3adddcf8a043e6bbab9614babfc17f20_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

3adddcf8a043e6bbab9614babfc17f20_NeikiAnalytics.exe
Size

1.5MB
MD5

3adddcf8a043e6bbab9614babfc17f20
SHA1

a7079c2ee452601fadd569712e01dbcfd758acda
SHA256

dbcdff118197ed23974e74609e26ae960a11c314e3b3e7e9c63e71f4ae784d36
SHA512

4ad5dba1dd390cf53de40826b5d5e930ddae7248aa069c017c855b77ad3a63bd655a5eb8630a1932a0b8b025fb80543cfcff5e4eadc0023366478a53c4b9a675
SSDEEP

12288:AVT4Y9Dmz5662JSZdgCnwAJAYBjvrEH7Nx:SZE5oJSPwGFrEH7Nx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3adddcf8a043e6bbab9614babfc17f20_NeikiAnalytics.exe

Files

3adddcf8a043e6bbab9614babfc17f20_NeikiAnalytics.exe
.exe windows:5 windows x86 arch:x86

5da3df3a3dedc94b321961384089c297

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OpenProcess
DuplicateHandle
WaitForMultipleObjectsEx
SleepEx
FindClose
GetExitCodeProcess
SetSystemPowerState
Beep
lstrcpynW
SetEvent
lstrcmpiW
LoadLibraryA
FreeLibrary
FileTimeToSystemTime
SystemTimeToFileTime
GetLocalTime
GetTimeFormatW
GetDateFormatW
MulDiv
CreateEventA
GetTickCount
SetThreadAffinityMask
GetCurrentProcess
GetProcessAffinityMask
SetLastError
GetCurrentProcessId
ProcessIdToSessionId
VirtualFree
QueryPerformanceCounter
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
lstrlenW
GlobalSize
GlobalUnlock
GetCurrentThread
GetThreadPriority
SetThreadPriority
SetHandleInformation
QueueUserAPC
ResumeThread
GetCurrentThreadId
TlsGetValue
ReleaseSemaphore
ReleaseMutex
CloseHandle
LoadLibraryW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
RtlUnwind
HeapDestroy
HeapCreate
GetSystemDirectoryA
GlobalFindAtomW
GetLocaleInfoA
CreateToolhelp32Snapshot
IsValidCodePage
OutputDebugStringA
GetFullPathNameW
FormatMessageW
GetLongPathNameW
GetShortPathNameW
SearchPathW
GetTempPathW
ExpandEnvironmentStringsW
SetEndOfFile
OpenFileMappingA
MapViewOfFile
lstrcpyW
UnmapViewOfFile
WriteFile
CreateSemaphoreA
LocalAlloc
GetPrivateProfileStringW
CreateDirectoryW
CopyFileW
MoveFileExW
DeleteFileW
GetPrivateProfileIntW
WritePrivateProfileStructW
GetPrivateProfileStructW
WritePrivateProfileStringW
CreateFileW
GetFileAttributesExW
SetFileAttributesW
GetFileAttributesW
FindNextFileW
FindFirstFileW
GetDiskFreeSpaceExA
Sleep
CreateMutexA
GetLastError
WaitForSingleObject
LoadLibraryExW
GetStartupInfoA
GetVersion
GetSystemInfo
GetModuleHandleW
GetProcAddress
VirtualAlloc
FlushFileBuffers
SetFilePointerEx
GetFileSizeEx
GetCommandLineW
GetDriveTypeA
OpenMutexA
GetComputerNameW
FindResourceW
LoadResource
LockResource
SizeofResource
WaitForSingleObjectEx
LocalFree
ReadFile
GetSystemTimeAsFileTime
GetModuleFileNameA
TlsFree
GlobalDeleteAtom
IsProcessorFeaturePresent
SetErrorMode
GlobalAddAtomA
GetModuleFileNameW
TerminateThread
TlsSetValue
TlsAlloc
QueryPerformanceFrequency
GetStringTypeExA
WideCharToMultiByte
GetModuleHandleA
RaiseException
CompareStringW
HeapFree
HeapAlloc

