3dc191d750341d8194332de4026e6500_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

3dc191d750341d8194332de4026e6500_NeikiAnalytics.exe
Size

2.3MB
MD5

3dc191d750341d8194332de4026e6500
SHA1

aae6823b6267036d1c5eaa7f94e936898b97391d
SHA256

c3a91a02198d8e5aaee16b396eeb2736bf34ef7ac71d6edd698f178f45703831
SHA512

334fe6c0f489669b7a70728db42e86bd9e38c789ef15426752f5a224939ee8b323bc3e6579437389a8a38450fb26c4785b64c35223b9f8c561492401fc8d4dbe
SSDEEP

24576:/qvjzHdq/YzgOOW6LxeIMYv5Ns7U6hfdx/En3gScWq2GlDmBQYdL3X2kn3hQjMCz:S9q/Y56nXNsPsy2LC40LVkTf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3dc191d750341d8194332de4026e6500_NeikiAnalytics.exe

Files

3dc191d750341d8194332de4026e6500_NeikiAnalytics.exe
.exe windows:5 windows x64 arch:x64

97138fe58342bf43a593317ef9075422

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\C-DEV\QLSI\bin\Intel C++ Compiler 16.0\Kunde\x64\CrashSender1402.pdb

Imports

ws2_32

htons
getservbyname
inet_addr
gethostbyname
WSAGetLastError
inet_ntoa
htonl
gethostbyaddr
send
recv
WSASetLastError
socket
connect
closesocket
WSACleanup
WSAStartup
ntohs
getservbyport

dnsapi

DnsQuery_A
DnsFree

wininet

HttpSendRequestExA
InternetSetOptionA
InternetConnectA
HttpEndRequestA
InternetReadFile
HttpOpenRequestA
InternetQueryOptionA
HttpQueryInfoA
InternetWriteFile
InternetOpenA
InternetCloseHandle

rpcrt4

UuidToStringA
RpcStringFreeA

psapi

GetProcessMemoryInfo

gdi32

CreateDCA
GetDIBits
BitBlt
CreateRectRgn
SelectClipRgn
TextOutA
SetViewportOrgEx
CreateFontA
CreateDIBSection
SetLayout
DeleteObject
DeleteDC
CreateFontIndirectA
GetObjectA
GetStockObject
SelectObject
SetTextColor
SetBkMode
Polygon
CreatePen
CreateCompatibleBitmap
CreateCompatibleDC
CreateSolidBrush
SetBkColor
StretchBlt
SetStretchBltMode
RealizePalette
SelectPalette
CreateHalftonePalette
CreatePalette
GetDIBColorTable
SetDIBits

shell32

SHGetSpecialFolderPathA
SHGetFileInfoA
ExtractIconA
CommandLineToArgvW
ShellExecuteA
Shell_NotifyIconA
SHFileOperationA

comdlg32

GetOpenFileNameA
GetSaveFileNameA

version

GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA

comctl32

ImageList_Remove
_TrackMouseEvent
InitCommonControlsEx
ImageList_Create
ImageList_ReplaceIcon

kernel32

InterlockedFlushSList
VirtualProtect
VirtualQuery
CreateFileW
GetDriveTypeW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapSize
GetModuleFileNameW
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RtlPcToFileHeader
RtlUnwindEx
HeapReAlloc
GetConsoleMode
ReadConsoleW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetFullPathNameW
SetStdHandle
GetConsoleCP
SetFilePointerEx
GetSystemInfo
lstrlenA
OpenFileMappingA
CreateFileMappingA
CloseHandle
UnmapViewOfFile
MapViewOfFile
GetLastError
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
DecodePointer
RaiseException
DebugBreak
OutputDebugStringA
GetModuleFileNameA
GetTempFileNameA
GetTempPathA
SystemTimeToTzSpecificLocalTime
FreeLibrary
WideCharToMultiByte
GetProcAddress
FlushFileBuffers
GetPrivateProfileStringA
WritePrivateProfileStringA
GlobalFree
FormatMessageA
GlobalAlloc
GetFileAttributesA
CreateDirectoryA
SystemTimeToFileTime
GetFileAttributesExA
CreateEventA
LeaveCriticalSection
ResetEvent
EnterCriticalSection
SetEvent
WaitForSingleObject
MultiByteToWideChar
GetFileSizeEx
CreateFileA
SetLastError
FindClose
FindNextFileA
GetFullPathNameA
FindFirstFileA
GetSystemTime
CopyFileA
FileTimeToSystemTime
GetProcessTimes
ReadProcessMemory
OpenProcess
GetCurrentThreadId
GetCommandLineW
GetModuleHandleA
lstrcmpiA
IsDBCSLeadByte
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
GetVersionExA
CompareStringA
lstrcmpA
MulDiv
CreateMutexA
TerminateProcess
GetCurrentProcessId
CreateToolhelp32Snapshot
Process32First
Process32Next
CreateThread
WriteFile
ReadFile
GetExitCodeProcess
GetCurrentProcess
CreateProcessA
GetFileInformationByHandle
InitializeCriticalSection
Sleep
GlobalUnlock
GlobalLock
GetSystemDirectoryA
GetTimeZoneInformation
IsDebuggerPresent
OutputDebugStringW
EncodePointer
HeapAlloc
HeapFree
GetProcessHeap
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
VirtualAlloc
VirtualFree
GetEnvironmentVariableA
GetModuleHandleExA
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
GetThreadLocale
PeekNamedPipe
GetTempPathW
ExitProcess
GetModuleHandleExW
GetStdHandle
GetACP
GetCurrentThread
GetStringTypeW
GetFileAttributesExW
SetConsoleCtrlHandler
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetEnvironmentVariableW
GetCommandLineA
FindFirstFileExA
FindFirstFileExW
FindNextFileW
WriteConsoleW
SetEndOfFile
LoadLibraryA
GetFileType

