cc4063ecd6d595bf6895f4ad2e3dd395ebde34c4111892bb554ed0a70981885_NeikiAnalytics.exe
.dll regsvr32 windows:6 windows x64 arch:x64

fcd2b3f3624f0995161dd2f96fc65a0f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\qb\workspace\26444\source\Build\mfts\x64\__bin\Release\mfx_mft_encrypt_64_full.pdb

Imports

mfplat

MFUnlockWorkQueue
MFAllocateSerialWorkQueue
MFCreateMediaType
MFCreateEventQueue
MFCreateMediaEvent
MFCreateAttributes
MFCreateDXGISurfaceBuffer
MFPutWorkItem
MFCreateDXGIDeviceManager
MFCreateTrackedSample
MFCreateDXSurfaceBuffer
MFTUnregister
MFTRegister

propsys

PSCreateMemoryPropertyStore
PropVariantCompareEx

d3d11

D3D11CreateDevice

api-ms-win-core-path-l1-1-0

PathCchRemoveFileSpec

kernel32

DecodePointer
GetLastError
InitializeCriticalSectionEx
DeleteCriticalSection
GetFileInformationByHandle
GetDriveTypeW
RtlUnwind
GetCommandLineW
GetLocalTime
GetModuleFileNameW
FormatMessageA
LoadLibraryExA
GetModuleHandleA
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
QueryPerformanceCounter
QueryPerformanceFrequency
SetFileTime
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
GetCurrentProcess
GetCurrentThreadId
K32GetProcessMemoryInfo
SetCurrentDirectoryW
GetCurrentDirectoryW
SetFilePointerEx
GetModuleFileNameA
SetConsoleCtrlHandler
VirtualFree
VirtualProtect
VirtualAlloc
GetSystemDirectoryA
FindFirstFileExW
IsValidCodePage
CloseHandle
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
SetEvent
ResetEvent
ReleaseSemaphore
ReleaseMutex
WaitForSingleObject
CreateMutexW
CreateEventW
CreateSemaphoreExW
WaitForMultipleObjects
GetProcessTimes
GetSystemInfo
LocalFree
GetACP
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
DeviceIoControl
CreateFileA
OutputDebugStringW
Sleep
MultiByteToWideChar
FindClose
FindFirstFileW
FindNextFileW
GetFileAttributesW
SetThreadErrorMode
FreeLibrary
GetModuleHandleExW
GetProcAddress
LoadLibraryExW
GetModuleHandleW
SwitchToThread
GetProcessHeap
SetStdHandle
VirtualQuery
GetFileSizeEx
WriteConsoleW
SetEndOfFile
GetFullPathNameW
HeapSize
ReadConsoleW
GetTimeZoneInformation
ReadFile
FormatMessageW
WideCharToMultiByte
GetStringTypeW
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
EncodePointer
GetCPInfo
CompareStringW
LCMapStringW
GetLocaleInfoW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedPushEntrySList
InterlockedFlushSList
CreateThread
ExitThread
ResumeThread
FreeLibraryAndExitThread
ExitProcess
GetCurrentThread
HeapAlloc
HeapFree
GetStdHandle
GetFileType
HeapReAlloc
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
WriteFile
GetConsoleCP
GetConsoleMode
CreateFileW

ole32

PropVariantClear
StringFromCLSID
CoCreateInstance
StringFromGUID2
CoTaskMemAlloc
CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
CoTaskMemFree

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

advapi32

RegGetValueW
RegQueryInfoKeyW
RegEnumValueW
ConvertStringSidToSidW
BuildTrusteeWithSidW
SetSecurityInfo
GetSecurityInfo
SetEntriesInAclW
RegDeleteValueW
RegDeleteTreeW
RegEnumKeyExW
EventUnregister
RegSetValueExW
RegDeleteKeyExW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
EventWrite
EventRegister

setupapi

CM_Open_DevNode_Key
CM_Get_Device_ID_List_SizeW
CM_Locate_DevNodeW
CM_Get_Device_ID_ListW

oleaut32

SysAllocString
VariantInit
VariantClear
SysStringByteLen
SysFreeString
SysAllocStringByteLen

dxgi

CreateDXGIFactory

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

TRSCODE
Size: 832KB - Virtual size: 832KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 495KB - Virtual size: 495KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 89KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fcd2b3f3624f0995161dd2f96fc65a0f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mfplat

propsys

d3d11

api-ms-win-core-path-l1-1-0

kernel32

ole32

version

advapi32

setupapi

oleaut32

dxgi

Exports

Exports

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

TRSCODE Size: 832KB - Virtual size: 832KB

.rdata Size: 495KB - Virtual size: 495KB

.data Size: 28KB - Virtual size: 101KB

.pdata Size: 89KB - Virtual size: 89KB

_RDATA Size: 512B - Virtual size: 256B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 11KB - Virtual size: 10KB

.text
Size: 1.3MB - Virtual size: 1.3MB

TRSCODE
Size: 832KB - Virtual size: 832KB

.rdata
Size: 495KB - Virtual size: 495KB

.data
Size: 28KB - Virtual size: 101KB

.pdata
Size: 89KB - Virtual size: 89KB

_RDATA
Size: 512B - Virtual size: 256B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 11KB - Virtual size: 10KB