0f9329755b81388cf07ad3f32a4f45f6de89ec91a108a229a930a15520b789e1_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

0f9329755b81388cf07ad3f32a4f45f6de89ec91a108a229a930a15520b789e1_NeikiAnalytics.exe
Size

955KB
MD5

1e378c4696816f4c94b0050cfe25d110
SHA1

b3432e6edec3bc24b143f5833fdbe31e35638e9c
SHA256

0f9329755b81388cf07ad3f32a4f45f6de89ec91a108a229a930a15520b789e1
SHA512

bac7457e5f662df9738aa6bf73397dccf51f5e736206eb9de0090243cd822d850bdb09ce40c39346e996d4479fe2a63ae75f0d0859357e3bd25c5fa52b9b9b10
SSDEEP

24576:wr37G4Tr6sLMrCvwHIo2WEyMz7yYK6ZSmd9saBEAnVFpMrEH7Q:wyFrCvPxzvbsVUFE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0f9329755b81388cf07ad3f32a4f45f6de89ec91a108a229a930a15520b789e1_NeikiAnalytics.exe

Files

0f9329755b81388cf07ad3f32a4f45f6de89ec91a108a229a930a15520b789e1_NeikiAnalytics.exe
.dll windows:5 windows x86 arch:x86

b813d59c32f5822b932ae175483fa6f7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetFullPathNameA
GetTempFileNameW
CreateFileA
SearchPathW
FindFirstFileW
VirtualQuery
FreeLibrary
CreateProcessW
LoadLibraryExW
ReadConsoleA
CreateDirectoryW
GetComputerNameW
ReadConsoleW
GetVolumeInformationA
CopyFileW
GetVersionExW
GetFileAttributesA
GetFileAttributesW
CreateProcessA
WriteConsoleW
GetModuleFileNameW
CreateFileW
GetTempPathW
GetShortPathNameA
CreateDirectoryA
SetCurrentDirectoryA
FindFirstFileA
GetCurrentDirectoryW
GetProcAddress
MoveFileW
RemoveDirectoryA
CopyFileA
SearchPathA
SetFileAttributesA
DisableThreadLibraryCalls
BuildCommDCBW
GetTempFileNameA
LoadLibraryA
WriteConsoleA
MoveFileA
SetCurrentDirectoryW
RemoveDirectoryW
GetSystemInfo
GetModuleFileNameA
FindNextFileA
LoadLibraryExA
FindNextFileW
BuildCommDCBA
GetCurrentDirectoryA
GetShortPathNameW
DeleteFileW
GetTempPathA
lstrcpyW
SetFileAttributesW
DeleteFileA
GetVolumeInformationW
lstrcpyA
SetFilePointer
SetEndOfFile
GetCommState
GetComputerNameA
WriteFile
GetConsoleMode
ReadFile
FlushFileBuffers
GetStdHandle
GetLastError
GetFileType
DuplicateHandle
CloseHandle
WaitForSingleObject
SetEvent
GetConsoleCP
TerminateThread
CreateEventA
SetConsoleMode
SetThreadPriority
ResetEvent
GetExitCodeThread
WaitForMultipleObjects
PeekConsoleInputA
CreateThread
SetupComm
GetCommModemStatus
ClearCommError
EscapeCommFunction
SetCommState
SetCommTimeouts
InitializeCriticalSection
LeaveCriticalSection
GetOverlappedResult
EnterCriticalSection
PurgeComm
DeleteCriticalSection
GetLogicalDriveStringsA
FindClose
GetCurrentThread
SetFileTime
GetWindowsDirectoryA
WideCharToMultiByte
MultiByteToWideChar
lstrlenW
GetPrivateProfileStringA
DeviceIoControl
GetFileInformationByHandle
GetEnvironmentVariableW
LoadLibraryW
GetEnvironmentVariableA
GetACP
lstrcmpiA
Sleep
GetCurrentThreadId
PeekNamedPipe
GetExitCodeProcess
CreatePipe
SetHandleInformation
QueryPerformanceCounter
WaitForSingleObjectEx
GetSystemTimeAsFileTime
GetTimeZoneInformation
QueryPerformanceFrequency
GetFullPathNameW
GetProcessHeap
HeapFree
GetCurrentProcess
InterlockedExchange
InterlockedCompareExchange
GetCurrentProcessId
GetTickCount
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
HeapAlloc

user32

DestroyWindow
CharLowerW
wsprintfA
RegisterClassA
DispatchMessageA
PostMessageA
MsgWaitForMultipleObjectsEx
DefWindowProcA
PeekMessageA
CreateWindowExA
UnregisterClassA
TranslateMessage
KillTimer
PostQuitMessage
SetTimer
GetMessageA
WaitForInputIdle
GetWindowLongA
SetWindowLongA
SendMessageA
CharLowerA

