8a19190d7b1941eec4bf15926154915a408f9fe2cf55989edc7a8e2aa47ae9cd_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

8a19190d7b1941eec4bf15926154915a408f9fe2cf55989edc7a8e2aa47ae9cd_NeikiAnalytics.exe
Size

141KB
MD5

bad355d5d0fab24055e5c146fc1ef1d0
SHA1

2a889d05391e5bbdf7a154b1174625b5101b7e2c
SHA256

8a19190d7b1941eec4bf15926154915a408f9fe2cf55989edc7a8e2aa47ae9cd
SHA512

6602013866d0dcacedd9c1ee13d19380c839127ea4aa084c115087ddbe0831f80eb180addb33ac9ff998c3c51104f1fbc7c3f8390007a5f571be7aa1f40e1ff4
SSDEEP

3072:vX/88QGx3I8W63rRFAAnzy8SGbvB/5a1/L+t/OowNb3y:vXWG+szjN/5a1/KkZb3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8a19190d7b1941eec4bf15926154915a408f9fe2cf55989edc7a8e2aa47ae9cd_NeikiAnalytics.exe

Files

8a19190d7b1941eec4bf15926154915a408f9fe2cf55989edc7a8e2aa47ae9cd_NeikiAnalytics.exe
.dll windows:5 windows x86 arch:x86

5992be98b2b9a697b1c2e724ff19e4e0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\bb-slave\win32\obj-instantbird\mozilla\security\nss\lib\softoken\softokn3.pdb

Imports

mozsqlite3

sqlite3_column_bytes
sqlite3_column_blob
sqlite3_bind_int
sqlite3_bind_text
sqlite3_step
sqlite3_column_int
sqlite3_bind_blob
sqlite3_reset
sqlite3_finalize
sqlite3_open
sqlite3_busy_timeout
sqlite3_close
sqlite3_exec
sqlite3_mprintf
sqlite3_file_control
sqlite3_prepare_v2
sqlite3_free

nssutil3

NSS_Get_SECOID_AlgorithmIDTemplate_Util
PORT_Alloc_Util
PORT_Free_Util
NSSUTIL_ArgStrip
PORT_NewArena_Util
PORT_ArenaZAlloc_Util
SECITEM_AllocItem_Util
PORT_FreeArena_Util
SECOID_FindOIDTag_Util
PORT_SetError_Util
SECITEM_CopyItem_Util
PORT_ArenaAlloc_Util
SECITEM_CompareItem_Util
NSSUTIL_ArgGetLabel
NSSUTIL_ArgDecodeNumber
NSSUTIL_ArgIsBlank
NSSUTIL_ArgFetchValue
NSSUTIL_ArgSkipParameter
NSSUTIL_ArgHasFlag
_NSSUTIL_EvaluateConfigDir
PORT_Strdup_Util
SECOID_FindOIDByMechanism
SGN_DecodeDigestInfo
SGN_CreateDigestInfo_Util
DER_Encode_Util
SGN_DestroyDigestInfo_Util
UTIL_SetForkState
SECOID_Shutdown
SECOID_Init
SECITEM_HashCompare
NSSUTIL_DoModuleDBFunction
PORT_GetError_Util
_NSSUTIL_GetSecmodName
DER_SetUInteger
NSS_Get_SEC_OctetStringTemplate_Util
SEC_QuickDERDecodeItem_Util
PORT_ArenaGrow_Util
PORT_Realloc_Util
SECOID_GetAlgorithmTag_Util
SEC_ASN1DecodeItem_Util
DER_GetInteger_Util
SEC_ASN1EncodeInteger_Util
SEC_ASN1EncodeItem_Util
SECOID_SetAlgorithmID_Util
SECOID_CopyAlgorithmID_Util
SECOID_DestroyAlgorithmID_Util
SECITEM_DupItem_Util
PORT_ZFree_Util
SECITEM_ZfreeItem_Util
PORT_ZAlloc_Util
SECITEM_FreeItem_Util
NSS_Get_SEC_AnyTemplate_Util
NSS_Get_SEC_BitStringTemplate_Util
NSS_Get_SEC_ObjectIDTemplate_Util

plc4

PL_strcasecmp
PL_strncasecmp

plds4

PL_CompareValues
PL_HashTableRemove
PL_HashTableAdd
PL_HashTableLookupConst
PL_HashTableEnumerateEntries
PL_NewHashTable
PL_HashTableDestroy
PL_HashTableLookup

nspr4

PR_Unlock
PR_CallOnce
PR_SetError
PR_Free
PR_smprintf
PR_NewMonitor
PR_DestroyMonitor
PR_Now
PR_EnterMonitor
PR_GetCurrentThread
PR_ExitMonitor
PR_MillisecondsToInterval
PR_IntervalNow
PR_Access
PR_SecondsToInterval
PR_NewLock
PR_Sleep
PR_snprintf
PR_GetEnv
PR_LoadLibraryWithFlags
PR_GetDirectorySeparator
PR_GetLibraryFilePathname
PR_Lock
PR_UnloadLibrary
PR_FindFunctionSymbol
PR_DestroyLock
PR_smprintf_free

msvcr100

_initterm_e
_initterm
_encoded_null
_malloc_crt
strcpy
getenv
sprintf
strrchr
atoi
isdigit
islower
isupper
memset
memcmp
memcpy
_chmod
strcat
_amsg_exit
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
__CppXcptFilter
_crt_debugger_hook
strlen

mozglue

free
malloc
frex

kernel32

DecodePointer
EncodePointer
InterlockedExchange
Sleep
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
DisableThreadLibraryCalls
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetTempPathA

Exports

Exports

C_GetFunctionList
FC_GetFunctionList
NSC_GetFunctionList
NSC_ModuleDBFunc

Sections

.text
Size: 110KB - Virtual size: 110KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 824B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5992be98b2b9a697b1c2e724ff19e4e0

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mozsqlite3

nssutil3

plc4

plds4

nspr4

msvcr100

mozglue

kernel32

Exports

Exports

Sections

.text Size: 110KB - Virtual size: 110KB

.rdata Size: 22KB - Virtual size: 22KB

.data Size: 1024B - Virtual size: 1KB

.rsrc Size: 1024B - Virtual size: 824B

.reloc Size: 5KB - Virtual size: 5KB

.text
Size: 110KB - Virtual size: 110KB

.rdata
Size: 22KB - Virtual size: 22KB

.data
Size: 1024B - Virtual size: 1KB

.rsrc
Size: 1024B - Virtual size: 824B

.reloc
Size: 5KB - Virtual size: 5KB