General

  • Target

    a31d2735a50530546ca5fefbefd9fc70_NeikiAnalytics

  • Size

    4.8MB

  • MD5

    a31d2735a50530546ca5fefbefd9fc70

  • SHA1

    2853f42cc056d34c0b3d78ab73cc05e1dc477191

  • SHA256

    9e31df41d4f59125e59eb678181e02fba9a1689a8d23f165318403f4775a05c2

  • SHA512

    bde1b133c6dd2131ef917cb084e519bef046fb6db2c7a9be409d6fc36cd4235f44ef372e4543133358bff8961ce6aa2d6c337dddf890de4abcb593a455809a48

  • SSDEEP

    98304:BKo5nuqEIZxbW6Pw0FESW4fVqceQ4HN8PMeYLmi7JB:vbhPw0FEifVCFaECi9B

Score
3/10

Malware Config

Signatures

  • Unsigned PE 4 IoCs

    Checks for missing Authenticode signature.

Files

  • a31d2735a50530546ca5fefbefd9fc70_NeikiAnalytics
    .exe windows:4 windows x86 arch:x86

    ee90b300161ad563b7387f4d64789dc2


    Headers

    Imports

    Sections

  • $APPDATA/$APPDATA/kuwodata/kwmusic2013/Conf/p2pconf/setup.xml
    .xml
  • $APPDATA/kuwodata/kwmusic2013/Res/cache/DOWNLOAD_ARTISTPIC/49FF334D.dat
    .jpg
  • $PLUGINSDIR/InstLancher.dll
    .dll windows:5 windows x86 arch:x86

    3509740b337b00c63de279fe136ea41e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KuWoNsis_new.dll
    .dll windows:5 windows x86 arch:x86

    f7bdf84c2df6c97befad5bdb81175b23


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KwBindApp.ini
  • $PLUGINSDIR/KwMusicNsis.dll
    .dll windows:5 windows x86 arch:x86

    d720c1fe9f9034edd57dcfc83df1eadf


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KwUnzip.dll
    .dll windows:5 windows x86 arch:x86

    9d1e5b4c8eb7a3bc71de8787dc7cf677


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KwVistaAssist.dll
    .dll windows:6 windows x86 arch:x86

    1107870b58f6f57cb18b2b2034cd590e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ShellLink.dll
    .dll windows:5 windows x86 arch:x86

    50112fdd20200a51dbedeae8f1f33cdb


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    039bcbc605477e8e87ec550c2e60e748


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/instAD/ad01.png
    .png
  • $PLUGINSDIR/instAD/ad02.png
    .png
  • $PLUGINSDIR/instAD/ad03.png
    .png
  • $PLUGINSDIR/instAD/ad04.png
    .png
  • $PLUGINSDIR/instAD/bk_install.png
    .png
  • $PLUGINSDIR/instAD/instAD.dat
  • $TEMP/KWMUSIC/channel.ini
  • $TEMP/KWMUSIC/duPlugab.exe
    .exe windows:4 windows x86 arch:x86

    ee90b300161ad563b7387f4d64789dc2


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/ExecWaitEx.dll
    .dll windows:5 windows x86 arch:x86

    3353e1f9f8993252a869f4e0fe9f5666


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KuWoNsis_new.dll
    .dll windows:5 windows x86 arch:x86

    8cc197da719dfd6bd5e496af12ba45af


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    039bcbc605477e8e87ec550c2e60e748


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/inetc.dll
    .dll windows:6 windows x86 arch:x86

    3907333ed0258fd761f45695b76b5c4e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $TEMP/KWMUSIC/BindConfig.ini
  • $TEMP/KWMUSIC/mylk.dat
  • $TEMP/KwBindApp.exe
    .exe windows:5 windows x86 arch:x86

