87ebe3bbde911209373f98679e039300_NeikiAnalytics[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

87ebe3bbde911209373f98679e039300_NeikiAnalytics.exe

IMPHASH 84062c623770f0d888e4ca58451aa7ad
SHA256 258fdbddc8ae716a73b26ec17d3dc8773a427f0b695f2fddfbda0c5c11a7516d
MD5 87ebe3bbde911209373f98679e039300
SHA1 3849b4f790a30f626b6d7adfc4920a4490790a87
SHA512 282ca968ecbaab661f96fff3811c92210c23fa2f198fb524d76f6fcd043968908174decea37a7c8b641de5f10bfe668866865da0bc6ca94dcda3299c6f12efc7
SSDEEP 12288:3iFZhAH10EjNRb8DZqhd4IVdyZa4IGm16nnk7EzIvUFU:yFZ2HRjNKghd4MI0unQE08FU
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

9e:e5:96:33:35:7a:e3:e4:dd:bd:0f:73:a6:63:ad:21:8e:dc:74:9a:9f:0e:1a:f7:dd:1e:63:1a:42:f6:a3:6f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Skocremens,OU=Etching Prewarms\ ,O=Skocremens,L=Meersburg,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c2074656d706572617475726e6472696e674077656174686572636f636b792e5265

Chains

May 16, 2024

Minor OS version

1

Major OS version

5

Entry point

14340

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCloseKey RegDeleteKeyW RegDeleteValueW RegEnumKeyW RegEnumValueW RegQueryValueExW RegSetValueExW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW SetFileSecurityW RegCreateKeyExW RegOpenKeyExW

shell32

SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteExW

ole32

OleInitialize OleUninitialize CoTaskMemFree IIDFromString CoCreateInstance

comctl32

ord17 ImageList_Destroy ImageList_AddMasked ImageList_Create

user32

PeekMessageW DispatchMessageW wsprintfA SystemParametersInfoW SetClassLongW GetWindowLongW GetSysColor ScreenToClient SetCursor GetWindowRect TrackPopupMenu AppendMenuW EnableMenuItem CreatePopupMenu GetSystemMenu GetSystemMetrics IsWindowEnabled EmptyClipboard SetClipboardData CloseClipboard OpenClipboard CheckDlgButton EndDialog DialogBoxParamW IsWindowVisible SetWindowPos CreateWindowExW GetClassInfoW SetDlgItemTextW CallWindowProcW GetMessagePos CharNextW ExitWindowsEx SetWindowTextW SetTimer CreateDialogParamW DestroyWindow LoadImageW FindWindowExW SetWindowLongW InvalidateRect ReleaseDC GetDC SetForegroundWindow EnableWindow GetDlgItem ShowWindow IsWindow PostQuitMessage SendMessageTimeoutW SendMessageW wsprintfW FillRect GetClientRect EndPaint BeginPaint DrawTextW DefWindowProcW GetDlgItemTextW CharNextA CharPrevW RegisterClassW MessageBoxIndirectW LoadCursorW

gdi32

SetBkMode CreateBrushIndirect GetDeviceCaps SelectObject DeleteObject SetBkColor SetTextColor CreateFontIndirectW

kernel32

GetLastError WaitForSingleObject GetExitCodeProcess RemoveDirectoryW GetTempFileNameW CreateDirectoryW WideCharToMultiByte lstrlenW lstrcpynW GlobalLock GlobalUnlock CreateThread GetDiskFreeSpaceW CopyFileW GetVersionExW GetWindowsDirectoryW ExitProcess GetCurrentProcess SetErrorMode CreateProcessW SetEnvironmentVariableW GetCommandLineW GetModuleFileNameW GetTickCount GetFileSize CreateFileW MultiByteToWideChar MoveFileW WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA lstrcmpiW lstrcmpW MulDiv GlobalFree GlobalAlloc LoadLibraryExW GetModuleHandleW FreeLibrary Sleep CloseHandle SetFileTime SetFilePointer SetFileAttributesW ReadFile GetShortPathNameW GetFullPathNameW GetFileAttributesW FindNextFileW FindFirstFileW FindClose DeleteFileW CompareFileTime SearchPathW SetCurrentDirectoryW ExpandEnvironmentStringsW WriteFile MoveFileExW GetSystemDirectoryW GetModuleHandleA GetProcAddress lstrcmpiA lstrcpyA lstrcatW GetTempPathW