user32

SetClipboardViewer
SetWindowLongW
GetOpenClipboardWindow
GetClipboardSequenceNumber
RegisterClipboardFormatA
GetKeyState
IsWindowVisible
LoadImageW
CloseDesktop
GetUserObjectInformationA
OpenInputDesktop
GetProcessWindowStation
SystemParametersInfoA
GetForegroundWindow
CreatePopupMenu
GetKeyboardLayout
GetWindowThreadProcessId
SendInput
SetForegroundWindow
GetDesktopWindow
GetWindow
MapVirtualKeyExW
VkKeyScanExW
GetSystemMetrics
MonitorFromPoint
PtInRect
IsCharLowerA
IsCharUpperA
IsCharAlphaA
PostQuitMessage
GetWindowLongW
GetMenuItemInfoW
SetMenuItemInfoW
FindWindowW
EnumWindows
IsDlgButtonChecked
LockSetForegroundWindow
EndDialog
EnableWindow
wvsprintfA
InternalGetWindowText
GetWindowTextLengthW
GetWindowTextW
TrackPopupMenuEx
EndMenu
OffsetRect
RealChildWindowFromPoint
CallWindowProcW
SetClipboardData
ChangeClipboardChain
GetClipboardOwner
EmptyClipboard
GetClipboardData
CloseClipboard
OpenClipboard
PostThreadMessageA
EnumThreadWindows
SendMessageW
CreateWindowExA
SetTimer
KillTimer
DestroyWindow
DefWindowProcW
RegisterHotKey
UnregisterHotKey
CopyIcon
EnumDisplayMonitors
InvalidateRect
GetCursorPos
FindWindowA
PostMessageW
SendNotifyMessageW
IsZoomed
SetFocus
AttachThreadInput
GetGUIThreadInfo
GetTopWindow
GetLastActivePopup
IsRectEmpty
GetShellWindow
GetSystemMenu
GetMenu
GetMenuItemCount
GetSubMenu
GetMenuItemID
GetMenuState
SendMessageTimeoutW
SendMessageCallbackA
IsWindowEnabled
LoadCursorA
GetCursorInfo
MsgWaitForMultipleObjectsEx
WaitForInputIdle
AllowSetForegroundWindow
LockWorkStation
ExitWindowsEx
MessageBeep
EnumChildWindows
BringWindowToTop
SetRect
RegisterWindowMessageA
PeekMessageW
DispatchMessageW
GetMessageW
GetDlgCtrlID
IsWindow
FindWindowExW
GetPropA
ReplyMessage
GetParent
GetClassLongW
GetSysColor
SetWindowPos
GetClientRect
CopyImage
CreateIconFromResourceEx
GetIconInfo
GetWindowRect
DestroyIcon
FillRect
DrawIconEx
ReleaseDC
GetDC
IsIconic
ShowWindow
CharUpperA
CharLowerA
CharLowerW
CharLowerBuffW
CharUpperBuffW
SetPropA
RemovePropA
TranslateMessage
GetMonitorInfoA
MonitorFromRect
MonitorFromWindow
MsgWaitForMultipleObjects
GetAsyncKeyState
MapVirtualKeyW
GetKeyNameTextW
MessageBoxW
MessageBoxIndirectW
DialogBoxIndirectParamA
CreateDialogIndirectParamA
DialogBoxIndirectParamW
CreateDialogIndirectParamW
CreateWindowExW
DrawTextW
InsertMenuItemW
AppendMenuW
RegisterClassExW
GetClassInfoExW
GetClassNameW
GetClassNameA
GetWindowPlacement
SetWindowPlacement
ScreenToClient
ClientToScreen
MapWindowPoints
GetDlgItem
SetWindowLongA
IsWindowUnicode
GetAncestor
IsChild
WindowFromPoint

gdi32

DeleteObject
BitBlt
SelectObject
GetDIBits
GetStockObject
CreateDIBitmap
GetDeviceCaps
GetObjectW
GetPixel
CreateCompatibleDC
DeleteDC
CreateCompatibleBitmap
CreateFontIndirectW
GetObjectA

advapi32

RegCreateKeyExW
InitiateSystemShutdownW
GetSidSubAuthorityCount
GetSidSubAuthority
RegDeleteValueW
RegDeleteKeyW
GetTokenInformation
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorA
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
GetUserNameW
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW

ole32

OleUninitialize
RegisterDragDrop
RevokeDragDrop
OleInitialize
CoGetClassObject
CreateStreamOnHGlobal
ReleaseStgMedium
GetRunningObjectTable
CreateBindCtx
CoCreateInstance
CLSIDFromProgID
IIDFromString
CoGetObject
CoTaskMemFree

oleaut32

VarDecFromUI2
VarDecFromUI1
VarDecFromR8
VarDecFromI4
VarDecFromUI4
VarCyFromStr
VarCyFromR4
VarCyFromDate
VarCyFromDec
VarCyFromUI2
VarCyFromUI1
VarCyFromR8
VarCyFromI4
VarCyFromUI4
VarDateFromR4
VarDateFromDec
VarDateFromCy
VarDateFromUI2
VarDateFromUI1
VarDateFromR8
VarDateFromI4
VarDateFromUI4
SafeArrayCreate
VarBstrFromR4
VarBstrFromDec
VarBstrFromCy
VarBstrFromDate
VarDecAdd
VarDecSu
VarDecMul
VarDecDiv
VarDecFix
VarDecCmp
VarCyAdd
VarCySu
VarCyMul
VarCyRound
VarCyFix
VarCyCmp
VarAdd
VarSu
VarMul
VarDiv
VarRound
VarFix
VarCmp
VarBstrCat
VarBstrCmp
SysAllocStringLen
SysReAllocStringLen
SysStringLen
GetActiveObject
SafeArrayAllocData
SafeArrayGetDim
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayUnlock
SafeArrayLock
SafeArrayPtrOfIndex
OleCreateFontIndirect
VariantInit
VarBstrFromR8
VarDateFromStr
VarR8Round
SysFreeString
SafeArrayDestroy
VariantClear
SysReAllocString
SafeArrayDestroyDescriptor
SysAllocString
GetErrorInfo
SafeArrayRedim
SafeArrayAllocDescriptor
OleLoadPicture
OleCreatePictureIndirect
VarUdateFromDate
SystemTimeToVariantTime
SafeArrayCopy
VariantCopy
SafeArrayGetVartype
SafeArrayCreateEx
VarCyNeg
VarDecNeg
VarNeg
VarDecFromCy
VarDecFromDate
VarDecFromR4
VarDecFromStr
VarR4FromCy
VarR4FromDec
VarR4FromDate
VarNot
VarI4FromR4
VarI4FromDec
VarI4FromCy
VarI4FromDate
VarI4FromStr
VariantChangeTypeEx
VarDecRound
VariantTimeToSystemTime
VarR8FromDec
VarR8FromCy
VarR8FromStr
VarR4FromStr

winmm

timeBeginPeriod
timeEndPeriod
timeGetTime
PlaySoundW

shlwapi

StrChrW
PathFindFileNameA
ord158
StrCatW
StrCmpW
StrCmpIW
PathGetArgsW
StrStrIW
SHDeleteKeyW
SHDeleteEmptyKeyW
SHCreateStreamOnFileW
StrRChrA
StrRetToStrW
PathSkipRootA

comctl32

InitCommonControlsEx
ImageList_GetIcon
ImageList_Add
ImageList_Create

msvcrt

__CxxFrameHandler
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_amsg_exit
_initterm
_acmdln
_XcptFilter
_cexit
__getmainargs
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
??1type_info@@UAE@XZ
_ismbblead
isspace
isxdigit
isgraph
isprint
ispunct
iscntrl
strncmp
abs
exit
strstr
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
?_set_new_mode@@YAHH@Z
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
_beginthreadex
_endthreadex
_CxxThrowException
memchr
strlen
malloc
realloc
calloc
free
_msize
_except_handler3
_strtime
_strdate
_ultoa
_i64toa
strcpy
fabs
sqrt
memmove
_itoa
strrchr
memcmp
memcpy
_exit
memset
strchr

shell32

SHGetDesktopFolder
SHGetMalloc
SHGetPathFromIDListW
SHGetSpecialFolderPathW
SHFileOperationW
SHChangeNotify
ShellExecuteExW
SHGetFileInfoW
SHBindToParent
SHGetSpecialFolderLocation

