3500912b2a829dcfc7d8a2e9563a0460_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

3500912b2a829dcfc7d8a2e9563a0460_NeikiAnalytics.exe
Size

4.4MB
MD5

3500912b2a829dcfc7d8a2e9563a0460
SHA1

ca1cd4a67251821af40d5c1bc6001e29283b0c75
SHA256

ded28037e1b7e9c6800d1558bd80396755ba831c5f33c2021d689d4d040e87f0
SHA512

4acbcdaa7ac9e3ad1a2b329c898f08d292d00019851570ac081234f4043acd4a4c5e3c799e1f21aa5578fdffbdab201ba38fa2bdff5b2a1b181405644d0b99b8
SSDEEP

98304:h2ollGn9NRkDYtNDQeMRFjAG/d7zqwStNxPluaVcw2O1dQJ/x41VxX:h2ollG9NrtNDqAIdqrNxPluaVcw/1dQY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3500912b2a829dcfc7d8a2e9563a0460_NeikiAnalytics.exe

Files

3500912b2a829dcfc7d8a2e9563a0460_NeikiAnalytics.exe
.exe windows:5 windows x86 arch:x86

23cdfd76a2a339b7ecfc7c0eeac09960

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersionExA
GetTickCount
WideCharToMultiByte
SetEnvironmentVariableA
CompareStringW
CompareStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetProcessHeap
SetEndOfFile
SetStdHandle
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetStringTypeA
GetLocaleInfoA
ReadFile
SetFilePointer
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetTimeZoneInformation
CreateFileW
CreateFileA
CloseHandle
InitializeCriticalSectionAndSpinCount
LoadLibraryA
GetCurrentProcessId
QueryPerformanceCounter
MultiByteToWideChar
GetLongPathNameW
GetCurrentProcess
SleepEx
SwitchToThread
LocalFree
FormatMessageA
GetLastError
Sleep
MulDiv
CreateDirectoryA
CreateDirectoryW
FindClose
FindNextFileW
FindFirstFileW
GetSystemTimeAsFileTime
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
RaiseException
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
GetStartupInfoW
GetModuleHandleW
GetProcAddress
ExitProcess
HeapAlloc
MoveFileA
MoveFileW
DeleteFileW
HeapReAlloc
LCMapStringA
LCMapStringW
GetCPInfo
GetStringTypeW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
HeapCreate
VirtualFree
VirtualAlloc
GetModuleHandleA
HeapSize
WriteFile
GetStdHandle
GetModuleFileNameA
GetACP
GetOEMCP
IsValidCodePage
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteFileA

user32

GetCursor
DrawTextW
GetWindowLongW
SystemParametersInfoW
UpdateWindow
SetActiveWindow
SetWindowLongW
SetWindowPos
DrawTextA
ShowWindow
MessageBoxW
GetKeyboardLayout
UnregisterClassW
DestroyWindow
DispatchMessageW
TranslateMessage
PeekMessageW
DefWindowProcW
LoadCursorW
SetCursor
SendMessageW
GetWindowRect
IsIconic
PostQuitMessage
DestroyIcon
CreateWindowExW
RegisterClassExW
LoadIconW
SetForegroundWindow
FindWindowW
ShowCursor
GetCursorPos
MessageBoxA
AdjustWindowRect
GetWindowInfo
ReleaseDC
GetClientRect
GetDC

shell32

ShellExecuteA
SHGetFolderPathW

squall

SQUALL_Channel_GetPlayPosition
SQUALL_Channel_SetPlayPosition
SQUALL_Channel_GetVolume
SQUALL_Channel_SetPan
SQUALL_Channel_GetPan
SQUALL_Channel_SetVolume
SQUALL_Channel_Pause
SQUALL_Channel_Start
SQUALL_Pause
SQUALL_ChannelGroup_SetVolume
SQUALL_Sample_Unload
SQUALL_Sample_PlayEx
SQUALL_Sample_GetFileFrequency
SQUALL_Channel_GetLength
SQUALL_Free
SQUALL_Stop
SQUALL_Listener_EAX_SetPreset
SQUALL_SetFileCallbacks
SQUALL_Init
SQUALL_Channel_Status
SQUALL_Channel_Stop
SQUALL_Sample_LoadFile

jngload

?freeData@@YAXAAPAK@Z
?readMNG@@YAXPBXAAK1AAPAK@Z

shlwapi

PathFindFileNameW

psapi

GetModuleFileNameExW
EnumProcessModules

winmm

timeEndPeriod
timeBeginPeriod
timeGetTime

d3d8

Direct3DCreate8

dinput8

DirectInput8Create

ws2_32

inet_ntoa
WSAGetLastError
socket
accept
bind
closesocket
connect
getpeername
getsockname
getsockopt
ioctlsocket
listen
recv
recvfrom
__WSAFDIsSet
select
send
sendto
setsockopt
shutdown
htonl
htons
ntohs
ntohl
getservbyname
inet_addr
gethostbyname

pyro

?DestroyParticleLibrary@@YAXPAVIPyroParticleLibrary@PyroParticles@@@Z
??1CPyroException@PyroParticles@@QAE@XZ
??0CPyroException@PyroParticles@@QAE@PAD@Z
??0CPyroException@PyroParticles@@QAE@ABV01@@Z
?CreateParticleLibrary@@YAPAVIPyroParticleLibrary@PyroParticles@@I@Z

gdi32

CreateSolidBrush
CreateFontW
CreateDIBSection
SetBkMode
CreateFontIndirectA
GetObjectA
GetDeviceCaps
CreateFontIndirectW
GetTextExtentPoint32W
SetTextColor
SetBkColor
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
BitBlt
GetDIBits
DeleteObject

advapi32

RegOpenKeyExA
RegCloseKey
RegSetValueExW
RegCreateKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExW

Sections

.text
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 878KB - Virtual size: 877KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 27KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 470KB - Virtual size: 469KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

23cdfd76a2a339b7ecfc7c0eeac09960

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shell32

squall

jngload

shlwapi

psapi

winmm

d3d8

dinput8

ws2_32

pyro

gdi32

advapi32

Sections

.text Size: 3.1MB - Virtual size: 3.1MB

.rdata Size: 878KB - Virtual size: 877KB

.data Size: 27KB - Virtual size: 46KB

.rsrc Size: 470KB - Virtual size: 469KB

.text
Size: 3.1MB - Virtual size: 3.1MB

.rdata
Size: 878KB - Virtual size: 877KB

.data
Size: 27KB - Virtual size: 46KB

.rsrc
Size: 470KB - Virtual size: 469KB