991839ef15921d97cf7b47d13a69112366d6ba8dcda4a49e1a83ccac3564a16d_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

991839ef15921d97cf7b47d13a69112366d6ba8dcda4a49e1a83ccac3564a16d_NeikiAnalytics.exe
Size

181KB
MD5

31f043854e7bea54662438e13ba65d70
SHA1

3b7d3e557ec8a35216ffe82bb9564a4c87310c57
SHA256

991839ef15921d97cf7b47d13a69112366d6ba8dcda4a49e1a83ccac3564a16d
SHA512

7eccb766a1b307e1997a48b1d021b992abb41b473277382e3ea90d36208edc97be7d60e479c58f35a95953ad0c73dad1226b3143d152b5ad8f3a610735bce138
SSDEEP

3072:Mzo2g/kceUl3Cie8xWqEUszRCtM+DUJUj7j7h+tTBfdRjn/J4sD9cT:MzBg/pD5szstM+DdPOTB1Rjnx4spO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
991839ef15921d97cf7b47d13a69112366d6ba8dcda4a49e1a83ccac3564a16d_NeikiAnalytics.exe

Files

991839ef15921d97cf7b47d13a69112366d6ba8dcda4a49e1a83ccac3564a16d_NeikiAnalytics.exe
.dll windows:4 windows x64 arch:x64

355293c917a80f86c1ec9d25889dfa7a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
CreateFileA
CreateFileW
DeleteCriticalSection
EnterCriticalSection
FlushFileBuffers
GetFileSize
GetLastError
GetStdHandle
GetSystemInfo
InitializeCriticalSection
IsProcessorFeaturePresent
LeaveCriticalSection
PeekConsoleInputA
ReadConsoleInputA
ReadFile
SetFilePointer
Sleep
TlsGetValue
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForSingleObject
WriteFile

msvcrt

__iob_func
_amsg_exit
_errno
_filelengthi64
_fileno
_fstat64
_get_osfhandle
_initterm
_lock
_lseeki64
_stat64
_time64
_unlock
_vscprintf
_vsnprintf
_wopen
abort
calloc
fclose
feof
ferror
fflush
fgetc
fgetpos
fgets
fopen
fprintf
fputc
fread
free
fseek
fsetpos
ftell
fwrite
getenv
islower
isspace
isupper
malloc
memchr
memcmp
memcpy
memmove
memset
qsort_s
rand
realloc
rewind
srand
sscanf
strchr
strcmp
strerror
strlen
strncmp
strncpy
strrchr
strtoul
tolower
toupper
vfprintf
wcstombs
_write
_unlink
_umask
_read
_putenv
_open
_lseek
_fdopen
_close
_access

ws2_32

select

Exports

Exports

ARMT_Convert
ARM_Convert
AlignOffsetAlloc_CreateVTable
BigAlloc
BigFree
BraState_SetFromMethod
CPU_IsSupported_AES
CPU_IsSupported_AVX2
CPU_IsSupported_PageGB
CPU_IsSupported_SHA
CPU_IsSupported_SSE41
CPU_IsSupported_SSSE3
CPU_IsSupported_VAES_AVX2
CPU_Is_InOrder
Crc64Calc
Crc64GenerateTable
Crc64Update
CrcCalc
CrcGenerateTable
CrcUpdate
CrcUpdateT1
CrcUpdateT4
CrcUpdateT8
Delta_Decode
Delta_Encode
Delta_Init
FileInStream_CreateVTable
FileOutStream_CreateVTable
FileSeqInStream_CreateVTable
File_Close
File_Construct
File_GetLength
File_Read
File_Seek
File_Write
IA64_Convert
InFile_Open
InFile_OpenW
LookInStream_LookRead
LookInStream_Read
LookInStream_Read2
LookInStream_SeekTo
LookToRead2_CreateVTable
Lzma2Dec_Allocate
Lzma2Dec_AllocateProbs
Lzma2Dec_DecodeToBuf
Lzma2Dec_DecodeToDic
Lzma2Dec_Init
Lzma2Dec_Parse
Lzma2Decode
LzmaDec_Allocate
LzmaDec_AllocateProbs
LzmaDec_DecodeToBuf
LzmaDec_DecodeToDic
LzmaDec_Free
LzmaDec_FreeProbs
LzmaDec_Init
LzmaDec_InitDicAndState
LzmaDecode
LzmaProps_Decode
MidAlloc
MidFree
MyAlloc
MyCPUID
MyFree
OutFile_Open
OutFile_OpenW
PPC_Convert
SHA256_K_ARRAY
SPARC_Convert
SecToLook_CreateVTable
SecToRead_CreateVTable
SeqInStream_Read
SeqInStream_Read2
SeqInStream_ReadByte
SetLargePageSize
Sha256Prepare
Sha256_Final
Sha256_Init
Sha256_InitState
Sha256_SetFunction
Sha256_Update
Sha256_UpdateBlocks
Sha256_UpdateBlocks_HW
XZ_SIG
XzBlock_Parse
XzBlock_ReadHeader
XzCheck_Final
XzCheck_Init
XzCheck_Update
XzCrc64UpdateT4
XzDecMtProps_Init
XzDecMt_Create
XzDecMt_Decode
XzDecMt_Destroy
XzFlags_GetCheckSize
XzStatInfo_Clear
XzUnpacker_Code
XzUnpacker_CodeFull
XzUnpacker_Construct
XzUnpacker_Free
XzUnpacker_GetExtraSize
XzUnpacker_Init
XzUnpacker_IsBlockFinished
XzUnpacker_IsStreamWasFinished
XzUnpacker_PrepareToRandomBlockDecoding
XzUnpacker_SetOutBuf
Xz_Construct
Xz_Free
Xz_GetPackSize
Xz_GetUnpackSize
Xz_ParseHeader
Xz_ReadHeader
Xz_ReadVarInt
Xz_WriteVarInt
Xzs_Construct
Xzs_Free
Xzs_GetNumBlocks
Xzs_GetUnpackSize
Xzs_ReadBackward
_dist_code
_length_code
_tr_align
_tr_flush_bits
_tr_flush_block
_tr_init
_tr_stored_block
_tr_tally
ab64_to_int
adler32
adler32_combine
adler32_combine64
adler32_z
base32_decode
base32_encode
base32_to_int
base64_decode
base64_encode
base64_to_int
base64url_to_int
bf64_to_int
byte_swap_16
byte_swap_32
byte_swap_64
call_zopen64
call_zseek64
call_ztell64
count_char
count_lines
crc32
crc32_combine
crc32_combine64
crc32_z
deflate
deflateBound
deflateCopy
deflateEnd
deflateGetDictionary
deflateInit2_
deflateInit_
deflateParams
deflatePending
deflatePrime
deflateReset
deflateResetKeep
deflateSetDictionary
deflateSetHeader
deflateTune
deflate_copyright
exec_hexify
exec_unhexify
extract_dynamicx_hash
fgetl
file_to_buffer
filename_from_filepath
fill_fopen64_filefunc
fill_fopen_filefunc
fill_zlib_filefunc64_32_def_from_filefunc32
g_AlignedAlloc
g_Alloc
g_BigAlloc
g_Crc64Table
g_CrcTable
g_CrcUpdate
g_CrcUpdateT0_32
g_CrcUpdateT0_64
g_CrcUpdateT4
g_CrcUpdateT8
g_MidAlloc
generic_salt_decode
generic_salt_encode
get_crc_table
get_entropy
get_random_num
gz_error
gzbuffer
gzclearerr
gzclose
gzclose_r
gzclose_w
gzdirect
gzdopen
gzeof
gzerror
gzflush
gzfread
gzfwrite
gzgetc
gzgetc_
gzgets
gzoffset
gzoffset64
gzopen
gzopen64
gzopen_w
gzprintf
gzputc
gzputs
gzread
gzrewind
gzseek
gzseek64
gzsetparams
gztell
gztell64
gzungetc
gzvprintf
gzwrite
hc_asprintf
hc_bsearch_r
hc_fclose
hc_feof
hc_fflush
hc_fgetc
hc_fgets
hc_fopen
hc_fopen_raw
hc_fprintf
hc_fputc
hc_fread
hc_fscanf
hc_fseek
hc_fstat
hc_fsync
hc_ftell
hc_fwrite
hc_get_processor_count
hc_lzma1_decompress
hc_lzma2_decompress
hc_lzma_alloc
hc_lzma_free
hc_path_create
hc_path_exist
hc_path_has_bom
hc_path_is_directory
hc_path_is_empty
hc_path_is_fifo
hc_path_is_file
hc_path_read
hc_path_write
hc_qsort_r
hc_rewind
hc_same_files
hc_strchr_last
hc_strchr_next
hc_string_bom_size
hc_string_is_digit
hc_string_trim_leading
hc_string_trim_trailing
hc_strncat
hc_strtoul
hc_strtoull
hc_vfprintf
hccalloc
hcfree
hcfree_aligned
hcmalloc
hcmalloc_aligned
hcrealloc
hcstrdup
hex_convert
hex_decode
hex_encode
hex_to_u32
hex_to_u64
hex_to_u8
in_superchop
inflate
inflateCodesUsed
inflateCopy
inflateEnd
inflateGetDictionary
inflateGetHeader
inflateInit2_
inflateInit_
inflateMark
inflatePrime
inflateReset
inflateReset2
inflateResetKeep
inflateSetDictionary
inflateSync
inflateSyncPoint
inflateUndermine
inflateValidate
inflate_copyright
inflate_fast
inflate_table
input_tokenizer
int_to_ab64
int_to_base32
int_to_base64
int_to_base64url
int_to_bf64
int_to_itoa32
int_to_itoa64
int_to_lotus64
is_hexify
is_power_of_2
is_valid_base58_char
is_valid_base58_string
is_valid_base64a_char
is_valid_base64a_string
is_valid_base64b_char
is_valid_base64b_string
is_valid_base64c_char
is_valid_base64c_string
is_valid_bech32_char
is_valid_bech32_string
is_valid_digit_char
is_valid_digit_string
is_valid_float_char
is_valid_float_string
is_valid_hex_char
is_valid_hex_string
itoa32_to_int
itoa64_to_int
lotus64_to_int
lowercase
module_attack_exec
module_dgst_pos0
module_dgst_pos1
module_dgst_pos2
module_dgst_pos3
module_dgst_size
module_esalt_size
module_hash_category
module_hash_decode
module_hash_encode
module_hash_name
module_init
module_kern_type
module_opti_type
module_opts_type
module_pw_max
module_salt_type
module_st_hash
module_st_pass
module_tmp_size
mydivc32
mydivc64
naive_escape
naive_replace
need_hexify
overflow_check_u32_add
overflow_check_u32_mul
overflow_check_u64_add
overflow_check_u64_mul
power_of_two_ceil_32
power_of_two_floor_32
rotl32
rotl64
rotr32
rotr64
round_up_multiple_32
round_up_multiple_64
select_read_timeout
select_read_timeout_console
select_write_timeout
setup_environment_variables
setup_seeding
setup_umask
sort_by_string_sized
sort_by_stringptr
strhashcategory
stroptitype
strparser
superchop_with_length
u32_to_hex
u64_to_hex
u8_to_hex
unzClose
unzCloseCurrentFile
unzGetCurrentFileInfo
unzGetCurrentFileInfo64
unzGetCurrentFileZStreamPos64
unzGetFilePos
unzGetFilePos64
unzGetGlobalComment
unzGetGlobalInfo
unzGetGlobalInfo64
unzGetLocalExtrafield
unzGetOffset
unzGetOffset64
unzGoToFilePos
unzGoToFilePos64
unzGoToFirstFile
unzGoToNextFile
unzLocateFile
unzOpen
unzOpen2
unzOpen2_64
unzOpen64
unzOpenCurrentFile
unzOpenCurrentFile2
unzOpenCurrentFile3
unzOpenCurrentFilePassword
unzReadCurrentFile
unzSetOffset
unzSetOffset64
unzStringFileNameCompare
unz_copyright
unzeof
unztell
unztell64
uppercase
v16a_from_v32
v16b_from_v32
v32_from_v16ab
v32a_from_v64
v32b_from_v64
v64_from_v32ab
v8a_from_v32
v8b_from_v32
v8c_from_v32
v8d_from_v32
x86_Convert
x86cpuid_CheckAndRead
x86cpuid_GetFirm
zError
z_errmsg
zcalloc
zcfree
zlibCompileFlags
zlibVersion

Sections

.text
Size: 127KB - Virtual size: 127KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 16KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

355293c917a80f86c1ec9d25889dfa7a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

ws2_32

Exports

Exports

Sections

.text Size: 127KB - Virtual size: 127KB

.data Size: 1KB - Virtual size: 1KB

.rdata Size: 22KB - Virtual size: 22KB

.pdata Size: 7KB - Virtual size: 6KB

.xdata Size: 5KB - Virtual size: 5KB

.bss Size: - Virtual size: 16KB

.edata Size: 11KB - Virtual size: 10KB

.idata Size: 3KB - Virtual size: 3KB

.CRT Size: 512B - Virtual size: 88B

.tls Size: 512B - Virtual size: 16B

.reloc Size: 512B - Virtual size: 216B

.text
Size: 127KB - Virtual size: 127KB

.data
Size: 1KB - Virtual size: 1KB

.rdata
Size: 22KB - Virtual size: 22KB

.pdata
Size: 7KB - Virtual size: 6KB

.xdata
Size: 5KB - Virtual size: 5KB

.bss
Size: - Virtual size: 16KB

.edata
Size: 11KB - Virtual size: 10KB

.idata
Size: 3KB - Virtual size: 3KB

.CRT
Size: 512B - Virtual size: 88B

.tls
Size: 512B - Virtual size: 16B

.reloc
Size: 512B - Virtual size: 216B