    36d2d79a6611b183022eb68ed45a3e1a


    Code Sign

    Headers

    Imports

    Sections

  • $TEMP/KwBindApp.ini
  • $TEMP/curl.exe
    .exe windows:5 windows x86 arch:x86

    8ade879b2aedf1dc1db682fd7ddf08f8


    Code Sign

    Headers

    Imports

    Sections

  • $TEMP/kwuninsthelper.exe
    .exe windows:4 windows x86 arch:x86

    ee90b300161ad563b7387f4d64789dc2


    Code Sign

    Headers

    Imports

    Sections

  • $WINDIR/KwYlx.dat
  • KwMusic.exe
    .exe windows:5 windows x86 arch:x86

    6289f52604730c650addf1b31e032785


    Code Sign

    Headers

    Imports

    Sections

  • bin/AdbWinApi.dll
    .dll windows:6 windows x86 arch:x86

    776334619bd19ec23e3a7a275473b5a7


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/AdbWinUsbApi.dll
    .dll windows:6 windows x86 arch:x86

    7a47d15cc64e5aab2606c46fd1fb8247


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/AudFprint.dll
    .dll windows:6 windows x86 arch:x86

    3db96d82ebae778f4b3714af73d057eb


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/AudioBuffer.dll
    .dll windows:5 windows x86 arch:x86

    2ea59a987a84ad1e5e11dde2542bc594


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/CKuwoPlayer.dll
    .dll windows:5 windows x86 arch:x86

    e2e27688989898c1655988e084bb39cd


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/CWmpPlayer.dll
    .dll windows:5 windows x86 arch:x86

    db5185d842767b66ec938a9743b66e72


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/CoreAVC0.ax
    .dll regsvr32 windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • bin/DshowPlayer.dll
    .dll windows:5 windows x86 arch:x86

    7665bc2c981c50f4d1c2e75e871e4a96


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/DuiLib.dll
    .dll windows:5 windows x86 arch:x86

    10fd4b02de2339625ece6e8be199f50c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/DumpReport.exe
    .exe windows:5 windows x86 arch:x86

    fa6f617e6ba0878bb1dd7bcbfb320456


    Code Sign

    Headers

    Imports

    Sections

  • bin/Encode.exe
    .exe windows:5 windows x86 arch:x86

    e616c2903083dd99b5ef8b8f99a8e9c4


    Code Sign

    Headers

    Imports

    Sections

  • bin/KWAudioEffx.dll
    .dll windows:5 windows x86 arch:x86

    387a425e8924b94dd7f6ab156a9d9c95


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KWUpdate.exe
    .exe windows:5 windows x86 arch:x86

    efa42bf976e54e5329c1dc8d94a697f2


    Code Sign

    Headers

    Imports

    Sections

  • bin/Kuwo.QuickLaunch.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    974468d78d2787fa743446f2afb8866d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KuwoSyncMobile.dll
    .dll windows:5 windows x86 arch:x86

    74f35f01d8646d64ff20c3c72dc9c3e0


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwAppTreasrue.dll
    .dll windows:5 windows x86 arch:x86

    55e1af6f9525a0cfaff92a5077cf38be


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwAudioEffect.ax
    .dll regsvr32 windows:5 windows x86 arch:x86

    6aa441a96078b7cfa3c1f6c1913ca1ec


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwConfig.exe
    .exe windows:5 windows x86 arch:x86

    6ed1d644dfe96cd6295967d290354cef


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwDPGame.exe
    .exe windows:5 windows x86 arch:x86

    3028465870c5f98fa086facbb6a57a64


    Code Sign

    Headers

    Imports

    Sections

  • bin/KwDataDef.dll
    .dll windows:5 windows x86 arch:x86

    816fa217204f9cccb686ec2b6fcc0e62


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwHttp.dll
    .dll windows:5 windows x86 arch:x86

    c079d35b955a4be42c2a9cdb21b8161b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/KwHttpRequestMgr.dll
    .dll windows:5 windows x86 arch:x86


    Headers

    Sections

  • bin/mylkx.dat
  • readme.txt