General

Malware Config

Signatures

Files

• 7d4b38a47cbe2abdae8cde0ee7614767b6f794db043a315b2f0b662a2ab3a01e_NeikiAnalytics.exe

  .exe windows:5 windows x86 arch:x86

  4aaede37b2f5e5fcb1f913332265608c

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  E:\delivery\Dev\wix37\build\ship\x86\burn.pdb

  Imports

  advapi32

  AdjustTokenPrivileges

  LookupPrivilegeValueW

  OpenProcessToken

  ConvertStringSecurityDescriptorToSecurityDescriptorW

  RegCloseKey

  RegDeleteValueW

  RegQueryValueExW

  GetUserNameW

  InitiateSystemShutdownExW

  CreateWellKnownSid

  InitializeAcl

  SetEntriesInAclW

  DecryptFileW

  ChangeServiceConfigW

  ControlService

  CloseServiceHandle

  QueryServiceStatus

  OpenServiceW

  OpenSCManagerW

  CryptAcquireContextW

  CryptCreateHash

  CryptHashData

  CryptGetHashParam

  CryptDestroyHash

  CryptReleaseContext

  RegDeleteKeyW

  RegCreateKeyExW

  RegEnumKeyExW

  RegEnumValueW

  RegQueryInfoKeyW

  RegSetValueExW

  SetEntriesInAclA

  SetSecurityDescriptorGroup

  RegOpenKeyExW

  GetTokenInformation

  CheckTokenMembership

  AllocateAndInitializeSid

  FreeSid

  LookupAccountNameW

  SetNamedSecurityInfoW

  InitializeSecurityDescriptor

  SetSecurityDescriptorDacl

  SetSecurityDescriptorOwner

  QueryServiceConfigW

  user32

  GetMessageW

  PeekMessageW

  PostMessageW

  PostThreadMessageW

  PostQuitMessage

  SetWindowLongW

  DefWindowProcW

  UnregisterClassW

  DispatchMessageW

  TranslateMessage

  GetMonitorInfoW

  IsDialogMessageW

  MessageBoxW

  GetWindowLongW

  RegisterClassW

  IsWindow

  MsgWaitForMultipleObjects

  WaitForInputIdle

  LoadCursorW

  LoadBitmapW

  GetCursorPos

  MonitorFromPoint

  CreateWindowExW

  oleaut32

  SysFreeString

  SysAllocString

  VariantInit

  VariantClear

  gdi32

  DeleteObject

  GetObjectW

  CreateCompatibleDC

  SelectObject

  DeleteDC

  StretchBlt

  shell32

  ShellExecuteExW

  SHGetFolderPathW

  CommandLineToArgvW

  ole32

  CoTaskMemFree

  CoInitializeSecurity

  CLSIDFromProgID

  CoCreateInstance

  CoInitialize

  StringFromGUID2

  CoInitializeEx

  CoUninitialize

  kernel32

  GetVersionExW

  GetModuleHandleW

  ReadFile

  SetFilePointerEx

  CreateFileW

  GetCurrentProcessId

  GetProcessId

  WriteFile

  ConnectNamedPipe

  SetNamedPipeHandleState

  lstrlenW

  CreateNamedPipeW

  WaitForSingleObject

  OpenProcess

  lstrlenA

  RemoveDirectoryW

  GetFileAttributesW

  ExpandEnvironmentStringsW

  LeaveCriticalSection

  EnterCriticalSection

  FreeLibrary

  GetProcAddress

  VerifyVersionInfoW

  VerSetConditionMask

  GetComputerNameW

  GetTempPathW

  GetSystemDirectoryW

  GetSystemWow64DirectoryW

  GetVolumePathNameW

  GetWindowsDirectoryW

  GetSystemDefaultLangID

  RtlUnwind

  GetDateFormatW

  GetSystemTime

  InterlockedExchange

  LoadLibraryW

  InterlockedCompareExchange

  GetExitCodeThread

  CreateThread

  SetEvent

  WaitForMultipleObjects

  CreateEventW

  ProcessIdToSessionId

  InterlockedIncrement

  InterlockedDecrement

  GetStringTypeW

  GetCurrentThreadId

  FindClose

  FindNextFileW

  FindFirstFileW

  CreateProcessW