user32

ShowWindow
GetDlgItem
SetWindowPos
GetMonitorInfoA
MonitorFromWindow
SetWindowTextA
EndDialog
GetActiveWindow
DestroyMenu
TrackPopupMenu
DeleteMenu
CheckMenuRadioItem
SetMenuItemInfoA
GetSubMenu
LoadMenuA
EnableMenuItem
MonitorFromPoint
IsDialogMessageA
LoadIconA
DrawIcon
GetIconInfo
DrawTextExA
FlashWindow
DialogBoxParamA
EnableWindow
MessageBoxA
PostQuitMessage
AdjustWindowRectEx
GetMenu
CopyRect
SetProcessDefaultLayout
PostMessageA
SetTimer
CharUpperA
SetScrollInfo
GetScrollInfo
KillTimer
DrawTextExW
AnimateWindow
SetClipboardData
CloseClipboard
EmptyClipboard
OpenClipboard
GetSystemMetrics
DrawFocusRect
EnumDisplayMonitors
GetCursorInfo
IsWindowVisible
GetWindowThreadProcessId
GetCursorPos
ScreenToClient
PtInRect
GetCapture
ReleaseCapture
SetFocus
SetCapture
SetCursor
GetDlgCtrlID
SetRectEmpty
GetKeyState
SendMessageA
GetParent
ReleaseDC
EndPaint
DestroyWindow
CallWindowProcA
GetWindowLongPtrA
SetWindowLongPtrA
InvalidateRect
DestroyIcon
DefWindowProcA
CreateDialogParamA
PeekMessageA
FillRect
DrawTextA
OffsetRect
GetClassNameA
LoadCursorA
SystemParametersInfoA
CreateWindowExA
GetMessageA
TranslateMessage
DispatchMessageA
GetGuiResources
GetWindowLongA
SetWindowLongA
GetDC
GetClientRect
GetWindow
GetWindowRect
MapWindowPoints
MoveWindow
CharNextA
LoadStringA
UnregisterClassA
RedrawWindow
LoadImageA
GetDesktopWindow
GetSysColorBrush
IsWindowEnabled
GetSysColor
IntersectRect
GetFocus
GetWindowTextLengthA
GetWindowTextA
BeginPaint
IsWindow
EnumWindows
UpdateWindow

advapi32

SystemFunction036
RegQueryValueExA
RegOpenKeyExA
RegDeleteKeyA
RegEnumKeyExA
RegSetValueExA
RegDeleteValueA
RegQueryInfoKeyW
RegCreateKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegEnumValueW
RegEnumKeyExW
RegQueryInfoKeyA
RegCloseKey

ole32

CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
CoUninitialize
CoInitialize
CoCreateGuid

oleaut32

VarI4FromStr
VarR8FromStr
VarDecFromStr
VarDateFromStr
VarDecCmp
VarUI4FromStr

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 394KB - Virtual size: 393KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 75KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data1
Size: 75KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.trace
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 1024B - Virtual size: 777B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 283B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 119KB - Virtual size: 118KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

97138fe58342bf43a593317ef9075422

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

dnsapi

wininet

rpcrt4

psapi

gdi32

shell32

comdlg32

version

comctl32

kernel32

user32

advapi32

ole32

oleaut32

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 394KB - Virtual size: 393KB

.data Size: 36KB - Virtual size: 51KB

.pdata Size: 75KB - Virtual size: 75KB

.idata Size: 17KB - Virtual size: 17KB

.data1 Size: 75KB - Virtual size: 75KB

.trace Size: 7KB - Virtual size: 7KB

.tls Size: 1024B - Virtual size: 777B

.00cfg Size: 512B - Virtual size: 283B

_RDATA Size: 6KB - Virtual size: 5KB

.rsrc Size: 119KB - Virtual size: 118KB

.reloc Size: 13KB - Virtual size: 13KB

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 394KB - Virtual size: 393KB

.data
Size: 36KB - Virtual size: 51KB

.pdata
Size: 75KB - Virtual size: 75KB

.idata
Size: 17KB - Virtual size: 17KB

.data1
Size: 75KB - Virtual size: 75KB

.trace
Size: 7KB - Virtual size: 7KB

.tls
Size: 1024B - Virtual size: 777B

.00cfg
Size: 512B - Virtual size: 283B

_RDATA
Size: 6KB - Virtual size: 5KB

.rsrc
Size: 119KB - Virtual size: 118KB

.reloc
Size: 13KB - Virtual size: 13KB