General

Malware Config

Signatures

Files

• 4cfc33deeedcc336cc541b2a91eb666fdb2c8984c215daf8cee6ab793c9ef9d1_NeikiAnalytics.exe

  .exe windows:6 windows x86 arch:x86

  78e337a2e45ceff8dd70ccf26e5f7285

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  GetStdHandle

  SetStdHandle

  GetCommandLineA

  CreateFileA

  FindFirstFileExW

  FindNextChangeNotification

  FlushFileBuffers

  GetFileAttributesExW

  GetFileInformationByHandle

  GetFileSize

  GetFileSizeEx

  GetFileType

  GetFileTime

  GetLogicalDrives

  LockFile

  LockFileEx

  SetEndOfFile

  SetFilePointer

  SetFilePointerEx

  SetFileValidData

  UnlockFile

  UnlockFileEx

  AreFileApisANSI

  EncodePointer

  DecodePointer

  EncodeSystemPointer

  DecodeSystemPointer

  SetHandleInformation

  GetLastError

  SetLastError

  DisconnectNamedPipe

  PeekNamedPipe

  GetNamedPipeInfo

  GetNamedPipeHandleStateW

  QueryPerformanceCounter

  QueryPerformanceFrequency

  HeapCreate

  GetProcessHeap

  CreateIoCompletionPort

  PostQueuedCompletionStatus

  InitializeCriticalSection

  EnterCriticalSection

  LeaveCriticalSection

  SetEvent

  ResetEvent

  ReleaseSemaphore

  ReleaseMutex

  WaitForSingleObject

  CreateMutexA

  CreateEventA

  CancelWaitableTimer

  WaitForMultipleObjects

  GetProcessTimes

  GetCurrentProcess

  GetCurrentProcessId

  GetCurrentThread

  GetCurrentThreadId

  GetThreadPriorityBoost

  GetThreadPriority

  GetProcessVersion

  SetPriorityClass

  GetPriorityClass

  GetProcessId

  GetThreadContext

  FlushInstructionCache

  GetThreadTimes

  OpenProcess

  IsProcessorFeaturePresent

  GetProcessHandleCount

  GetProcessPriorityBoost

  SetProcessPriorityBoost

  GetThreadIOPendingFlag

  LoadLibraryA

  GetVersion

  GetVersionExA

  GetNativeSystemInfo

  SetSystemTimeAdjustment

  CreateFileMappingW

  FlushViewOfFile

  SetProcessWorkingSetSize

  GetWriteWatch

  ResetWriteWatch

  CreateMemoryResourceNotification

  IsProcessInJob

  AssignProcessToJobObject

  SetInformationJobObject

  DisableThreadLibraryCalls

  FreeResource

  GetModuleFileNameA

  GetModuleFileNameW

  LockResource

  GlobalUnlock

  GlobalCompact

  GlobalUnfix

  GlobalUnWire

  LocalUnlock

  LocalShrink

  LocalCompact

  GetProcessAffinityMask

  GetProcessIoCounters

  ConvertFiberToThread

  CreateFiberEx

  CreateFiber

  ConvertThreadToFiber

  PulseEvent

  GlobalDeleteAtom

  InitAtomTable

  DeleteAtom

  SetHandleCount

  SetMessageWaitingIndicator

  ClearCommBreak

  ClearCommError

  EscapeCommFunction

  GetCommMask

  GetCommModemStatus

  GetCommTimeouts

  TransmitCommChar

  PrepareTape

  EraseTape

  CreateTapePartition

  GetTapeStatus

  MulDiv

  GetMailslotInfo

  SetMailslotInfo

  AddAtomA

  GetNamedPipeHandleStateA

  VerifyVersionInfoA

  MapUserPhysicalPagesScatter

  CloseHandle

  CreateFileW

  WriteConsoleW

  GetConsoleMode

  GetConsoleOutputCP

  HeapReAlloc

  HeapSize

  LCMapStringW

  GetProcAddress

  GetSystemInfo

  GetModuleHandleA

  GetStringTypeW

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  WideCharToMultiByte

  MultiByteToWideChar

  GetCommandLineW

  GetCPInfo

  GetOEMCP

  GetACP

  IsValidCodePage

  FindNextFileW

  FindClose

  HeapFree

  HeapAlloc

  GetModuleHandleExW

  ExitProcess

  WriteFile

  RaiseException

  LoadLibraryExW

  FreeLibrary

  TlsFree

  TlsSetValue

  TlsGetValue

  TlsAlloc

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  RtlUnwind

  TerminateProcess

  GetModuleHandleW

  GetStartupInfoW

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  IsDebuggerPresent

  InitializeSListHead

  GetSystemTimeAsFileTime

  winspool.drv

  SetJobA

  SetPrinterA

  GetPrinterA

  FlushPrinter

  GetPrinterDataA

  GetPrinterDataExA

  EnumPrinterDataA

  EnumPrinterDataExA

  EnumPrinterKeyA

  SetPrinterDataA

  SetPrinterDataExA

  GetFormA

  EnumFormsA

  ResetPrinterA

  ConnectToPrinterDlg

  EnumPrintersA

  advapi32

  DecryptFileA

  GetUserNameA

  ole32

  CoTaskMemRealloc

  CoTaskMemAlloc

  CoInvalidateRemoteMachineBindings

  CoGetTreatAsClass

  CoWaitForMultipleHandles

  StringFromGUID2

  CLSIDFromProgID

  ProgIDFromCLSID

  StringFromIID

  CLSIDFromString

  CoDisableCallCancellation

  CoEnableCallCancellation

  CoTestCancel

  CoCancelCall

  CoSetCancelObject

  CoSwitchCallContext

  CoFileTimeNow

  CoRevokeMallocSpy

  CoSetProxyBlanket

  CoQueryProxyBlanket

  CoGetCallContext

  CoGetInterfaceAndReleaseStream

  CoMarshalInterThreadInterfaceInStream

  CoGetStdMarshalEx

  CoGetStandardMarshal

  CoLockObjectExternal

  CoDisconnectObject

  CoUnmarshalHresult

  CoMarshalHresult

  CoMarshalInterface

  CoGetMarshalSizeMax

  CoGetPSClsid

  CoRevokeClassObject

  CoGetContextToken

  CoGetCallerTID

  CoGetCurrentProcess

  CoUninitialize

  CoCopyProxy

  CoRevokeInitializeSpy

  CoGetInterceptor

  OleDoAutoConvert

  OleRegGetUserType

  OleGetIconOfClass

  OleGetIconOfFile

  IsAccelerator

  GetRunningObjectTable

  GetClassFile

  MkParseDisplayName

  CoGetObject

  BindMoniker

  CoInstall

  CoAllowSetForegroundWindow

  CoRevertToSelf

  CoGetInstanceFromIStorage

  gdiplus

  GdiplusStartup

  Sections

  .text

  Size: 973KB - Virtual size: 972KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 327KB - Virtual size: 327KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 295KB - Virtual size: 301KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