1b744c8a425253946893e1fe1608aaba5b0c3196077e3fd1322ca71732e2ef6e_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

1b744c8a425253946893e1fe1608aaba5b0c3196077e3fd1322ca71732e2ef6e_NeikiAnalytics.exe
Size

26KB
MD5

9cceb622d6ec58fde2bc55ff37007740
SHA1

5d5f883b1781ffe3abf39540e03740237342c6e2
SHA256

1b744c8a425253946893e1fe1608aaba5b0c3196077e3fd1322ca71732e2ef6e
SHA512

f8bc84ba58f6220e25e1dfb3ce5b09a86209ce3c8b0298a98eac5a3b69df8f48a432cdb7d80a67f8f35e577f8460677594b70380f53f764958a57041cdb9252a
SSDEEP

768:OpeAbFwu7SAIRRNUqHU03zVGXisMXS7OV3r:OpeqyuWAIRRXza5OV3r

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1b744c8a425253946893e1fe1608aaba5b0c3196077e3fd1322ca71732e2ef6e_NeikiAnalytics.exe

Files

1b744c8a425253946893e1fe1608aaba5b0c3196077e3fd1322ca71732e2ef6e_NeikiAnalytics.exe
.exe windows:5 windows x86 arch:x86

8e345bb2f3d811937f4ac22e50ce8a33

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

G:\bluefoot\lib\Release\LV_Engine.pdb

Imports

ace

??1ACE_Semaphore@@QAE@XZ
?acquire@ACE_Thread_Mutex@@QAEHXZ
?release@ACE_Thread_Mutex@@QAEHXZ
?thr_keycreate@ACE_OS@@YAHPAKP6AXPAX@Z1@Z
?thr_setspecific@ACE_OS@@YAHKPAX@Z
?getspecific@ACE_Thread@@SAHKPAPAX@Z
?printf@ACE_OS@@YAHPBDZZ
??0ACE_Process_Semaphore@@QAE@IPB_WPAXH@Z
??1ACE_Process_Semaphore@@QAE@XZ
?tryacquire@ACE_Process_Semaphore@@QAEHXZ
?sprintf@ACE_OS@@YAHPA_WPB_WZZ

psapi

GetProcessMemoryInfo

kernel32

GetLastError
Sleep
CloseHandle
GetExitCodeProcess
WaitForSingleObject
OpenProcess
DebugBreak
GetCurrentProcess
SetConsoleCtrlHandler
MultiByteToWideChar
GetCurrentProcessId
GetSystemTimeAsFileTime
GetACP
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
DecodePointer
InterlockedExchange
InterlockedCompareExchange
HeapSetInformation
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
EncodePointer

advapi32

OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges

ole32

CoUninitialize
CoInitializeSecurity
CoInitialize

lv_bridge

?SetPollSempahore@LV_BridgeInitialize@@QAEXPAVACE_Process_Semaphore@@@Z
?singleton@LV_BridgeInitialize@@2V1@A

lv_changejournal

?singleton@LV_ChangeLogInitialize@@2V1@A

lv_command

?singleton@LV_CommandInitialize@@2V1@A

lv_config

?init@LV_Config@@QAEHPA_W@Z
?getUint64@LV_Config@@QAE_KPA_W0@Z
?logsPath@LV_Config@@QAEPB_W_K@Z
?LVCryptoDeinit@@YAXXZ
?GetSubjectName@@YAHPAXPA_WI@Z
?LVCryptoInit@@YAHXZ
?configInfo@LV_Config@@0PAV1@A
?getBoolean@LV_Config@@QAE_NPA_W0@Z
?getUint32@LV_Config@@QAEIPA_W0@Z

lv_debugserver

??0LV_DebugServerBase@@QAE@PB_W00II@Z
??1LV_DebugServerBase@@QAE@XZ

lv_debug

??1LV_DebugClassRegister@@UAE@XZ
?message@LV_DebugContext@@QAAXPB_WZZ
??0LV_DebugContext@@QAE@PB_WPAVLV_DebugClassRegister@@0H@Z
??1LV_DebugContext@@QAE@XZ
?setIdentity@LV_DebugContext@@QAEX_KW4LV_LibEngineType@@PB_W@Z
??0LV_DebugClassRegister@@QAE@PB_W0_N@Z

lv_disconnectedrestore

?singleton@LV_DisconnectedRestoreInitialize@@2V1@A

lv_error

??BLV_Error@@QAEPB_WXZ
?typeNative@LV_Error@@2W4Type@1@B
?threadSpecific@LV_Error@@2V?$ACE_TSS@VLV_Error@@@@A
?loadCode@LV_Error@@QAEXIW4Type@1@@Z
?loadACE@LV_Error@@QAEXW4Type@1@@Z

lv_lib

?ForceDrWatsonOnException@LV_LibThread@@SAX_N@Z
?invoke@LV_LibThread@@SAHPB_WP6AKPAX@Z1@Z
?Instance@LV_LibOSVersion@@SAPAV1@XZ
?StartAll@LV_LibInitialize@@SAHW4LV_LibEngineType@@@Z
?checkForThreadHang@LV_LibThread@@SAXJJ@Z
?StopAll@LV_LibInitialize@@SAXW4LV_LibEngineType@@@Z
?processDoneCode@LV_LibThread@@2HA
?processDoneReason@LV_LibThread@@2PB_WB
??1LV_LibInitialize@@UAE@XZ
??0LV_LibInitialize@@QAE@PB_W@Z
?spawn@LV_LibThread@@SAHPB_WP6AKPAX@Z1JH@Z

lv_policy

?singleton@LV_PolicyCoordinatorInitialize@@2V1@A

msvcr100

_chdir
_wstat32
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
__CxxFrameHandler3
??_V@YAXPAX@Z
exit
setlocale
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
?_set_new_mode@@YAHH@Z
fprintf
__iob_func
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_amsg_exit
__getmainargs
_cexit
strtol
_XcptFilter
__initenv
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_commode
_fmode
__set_app_type
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_except_handler4_common
_invoke_watson
_controlfp_s
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBDH@Z
_errno
??2@YAPAXI@Z
??3@YAXPAX@Z
_exit
_time32
_stricmp

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8e345bb2f3d811937f4ac22e50ce8a33

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ace

psapi

kernel32

advapi32

ole32

lv_bridge

lv_changejournal

lv_command

lv_config

lv_debugserver

lv_debug

lv_disconnectedrestore

lv_error

lv_lib

lv_policy

msvcr100

Sections

.text Size: 12KB - Virtual size: 11KB

.rdata Size: 10KB - Virtual size: 10KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 1KB

.text
Size: 12KB - Virtual size: 11KB

.rdata
Size: 10KB - Virtual size: 10KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 1KB