ws2_32

ntohs
WSAStartup
getservbyname
getsockopt
accept
listen
WSAAsyncSelect
send
gethostbyname
gethostbyaddr
closesocket
socket
bind
recv
getsockname
htons
WSAGetLastError
select
inet_addr
inet_ntoa
connect
gethostname
ioctlsocket
getpeername
setsockopt

msvcr90

_isatty
_getpid
memset
_timezone
memcpy
_putenv
_tzset
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
toupper
_gmtime32
strspn
_ftime32
wcsncmp
_wcsicmp
_stricmp
wcschr
sprintf
strncmp
qsort
__iob_func
fflush
fprintf
atoi
strncpy
free
malloc
realloc
atan2
sqrt
cos
ceil
modf
pow
log
strstr
tanh
_errno
sinh
tan
fmod
cosh
acos
floor
_isnan
log10
atan
_hypot
exp
_finite
getenv
asin
sin
isdigit
strtoul
isxdigit
fabs
_localtime32
_mktime32
strcmp
strpbrk
memcmp
strchr
isalpha
memmove
strlen
strtol
_environ
exit
strrchr
memchr
islower
abort
strerror
ldexp
frexp
_HUGE
tolower
_wcsnicmp
_strnicmp

advapi32

GetUserNameW
GetSecurityDescriptorOwner
GetSidIdentifierAuthority
GetUserNameA

Exports

Exports

TclAddLiteralObj
TclAllocateFreeObjects
TclBN_epoch
TclBN_fast_s_mp_mul_digs
TclBN_fast_s_mp_sqr
TclBN_mp_add
TclBN_mp_add_d
TclBN_mp_and
TclBN_mp_clamp
TclBN_mp_clear
TclBN_mp_clear_multi
TclBN_mp_cmp
TclBN_mp_cmp_d
TclBN_mp_cmp_mag
TclBN_mp_cnt_lsb
TclBN_mp_copy
TclBN_mp_count_bits
TclBN_mp_div
TclBN_mp_div_2
TclBN_mp_div_2d
TclBN_mp_div_3
TclBN_mp_div_d
TclBN_mp_exch
TclBN_mp_expt_d
TclBN_mp_grow
TclBN_mp_init
TclBN_mp_init_copy
TclBN_mp_init_multi
TclBN_mp_init_set
TclBN_mp_init_set_int
TclBN_mp_init_size
TclBN_mp_karatsuba_mul
TclBN_mp_karatsuba_sqr
TclBN_mp_lshd
TclBN_mp_mod
TclBN_mp_mod_2d
TclBN_mp_mul
TclBN_mp_mul_2
TclBN_mp_mul_2d
TclBN_mp_mul_d
TclBN_mp_neg
TclBN_mp_or
TclBN_mp_radix_size
TclBN_mp_read_radix
TclBN_mp_rshd
TclBN_mp_set
TclBN_mp_set_int
TclBN_mp_shrink
TclBN_mp_sqr
TclBN_mp_sqrt
TclBN_mp_sub
TclBN_mp_sub_d
TclBN_mp_to_unsigned_bin
TclBN_mp_to_unsigned_bin_n
TclBN_mp_toom_mul
TclBN_mp_toom_sqr
TclBN_mp_toradix_n
TclBN_mp_unsigned_bin_size
TclBN_mp_xor
TclBN_mp_zero
TclBN_reverse
TclBN_revision
TclBN_s_mp_add
TclBN_s_mp_mul_digs
TclBN_s_mp_sqr
TclBN_s_mp_sub
TclBackgroundException
TclCallVarTraces
TclChannelEventScriptInvoker
TclChannelTransform
TclCheckExecutionTraces
TclCheckInterpTraces
TclCleanupChildren
TclCleanupCommand
TclCleanupVar
TclCopyAndCollapse
TclCopyChannel
TclCreatePipeline
TclCreateProc
TclDbDumpActiveObjects
TclDeleteCompiledLocalVars
TclDeleteVars
TclDoubleDigits
TclDumpMemoryInfo
TclEvalObjEx
TclExpandCodeArray
TclExprFloatError
TclFindElement
TclFindProc
TclFormatInt
TclFreeObj
TclFreePackageInfo
TclGetAndDetachPids
TclGetAuxDataType
TclGetEnv
TclGetExtension
TclGetFrame
TclGetInstructionTable
TclGetIntForIndex
TclGetLibraryPath
TclGetLoadedPackages
TclGetLong
TclGetNamespaceForQualName
TclGetNamespaceFromObj
TclGetObjInterpProc
TclGetObjNameOfExecutable
TclGetOpenMode
TclGetOriginalCommand
TclGetPlatform
TclGetSrcInfoForPc
TclGetStartupScriptFileName
TclGetStartupScriptPath
TclGuessPackageName
TclHandleCreate
TclHandleFree
TclHandlePreserve
TclHandleRelease
TclHideLiteral
TclHideUnsafeCommands
TclInExit
TclInThreadExit
TclInitCompiledLocals
TclInitVarHashTable
TclInterpInit
TclInvokeObjectCommand
TclInvokeStringCommand
TclIsProc
TclListObjSetElement
TclLookupVar
TclNeedSpace
TclNewProcBodyObj
TclObjBeingDeleted
TclObjCommandComplete
TclObjGetFrame
TclObjInterpProc
TclObjInterpProcCore
TclObjInvoke
TclObjLookupVar
TclPopStackFrame
TclPrecTraceProc
TclPreventAliasLoop
TclProcCleanupProc
TclProcCompileProc
TclProcDeleteProc
TclPtrMakeUpvar
TclPushStackFrame
TclRegAbout
TclRegError
TclRegExpRangeUniChar
TclRenameCommand
TclResetShadowedCmdRefs
TclServiceIdle
TclSetByteCodeFromAny
TclSetLibraryPath
TclSetNsPath
TclSetObjNameOfExecutable
TclSetPreInitScript
TclSetStartupScriptFileName
TclSetStartupScriptPath
TclSetupEnv
TclSockGetPort
TclSockMinimumBuffers
TclSockMinimumBuffersOld
TclStackAlloc
TclStackFree
TclTeardownNamespace
TclTraceDictPath
TclUniCharMatch
TclUpdateReturnInfo
TclVarErrMsg
TclVarHashCreateVar
TclVarTraceExists
TclWinAddProcess
TclWinCPUID
TclWinConvertError
TclWinConvertWSAError
TclWinFlushDirtyChannels
TclWinGetPlatformId
TclWinGetServByName
TclWinGetSockOpt
TclWinGetTclInstance
TclWinNToHS
TclWinNoBackslash
TclWinResetInterfaces
TclWinSetInterfaces
TclWinSetSockOpt
Tcl_Access
Tcl_AddErrorInfo
Tcl_AddInterpResolvers
Tcl_AddObjErrorInfo
Tcl_AlertNotifier
Tcl_Alloc
Tcl_AllocStatBuf
Tcl_AllowExceptions
Tcl_AppendAllObjTypes
Tcl_AppendElement
Tcl_AppendExportList
Tcl_AppendFormatToObj
Tcl_AppendLimitedToObj
Tcl_AppendObjToErrorInfo
Tcl_AppendObjToObj
Tcl_AppendPrintfToObj
Tcl_AppendResult
Tcl_AppendResultVA
Tcl_AppendStringsToObj
Tcl_AppendStringsToObjVA
Tcl_AppendToObj
Tcl_AppendUnicodeToObj
Tcl_AsyncCreate
Tcl_AsyncDelete
Tcl_AsyncInvoke
Tcl_AsyncMark
Tcl_AsyncReady
Tcl_AttemptAlloc
Tcl_AttemptDbCkalloc
Tcl_AttemptDbCkrealloc
Tcl_AttemptRealloc
Tcl_AttemptSetObjLength
Tcl_BackgroundError
Tcl_Backslash
Tcl_BadChannelOption
Tcl_CallWhenDeleted
Tcl_CancelIdleCall
Tcl_ChannelBlockModeProc
Tcl_ChannelBuffered
Tcl_ChannelClose2Proc
Tcl_ChannelCloseProc
Tcl_ChannelFlushProc
Tcl_ChannelGetHandleProc
Tcl_ChannelGetOptionProc
Tcl_ChannelHandlerProc
Tcl_ChannelInputProc
Tcl_ChannelName
Tcl_ChannelOutputProc
Tcl_ChannelSeekProc
Tcl_ChannelSetOptionProc
Tcl_ChannelThreadActionProc
Tcl_ChannelTruncateProc
Tcl_ChannelVersion
Tcl_ChannelWatchProc
Tcl_ChannelWideSeekProc
Tcl_Chdir
Tcl_ClearChannelHandlers
Tcl_Close
Tcl_CommandComplete
Tcl_CommandTraceInfo
Tcl_Concat
Tcl_ConcatObj
Tcl_ConditionFinalize
Tcl_ConditionNotify
Tcl_ConditionWait
Tcl_ConvertCountedElement
Tcl_ConvertElement
Tcl_ConvertToType
Tcl_CreateAlias
Tcl_CreateAliasObj
Tcl_CreateChannel
Tcl_CreateChannelHandler
Tcl_CreateCloseHandler
Tcl_CreateCommand
Tcl_CreateEncoding
Tcl_CreateEnsemble
Tcl_CreateEventSource
Tcl_CreateExitHandler
Tcl_CreateHashEntry
Tcl_CreateInterp
Tcl_CreateMathFunc
Tcl_CreateNamespace
Tcl_CreateObjCommand
Tcl_CreateObjTrace
Tcl_CreateSlave
Tcl_CreateThread
Tcl_CreateThreadExitHandler
Tcl_CreateTimerHandler
Tcl_CreateTrace
Tcl_CutChannel
Tcl_DStringAppend
Tcl_DStringAppendElement
Tcl_DStringEndSublist
Tcl_DStringFree
Tcl_DStringGetResult
Tcl_DStringInit
Tcl_DStringResult
Tcl_DStringSetLength
Tcl_DStringStartSublist
Tcl_DbCkalloc
Tcl_DbCkfree
Tcl_DbCkrealloc
Tcl_DbDecrRefCount
Tcl_DbIncrRefCount
Tcl_DbIsShared
Tcl_DbNewBignumObj
Tcl_DbNewBooleanObj
Tcl_DbNewByteArrayObj
Tcl_DbNewDictObj
Tcl_DbNewDoubleObj
Tcl_DbNewListObj
Tcl_DbNewLongObj
Tcl_DbNewObj
Tcl_DbNewStringObj
Tcl_DbNewWideIntObj
Tcl_DeleteAssocData
Tcl_DeleteChannelHandler
Tcl_DeleteCloseHandler
Tcl_DeleteCommand
Tcl_DeleteCommandFromToken
Tcl_DeleteEventSource
Tcl_DeleteEvents
Tcl_DeleteExitHandler
Tcl_DeleteHashEntry
Tcl_DeleteHashTable
Tcl_DeleteInterp
Tcl_DeleteNamespace
Tcl_DeleteThreadExitHandler
Tcl_DeleteTimerHandler
Tcl_DeleteTrace
Tcl_DetachChannel
Tcl_DetachPids
Tcl_DictObjDone
Tcl_DictObjFirst
Tcl_DictObjGet
Tcl_DictObjNext
Tcl_DictObjPut
Tcl_DictObjPutKeyList
Tcl_DictObjRemove
Tcl_DictObjRemoveKeyList
Tcl_DictObjSize
Tcl_DiscardInterpState
Tcl_DiscardResult
Tcl_DoOneEvent
Tcl_DoWhenIdle
Tcl_DontCallWhenDeleted
Tcl_DumpActiveMemory
Tcl_DuplicateObj
Tcl_Eof
Tcl_ErrnoId
Tcl_ErrnoMsg
Tcl_Eval
Tcl_EvalEx
Tcl_EvalFile
Tcl_EvalObj
Tcl_EvalObjEx
Tcl_EvalObjv
Tcl_EvalTokens
Tcl_EvalTokensStandard
Tcl_EventuallyFree
Tcl_Exit
Tcl_ExitThread
Tcl_Export
Tcl_ExposeCommand
Tcl_ExprBoolean
Tcl_ExprBooleanObj
Tcl_ExprDouble
Tcl_ExprDoubleObj
Tcl_ExprLong
Tcl_ExprLongObj
Tcl_ExprObj
Tcl_ExprString
Tcl_ExternalToUtf
Tcl_ExternalToUtfDString
Tcl_FSAccess
Tcl_FSChdir
Tcl_FSConvertToPathType
Tcl_FSCopyDirectory
Tcl_FSCopyFile
Tcl_FSCreateDirectory
Tcl_FSData
Tcl_FSDeleteFile
Tcl_FSEqualPaths
Tcl_FSEvalFile
Tcl_FSEvalFileEx
Tcl_FSFileAttrStrings
Tcl_FSFileAttrsGet
Tcl_FSFileAttrsSet
Tcl_FSFileSystemInfo
Tcl_FSGetCwd
Tcl_FSGetFileSystemForPath
Tcl_FSGetInternalRep
Tcl_FSGetNativePath
Tcl_FSGetNormalizedPath
Tcl_FSGetPathType
Tcl_FSGetTranslatedPath
Tcl_FSGetTranslatedStringPath
Tcl_FSJoinPath
Tcl_FSJoinToPath
Tcl_FSLink
Tcl_FSListVolumes
Tcl_FSLoadFile
Tcl_FSLstat
Tcl_FSMatchInDirectory
Tcl_FSMountsChanged
Tcl_FSNewNativePath
Tcl_FSOpenFileChannel
Tcl_FSPathSeparator
Tcl_FSRegister
Tcl_FSRemoveDirectory
Tcl_FSRenameFile
Tcl_FSSplitPath
Tcl_FSStat
Tcl_FSUnregister
Tcl_FSUtime
Tcl_Finalize
Tcl_FinalizeNotifier
Tcl_FinalizeThread
Tcl_FindCommand
Tcl_FindEnsemble
Tcl_FindExecutable
Tcl_FindHashEntry
Tcl_FindNamespace
Tcl_FindNamespaceVar
Tcl_FirstHashEntry
Tcl_Flush
Tcl_ForgetImport
Tcl_Format
Tcl_Free
Tcl_FreeEncoding
Tcl_FreeParse
Tcl_FreeResult
Tcl_GetAlias
Tcl_GetAliasObj
Tcl_GetAllocMutex
Tcl_GetAssocData
Tcl_GetBignumFromObj
Tcl_GetBoolean
Tcl_GetBooleanFromObj
Tcl_GetByteArrayFromObj
Tcl_GetChannel
Tcl_GetChannelBufferSize
Tcl_GetChannelError
Tcl_GetChannelErrorInterp
Tcl_GetChannelHandle
Tcl_GetChannelInstanceData
Tcl_GetChannelMode
Tcl_GetChannelName
Tcl_GetChannelNames
Tcl_GetChannelNamesEx
Tcl_GetChannelOption
Tcl_GetChannelThread
Tcl_GetChannelType
Tcl_GetCharLength
Tcl_GetCommandFromObj
Tcl_GetCommandFullName
Tcl_GetCommandInfo
Tcl_GetCommandInfoFromToken
Tcl_GetCommandName
Tcl_GetCurrentNamespace
Tcl_GetCurrentThread
Tcl_GetCwd
Tcl_GetDefaultEncodingDir
Tcl_GetDouble
Tcl_GetDoubleFromObj
Tcl_GetEncoding
Tcl_GetEncodingFromObj
Tcl_GetEncodingName
Tcl_GetEncodingNameFromEnvironment
Tcl_GetEncodingNames
Tcl_GetEncodingSearchPath
Tcl_GetEnsembleFlags
Tcl_GetEnsembleMappingDict
Tcl_GetEnsembleNamespace
Tcl_GetEnsembleSubcommandList
Tcl_GetEnsembleUnknownHandler
Tcl_GetErrno
Tcl_GetGlobalNamespace
Tcl_GetHostName
Tcl_GetIndexFromObj
Tcl_GetIndexFromObjStruct
Tcl_GetInt
Tcl_GetIntFromObj
Tcl_GetInterpPath
Tcl_GetInterpResolvers
Tcl_GetLongFromObj
Tcl_GetMaster
Tcl_GetMathFuncInfo
Tcl_GetNameOfExecutable
Tcl_GetNamespaceResolvers
Tcl_GetNamespaceUnknownHandler
Tcl_GetObjResult
Tcl_GetObjType
Tcl_GetPathType
Tcl_GetRange
Tcl_GetRegExpFromObj
Tcl_GetReturnOptions
Tcl_GetServiceMode
Tcl_GetSlave
Tcl_GetStackedChannel
Tcl_GetStartupScript
Tcl_GetStdChannel
Tcl_GetString
Tcl_GetStringFromObj
Tcl_GetStringResult
Tcl_GetThreadData
Tcl_GetTime
Tcl_GetTopChannel
Tcl_GetUniChar
Tcl_GetUnicode
Tcl_GetUnicodeFromObj
Tcl_GetVar
Tcl_GetVar2
Tcl_GetVar2Ex

Sections

.text
Size: 716KB - Virtual size: 715KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 113KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b813d59c32f5822b932ae175483fa6f7

Headers

File Characteristics

Imports

kernel32

user32

ws2_32

msvcr90

advapi32

Exports

Exports

Sections

.text Size: 716KB - Virtual size: 715KB

.rdata Size: 113KB - Virtual size: 113KB

.data Size: 11KB - Virtual size: 14KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 36KB - Virtual size: 35KB

.text
Size: 716KB - Virtual size: 715KB

.rdata
Size: 113KB - Virtual size: 113KB

.data
Size: 11KB - Virtual size: 14KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 36KB - Virtual size: 35KB