e9b9de1d112c662d06afb18cfb12e1b0_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

e9b9de1d112c662d06afb18cfb12e1b0_NeikiAnalytics.exe
Size

2.7MB
MD5

e9b9de1d112c662d06afb18cfb12e1b0
SHA1

1c8e155181099f873b99c564d994a00f74958f20
SHA256

35c14bd053fd601b68e0230f0b20372ab2b7b095957863d1d589980258f397d3
SHA512

f148dc2709ddf6c68e3d7fd1aef4092a19364307e908937e09863026963a6efd211b41dea8274f221b2d5f6ea612a823f251e5e91af47fb8a908a4a2d63c8735
SSDEEP

49152:aWj/vUq/PBuD64F2P51EGEROypNSl9auK33F/DIVW/F6Di2M9Jh+uOXx:bjEQThoGAylMPpQW/FWHMZJq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e9b9de1d112c662d06afb18cfb12e1b0_NeikiAnalytics.exe

Files

e9b9de1d112c662d06afb18cfb12e1b0_NeikiAnalytics.exe
.dll windows:5 windows x86 arch:x86

56e523e8ca43f3164acad41bd06c3aa4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetTickCount
GetACP
GetOEMCP
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetLastError
GetSystemDefaultLCID
GetVersion
TerminateThread
Sleep
WaitForSingleObject
Sleep
CloseHandle
GetSystemTimeAsFileTime
InitializeCriticalSection
EnterCriticalSection
DeleteCriticalSection
IsBadReadPtr
LeaveCriticalSection
GetCurrentThreadId
GetCurrentProcessId
HeapAlloc
GetProcessHeap
HeapFree
DeviceIoControl
LocalFree
CreateFileA
LocalAlloc
InterlockedDecrement
InterlockedCompareExchange
CreateMutexA
ReleaseMutex
FormatMessageA
GetLastError
GetVolumeInformationA
GetEnvironmentVariableA
GetExitCodeThread
GetProcAddress
LoadLibraryA
TlsSetValue
TlsGetValue
TlsAlloc
SystemTimeToFileTime
GetSystemTime
FileTimeToSystemTime
GetCurrentProcess
TlsFree
GetModuleHandleA
ReadFile
WriteFile
GetFileSize
FindClose
GetLocalTime
SetErrorMode
FindFirstFileA
FindNextFileA
GetModuleFileNameA
InterlockedIncrement
HeapReAlloc
SearchPathA
CreateSemaphoreA
OpenSemaphoreA
ReleaseSemaphore
CreateThread
TerminateThread
FreeLibrary
GetVersion
GetModuleHandleA
GetProcAddress
LocalFree

wsock32

WSAStartup

msvcrt

strncmp

setupapi

SetupDiEnumDeviceInfo

advapi32

GetUserNameA
RegOpenKeyA

comctl32

InitCommonControlsEx

user32

IsWindow
ShowWindow
GetClassNameA
GetWindowThreadProcessId
GetWindow
SetWindowPos
GetDlgItem
UpdateWindow
SetWindowTextW
GetWindowTextW
GetClientRect
GetWindowRect
SendMessageA
DefWindowProcA
GetDesktopWindow
MessageBoxW
EnumWindows
GetWindowLongA
SetWindowLongA
MessageBoxA
GetSysColorBrush

datawindow

DataWindow_TFC_GetConditionIndex

gdi32

SetMapMode

comdlg32

CommDlgExtendedError

winspool.drv

ClosePrinter

shlwapi

PathFindExtensionA

oleaut32

VariantClear

Exports

Exports

FilterDllMsg
TFC_BatchCalculate
TFC_BatchGetIndexForPosition
TFC_BatchSetBaselineIntervalForCondition
TFC_CalculateCovariance
TFC_CalculateTFC
TFC_CloseDisplay
TFC_DialogProc
TFC_DisplayResult
TFC_GetEpoch
TFC_GetIndex_ControlCondition
TFC_GetTFCSettings
TFC_Init
TFC_Init_Lean
TFC_IsModuleAvailable
TFC_NotifyDataFileOrMontageChanged
TFC_Notify_BaselineIntervalChanged
TFC_SetBaselineIntervals
TFC_SetFlag_CovarianceMode
TFC_SetTFCSettings
TFC_UpdateChannelsAndCallbackFunction
TFC_UpdateConditionInfo

Sections

.text
Size: 398KB - Virtual size: 398KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 105KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 67KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.protect
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

56e523e8ca43f3164acad41bd06c3aa4

Headers

File Characteristics

Imports

kernel32

wsock32

msvcrt

setupapi

advapi32

comctl32

user32

datawindow

gdi32

comdlg32

winspool.drv

shlwapi

oleaut32

Exports

Exports

Sections

.text Size: 398KB - Virtual size: 398KB

.rdata Size: 105KB - Virtual size: 104KB

.data Size: 26KB - Virtual size: 59KB

.rsrc Size: 56KB - Virtual size: 55KB

.reloc Size: 67KB - Virtual size: 66KB

.protect Size: 2.0MB - Virtual size: 2.0MB

.text
Size: 398KB - Virtual size: 398KB

.rdata
Size: 105KB - Virtual size: 104KB

.data
Size: 26KB - Virtual size: 59KB

.rsrc
Size: 56KB - Virtual size: 55KB

.reloc
Size: 67KB - Virtual size: 66KB

.protect
Size: 2.0MB - Virtual size: 2.0MB