  SetCurrentDirectoryW

  GetCurrentDirectoryW

  GetExitCodeProcess

  DuplicateHandle

  SetThreadExecutionState

  CopyFileExW

  UnmapViewOfFile

  MapViewOfFile

  CreateFileMappingW

  CreateMutexW

  SetEndOfFile

  ResetEvent

  SetFileTime

  LocalFileTimeToFileTime

  DosDateTimeToFileTime

  CreateFileA

  CompareStringA

  GetSystemTimeAsFileTime

  VirtualFree

  VirtualAlloc

  DeleteFileW

  GetThreadLocale

  TlsAlloc

  TlsSetValue

  ReleaseMutex

  Sleep

  TlsGetValue

  GetLastError

  CompareStringW

  LocalFree

  CloseHandle

  DeleteCriticalSection

  GetTimeZoneInformation

  GetACP

  GetCPInfo

  RaiseException

  HeapAlloc

  HeapFree

  IsDebuggerPresent

  UnhandledExceptionFilter

  TerminateProcess

  IsProcessorFeaturePresent

  SystemTimeToTzSpecificLocalTime

  SystemTimeToFileTime

  GlobalAlloc

  GlobalFree

  SetFilePointer

  WideCharToMultiByte

  GetConsoleCP

  GetConsoleMode

  TlsFree

  InitializeCriticalSection

  GetCurrentProcess

  HeapSetInformation

  GetOEMCP

  SetFileAttributesW

  IsValidCodePage

  HeapSize

  HeapReAlloc

  LCMapStringW

  MultiByteToWideChar

  SetStdHandle

  WriteConsoleW

  FlushFileBuffers

  GetLocalTime

  FormatMessageW

  GetTempFileNameW

  GetFullPathNameW

  CreateDirectoryW

  GetProcessHeap

  GetModuleHandleA

  GetFileSizeEx

  GetUserDefaultLangID

  GetTickCount

  QueryPerformanceCounter

  HeapCreate

  SetLastError

  EncodePointer

  GetFileType

  InitializeCriticalSectionAndSpinCount

  SetHandleCount

  GetEnvironmentStringsW

  MoveFileExW

  FreeEnvironmentStringsW

  GetModuleFileNameW

  GetStdHandle

  DecodePointer

  GetCommandLineW

  GetStartupInfoW

  SetUnhandledExceptionFilter

  ExitProcess

  CopyFileW

  cabinet

  ord23

  ord22

  ord20

  crypt32

  CryptHashPublicKeyInfo

  CertGetCertificateContextProperty

  msi

  ord116

  ord17

  ord125

  ord171

  ord8

  ord115

  ord118

  ord205

  ord45

  ord137

  ord141

  ord238

  ord190

  ord88

  ord90

  ord173

  ord111

  ord70

  ord169

  rpcrt4

  UuidCreate

  wininet

  InternetCrackUrlW

  HttpQueryInfoW

  InternetCloseHandle

  HttpAddRequestHeadersW

  HttpOpenRequestW

  InternetErrorDlg

  InternetReadFile

  HttpSendRequestW

  InternetSetOptionW

  InternetConnectW

  InternetOpenW

  wintrust

  CryptCATAdminCalcHashFromFileHandle

  WTHelperProvDataFromStateData

  WTHelperGetProvSignerFromChain

  WinVerifyTrust

  version

  GetFileVersionInfoW

  GetFileVersionInfoSizeW

  VerQueryValueW

  Sections

  .text

  Size: 224KB - Virtual size: 223KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 101KB - Virtual size: 100KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .data

  Size: 4KB - Virtual size: 12KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .wixburn

  Size: 512B - Virtual size: 56B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .tls

  Size: 512B - Virtual size: 9B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 13KB - Virtual size: 13KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 85KB - Virtual size: 88KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE