6e39bd9e74d37b5d549024fbd269af90_NeikiAnalytics

Sharing

Copy URL Twitter E-mail

General

Target

6e39bd9e74d37b5d549024fbd269af90_NeikiAnalytics
Size

594KB
MD5

6e39bd9e74d37b5d549024fbd269af90
SHA1

2adaabc4ba44a715789b38f55984621cc44b71f0
SHA256

9e2493ae610fc1a9e756ea75b6d94283f3076d201685aeef4a9ae0d30cb46ab9
SHA512

8c29655a49c04dd49067a9164eb4e9e06076931804959ef46453e06de23cbf58d8970b95f5cad267376d6238ea9a1fbe00b5694fde231a3eaaa0569c2e2e6746
SSDEEP

12288:+/7tUvuHngDha/crVsX36rN50dK8fQlhnKzWZQ2Tt+:+/7JHngBsX1ZfeRKzW22T

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6e39bd9e74d37b5d549024fbd269af90_NeikiAnalytics

Files

6e39bd9e74d37b5d549024fbd269af90_NeikiAnalytics
.exe windows:4 windows x86 arch:x86

b57bee36f079275b575f8244a7d9c0ed

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

comdlg32

GetSaveFileNameA
GetOpenFileNameA
GetFileTitleA

kernel32

SizeofResource
GlobalFree
GetModuleHandleA
lstrcmpA
GlobalDeleteAtom
GlobalAddAtomA
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
lstrlenA
lstrcmpiA
WaitForSingleObject
ReleaseMutex
LoadLibraryA
GetProcAddress
FreeLibrary
FindResourceA
LoadResource
LockResource
FreeResource
LocalFree
LocalReAlloc
LocalAlloc
WriteProfileStringA
GetProfileStringA
CreateProcessA
GetLastError
GetVersionExA
GetCurrentThreadId
GetVersion
ExitProcess
GetModuleFileNameA
SetCurrentDirectoryA
GlobalAlloc
InterlockedDecrement
GetStartupInfoA
GetVolumeInformationA
GetFileAttributesA
GetFullPathNameA
WritePrivateProfileStringA
GetPrivateProfileStringA
WideCharToMultiByte
InterlockedIncrement
FatalExit
GetCurrentDirectoryA
GlobalLock
GlobalUnlock
MultiByteToWideChar

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

user32

DestroyWindow
EnableWindow
GetActiveWindow
GetDlgCtrlID
UpdateWindow
SetForegroundWindow
ShowWindow
SetDlgItemTextA
SetWindowPos
GetWindowRect
GetParent
CreateDialogParamA
SetFocus
DispatchMessageA
TranslateMessage
DefWindowProcA
IsDialogMessageA
PeekMessageA
SetWindowTextA
SetActiveWindow
IsIconic
MessageBoxA
LoadStringA
PostThreadMessageA
PostMessageA
SetClipboardData
CloseClipboard
OpenClipboard
GetSystemMetrics
SetCursor
LoadCursorA
ShowCursor
DestroyCursor
SetCursorPos
ReleaseDC
IsZoomed
GetDC
SetWindowLongA
CreateWindowExA
RegisterClassA
EndPaint
BeginPaint
MoveWindow
DialogBoxParamA
EndDialog
GetDlgItem
GetDlgItemTextA
SendDlgItemMessageA
SendMessageA
IsWindow
GetClassNameA
GetWindowTextLengthA
HideCaret
ShowCaret
ExcludeUpdateRgn
GetWindowTextA
IsWindowEnabled
IntersectRect
DrawFocusRect
DefDlgProcA
InflateRect
OffsetRect
RemovePropA
IsWindowUnicode
SetPropA
GetPropA
DefMDIChildProcA
ChildWindowFromPoint
DlgDirListA
GetMenuItemID
GetCursorPos
BringWindowToTop
ValidateRect
ScrollWindow
EnableScrollBar
UnregisterClassA
IsWindowVisible
GetWindow
DrawTextA
IsChild
LoadAcceleratorsA
GetMenu
DefFrameProcA
GetWindowDC
ClientToScreen
ScreenToClient
GetClassLongA
SetScrollPos
ShowScrollBar
SetScrollRange
CharNextA
GetUpdateRect
GetFocus
OemToCharA
GetClassInfoA
GetSysColor
CallWindowProcA
SetParent
EnumChildWindows
ReleaseCapture
GetClientRect
SetCapture
LoadBitmapA
DestroyIcon
DeleteMenu
GetSubMenu
AppendMenuA
ModifyMenuA
CheckMenuItem
EnableMenuItem
LoadMenuA
GetMenuItemCount
FindWindowA
PostQuitMessage
WinHelpA
CallNextHookEx
InvalidateRect
MessageBeep
UnhookWindowsHookEx
GetKeyboardType
LoadIconA
RegisterWindowMessageA
SetWindowsHookExA
GetDesktopWindow
GetKeyState
TranslateMDISysAccel
TranslateAcceleratorA
GetMessageA
FillRect
PtInRect
MapWindowPoints
GetWindowLongA

gdi32

EndDoc
SetBkColor
RealizePalette
CreateICA
UpdateColors
GetTextExtentPointA
GetTextExtentPoint32A
SelectObject
SetTextColor
TextOutA
GetTextColor
DeleteDC
StretchBlt
GetObjectA
CreateCompatibleDC
GetTextMetricsA
AbortDoc
CreatePen
StartPage
StartDocA
SetAbortProc
Escape
CreateDCA
DeleteObject
EndPage
GetDeviceCaps
SetBkMode
SelectPalette
LineTo
MoveToEx
ExtCreatePen
Polyline
SetPixel
GetClipBox
Ellipse
CreateSolidBrush
Rectangle
CreatePatternBrush
SetROP2
BitBlt
GdiComment
CreateFontA
CreateBitmap
ExtTextOutA
PatBlt
IntersectClipRect
CreateBrushIndirect
GetStockObject
SetWindowOrgEx
CreatePalette
CreateDiscardableBitmap
StretchDIBits
CreateDIBitmap
RectVisible

ole32

OleUninitialize
StringFromCLSID
CoTaskMemFree
CoRevokeClassObject
CoRegisterClassObject
OleInitialize

oleaut32

VariantClear
RegisterTypeLi
SysStringByteLen
SysAllocString
SysFreeString
SysAllocStringByteLen
LoadTypeLi
LoadRegTypeLi
SetErrorInfo

advapi32

RegEnumKeyExA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey

psp_wobj

?createWOptServerSinkInterface@@YAPAVwOptServerSinkInterface@@XZ
?writeProjectFiles@@YAHABV?$basic_string_kludged@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0ABV?$list@V?$basic_string_kludged@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string_kludged@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@2@_N@Z
?readProjectFiles@@YAHABV?$basic_string_kludged@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0AAV?$list@V?$basic_string_kludged@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string_kludged@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@2@_N@Z

orcadfnc

OrCADFncEntry
OrCADFncInit

msvcrt

__getmainargs
_acmdln
_XcptFilter
_exit
?terminate@@YAXXZ
_initterm
_except_handler3
_onexit
__dllonexit
??1type_info@@UAE@XZ
ftell
fseek
fread
fwrite
_errno
wcslen
isalpha
tolower
strpbrk
vfprintf
fflush
_strdup
_controlfp
localtime
asctime
strftime
atol
tmpnam
exit
wcstombs
fgets
exp
time
ctime
__p__fmode
_adjust_fdiv
__setusermatherr
isspace
strtok
asin
acos
sin
atan2
__p__commode
malloc
_open
_read
strncmp
strrchr
fclose
abs
ceil
fopen
isdigit
toupper
pow
sqrt
log
strcspn
fprintf
_splitpath
mbstowcs
strstr
log10
remove
_stat
strncpy
sscanf
strcmp
_CxxThrowException
atof
memset
strcpy
__set_app_type
free
strcat
strncat
atoi
_purecall
memcpy
memcmp
_snprintf
strlen
strchr
floor
_ftol
_EH_prolog
__CxxFrameHandler
memmove
fabs
sprintf
??3@YAXPAX@Z
??2@YAPAXI@Z
cos
_strnicmp
vsprintf
_close
_getcwd
_strupr
_utime
_strcmpi
_stricmp
_mkdir
_unlink
_access

msvcp50

?_Xran@std@@YAXXZ
?_Xlen@std@@YAXXZ

shell32

ShellExecuteA

Exports

Exports

Expn
Ln

Sections

.text
Size: 425KB - Virtual size: 424KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 31KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 97KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b57bee36f079275b575f8244a7d9c0ed

Headers

File Characteristics

Imports

comdlg32

kernel32

winspool.drv

user32

gdi32

ole32

oleaut32

advapi32

psp_wobj

orcadfnc

msvcrt

msvcp50

shell32

Exports

Exports

Sections

.text Size: 425KB - Virtual size: 424KB

.rdata Size: 39KB - Virtual size: 39KB

.data Size: 31KB - Virtual size: 58KB

.rsrc Size: 97KB - Virtual size: 97KB

.text
Size: 425KB - Virtual size: 424KB

.rdata
Size: 39KB - Virtual size: 39KB

.data
Size: 31KB - Virtual size: 58KB

.rsrc
Size: 97KB - Virtual size: 97KB