d97b6171811733c489e0e70adac454f0_NeikiAnalytics

Sharing

Copy URL

Twitter E-mail

General

Target

d97b6171811733c489e0e70adac454f0_NeikiAnalytics
Size

3.8MB
MD5

d97b6171811733c489e0e70adac454f0
SHA1

c8812d2ac7292b601b30d1d98a2cbf6a38531093
SHA256

a1c803fcf1517028cd90efac93bebaad7a01e1ebd78421039ff0a8472ca32b8b
SHA512

b2fa0f54476fd09981bcd569d28ed598fe0bb8fd5c8cc6881d0cb997004cd214e634946b737ff1b79636559938f5502ae69a486beb2799ed22ceacd88d3a769f
SSDEEP

49152:CueTqzEBHKBLu7Y5AYKTxo3jcgHWArXN/ZOD9hSgBt+y+ijdNmkgyo:CZQEBHKRu7Y5AYK1o3jcaMD9uyNvs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d97b6171811733c489e0e70adac454f0_NeikiAnalytics

Files

d97b6171811733c489e0e70adac454f0_NeikiAnalytics
.dll windows:4 windows x86 arch:x86

96662057bde48903e62a58dbac4b113c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msi

ord46
ord34
ord145
ord120
ord114
ord67
ord70
ord47
ord147
ord144
ord31
ord158
ord20
ord117
ord204
ord112
ord189
ord48
ord118
ord103
ord170
ord124
ord73
ord171
ord74
ord163
ord160
ord159
ord121
ord125
ord17
ord8
ord32
ord49

kernel32

WriteFile
InterlockedExchange
SetEndOfFile
TerminateProcess
OpenProcess
lstrcmpiA
FreeLibrary
lstrcmpW
OpenMutexA
Sleep
GetProcAddress
LoadLibraryA
lstrcatW
FindClose
lstrcmpiW
FindNextFileA
FindNextFileW
FindFirstFileA
FindFirstFileW
RemoveDirectoryA
lstrcatA
lstrcpyA
LocalAlloc
LocalFree
WideCharToMultiByte
lstrlenA
GetVersionExA
lstrcmpA
GetTempPathW
GetTempFileNameW
CreateFileW
GetTempPathA
GetTempFileNameA
CreateFileA
DuplicateHandle
GetCurrentProcess
GetStdHandle
CreateProcessW
CreateProcessA
DeleteFileW
DeleteFileA
WaitForSingleObject
CloseHandle
GetExitCodeProcess
ReadFile
SetFilePointer
LockFile
RaiseException
UnlockFile
GetLastError
GetLocaleInfoA
lstrcpynA

user32

GetWindowLongA
GetClassNameA
PostMessageA
IsWindow
GetWindowTextW
EnumWindows
GetWindowThreadProcessId
wsprintfA
GetForegroundWindow
MessageBoxW
EnumChildWindows
SendMessageA
wsprintfW

comdlg32

GetOpenFileNameA

advapi32

RegOpenKeyExW
RegEnumValueA
EnumServicesStatusA
QueryServiceStatus
OpenServiceA
OpenSCManagerA
RegQueryValueExW
RegOpenKeyExA
RegEnumKeyExA
RegSetValueExA
RegCreateKeyExA
RegCloseKey
RegQueryInfoKeyA

ole32

CoCreateInstance
CoInitialize
CoTaskMemFree
CoUninitialize

Exports

Exports

AI_AuthorSinglePackage
AI_ResolveKnownFolders
ActiveInternetConnection
AddCaspolSecurityPolicy
BrowseForFile
CheckFreeTCPPort
CheckIfUserExists
CloseApplication
ComputeReplaceProductsList
CreateExeProcess
DeleteEmptyDirectory
DeleteFromComboBox
DeleteFromListBox
DeleteShortcuts
DetectProcess
DetectService
EnumStartedServices
ExtractComboBoxData
ExtractListBoxData
GetArpIconPath
GetFreeTCPPort
GetVideoMemory
IsRunningOnVM
JoinFiles
LaunchApp
LoadShortcutDirs
MsgBox
MsmTrialMessage
PlayAudioFile
PopulateComboBox
PopulateListBox
PrepareUpgrade
PreserveInstallType
PrintRTF
RemoveCaspolSecurityPolicy
RequiredJdkExists
RequiredJreExists
ResolveKnownFolder
RestoreLocation
RunAsAdmin
RunFinishActions
SetLatestVersionPath
StopProcess
TrialMessage
UninstallPreviousVersions
UpdateMsiEditControls
ViewReadMe
WarningMessageBox

Sections

.text
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 509B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

96662057bde48903e62a58dbac4b113c

Headers

DLL Characteristics

File Characteristics

Imports

msi

kernel32

user32

comdlg32

advapi32

ole32

Exports

Exports

Sections

.text Size: 34KB - Virtual size: 34KB

.rdata Size: 16KB - Virtual size: 15KB

.data Size: 512B - Virtual size: 509B

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 34KB - Virtual size: 34KB

.rdata
Size: 16KB - Virtual size: 15KB

.data
Size: 512B - Virtual size: 509B

.reloc
Size: 2KB - Virtual size: 2KB