$PLUGINSDIR/System.dll

IMPHASH 4f33ea844b96a31c8f4690530ba63854
SHA256 edf12a3040cff0d801a86c02313d6605b41d766807f3dcb261754cf01b4e14b9
MD5 e227391c7ff576135eac4871e78ebe2d
SHA1 85d4bdbb79bdc47095ca35ed2141b2e64d029218
SHA512 06f1b65dd980c6aac17518faf34d200453fedf893efa01bfc71128ccb1a70abcd7165f581c9789caf80776fac313a4e754df7b58f7467930a666de37b55396a6
SSDEEP 192:asA1YOTDExj7EFrYCT4E8y3hoSdtTgwF43E7QbGPXI9uIc6w79Mw:hR7SrtTv53tdtTgwF4SQbGPX36wJMw
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

6730

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Hjemfalder/Alife.non

SHA256 57abea180cc87d8b22d303fa59ca4d52cfccfa73fa2a8aa72d511339235af958
MD5 baf5d8c75ef42ada3192c9ed7bcf2f28
SHA1 ac782de0b4ae05502d97cd21143e806405688940
SHA512 8bb86fb60f9e25fb15e6e3937da130d81d2584342ca28b53c01290184de887738c96ab789c813c5e54ce8c1d5cf139b1928ab0ae6ab4b5adf6e18fab931b6fde
SSDEEP 384:JYpIy8+3Fai9eREWiavbwsItuWaklgeIYha2:J8q2W6dtuJygQ
MD5 SHA1 SHA512 SSDEEP

Hjemfalder/Tvelysets.txt

SHA256 6da3183fdf78fa54e59dd67d4df2893fd0d69c2d76cb687ff6c271014ff19bab
MD5 016e1ac61b519d6bf36e9bac05b7763b
SHA1 2a7497efa2941061ed218e93e887e90398510990
SHA512 dc888374f9606b939a0f9beda786a622b2506f629a4371acdd63e7f2ff8632c78d792a832601cc19140e75dcae047fc0c8dbfd76a200120dd0076698564ea57d
MD5 SHA1 SHA512

Hjemfalder/altaid.tel

SHA256 483de8ff7ff7ea92d1d35d7a1869183430e4c6a519933e28c7459a7c906332d3
MD5 c89a4202414ced28b14ba0ff7fdc8d2c
SHA1 72f0f08f597bcf29e156bd9384070c933ed3a2a8
SHA512 08f96275fb5f2edc1801b318f69c0c36a10106d1e611f585bdf31ddab594464751b5da042d65eb663eaaa567b2bb4e503fbd0264c7fff82f378543fad256f74c
SSDEEP 24:mMmYRhr/52FKDsXiC6kwBqQ1XIbVfjP8zCCTss0nE7E+VaLASDOp9u/:mydjgX61IQ2R8Losq2VaL69u
MD5 SHA1 SHA512 SSDEEP

Hjemfalder/forbeholdsklausul.til

SHA256 d3bf0efdde83a621ed38476557cb8cffb97d4696262cee172c6dce3773ab6568
MD5 131dbd104624dff65f5d6dd92a18da84
SHA1 81195cbea085bbbe34b8080a7d5f4855a3166156
SHA512 fac9d2381da177d4045a33966b9e63e500dc80ba9a6baac7ef746ea8be13803c6b8abf83a5f59fdde2193efafc4041510bc354838d2888b44cd2c5df2b2e6b0b
SSDEEP 48:h9jygpvtKWu+6X6sxQzBZy2W2H84yKYUi:njAWP6X6QIPH8B
MD5 SHA1 SHA512 SSDEEP

Typhlomolge.Sem

SHA256 ca73b61a47cd22e6d8168068d45c05cbb8ae7d829acd0e793caabfb3d3828f96
MD5 8a9b3d385c2e67ebc3557948f7fce0ef
SHA1 a9fc94c13b09bb00e9e6c5c347735290fb896b32
SHA512 944b12418a6905d994584719311606d6c24780a439c4417f5d7ef326382132e283316adfc67eb1b93579ab441dbdd461d586509a92354bd60885db2e938a73a5
SSDEEP 6144:VDnyb5X32aWeMlJG2W5/JUkKfOs4apm5J2Ykb:Vr6h32HGH/XMOjJgb
MD5 SHA1 SHA512 SSDEEP

87ebe3bbde911209373f98679e039300_NeikiAnalytics.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Hjemfalder/Alife.non

Hjemfalder/Tvelysets.txt

Hjemfalder/altaid.tel

Hjemfalder/forbeholdsklausul.til

Typhlomolge.Sem

Sharing

General

Malware Config

Signatures

File Explorer

87ebe3bbde911209373f98679e039300_NeikiAnalytics.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Hjemfalder/Alife.non

Hjemfalder/Tvelysets.txt

Hjemfalder/altaid.tel

Hjemfalder/forbeholdsklausul.til

Typhlomolge.Sem