Exports

Exports

AdjustWindowPos
AllowActivateWindows
AutoSizeControls
Brac2
ConvertSignedUnsigned
Crc32
CreateCsScript
CreateCsv
CreateEnumFiles
CreateFileU
CreateRegExpMenu
CreateShortcutEx
CreateStringMap
CreateXml
DetectStringEncoding
DialogBoxIndirectParamU
DpiClientToScreen
DpiGetDPI
DpiGetWindowRect
DpiIsWindowScaled
DpiMapWindowPoints
DpiScale
DpiScreenToClient
DrawTextU
EditReplaceSel
EnsureLoggedOn
EnumProcessesEx
EnumQmThreads
ExeExtractFile
ExeGetResourceData
FileExists
FindFirstFileU
FindNextFileU
FormatKeyString
GetCPU
GetCallStack
GetDiskUsage
GetExeResHandle
GetFileIcon
GetFileOrFolderSize
GetFullPath
GetMod
GetProcessExename
GetProcessIntegrityLevel
GetProcessUacInfo
GetQmThreadInfo
GetSecurityAttributes
GetShortcutInfoEx
GetToolbarOwner
GetUserInfo
GetWindowIcon
HtmlHelpU
InitWindowsDll
InsertMenuItemU
InterfaceForDll
IsExtendedKey
IsHungWindow
IsLoggedOn
IsThreadRunning
IsUserAdmin
IsValidCallback
IsWindow64Bit
LoadPictureFile
MemCompare
MenuGetString
MenuSetString
MonitorFromIndex
MonitorIndex
PerfFirst
PerfNext
PerfOut
PidlFromStr
PidlToStr
ProcessHandleToId
ProcessNameToId
QmKeyCodeFromVK
QmKeyCodeToVK
QmRegisterDropTarget
QmSetWindowClassFlags
QmUnregisterDropTarget
RandomInt
RandomNumber
RealGetKeyState
RealGetNextWindow
RealGetParent
RedirectQmOutput
RegisterComComponent
RichEditLoad
RichEditSave
Round
RtOptions
SaveBitmap
SelStr
SetPrivilege
SetWinStyle
StrCompare
StrCompareEx
StrCompareN
SubclassWindow
WaitForAnActiveWindow
__CDD_CanHaveText
__CDD_LoadControlDllOnDemand
__CompileDialogDefinition
__Crc
__GetQmItemIcon
__ImageListLoad
__SfMap
__Str_GetNotThis
__SysLinkOnClick
__Test
__TrackPopupMenu
__Val
__VarProp_Get
__VarProp_GetVar
__VarProp_Remove
__VarProp_Set
q_calloc
q_free
q_isalnum
q_iscsym
q_isdigit
q_malloc
q_memicmp
q_msize
q_printf
q_realloc
q_sort
q_strdup
q_stricmp
q_strnicmp

Sections

.text
Size: 316KB - Virtual size: 316KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5da3df3a3dedc94b321961384089c297

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

ole32

oleaut32

winmm

shlwapi

comctl32

msvcrt

shell32

Exports

Exports

Sections

.text Size: 316KB - Virtual size: 316KB

.rdata Size: 60KB - Virtual size: 60KB

.data Size: 3KB - Virtual size: 13KB

.rsrc Size: 1.1MB - Virtual size: 1.1MB

.text
Size: 316KB - Virtual size: 316KB

.rdata
Size: 60KB - Virtual size: 60KB

.data
Size: 3KB - Virtual size: 13KB

.rsrc
Size: 1.1MB - Virtual size: 1.1MB