Overview

overview

7

Static

static

7

c2ffaacfbc...cs.exe

windows7-x64

7

c2ffaacfbc...cs.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...nu.dll

windows7-x64

3

$PLUGINSDI...nu.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

AM_Exit.exe

windows7-x64

1

AM_Exit.exe

windows10-2004-x64

1

AM_Restorer.exe

windows7-x64

1

AM_Restorer.exe

windows10-2004-x64

1

AmlMaple.dll

windows7-x64

1

AmlMaple.dll

windows10-2004-x64

1

AmlMaple.exe

windows7-x64

7

AmlMaple.exe

windows10-2004-x64

7

FlgCrt.dll

windows7-x64

1

FlgCrt.dll

windows10-2004-x64

3

GGSoundUtil.dll

windows7-x64

1

GGSoundUtil.dll

windows10-2004-x64

1

Help_By.chm

windows7-x64

1

Help_By.chm

windows10-2004-x64

1

Help_En.chm

windows7-x64

1

Help_En.chm

windows10-2004-x64

1

Help_Ru.chm

windows7-x64

1

Help_Ru.chm

windows10-2004-x64

1

Help_UK.chm

windows7-x64

1

Help_UK.chm

windows10-2004-x64

1

SHOW_COMMA...YS.bat

windows7-x64

7

SHOW_COMMA...YS.bat

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    c2ffaacfbc43f5107a417a72cf80f930_NeikiAnalytics

  • Size

    1.3MB

  • MD5

    c2ffaacfbc43f5107a417a72cf80f930

  • SHA1

    4851dd223bea3b62af0be65e09021c420fa09791

  • SHA256

    f402560019eb33dea9ced1593c0cb5d2f6fff974d4e43db8ba551b33b78c8fe8

  • SHA512

    4de2995bffe06115c9bce5b4a6bc942f3102521ef3d5e03ed7213164ea10a16f4c282c4d950e961710005fa513f2cff9024cdec327d40da7483374b41fcd9777

  • SSDEEP

    24576:3sG8dyxls+IUN58GKQUEu97iG+5WQ21cuJ/0AjG8RSNQMABD27fl9zxd23d:P8YDIaw2e7rUY1cuJNG8RBJWlhy3d

Score
7/10
vmprotect

Malware Config

Signatures

  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Unsigned PE 14 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 4 IoCs
    installer

Files

  • c2ffaacfbc43f5107a417a72cf80f930_NeikiAnalytics
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/LangDLL.dll
    .dll windows:4 windows x86 arch:x86

    9b6b6a7858e17fb0b17e1c1428330343


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/OtherProducts.ini
  • $PLUGINSDIR/StartMenu.dll
    .dll windows:4 windows x86 arch:x86

    a648aeaa164b592c1e8892a10400b5ae


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • AM_Exit.exe
    .exe windows:4 windows x86 arch:x86

    8a567512bffdd114fff0e66f783ee625


    Headers

    Imports

    Sections

  • AM_Restorer.exe
    .exe windows:4 windows x86 arch:x86

    d3f9b5423c87da0a4dd66bc48bce344f


    Headers

    Imports

    Sections

  • AmlMaple.dll
    .dll windows:4 windows x86 arch:x86

    c9fcf4c7eef8679b74e7edd1e8a1e09a


    Headers

    Imports

    Exports

    Sections

  • AmlMaple.exe
    .exe windows:4 windows x86 arch:x86

    861048d5d64c1cd9359f4191ba4806d8


    Headers

    Imports

    Sections

  • Belorussian.lng
  • BrazilianPortuguese.lng
  • Bulgarian.lng
  • Chinese Simplified.lng
  • FlgCrt.dll
    .dll windows:4 windows x86 arch:x86

    4002a84c65eec45213b5a2668d8a3aaa


    Headers

    Imports

    Exports

    Sections

  • French.lng
  • GGSoundUtil.dll
    .dll windows:4 windows x86 arch:x86

    4b8c6e649fedd5aa2b147148cdaddca5


    Headers

    Imports

    Exports

    Sections

  • German.lng
  • Hebrew.lng
  • Hellenic.lng
  • Help_By.chm
    .chm
  • Help_En.chm
    .chm
  • Help_Ru.chm
    .chm
  • Help_UK.chm
    .chm
  • Italian.lng
  • Kazakh.lng
  • Korean.lng
  • Lithuanian.lng
  • LocalizationExample.lng
  • Magyar.lng
  • Norwegian.lng
  • Polish.lng
  • Russian.lng
  • SHOW_COMMAND_LINE_KEYS.Bat
  • SHOW_DETECT_langs.Bat
  • SHOW_MENU.Bat
  • SHOW_SETTINGS.Bat
  • Serbian.lng
  • Sinhala.lng
  • Spanish.lng
  • Turkish.lng
  • Ukrainian.lng
  • UpdateReport_Pl.htm
  • UpdateReport_Ru.htm
  • already_work.wav
  • arabic.lng
  • encode.wav
  • lang_blinked.wav
  • start.wav
  • start_asadmin.wav
  • uninst.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/LangDLL.dll
    .dll windows:4 windows x86 arch:x86

    9b6b6a7858e17fb0b17e1c1428330343


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp