274e39fdabeb0843baf1d0ee18da8fd5cfc8380bea7b30dfddba276cf8cf867e_NeikiAnalytics

Sharing

Copy URL Twitter E-mail

General

Target

274e39fdabeb0843baf1d0ee18da8fd5cfc8380bea7b30dfddba276cf8cf867e_NeikiAnalytics
Size

4.9MB
MD5

aca4ef329093b1cf7012a6b8204ac220
SHA1

6b2b2ec1381eb067556ef0d4db2224f125ff9c81
SHA256

274e39fdabeb0843baf1d0ee18da8fd5cfc8380bea7b30dfddba276cf8cf867e
SHA512

14b5546f1f6fcf36e51762737f4c0ae6b25e78ca162a772ae5b617a8495d927f2da1dd950fc20860f2510fd6c7a1a8c052e53d5629a7bd27c837bddbd17550d5
SSDEEP

49152:sa6ISyLMed/wKOqbO6PoySgmkfssOJwco/wu+A35qSdHtnkIYNUjXEBX+pyuyoTP:n6ISy49CCSmkf/cMqSltn/WzCHl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
274e39fdabeb0843baf1d0ee18da8fd5cfc8380bea7b30dfddba276cf8cf867e_NeikiAnalytics

Files

274e39fdabeb0843baf1d0ee18da8fd5cfc8380bea7b30dfddba276cf8cf867e_NeikiAnalytics
.exe windows:4 windows x86 arch:x86

eb9cac553ad8cbdee45d7651d964d84c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Beep
GetCurrentProcessId
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
CloseHandle
Module32FirstW
Module32NextW
WideCharToMultiByte
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetOEMCP
GetACP
SetEndOfFile
SetStdHandle
GetLocaleInfoW
InterlockedExchange
LoadLibraryA
IsBadCodePtr
IsBadReadPtr
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
VirtualQuery
GetSystemInfo
VirtualProtect
GetLocaleInfoA
GetTimeZoneInformation
FlushFileBuffers
GetStartupInfoA
GetFileType
LocalFree
FormatMessageA
GetLastError
GetLongPathNameA
GetCurrentProcess
Sleep
MulDiv
SetPriorityClass
GetPriorityClass
SetThreadPriority
GetThreadPriority
GetCurrentThread
CreateDirectoryA
CreateDirectoryW
FindClose
FindNextFileA
FindFirstFileA
CreateFileA
CreateFileW
MoveFileExA
DeleteFileA
GetFileSize
SetFilePointer
ReadFile
WriteFile
GetSystemTimeAsFileTime
MultiByteToWideChar
HeapFree
RaiseException
RtlUnwind
ExitProcess
GetProcAddress
GetModuleHandleA
TerminateProcess
GetStartupInfoW
GetVersionExA
GetLocalTime
HeapAlloc
GetCPInfo
HeapReAlloc
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetModuleFileNameA
HeapSize
GetStdHandle
UnhandledExceptionFilter
GetModuleFileNameW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount

shell32

ShellExecuteA
SHGetFolderPathA

squall

SQUALL_Channel_GetVolume
SQUALL_Channel_SetPan
SQUALL_Channel_GetPan
SQUALL_Channel_SetVolume
SQUALL_Channel_Pause
SQUALL_Channel_Start
SQUALL_Pause
SQUALL_ChannelGroup_SetVolume
SQUALL_Sample_LoadFile
SQUALL_Sample_Unload
SQUALL_Sample_PlayEx
SQUALL_Channel_SetPlayPosition
SQUALL_Free
SQUALL_Stop
SQUALL_Listener_EAX_SetPreset
SQUALL_SetFileCallbacks
SQUALL_Init
SQUALL_Channel_GetPlayPosition
SQUALL_Channel_Stop
SQUALL_Channel_Status
SQUALL_Channel_GetLength
SQUALL_Sample_GetFileFrequency

jngload

?freeData@@YAXAAPAK@Z
?readMNG@@YAXPBXAAK1AAPAK@Z

shlwapi

PathFindFileNameA

psapi

EnumProcessModules
GetModuleFileNameExA

d3d8

Direct3DCreate8

dinput8

DirectInput8Create

winmm

timeEndPeriod
timeGetTime
timeBeginPeriod

ws2_32

inet_ntoa
recv
WSAGetLastError
socket
accept
bind
closesocket
connect
getpeername
getsockname
getsockopt
ioctlsocket
listen
recvfrom
__WSAFDIsSet
select
send
sendto
setsockopt
shutdown
htonl
htons
ntohs
ntohl
getservbyname
inet_addr
gethostbyname

user32

DrawTextW
GetWindowLongW
DrawTextA
GetCursor
GetCursorPos
PostQuitMessage
MessageBoxA
GetKeyboardLayout
SendMessageW
IsIconic
DefWindowProcW
UnregisterClassW
DestroyWindow
DispatchMessageW
TranslateMessage
PeekMessageW
DestroyIcon
SetCursor
CreateWindowExW
RegisterClassExW
LoadCursorW
LoadIconW
SetForegroundWindow
FindWindowA
AdjustWindowRect
GetWindowInfo
SetWindowPos
SetWindowLongW
SetActiveWindow
UpdateWindow
ShowWindow
SystemParametersInfoW

gdi32

SetTextColor
SetBkColor
GetDIBits
DeleteDC
DeleteObject
CreateFontW
GetTextExtentPoint32W
CreateSolidBrush
CreateDIBSection
SetBkMode
CreateFontIndirectA
GetObjectA
SelectObject
CreateFontIndirectW
CreateCompatibleDC
GetDeviceCaps
CreateCompatibleBitmap

advapi32

RegOpenKeyExA
RegOpenKeyExW
RegQueryValueExA
RegCloseKey
RegQueryValueExW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor

Sections

.text
Size: 3.6MB - Virtual size: 3.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 808KB - Virtual size: 805KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 520KB - Virtual size: 517KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

eb9cac553ad8cbdee45d7651d964d84c

Headers

File Characteristics

Imports

kernel32

shell32

squall

jngload

shlwapi

psapi

d3d8

dinput8

winmm

ws2_32

user32

gdi32

advapi32

Sections

.text Size: 3.6MB - Virtual size: 3.6MB

.rdata Size: 808KB - Virtual size: 805KB

.data Size: 16KB - Virtual size: 36KB

.rsrc Size: 520KB - Virtual size: 517KB

.text
Size: 3.6MB - Virtual size: 3.6MB

.rdata
Size: 808KB - Virtual size: 805KB

.data
Size: 16KB - Virtual size: 36KB

.rsrc
Size: 520KB - Virtual size: 517KB